ACK strictly follows Kubernetes community conformance. This topic describes the changes in the ACK Kubernetes 1.22 release, including key changes, removed beta APIs, and upgrade requirements.
Before you upgrade
Kubernetes 1.22 permanently removes multiple beta APIs. Complete these checks before upgrading — controllers or applications that call removed APIs will fail.
Required actions:
API migration (blocking): Kubernetes 1.22 removes all
v1beta1APIs listed in Removed beta APIs. Migrate affected resources to thev1stable version before upgrading. Existing objects are unaffected, but controllers or tooling that call removed APIs will fail.Docker runtime migration: Dockershim is scheduled for removal in Kubernetes 1.24. Before upgrading to 1.24, migrate nodes from Docker to containerd using the node pool upgrade feature. For dedicated clusters, master nodes migrate automatically — all containers are recreated, so back up custom containers that require data persistence. For Windows nodes, continue using Docker EE due to containerd limitations on Windows.
NodePort range overlap (1.22.10+): From Kubernetes 1.22.10, kube-proxy no longer listens on NodePort service ports. If the NodePort range (
ServiceNodePortRangeon the API server) overlaps with the kernel'snet.ipv4.ip_local_port_rangeon any node, intermittent TCP connection failures occur, causing failed health checks and service disruptions. Verify no overlap before upgrading to 1.22.10 or later. See How do I configure the NodePort range? and the Kubernetes community PR.Service account token expiration: Service account tokens have a one-year default validity. Clients on client-go v11.0.0+ or v0.15.0+ automatically reload rotated tokens. Older clients do not auto-reload and fail to authenticate after expiry — upgrade client-go if affected. See \[Product Change\] Resolve ServiceAccount token expiration issues in Kubernetes 1.22+.
Ingress controller upgrade: The ingress controller upgrade to 1.1.0-aliyun.1 may cause brief service interruptions and configuration compatibility issues. Verify configurations during the component upgrade before the cluster upgrade.
CVE-2022-3172: This version may be affected by CVE-2022-3172. Review the impact and mitigation before upgrading.
Virtual node pod scheduling: From Kubernetes 1.22, pod scheduling to virtual nodes is enabled by default. Scheduling is affected by virtual node taints and pod-level node affinity, pod affinity, or topology spread constraints. To preserve pre-upgrade behavior, disable Enable Virtual Node-based Pod Scheduling in kube-scheduler. See Custom parameters of kube-scheduler.
PodSecurityPolicy (PSP) migration: PSP is scheduled for removal in Kubernetes 1.25. The pod security admission controller is enabled by default in ACK — start migrating away from PSP now. See Pod Security Admission and the PodSecurityPolicy Deprecation blog post.
Component versions
Component | Version | Release notes |
Kubernetes | 1.22.15-aliyun.1 | |
etcd | 3.5.1 | None |
CoreDNS | v1.9.3.6-32932850-aliyun | Non-disruptive upgrade. New: EndpointSlice watch support; DNS queries over IPv6 |
CRI — Docker CE | 19.03.15 | None |
CRI — Docker EE | Varies with Windows version | None |
CRI — containerd | 1.4.8 | None |
CSI | v1.26 | None |
CNI — Flannel | 0.15.1.4-e02c8f12-aliyun | Non-disruptive upgrade. New: Kubernetes 1.22 APIVersion compatibility for Authorization and similar resources; HostPort service exposure; hairpin mode |
CNI — Terway | — | None |
NVIDIA Container Runtime | 3.7.0 | None |
Ingress controller | 1.1.0-aliyun.1 | May cause brief service interruptions and configuration compatibility issues. Verify configurations before the cluster upgrade. |
Key changes in Kubernetes 1.22
Removed beta APIs
All v1beta1 API versions listed below are permanently removed. Calls to these APIs fail immediately after the upgrade.
Resource | Removed API | Migrate to |
MutatingWebhookConfiguration, ValidatingWebhookConfiguration |
|
|
CustomResourceDefinition (CRD) |
|
|
APIService |
|
|
TokenReview |
|
|
SubjectAccessReview |
|
|
CertificateSigningRequest |
|
|
Lease |
|
|
Ingress, IngressClass |
|
|
ClusterRole, ClusterRoleBinding, Role, RoleBinding |
|
|
CSIDriver, CSINode, StorageClass, VolumeAttachment |
|
|
PriorityClass |
|
|
Deprecations
Dockershim is deprecated and scheduled for removal in Kubernetes 1.24. See EP-2221 and cri-containerd. Before upgrading to Kubernetes 1.24, transition Docker-based nodes to a non-Docker runtime:
Plan capacity (instance types and count) for non-Docker runtime nodes based on pod count.
Scale out the new nodes during off-peak hours.
Drain Docker-based nodes one by one. After each drain, verify application pods have recovered before proceeding.
Remove Docker-based nodes after all are drained.
NodePort kube-proxy behavior change (1.22.10+): From Kubernetes 1.22.10, kube-proxy no longer listens on NodePort service ports. If the NodePort range (
ServiceNodePortRange) overlaps with the kernel'snet.ipv4.ip_local_port_rangeon any node, intermittent TCP connection failures occur. Verify no overlap before upgrading. See How do I configure the NodePort range? and the Kubernetes community PR.
Default-enabled feature gates
The following feature gates are enabled by default in Kubernetes 1.22.
Workloads and scheduling
ImmutableEphemeralVolumes: Mark ConfigMaps and Secrets as immutable to reduce API server load. See Secrets and ConfigMaps.
DaemonSetUpdateSurge: During a DaemonSet rolling update, set
.spec.strategy.rollingUpdate.maxSurgeto control how many pods can exceed the desired count. See Perform a rolling update on a DaemonSet.IndexedJob: Set
.spec.completionModetoIndexedin a Job to assign each pod a completion index annotation (batch.kubernetes.io/job-completion-index) and environment variable (JOB_COMPLETION_INDEX). See Introducing Indexed Jobs.SuspendJob: Suspend and resume a Job to control its lifecycle. See Introducing suspended Jobs.
PodDeletionCost: Influence pod termination order during scale-down by setting a deletion cost — pods with lower utilization receive lower cost and are terminated first. See ReplicaSet.
PodAffinityNamespaceSelector: Pod affinity policies support label selection across namespaces for more flexible cross-namespace scheduling. See KEP-2249.
PreferNominatedNode: kube-scheduler prioritizes nominated nodes, evaluating others only when all nominated nodes are unsuitable. See KEP-1923.
LogarithmicScaleDown: Pod termination is randomized during scale-down to mitigate topology spread constraint issues. See KEP-2185.
ProbeTerminationGracePeriod: Configure a probe-level
terminationGracePeriodSecondson liveness probes to reduce wait time before restarting a failed pod. See Configure liveness, readiness and startup probes.
Node and runtime
GracefulNodeShutdown (Linux only): The kubelet receives pending shutdown notifications and gracefully terminates pods within the configured shutdown period. See Graceful node shutdown.
MemoryManager (Linux only): Provides Non-Uniform Memory Access (NUMA)-aware memory management for applications with specific memory requirements. ACK does not configure memory reservations for this feature. See Runtime memory maps and Control CPU management policies on the node.
SizeMemoryBackedVolumes (Linux only): Define the size of memory-backed emptyDir volumes using
emptyDir.sizeLimit, improving pod scheduling transparency. See KEP-1967.CSI support for Windows containers (stable): On operating systems without privileged container support — such as Windows Server 2019 and Windows Server Core 2004 — Windows containers manage host storage through a CSI proxy. Requires a compatible CSI plugin. See csi-proxy.
Networking
IPv4/IPv6 dual-stack (IPv6DualStack): Configure IPv4 and IPv6 CIDR blocks during cluster creation and install a dual-stack-capable CNI plugin. See IPv4/IPv6 dual-stack.
NetworkPolicyEndPort: Define a range of ports in a NetworkPolicy. See Network Policies.
ServiceInternalTrafficPolicy: Route Service internal traffic to ready endpoints on the local node (
Local) or cluster-wide (Cluster). See Service internal traffic policy.ServiceLoadBalancerClass: Use a custom load balancer implementation. See Specifying the class of load balancer implementation.
ServiceLBNodePortControl: Disable NodePort allocation for LoadBalancer Services by setting
.spec.allocateLoadBalancerNodePortstofalsewhen traffic routes directly to pods. See Disabling load balancer NodePort allocation.
Storage
CSIStorageCapacity: kube-scheduler considers node storage capacity when scheduling pods that require specific volume sizes. See Storage Capacity.
Authentication and API
EfficientWatchResumption: Watch-based caches restore more efficiently after API server restarts, improving large-scale cluster performance. See KEP-1904.
Server-Side Apply (GA): Track the source, time, and operation for changes to a resource's fields. See Server-Side Apply.
BoundServiceAccountTokenVolume (GA): Service accounts mounted into pods using non-projected volumes have a one-year default validity. The kubelet automatically rotates these tokens. Clients on client-go v11.0.0+ or v0.15.0+ automatically reload tokens from disk. See the feature documentation.
CSRDuration: When you submit a CertificateSigningRequest (CSR) with
.spec.expirationSeconds, the certificate validity is the lesser of the requested duration and the controller manager's--cluster-signing-duration. The ACK default is 10 years. See Signers.
New features
Persistent volume (PV) health monitoring: Workloads can detect PV health, preventing reads or writes to faulty volumes. Enabled by default in ACK. Requires CSI plugin support. See Volume Health Monitoring.
Memory Quality of Service (QoS) based on cgroup v2: Unlike CPU, memory cannot be throttled when resources are constrained. The Linux kernel community optimized cgroup v2 for memory throttling. Enabled by default in ACK on Linux nodes with a supported kernel. See memcg QoS feature of the cgroup v1 interface and 2570-memory-qos.
Windows HostProcess containers: Run privileged containers on Windows nodes. Enabled by default in ACK. Requires OS support. See What's new for Windows containers on Windows Server 2022 and Create a Windows HostProcess pod.
Node swap memory (disabled by default): Workloads can use node swap memory — useful for swap-optimized applications or improved node stability under memory pressure. Linux only. Disabled by default in ACK. See Swap memory management and KEP-2400.
Default seccomp profile (disabled by default): Configure a default seccomp profile for all workloads. Applies
RuntimeDefaultwhen enabled. Disabled by default in ACK because some workloads require fewer syscall restrictions. Linux only. See Enable the use of RuntimeDefault as the default seccomp profile for all workloads.
Feature replacements
PodSecurityPolicy (PSP) replaced by pod security admission controller: PSP is deprecated and scheduled for removal in Kubernetes 1.25. The pod security admission controller is enabled by default in ACK. Migrate PSP resources in Kubernetes 1.22. See Pod Security Admission and the PodSecurityPolicy Deprecation blog post.
ServiceTopology replaced by Topology Aware Hints: ServiceTopology (
topologyKeysfield in a Service) is deprecated, replaced by Topology Aware Hints. Disabled by default in ACK. If enabled, enable Topology Aware Hints in Kubernetes 1.22 and migrate. See Topology Aware Hints.
ACK enhancements for Kubernetes 1.22
Observability
Additional API server access request metrics.
ACK Pro, ACK Serverless Pro, and ACK Edge Pro clusters now expose key control plane component metrics.
Stability
The following improvements apply to all cluster types:
Storage layer protection to reduce etcd impact during cold starts.
API server traffic throttling by request source, type, or route to reduce impact during cold starts.
Performance optimizations
kubelet: During an in-place upgrade, the kubelet minimizes container restarts. See kubelet's calculation of whether a container has changed can cause cluster-wide outages.
kube-proxy: Compatible with Alibaba Cloud Linux (Alinux) 2 (kernel-4.19.91-23) and later. When IPVS mode is enabled, do not set
conn_reuse_modeto0. See \[ipvs\] set conn_reuse_mode=1 on Linux kernel versions >=v5.9.ACK Serverless: ECI pods are not proactively evicted when a virtual node is not ready, reducing business impact.
ACK Pro and ACK Edge Pro: Enhanced scheduler supports gang scheduling, CPU topology awareness, and GPU topology awareness. See Overview of ACK Pro clusters.
Bug fixes
kube-controller-manager: Fixed an EndpointSlice leak in specific scenarios. See Fixing how EndpointSlice Mirroring handles Service selector transitions.