Update Kubernetes from v1.16.3 to v1.17.0

* https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.17.md/#v1170

README.md

@@ -17,7 +17,6 @@ module "bootstrap" {
   cluster_name = "example"
   api_servers = ["node1.example.com"]
   etcd_servers = ["node1.example.com"]
-  asset_dir = "/home/core/clusters/mycluster"
 }
 ```
 

auth.tf

@@ -1,3 +1,10 @@
+locals {
+  # auth kubeconfig assets map
+  auth_kubeconfigs = {
+    "auth/kubeconfig" = data.template_file.kubeconfig-admin.rendered,
+  }
+}
+
 # Generated kubeconfig for Kubelets
 data "template_file" "kubeconfig-kubelet" {
   template = file("${path.module}/resources/kubeconfig-kubelet")
@@ -25,18 +32,24 @@ data "template_file" "kubeconfig-admin" {
 
 # Generated kubeconfig for Kubelets
 resource "local_file" "kubeconfig-kubelet" {
+  count = var.asset_dir == "" ? 0 : 1
+
   content  = data.template_file.kubeconfig-kubelet.rendered
   filename = "${var.asset_dir}/auth/kubeconfig-kubelet"
 }
 
 # Generated admin kubeconfig to bootstrap control plane
 resource "local_file" "kubeconfig-admin" {
+  count = var.asset_dir == "" ? 0 : 1
+
   content  = data.template_file.kubeconfig-admin.rendered
   filename = "${var.asset_dir}/auth/kubeconfig"
 }
 
 # Generated admin kubeconfig in a file named after the cluster
 resource "local_file" "kubeconfig-admin-named" {
+  count = var.asset_dir == "" ? 0 : 1
+
   content  = data.template_file.kubeconfig-admin.rendered
   filename = "${var.asset_dir}/auth/${var.cluster_name}-config"
 }

conditional.tf

@@ -1,9 +1,10 @@
 # Assets generated only when certain options are chosen
 
 locals {
-  # flannel manifests (manifest.yaml => content)
+  # flannel manifests map
+  # { manifests-networking/manifest.yaml => content }
   flannel_manifests = {
-    for name in fileset("${path.module}/resources/flannel", "*.yaml"):
+    for name in fileset("${path.module}/resources/flannel", "*.yaml") :
     "manifests-networking/${name}" => templatefile(
       "${path.module}/resources/flannel/${name}",
       {
@@ -15,9 +16,10 @@ locals {
     if var.networking == "flannel"
   }
 
-  # calico manifests (manifest.yaml => content)
+  # calico manifests map
+  # { manifests-networking/manifest.yaml => content }
   calico_manifests = {
-    for name in fileset("${path.module}/resources/calico", "*.yaml"):
+    for name in fileset("${path.module}/resources/calico", "*.yaml") :
     "manifests-networking/${name}" => templatefile(
       "${path.module}/resources/calico/${name}",
       {
@@ -36,9 +38,10 @@ locals {
     if var.networking == "calico"
   }
 
-  # kube-router manifests (manifest.yaml => content)
+  # kube-router manifests map
+  # { manifests-networking/manifest.yaml => content }
   kube_router_manifests = {
-    for name in fileset("${path.module}/resources/kube-router", "*.yaml"):
+    for name in fileset("${path.module}/resources/kube-router", "*.yaml") :
     "manifests-networking/${name}" => templatefile(
       "${path.module}/resources/kube-router/${name}",
       {
@@ -53,7 +56,7 @@ locals {
 
 # flannel manifests
 resource "local_file" "flannel-manifests" {
-  for_each = local.flannel_manifests
+  for_each = var.asset_dir == "" ? {} : local.flannel_manifests
 
   filename = "${var.asset_dir}/${each.key}"
   content  = each.value
@@ -61,7 +64,7 @@ resource "local_file" "flannel-manifests" {
 
 # Calico manifests
 resource "local_file" "calico-manifests" {
-  for_each = local.calico_manifests
+  for_each = var.asset_dir == "" ? {} : local.calico_manifests
 
   filename = "${var.asset_dir}/${each.key}"
   content  = each.value
@@ -69,7 +72,7 @@ resource "local_file" "calico-manifests" {
 
 # kube-router manifests
 resource "local_file" "kube-router-manifests" {
-  for_each = local.kube_router_manifests
+  for_each = var.asset_dir == "" ? {} : local.kube_router_manifests
 
   filename = "${var.asset_dir}/${each.key}"
   content  = each.value

manifests.tf

@@ -1,7 +1,8 @@
 locals {
-  # Kubernetes static pod manifests (manifest.yaml => content)
+  # Kubernetes static pod manifests map
+  # {static-manifests/manifest.yaml => content }
   static_manifests = {
-    for name in fileset("${path.module}/resources/static-manifests", "*.yaml"):
+    for name in fileset("${path.module}/resources/static-manifests", "*.yaml") :
     "static-manifests/${name}" => templatefile(
       "${path.module}/resources/static-manifests/${name}",
       {
@@ -16,9 +17,10 @@ locals {
     )
   }
 
-  # Kubernetes control plane manifests (manifest.yaml => content)
+  # Kubernetes control plane manifests map
+  # { manifests/manifest.yaml => content }
   manifests = {
-    for name in fileset("${path.module}/resources/manifests", "**/*.yaml"):
+    for name in fileset("${path.module}/resources/manifests", "**/*.yaml") :
     "manifests/${name}" => templatefile(
       "${path.module}/resources/manifests/${name}",
       {
@@ -37,7 +39,7 @@ locals {
 
 # Kubernetes static pod manifests
 resource "local_file" "static-manifests" {
-  for_each = local.static_manifests
+  for_each = var.asset_dir == "" ? {} : local.static_manifests
 
   content  = each.value
   filename = "${var.asset_dir}/${each.key}"
@@ -45,7 +47,7 @@ resource "local_file" "static-manifests" {
 
 # Kubernetes control plane manifests
 resource "local_file" "manifests" {
-  for_each = local.manifests
+  for_each = var.asset_dir == "" ? {} : local.manifests
 
   content  = each.value
   filename = "${var.asset_dir}/${each.key}"

outputs.tf

@@ -5,40 +5,67 @@ output "cluster_dns_service_ip" {
 
 // Generated kubeconfig for Kubelets (i.e. lower privilege than admin)
 output "kubeconfig-kubelet" {
-  value = data.template_file.kubeconfig-kubelet.rendered
+  value     = data.template_file.kubeconfig-kubelet.rendered
+  sensitive = true
 }
 
 // Generated kubeconfig for admins (i.e. human super-user)
 output "kubeconfig-admin" {
-  value = data.template_file.kubeconfig-admin.rendered
+  value     = data.template_file.kubeconfig-admin.rendered
+  sensitive = true
+}
+
+# assets to distribute to controllers
+# { some/path => content }
+output "assets_dist" {
+  # combine maps of assets
+  value = merge(
+    local.auth_kubeconfigs,
+    local.etcd_tls,
+    local.kubernetes_tls,
+    local.aggregation_tls,
+    local.static_manifests,
+    local.manifests,
+    local.flannel_manifests,
+    local.calico_manifests,
+    local.kube_router_manifests,
+  )
+  sensitive = true
 }
 
 # etcd TLS assets
 
 output "etcd_ca_cert" {
-  value = tls_self_signed_cert.etcd-ca.cert_pem
+  value     = tls_self_signed_cert.etcd-ca.cert_pem
+  sensitive = true
 }
 
 output "etcd_client_cert" {
-  value = tls_locally_signed_cert.client.cert_pem
+  value     = tls_locally_signed_cert.client.cert_pem
+  sensitive = true
 }
 
 output "etcd_client_key" {
-  value = tls_private_key.client.private_key_pem
+  value     = tls_private_key.client.private_key_pem
+  sensitive = true
 }
 
 output "etcd_server_cert" {
-  value = tls_locally_signed_cert.server.cert_pem
+  value     = tls_locally_signed_cert.server.cert_pem
+  sensitive = true
 }
 
 output "etcd_server_key" {
-  value = tls_private_key.server.private_key_pem
+  value     = tls_private_key.server.private_key_pem
+  sensitive = true
 }
 
 output "etcd_peer_cert" {
-  value = tls_locally_signed_cert.peer.cert_pem
+  value     = tls_locally_signed_cert.peer.cert_pem
+  sensitive = true
 }
 
 output "etcd_peer_key" {
-  value = tls_private_key.peer.private_key_pem
+  value     = tls_private_key.peer.private_key_pem
+  sensitive = true
 }

resources/calico/daemonset.yaml

@@ -137,7 +137,7 @@ spec:
             privileged: true
           resources:
             requests:
-              cpu: 150m
+              cpu: 100m
           livenessProbe:
             exec:
               command:

resources/static-manifests/kube-apiserver.yaml

@@ -46,7 +46,7 @@ spec:
           fieldPath: status.podIP
     resources:
       requests:
-        cpu: 200m
+        cpu: 150m
     volumeMounts:
     - name: secrets
       mountPath: /etc/kubernetes/secrets

resources/static-manifests/kube-controller-manager.yaml

@@ -21,16 +21,18 @@ spec:
     - /hyperkube
     - kube-controller-manager
     - --allocate-node-cidrs=true
-    - --cluster-cidr=${pod_cidr}
-    - --service-cluster-ip-range=${service_cidr}
     - --cloud-provider=${cloud_provider}
+    - --cluster-cidr=${pod_cidr}
     - --cluster-signing-cert-file=/etc/kubernetes/secrets/ca.crt
     - --cluster-signing-key-file=/etc/kubernetes/secrets/ca.key
     - --configure-cloud-routes=false
+    - --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins
     - --kubeconfig=/etc/kubernetes/secrets/kubeconfig
     - --leader-elect=true
+    - --pod-eviction-timeout=1m
     - --root-ca-file=/etc/kubernetes/secrets/ca.crt
     - --service-account-private-key-file=/etc/kubernetes/secrets/service-account.key
+    - --service-cluster-ip-range=${service_cidr}
     livenessProbe:
       httpGet:
         scheme: HTTPS
@@ -41,7 +43,7 @@ spec:
       timeoutSeconds: 15
     resources:
       requests:
-        cpu: 200m
+        cpu: 150m
     volumeMounts:
     - name: secrets
       mountPath: /etc/kubernetes/secrets

terraform.tfvars.example

@@ -1,5 +1,4 @@
 cluster_name = "example"
 api_servers = ["node1.example.com"]
 etcd_servers = ["node1.example.com"]
-asset_dir = "/home/core/mycluster"
 networking = "flannel"

tls-aggregation.tf

@@ -1,3 +1,14 @@
+locals {
+  # Kubernetes Aggregation TLS assets map
+  aggregation_tls = var.enable_aggregation ? {
+    "tls/k8s/aggregation-ca.crt"     = tls_self_signed_cert.aggregation-ca[0].cert_pem,
+    "tls/k8s/aggregation-client.crt" = tls_locally_signed_cert.aggregation-client[0].cert_pem,
+    "tls/k8s/aggregation-client.key" = tls_private_key.aggregation-client[0].private_key_pem,
+  } : {}
+}
+
+
+
 # Kubernetes Aggregation CA (i.e. front-proxy-ca)
 # Files: tls/{aggregation-ca.crt,aggregation-ca.key}
 
@@ -29,14 +40,14 @@ resource "tls_self_signed_cert" "aggregation-ca" {
 }
 
 resource "local_file" "aggregation-ca-key" {
-  count = var.enable_aggregation ? 1 : 0
+  count = var.enable_aggregation && var.asset_dir != "" ? 1 : 0
 
   content  = tls_private_key.aggregation-ca[0].private_key_pem
   filename = "${var.asset_dir}/tls/aggregation-ca.key"
 }
 
 resource "local_file" "aggregation-ca-crt" {
-  count = var.enable_aggregation ? 1 : 0
+  count = var.enable_aggregation && var.asset_dir != "" ? 1 : 0
 
   content  = tls_self_signed_cert.aggregation-ca[0].cert_pem
   filename = "${var.asset_dir}/tls/aggregation-ca.crt"
@@ -82,14 +93,14 @@ resource "tls_locally_signed_cert" "aggregation-client" {
 }
 
 resource "local_file" "aggregation-client-key" {
-  count = var.enable_aggregation ? 1 : 0
+  count = var.enable_aggregation && var.asset_dir != "" ? 1 : 0
 
   content  = tls_private_key.aggregation-client[0].private_key_pem
   filename = "${var.asset_dir}/tls/aggregation-client.key"
 }
 
 resource "local_file" "aggregation-client-crt" {
-  count = var.enable_aggregation ? 1 : 0
+  count = var.enable_aggregation && var.asset_dir != "" ? 1 : 0
 
   content  = tls_locally_signed_cert.aggregation-client[0].cert_pem
   filename = "${var.asset_dir}/tls/aggregation-client.crt"

tls-etcd.tf

@@ -1,70 +1,19 @@
-# etcd-ca.crt
-resource "local_file" "etcd_ca_crt" {
-  content  = tls_self_signed_cert.etcd-ca.cert_pem
-  filename = "${var.asset_dir}/tls/etcd-ca.crt"
+locals {
+  # etcd TLS assets map
+  etcd_tls = {
+    "tls/etcd/etcd-client-ca.crt" = tls_self_signed_cert.etcd-ca.cert_pem,
+    "tls/etcd/etcd-client.crt"    = tls_locally_signed_cert.client.cert_pem,
+    "tls/etcd/etcd-client.key"    = tls_private_key.client.private_key_pem
+    "tls/etcd/server-ca.crt"      = tls_self_signed_cert.etcd-ca.cert_pem,
+    "tls/etcd/server.crt"         = tls_locally_signed_cert.server.cert_pem
+    "tls/etcd/server.key"         = tls_private_key.server.private_key_pem
+    "tls/etcd/peer-ca.crt"        = tls_self_signed_cert.etcd-ca.cert_pem,
+    "tls/etcd/peer.crt"           = tls_locally_signed_cert.peer.cert_pem
+    "tls/etcd/peer.key"           = tls_private_key.peer.private_key_pem
+  }
 }
 
-# etcd-ca.key
-resource "local_file" "etcd_ca_key" {
-  content  = tls_private_key.etcd-ca.private_key_pem
-  filename = "${var.asset_dir}/tls/etcd-ca.key"
-}
-
-# etcd-client-ca.crt
-resource "local_file" "etcd_client_ca_crt" {
-  content  = tls_self_signed_cert.etcd-ca.cert_pem
-  filename = "${var.asset_dir}/tls/etcd-client-ca.crt"
-}
-
-# etcd-client.crt
-resource "local_file" "etcd_client_crt" {
-  content  = tls_locally_signed_cert.client.cert_pem
-  filename = "${var.asset_dir}/tls/etcd-client.crt"
-}
-
-# etcd-client.key
-resource "local_file" "etcd_client_key" {
-  content  = tls_private_key.client.private_key_pem
-  filename = "${var.asset_dir}/tls/etcd-client.key"
-}
-
-# server-ca.crt
-resource "local_file" "etcd_server_ca_crt" {
-  content  = tls_self_signed_cert.etcd-ca.cert_pem
-  filename = "${var.asset_dir}/tls/etcd/server-ca.crt"
-}
-
-# server.crt
-resource "local_file" "etcd_server_crt" {
-  content  = tls_locally_signed_cert.server.cert_pem
-  filename = "${var.asset_dir}/tls/etcd/server.crt"
-}
-
-# server.key
-resource "local_file" "etcd_server_key" {
-  content  = tls_private_key.server.private_key_pem
-  filename = "${var.asset_dir}/tls/etcd/server.key"
-}
-
-# peer-ca.crt
-resource "local_file" "etcd_peer_ca_crt" {
-  content  = tls_self_signed_cert.etcd-ca.cert_pem
-  filename = "${var.asset_dir}/tls/etcd/peer-ca.crt"
-}
-
-# peer.crt
-resource "local_file" "etcd_peer_crt" {
-  content  = tls_locally_signed_cert.peer.cert_pem
-  filename = "${var.asset_dir}/tls/etcd/peer.crt"
-}
-
-# peer.key
-resource "local_file" "etcd_peer_key" {
-  content  = tls_private_key.peer.private_key_pem
-  filename = "${var.asset_dir}/tls/etcd/peer.key"
-}
-
-# certificates and keys
+# etcd CA
 
 resource "tls_private_key" "etcd-ca" {
   algorithm = "RSA"
@@ -90,8 +39,32 @@ resource "tls_self_signed_cert" "etcd-ca" {
   ]
 }
 
-# client certs are used for client (apiserver, locksmith, etcd-operator)
-# to etcd communication
+# etcd-ca.crt
+resource "local_file" "etcd_ca_crt" {
+  count = var.asset_dir == "" ? 0 : 1
+
+  content  = tls_self_signed_cert.etcd-ca.cert_pem
+  filename = "${var.asset_dir}/tls/etcd-ca.crt"
+}
+
+# etcd-client-ca.crt
+resource "local_file" "etcd_client_ca_crt" {
+  count = var.asset_dir == "" ? 0 : 1
+
+  content  = tls_self_signed_cert.etcd-ca.cert_pem
+  filename = "${var.asset_dir}/tls/etcd-client-ca.crt"
+}
+
+# etcd-ca.key
+resource "local_file" "etcd_ca_key" {
+  count = var.asset_dir == "" ? 0 : 1
+
+  content  = tls_private_key.etcd-ca.private_key_pem
+  filename = "${var.asset_dir}/tls/etcd-ca.key"
+}
+
+# etcd Client (apiserver to etcd communication)
+
 resource "tls_private_key" "client" {
   algorithm = "RSA"
   rsa_bits  = "2048"
@@ -130,6 +103,24 @@ resource "tls_locally_signed_cert" "client" {
   ]
 }
 
+# etcd-client.crt
+resource "local_file" "etcd_client_crt" {
+  count = var.asset_dir == "" ? 0 : 1
+
+  content  = tls_locally_signed_cert.client.cert_pem
+  filename = "${var.asset_dir}/tls/etcd-client.crt"
+}
+
+# etcd-client.key
+resource "local_file" "etcd_client_key" {
+  count = var.asset_dir == "" ? 0 : 1
+
+  content  = tls_private_key.client.private_key_pem
+  filename = "${var.asset_dir}/tls/etcd-client.key"
+}
+
+# etcd Server
+
 resource "tls_private_key" "server" {
   algorithm = "RSA"
   rsa_bits  = "2048"
@@ -168,6 +159,32 @@ resource "tls_locally_signed_cert" "server" {
   ]
 }
 
+# server-ca.crt
+resource "local_file" "etcd_server_ca_crt" {
+  count = var.asset_dir == "" ? 0 : 1
+
+  content  = tls_self_signed_cert.etcd-ca.cert_pem
+  filename = "${var.asset_dir}/tls/etcd/server-ca.crt"
+}
+
+# server.crt
+resource "local_file" "etcd_server_crt" {
+  count = var.asset_dir == "" ? 0 : 1
+
+  content  = tls_locally_signed_cert.server.cert_pem
+  filename = "${var.asset_dir}/tls/etcd/server.crt"
+}
+
+# server.key
+resource "local_file" "etcd_server_key" {
+  count = var.asset_dir == "" ? 0 : 1
+
+  content  = tls_private_key.server.private_key_pem
+  filename = "${var.asset_dir}/tls/etcd/server.key"
+}
+
+# etcd Peer
+
 resource "tls_private_key" "peer" {
   algorithm = "RSA"
   rsa_bits  = "2048"
@@ -202,3 +219,27 @@ resource "tls_locally_signed_cert" "peer" {
   ]
 }
 
+# peer-ca.crt
+resource "local_file" "etcd_peer_ca_crt" {
+  count = var.asset_dir == "" ? 0 : 1
+
+  content  = tls_self_signed_cert.etcd-ca.cert_pem
+  filename = "${var.asset_dir}/tls/etcd/peer-ca.crt"
+}
+
+# peer.crt
+resource "local_file" "etcd_peer_crt" {
+  count = var.asset_dir == "" ? 0 : 1
+
+  content  = tls_locally_signed_cert.peer.cert_pem
+  filename = "${var.asset_dir}/tls/etcd/peer.crt"
+}
+
+# peer.key
+resource "local_file" "etcd_peer_key" {
+  count = var.asset_dir == "" ? 0 : 1
+
+  content  = tls_private_key.peer.private_key_pem
+  filename = "${var.asset_dir}/tls/etcd/peer.key"
+}
+

tls-k8s.tf

@@ -1,3 +1,15 @@
+locals {
+  # Kubernetes TLS assets map
+  kubernetes_tls = {
+    "tls/k8s/ca.crt"              = tls_self_signed_cert.kube-ca.cert_pem,
+    "tls/k8s/ca.key"              = tls_private_key.kube-ca.private_key_pem,
+    "tls/k8s/apiserver.crt"       = tls_locally_signed_cert.apiserver.cert_pem,
+    "tls/k8s/apiserver.key"       = tls_private_key.apiserver.private_key_pem,
+    "tls/k8s/service-account.pub" = tls_private_key.service-account.public_key_pem
+    "tls/k8s/service-account.key" = tls_private_key.service-account.private_key_pem
+  }
+}
+
 # Kubernetes CA (tls/{ca.crt,ca.key})
 
 resource "tls_private_key" "kube-ca" {
@@ -25,11 +37,15 @@ resource "tls_self_signed_cert" "kube-ca" {
 }
 
 resource "local_file" "kube-ca-key" {
+  count = var.asset_dir == "" ? 0 : 1
+
   content  = tls_private_key.kube-ca.private_key_pem
   filename = "${var.asset_dir}/tls/ca.key"
 }
 
 resource "local_file" "kube-ca-crt" {
+  count = var.asset_dir == "" ? 0 : 1
+
   content  = tls_self_signed_cert.kube-ca.cert_pem
   filename = "${var.asset_dir}/tls/ca.crt"
 }
@@ -81,11 +97,15 @@ resource "tls_locally_signed_cert" "apiserver" {
 }
 
 resource "local_file" "apiserver-key" {
+  count = var.asset_dir == "" ? 0 : 1
+
   content  = tls_private_key.apiserver.private_key_pem
   filename = "${var.asset_dir}/tls/apiserver.key"
 }
 
 resource "local_file" "apiserver-crt" {
+  count = var.asset_dir == "" ? 0 : 1
+
   content  = tls_locally_signed_cert.apiserver.cert_pem
   filename = "${var.asset_dir}/tls/apiserver.crt"
 }
@@ -124,11 +144,15 @@ resource "tls_locally_signed_cert" "admin" {
 }
 
 resource "local_file" "admin-key" {
+  count = var.asset_dir == "" ? 0 : 1
+
   content  = tls_private_key.admin.private_key_pem
   filename = "${var.asset_dir}/tls/admin.key"
 }
 
 resource "local_file" "admin-crt" {
+  count = var.asset_dir == "" ? 0 : 1
+
   content  = tls_locally_signed_cert.admin.cert_pem
   filename = "${var.asset_dir}/tls/admin.crt"
 }
@@ -141,11 +165,15 @@ resource "tls_private_key" "service-account" {
 }
 
 resource "local_file" "service-account-key" {
+  count = var.asset_dir == "" ? 0 : 1
+
   content  = tls_private_key.service-account.private_key_pem
   filename = "${var.asset_dir}/tls/service-account.key"
 }
 
 resource "local_file" "service-account-crt" {
+  count = var.asset_dir == "" ? 0 : 1
+
   content  = tls_private_key.service-account.public_key_pem
   filename = "${var.asset_dir}/tls/service-account.pub"
 }
@@ -185,11 +213,15 @@ resource "tls_locally_signed_cert" "kubelet" {
 }
 
 resource "local_file" "kubelet-key" {
+  count = var.asset_dir == "" ? 0 : 1
+
   content  = tls_private_key.kubelet.private_key_pem
   filename = "${var.asset_dir}/tls/kubelet.key"
 }
 
 resource "local_file" "kubelet-crt" {
+  count = var.asset_dir == "" ? 0 : 1
+
   content  = tls_locally_signed_cert.kubelet.cert_pem
   filename = "${var.asset_dir}/tls/kubelet.crt"
 }

variables.tf

@@ -16,6 +16,7 @@ variable "etcd_servers" {
 variable "asset_dir" {
   type        = string
   description = "Absolute path to a directory where generated assets should be placed (contains secrets)"
+  default     = ""
 }
 
 variable "cloud_provider" {
@@ -55,12 +56,12 @@ variable "pod_cidr" {
 }
 
 variable "service_cidr" {
-  type    = string
+  type        = string
   description = <<EOD
 CIDR IP range to assign Kubernetes services.
 The 1st IP will be reserved for kube_apiserver, the 10th IP will be reserved for kube-dns.
 EOD
-  default = "10.3.0.0/24"
+  default     = "10.3.0.0/24"
 }
 
 
@@ -74,7 +75,7 @@ variable "container_images" {
     flannel     = "quay.io/coreos/flannel:v0.11.0-amd64"
     flannel_cni = "quay.io/coreos/flannel-cni:v0.3.0"
     kube_router = "cloudnativelabs/kube-router:v0.3.2"
-    hyperkube   = "k8s.gcr.io/hyperkube:v1.16.3"
+    hyperkube   = "k8s.gcr.io/hyperkube:v1.17.0"
     coredns     = "k8s.gcr.io/coredns:1.6.5"
   }
 }