Container Service for Kubernetes:ACK Lingjun release notes for Kubernetes 1.22

Discontinued beta APIs

Kubernetes 1.22 removes a set of beta APIs in favor of their stable (v1) versions. Existing resources created via beta APIs are preserved and remain accessible through the stable APIs — but controllers, operators, and tools that call the removed beta API versions will stop working after the upgrade.

Before upgrading, update manifests and API clients to the stable API versions listed in the table below, and redeploy controllers and applications that call the removed beta APIs.

The following beta APIs are discontinued in Kubernetes 1.22:

dockershim removal

dockershim, deprecated in Kubernetes 1.20, is removed in Kubernetes 1.22. Clusters still running Docker as the container runtime must migrate to containerd before upgrading.

Migration steps:

1. Calculate the number of new nodes needed based on your current Docker workload.

2. Add new nodes running containerd to the cluster during off-peak hours. To change the container runtime for node pools, see Change the container runtime from Docker to containerd.

3. Drain Docker nodes one at a time. After each drain, verify that all pods have migrated successfully before draining the next node.

4. Remove drained Docker nodes once no pods remain on them.

NodePort behavior change (Kubernetes 1.22.10 and later)

kube-proxy no longer listens on the ports of NodePort Services. If the NodePort Service port range (configured by ServiceNodePortRange on the API server) overlaps with the ephemeral port range defined by the net.ipv4.ip_local_port_range kernel parameter, TCP connections may fail intermittently, causing health check failures and service exceptions.

Before upgrading to 1.22.10 or later, verify that your NodePort Service port ranges do not conflict with net.ipv4.ip_local_port_range. For configuration guidance, see How do I configure a proper node port range? or the Kubernetes community PR.

Service account token expiration

In Kubernetes 1.22 and later, service account tokens have a validity period of one year. kubelet periodically renews tokens before expiration.

• client-go >= 11.0.0 or >= 0.15.0: Tokens are automatically reloaded from disk.

• client-go < 11.0.0 or < 0.15.0: Tokens are not automatically renewed. After a token expires, API server access from within the cluster fails. Upgrade client-go to 11.0.0 or later (or 0.15.0 or later) to avoid this.

For details on impacts and solutions, see [Product Changes] Solutions for service account token expiration in Kubernetes 1.22 and later.

Other pre-upgrade items

• Back up control plane node data: All containers on control plane nodes are recreated during a version upgrade. Back up any container data before starting the upgrade.

• CVE-2022-3172: This vulnerability may affect your cluster. Review the details and apply the fix described in CVE-2022-3172.

• PodSecurityPolicy (PSP): PSP was deprecated in Kubernetes 1.21 and will be removed in Kubernetes 1.25. PSPs continue to work in 1.22. Start planning a migration to the PodSecurity admission controller. For details, see Pod security admission and PodSecurityPolicy deprecation: past, present, and future.

Feature gates enabled by default

The following feature gates are enabled by default in Kubernetes 1.22 (or earlier as noted).

Enabled since Kubernetes 1.21:

Enabled since Kubernetes 1.22:

CSI integration with Windows containers (stabilized in 1.22):

The Container Storage Interface (CSI) integration with Windows containers is now stable. Use CSI Proxy to run storage operations on Windows nodes that do not support privileged containers (such as Windows Server 2019 and Windows Server version 2004). The CSI plug-in you use must support this feature. For details, see CSI Proxy.

New features

Feature updates

• PodSecurityPolicy (PSP): PSP was deprecated in Kubernetes 1.21 and will be removed in Kubernetes 1.25. ACK provides pod security policies as an alternative. See Pod security admission.

• Topology Aware Hints: The topologyKeys field was deprecated in Kubernetes 1.21. Use the Topology Aware Hints feature instead to enable Service topology-aware routing. Service topology is disabled by default in ACK 1.22 clusters. See Topology Aware Hints.

Observability

• Additional metrics for Kubernetes API server access and request patterns improve API server observability.

• Key metrics for control plane components can now be collected from ACK Lingjun clusters.

Stability

• Storage resource protection reduces etcd load during cold starts.

• API server traffic throttling based on request source, type, and route reduces etcd load during cold starts.

Performance improvements

• kubelet: During in-place kubelet upgrades, the system prevents pod restarts on a best-effort basis. See the related Kubernetes issue.

• kube-proxy: kube-proxy is now compatible with Alibaba Cloud Linux 2 (kernel 4.19.91-23 and later). When IP Virtual Server (IPVS) mode is enabled, conn_reuse_mode is no longer set to 0. See the related Kubernetes issue.

Fixed issues

• Fixed an EndpointSlice leak in kube-controller-manager that occurred in specific scenarios. See Fixing how EndpointSlice mirroring handles Service selector transitions.