Kubernetes 1.23: What Changed

Kubernetes 1.23 (“The Next Frontier”) was released on 7 December 2021. It is the last release of the year, supported for about 14 months, and the final one before 1.24 removes dockershim. This post covers what matters to operators and what to prepare before upgrading.

Timing. Managed services trail the upstream release by a few months (EKS and GKE currently offer 1.21 and 1.22 at most), so treat this as planning information for early 2022 rather than something to deploy today.

Highlights

flowchart TB
  R[Kubernetes 1.23] --> S[Stable]
  R --> B[Beta]
  R --> D[Deprecations and removals]
  S --> S1[HPA autoscaling/v2 GA]
  S --> S2[IPv4 IPv6 dual-stack GA]
  S --> S3[Generic ephemeral volumes GA]
  S --> S4[Job TTL after finished GA]
  B --> B1[Pod Security Admission beta on by default]
  B --> B2[CSI migration on for AWS EBS GCE PD Azure Disk vSphere]
  D --> D1[FlexVolume deprecated]
  D --> D2[HPA v2beta2 deprecated, removal in 1.26]
  D --> D3[PodSecurityPolicy still deprecated, removal in 1.25]
  D --> D4[dockershim removal next release 1.24]

Stable (GA)

• HorizontalPodAutoscaler autoscaling/v2 is stable. It contains the multi-metric and behavior features that were in v2beta2. Update manifests to autoscaling/v2; v2beta2 still works but is deprecated and is planned for removal in 1.26.
• IPv4/IPv6 dual-stack networking is stable: pods and services can have addresses from both families if the cluster and CNI are configured for it.
• Generic ephemeral volumes let a pod request a scratch volume from any CSI driver that lives and dies with the pod.
• ttlSecondsAfterFinished on Jobs is stable, so finished Jobs and their pods clean themselves up.

Beta

• Pod Security Admission (the built-in replacement for PodSecurityPolicy) is beta and enabled by default. You label namespaces with a policy level (privileged, baseline, restricted) and a mode (enforce, audit, warn):

  kubectl label namespace shop pod-security.kubernetes.io/enforce=baseline pod-security.kubernetes.io/warn=restricted
  kubectl get ns shop --show-labels

  Start in warn and audit modes to see what would break, then enforce. It checks pod specs at admission; it is simpler and less flexible than PodSecurityPolicy, and policy engines such as Kyverno or Gatekeeper cover custom rules.

• CSI migration for AWS EBS, GCE PD, Azure Disk and vSphere is on by default, meaning the in-tree volume plugins are redirected to CSI drivers. On AWS the EBS CSI driver must be installed (on EKS as an add-on) before upgrading a cluster that uses EBS-backed volumes, or volume operations fail.

Deprecations and removals to know

Item	Status
FlexVolume	Deprecated; move to CSI
autoscaling/v2beta2	Deprecated; removal planned for 1.26
PodSecurityPolicy	Deprecated since 1.21; removed in 1.25
Dockershim	Removal planned for 1.24
Some in-tree storage plugins	Moving behind CSI

The dockershim change in 1.24, in practice

Kubernetes 1.24 is expected around April 2022 and will no longer contain the Docker Engine integration. Clusters whose nodes use containerd or CRI-O are unaffected; clusters whose nodes use Docker as the runtime need new node images before upgrading to 1.24. Check now:

kubectl get nodes -o wide                        # CONTAINER-RUNTIME column: docker://..., containerd://...
kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.nodeInfo.containerRuntimeVersion}{"\n"}{end}'
kubectl get pods -A -o json | jq -r '.items[] | select(.spec.volumes[]?.hostPath.path=="/var/run/docker.sock") | .metadata.namespace+"/"+.metadata.name'

Fix workloads that mount /var/run/docker.sock (CI agents, log collectors, monitoring), and use crictl instead of docker on nodes.

Upgrade preparation checklist

1. Read the full 1.23 changelog and the urgent upgrade notes.
2. Scan manifests and clusters for removed or deprecated APIs (pluto, kubent), and move HPAs to autoscaling/v2.
3. Confirm CSI drivers are installed for your storage and snapshot classes.
4. Plan the PodSecurityPolicy migration now: choose Pod Security Admission or a policy engine, because PSP disappears in 1.25.
5. Upgrade add-ons (CNI, CoreDNS, ingress controllers, cert-manager, monitoring) to versions that support 1.23.
6. Test on a disposable cluster (kind with a 1.23 image), then staging, then production, one minor version at a time (never skip).

Kubernetes support windows are short: roughly three releases are supported at once, so the cluster you run today should have an upgrade date planned. The routine of upgrading every four to six months makes each step small.