Changelog for Kubernetes 1.21

Versions

• Kubernetes 1.21.5
• Nginx-ingress: 1.0.1
• Certmanager: 1.5.3

Major changes

• Load Balancers are by default allowed to talk to all tcp ports on worker nodes.

New Kubernetes features:

• The ability to create immutable secrets and configmaps.
• Cronjobs are now stable and the new API batch/v1 is implemented.
• Graceful node shutdown, when shutting worker nodes this is detected by Kubernetes and pods will be evicted.

Deprecations

Note that all deprecations will be removed in a future Kubernetes release, this does not mean you need to perform any changes now however we recommend you to start migrating your applications to avoid issues in future releases.

APIs removed in Kubernetes 1.22

A guide on how to migrate from affected APIs can be found in the Kubernetes upstream documentation.

• Ingress extensions/v1beta1 and networking.k8s.io/v1beta1
• ValidatingWebhookConfiguration and MutatingWebhookConfiguration admissionregistration.k8s.io/v1beta1
• CustomResourceDefinition apiextensions.k8s.io/v1beta1
• CertificateSigningRequest certificates.k8s.io/v1beta1
• APIService apiregistration.k8s.io/v1beta1
• TokenReview authentication.k8s.io/v1beta1
• Lease coordination.k8s.io/v1beta1
• SubjectAccessReview, LocalSubjectAccessReview and SelfSubjectAccessReview authorization.k8s.io/v1beta1
• Certmanager api v1alpha2, v1alpha3 and v1beta1

Other noteworthy deprecations

Kubernetes beta topology labels on nodes are deprecated and will be removed in a future release, follow the list below to see what labels are being replaced:

Please note: the following change does not have a set Kubernetes release when being removed however the replacement labels are already implemented.

• beta.kubernetes.io/instance-type -> node.kubernetes.io/instance-type
• beta.kubernetes.io/arch -> kubernetes.io/arch
• beta.kubernetes.io/os -> kubernetes.io/os
• failure-domain.beta.kubernetes.io/region -> topology.kubernetes.io/region
• failure-domain.beta.kubernetes.io/zone -> topology.kubernetes.io/zone

APIs removed in Kubernetes 1.25

more detail can be found in Kubernetes official documentation.

• Pod Security Policies will be removed in Kubernetes 1.25.
• CronJob batch/v1beta1, the new API batch/v1 was implemented in Kubernetes 1.21 (this is a drop in replacement)
• EndpointSlice discovery.k8s.io/v1beta1, the new API discovery.k8s.io/v1 was implemented in Kubernetes 1.21
• Event events.k8s.io/v1beta1, the new API events.k8s.io/v1 was implemented in Kubernetes 1.19
• PodDisruptionBudget policy/v1beta1, the new API policy/v1 was implemented in Kubernetes 1.21
• RuntimeClass node.k8s.io/v1beta1, the new API node.k8s.io/v1 was implemented in Kubernetes 1.20

Is downtime expected

The upgrade drains (moving all workload from) one node at the time, patches that node and brings it back in the cluster. First after all deployments and statefulsets are running again we will continue on with the next node.

Known issues

Custom node taints and labels lost during upgrade

All custom taints and labels on nodes are lost during upgrade.

Custom changes to non -customer security groups will be lost

All changes to security groups not suffixed with “-customer” will be lost during the upgrade

Snapshots is not working

There is currently a limitation in the snapshot controller not making it topology aware.