cluster.ninja

Upgrade hop

Kubernetes 1.21 → 1.22

1.21End of lifeEOL 28 Jun 2022 1.22End of lifeEOL 8 Dec 2022

1.22 is itself end of life. If you are on 1.21 today, plan the whole path to a supported version (at least 1.35) with the upgrade planner.

1 · Fix removed APIs first

25 kinds stop being served in 1.22. Update manifests, charts and controllers to the replacement versions while the cluster still runs 1.21: the replacements are already served there.

KindAPI versionStops being servedUse instead
AdmissionReview admission.k8s.io/v1beta1 1.22 admission.k8s.io/v1
MutatingWebhookConfiguration admissionregistration.k8s.io/v1beta1 1.22 admissionregistration.k8s.io/v1
ValidatingWebhookConfiguration admissionregistration.k8s.io/v1beta1 1.22 admissionregistration.k8s.io/v1
ConversionReview apiextensions.k8s.io/v1beta1 1.22 apiextensions.k8s.io/v1
CustomResourceDefinition apiextensions.k8s.io/v1beta1 1.22 apiextensions.k8s.io/v1
APIService apiregistration.k8s.io/v1beta1 1.22 apiregistration.k8s.io/v1
TokenReview authentication.k8s.io/v1beta1 1.22 authentication.k8s.io/v1
LocalSubjectAccessReview authorization.k8s.io/v1beta1 1.22 authorization.k8s.io/v1
SelfSubjectAccessReview authorization.k8s.io/v1beta1 1.22 authorization.k8s.io/v1
SelfSubjectRulesReview authorization.k8s.io/v1beta1 1.22 authorization.k8s.io/v1
SubjectAccessReview authorization.k8s.io/v1beta1 1.22 authorization.k8s.io/v1
CertificateSigningRequest certificates.k8s.io/v1beta1 1.22 certificates.k8s.io/v1
Lease coordination.k8s.io/v1beta1 1.22 coordination.k8s.io/v1
Ingress extensions/v1beta1 1.22 networking.k8s.io/v1
Ingress networking.k8s.io/v1beta1 1.22 networking.k8s.io/v1
IngressClass networking.k8s.io/v1beta1 1.22 networking.k8s.io/v1
ClusterRole rbac.authorization.k8s.io/v1beta1 1.22 rbac.authorization.k8s.io/v1
ClusterRoleBinding rbac.authorization.k8s.io/v1beta1 1.22 rbac.authorization.k8s.io/v1
Role rbac.authorization.k8s.io/v1beta1 1.22 rbac.authorization.k8s.io/v1
RoleBinding rbac.authorization.k8s.io/v1beta1 1.22 rbac.authorization.k8s.io/v1
PriorityClass scheduling.k8s.io/v1beta1 1.22 scheduling.k8s.io/v1
CSIDriver storage.k8s.io/v1beta1 1.22 storage.k8s.io/v1
CSINode storage.k8s.io/v1beta1 1.22 storage.k8s.io/v1
StorageClass storage.k8s.io/v1beta1 1.22 storage.k8s.io/v1
VolumeAttachment storage.k8s.io/v1beta1 1.22 storage.k8s.io/v1

Field-level changes for each of these are on the API pages and in the official Deprecated API Migration Guide.

Check your files with the manifest checker; in a live cluster, the API server metric apiserver_requested_deprecated_apis shows which deprecated APIs clients still call.

2 · Other changes that can bite

Removed in 1.22

  • Beta Ingress APIs (extensions/v1beta1 and networking.k8s.io/v1beta1) and the beta IngressClass API are no longer served; use networking.k8s.io/v1.
  • apiextensions.k8s.io/v1beta1 CustomResourceDefinition and admissionregistration.k8s.io/v1beta1 webhook configurations are removed; use the v1 versions.
  • Beta APIService, TokenReview, SubjectAccessReview-family, CertificateSigningRequest and Lease APIs are removed in favour of their v1 versions.

Deprecated in 1.22

  • The new kubeadm v1beta3 configuration API deprecates some existing options; v1beta2 remains available and is not yet deprecated.

Our summary of the 1.22 release announcement (CC BY 4.0). Read the full changelog for your components.

3 · Upgrade in this order

  1. Prepare. Move every node to 1.20 or newer if any are older: a 1.22 API server supports kubelets back to 1.20 only. Upgrade to the newest 1.21 patch, 1.21.14.
  2. kube-apiserver to 1.22 (in HA clusters, one instance at a time; old and new may differ by one minor during the roll). Use the newest patch, 1.22.17.
  3. kube-controller-manager, kube-scheduler, cloud-controller-manager to 1.22, once every API server is on 1.22.
  4. kubelet on each node (drain first). Optional in this hop: kubelets from 1.20 to 1.22 all work with a 1.22 control plane.
  5. kube-proxy: no newer than the API server, and within the same window as the kubelet it runs beside.
  6. kubectl: 1.21 to 1.23 all talk to a 1.22 API server.

From the official version skew policy. Managed services run the control-plane steps for you; node pools are still yours to schedule.