<commit_before># Images

As of Kubernetes 1.18 the default images used by kOps are the **[official Ubuntu 20.04](#ubuntu-2004-focal)** images.

You can choose a different image for an instance group by editing it with `kops edit ig nodes`.

For AWS, you should set the `image` field in one of the following formats:
* `ami-abcdef` - specifies an image by id directly (image id is precise, but ids vary by region)
* `<owner>/<name>` specifies an image by its owner's account ID  and name properties
* `<alias>/<name>` specifies an image by its [owner's alias](#owner-aliases) and name properties
* `ssm:<ssm_parameter>` specifies an image through an SSM parameter (kOps 1.26+)

```yaml
image: ami-00579fbb15b954340
image: 099720109477/ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-20200423
image: ubuntu/ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-20200423
image: ssm:/aws/service/canonical/ubuntu/server/20.04/stable/current/amd64/hvm/ebs-gp2/ami-id
```

## Security Updates

Automated security updates are handled by kOps for Debian, Flatcar and Ubuntu distros. This can be disabled by editing the cluster configuration:

```yaml
spec:
  updatePolicy: external
```

## Distros Support Matrix

The following table provides the support status for various distros with regards to kOps version:

| Distro                              | Experimental | Stable | Deprecated | Removed |
|-------------------------------------|-------------:|-------:|-----------:|--------:|
| [Amazon Linux 2](#amazon-linux-2)   |         1.10 |   1.18 |          - |       - |
| CentOS 7                            |            - |    1.5 |       1.21 |    1.23 |
| CentOS 8                            |         1.15 |      - |       1.21 |    1.23 |
| CoreOS                              |          1.6 |    1.9 |       1.17 |    1.18 |
| Debian 8                            |            - |    1.5 |       1.17 |    1.18 |
| Debian 9                            |          1.8 |   1.10 |       1.21 |    1.23 |
| [Debian 10](#debian-10-buster)      |         1.13 |   1.17 |          - |       - |
| [Debian 11](#debian-11-bullseye)    |       1.21.1 |      - |          - |       - |
| [Flatcar](#flatcar)                 |       1.15.1 |   1.17 |          - |       - |
| Kope.io                             |            - |      - |       1.18 |    1.23 |
| RHEL 7                              |            - |    1.5 |       1.21 |    1.23 |
| [RHEL 8](#rhel-8)                   |         1.15 |   1.18 |          - |       - |
| [Rocky 8](#rocky-8)                 |       1.23.2 |   1.24 |          - |       - |
| Ubuntu 16.04                        |          1.5 |   1.10 |       1.17 |    1.20 |
| [Ubuntu 18.04](#ubuntu-1804-bionic) |         1.10 |   1.16 |       1.26 |       - |
| [Ubuntu 20.04](#ubuntu-2004-focal)  |       1.16.2 |   1.18 |          - |       - |
| [Ubuntu 22.04](#ubuntu-2204-jammy)  |         1.23 |   1.24 |          - |       - |

## Supported Distros

### Amazon Linux 2

Amazon Linux 2 has variants using Kernel versions 4.14 and 5.10. Be sure to use the 5.10 images as specified in the image filter below. More information is available in the [AWS Documentation](https://aws.amazon.com/amazon-linux-2/faqs/).

For kOps versions 1.16 and 1.17, the only supported Docker version is `18.06.3`. Newer versions of Docker cannot be installed due to missing dependencies for `container-selinux`. This issue is fixed in kOps **1.18**.

Available images can be listed using:

```bash
aws ec2 describe-images --region us-east-1 --output table \
  --owners 137112412989 \
  --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \
  --filters "Name=name,Values=amzn2-ami-kernel-5.10-hvm-2*-x86_64-gp2"
```

### Debian 10 (Buster)

Debian 10 is based on Kernel version **4.19** which fixes some of the bugs present in Debian 9 and effects are less visible.

One notable change is the addition of `iptables` NFT, which is by default. This is not yet supported by most CNI plugins and seems to be [slower](https://youtu.be/KHMnC3kj3Js?t=771) than the legacy version. It is recommended to switch to `iptables` legacy by using the following script in `additionalUserData` for each instance group:

```yaml
additionalUserData:
  - name: busterfix.sh
    type: text/x-shellscript
    content: |
      #!/bin/sh
      update-alternatives --set iptables /usr/sbin/iptables-legacy
      update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
      update-alternatives --set arptables /usr/sbin/arptables-legacy
      update-alternatives --set ebtables /usr/sbin/ebtables-legacy
```

Available images can be listed using:

```bash
aws ec2 describe-images --region us-east-1 --output table \
  --owners 136693071363 \
  --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \
  --filters "Name=name,Values=debian-10-amd64-*"
```

### Debian 11 (Bullseye)

Debian 11 is based on Kernel version **5.10** which has no known major Kernel bugs and fully supports all Cilium features.

Available images can be listed using:

```bash
aws ec2 describe-images --region us-east-1 --output table \
  --owners 136693071363 \
  --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \
  --filters "Name=name,Values=debian-11-amd64-*"
```

### Flatcar

Flatcar is a friendly fork of CoreOS and as such, compatible with it.

Available images can be listed using:

```bash
aws ec2 describe-images --region us-east-1 --output table \
  --owners 075585003325 \
  --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \
  --filters "Name=name,Values=Flatcar-stable-*-hvm"
```

### RHEL 8

RHEL 8 is based on Kernel version **4.18** which fixes some of the bugs present in RHEL/CentOS 7 and effects are less visible.

One notable change is the addition of `iptables` NFT, which is the only iptables backend available. This may not be supported by some CNI plugins and should be used with care.<commit_msg>Add commands for finding the latest Debian images for GCP and Azure<commit_after># Images

As of Kubernetes 1.18 the default images used by kOps are the **[official Ubuntu 20.04](#ubuntu-2004-focal)** images.

You can choose a different image for an instance group by editing it with `kops edit ig nodes`.

For AWS, you should set the `image` field in one of the following formats:
* `ami-abcdef` - specifies an image by id directly (image id is precise, but ids vary by region)
* `<owner>/<name>` specifies an image by its owner's account ID  and name properties
* `<alias>/<name>` specifies an image by its [owner's alias](#owner-aliases) and name properties
* `ssm:<ssm_parameter>` specifies an image through an SSM parameter (kOps 1.26+)

```yaml
image: ami-00579fbb15b954340
image: 099720109477/ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-20200423
image: ubuntu/ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-20200423
image: ssm:/aws/service/canonical/ubuntu/server/20.04/stable/current/amd64/hvm/ebs-gp2/ami-id
```

## Security Updates

Automated security updates are handled by kOps for Debian, Flatcar and Ubuntu distros. This can be disabled by editing the cluster configuration:

```yaml
spec:
  updatePolicy: external
```

## Distros Support Matrix

The following table provides the support status for various distros with regards to kOps version:

| Distro                              | Experimental | Stable | Deprecated | Removed |
|-------------------------------------|-------------:|-------:|-----------:|--------:|
| [Amazon Linux 2](#amazon-linux-2)   |         1.10 |   1.18 |          - |       - |
| CentOS 7                            |            - |    1.5 |       1.21 |    1.23 |
| CentOS 8                            |         1.15 |      - |       1.21 |    1.23 |
| CoreOS                              |          1.6 |    1.9 |       1.17 |    1.18 |
| Debian 8                            |            - |    1.5 |       1.17 |    1.18 |
| Debian 9                            |          1.8 |   1.10 |       1.21 |    1.23 |
| [Debian 10](#debian-10-buster)      |         1.13 |   1.17 |          - |       - |
| [Debian 11](#debian-11-bullseye)    |       1.21.1 |      - |          - |       - |
| [Flatcar](#flatcar)                 |       1.15.1 |   1.17 |          - |       - |
| Kope.io                             |            - |      - |       1.18 |    1.23 |
| RHEL 7                              |            - |    1.5 |       1.21 |    1.23 |
| [RHEL 8](#rhel-8)                   |         1.15 |   1.18 |          - |       - |
| [Rocky 8](#rocky-8)                 |       1.23.2 |   1.24 |          - |       - |
| Ubuntu 16.04                        |          1.5 |   1.10 |       1.17 |    1.20 |
| [Ubuntu 18.04](#ubuntu-1804-bionic) |         1.10 |   1.16 |       1.26 |       - |
| [Ubuntu 20.04](#ubuntu-2004-focal)  |       1.16.2 |   1.18 |          - |       - |
| [Ubuntu 22.04](#ubuntu-2204-jammy)  |         1.23 |   1.24 |          - |       - |

## Supported Distros

### Amazon Linux 2

Amazon Linux 2 has variants using Kernel versions 4.14 and 5.10. Be sure to use the 5.10 images as specified in the image filter below. More information is available in the [AWS Documentation](https://aws.amazon.com/amazon-linux-2/faqs/).

For kOps versions 1.16 and 1.17, the only supported Docker version is `18.06.3`. Newer versions of Docker cannot be installed due to missing dependencies for `container-selinux`. This issue is fixed in kOps **1.18**.

Available images can be listed using:

```bash
aws ec2 describe-images --region us-east-1 --output table \
  --owners 137112412989 \
  --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \
  --filters "Name=name,Values=amzn2-ami-kernel-5.10-hvm-2*-x86_64-gp2"
```

### Debian 10 (Buster)

Debian 10 is based on Kernel version **4.19** which fixes some of the bugs present in Debian 9 and effects are less visible.

One notable change is the addition of `iptables` NFT, which is by default. This is not yet supported by most CNI plugins and seems to be [slower](https://youtu.be/KHMnC3kj3Js?t=771) than the legacy version. It is recommended to switch to `iptables` legacy by using the following script in `additionalUserData` for each instance group:

```yaml
additionalUserData:
  - name: busterfix.sh
    type: text/x-shellscript
    content: |
      #!/bin/sh
      update-alternatives --set iptables /usr/sbin/iptables-legacy
      update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
      update-alternatives --set arptables /usr/sbin/arptables-legacy
      update-alternatives --set ebtables /usr/sbin/ebtables-legacy
```

Available images can be listed using:

```bash
# Amazon Web Services (AWS)
aws ec2 describe-images --region us-east-1 --output table \
  --owners 136693071363 \
  --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \
  --filters "Name=name,Values=debian-10-amd64-*"

# Google Cloud Platform (GCP)
gcloud compute images list --filter debian-10-buster-v

# Microsoft Azure
az vm image list --all --output table \
  --publisher Debian --offer debian-10 --sku 10-gen2
```

### Debian 11 (Bullseye)

Debian 11 is based on Kernel version **5.10** which has no known major Kernel bugs and fully supports all Cilium features.

Available images can be listed using:

```bash
# Amazon Web Services (AWS)
aws ec2 describe-images --region us-east-1 --output table \
  --owners 136693071363 \
  --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \
  --filters "Name=name,Values=debian-11-amd64-*"

# Google Cloud Platform (GCP)
gcloud compute images list --filter debian-11-bullseye-v

# Microsoft Azure
az vm image list --all --output table \
  --publisher Debian --offer debian-11 --sku 11-gen2
```

### Flatcar

Flatcar is a friendly fork of CoreOS and as such, compatible with it.

Available images can be listed using:

```bash
aws ec2 describe-images --region us-east-1 --output table \
  --owners 075585003325 \
  --query "sort_by(Images, &CreationDate)[*].[CreationDate,Name,ImageId]" \
  --filters "Name=name,Values=Flatcar-stable-*-hvm"
```

### RHEL 8

RHEL 8 is based on Kernel version **4.18** which fixes some of the bugs present in RHEL/CentOS 7 and effects are less visible.

One notable change is the addition of `iptables` NFT, which is the only iptables backend available. This may not be supported by some CNI plugins and should be used with care.
{'fraction_non_alphanumeric': 0.13304445514363666, 'fraction_numerical': 0.061787835018456104, 'mean_word_length': 2.1314070351758794, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 13, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 30, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7525131', 'n_tokens_mistral': 4517, 'n_tokens_neox': 3864, 'n_words': 1238}