Chapter 5. Preparing to update to OpenShift Container Platform 4.12 OpenShift Container Platform 4.12 uses Kubernetes 1.25, which removed several deprecated APIs. A cluster administrator must provide a manual acknowledgment before the cluster can be updated from OpenShift Container Platform 4.11 to 4.12. This is to help prevent issues after upgrading to OpenShift Container Platform 4.12, where APIs that have been removed are still in use by workloads, tools, or other components running on or interacting with the cluster. Administrators must evaluate their cluster for any APIs in use that will be removed and migrate the affected components to use the appropriate new API version. After this evaluation and migration is complete, the administrator can provide the acknowledgment. Before you can update your OpenShift Container Platform 4.11 cluster to 4.12, you must provide the administrator acknowledgment. 5.1. Removed Kubernetes APIs OpenShift Container Platform 4.12 uses Kubernetes 1.25, which removed the following deprecated APIs. You must migrate manifests and API clients to use the appropriate API version. For more information about migrating removed APIs, see the Kubernetes documentation . Table 5.1. APIs removed from Kubernetes 1.25 Resource Removed API Migrate to Notable changes CronJob batch/v1beta1 batch/v1 No EndpointSlice discovery.k8s.io/v1beta1 discovery.k8s.io/v1 Yes Event events.k8s.io/v1beta1 events.k8s.io/v1 Yes HorizontalPodAutoscaler autoscaling/v2beta1 autoscaling/v2 No PodDisruptionBudget policy/v1beta1 policy/v1 Yes PodSecurityPolicy policy/v1beta1 Pod Security Admission [1] Yes RuntimeClass node.k8s.io/v1beta1 node.k8s.io/v1 No For more information about pod security admission in OpenShift Container Platform, see Understanding and managing pod security admission . Additional resources Understanding and managing pod security admission 5.2. Evaluating your cluster for removed APIs There are several methods to help administrators identify where APIs that will be removed are in use. However, OpenShift Container Platform cannot identify all instances, especially workloads that are idle or external tools that are used. It is the responsibility of the administrator to properly evaluate all workloads and other integrations for instances of removed APIs. 5.2.1. Reviewing alerts to identify uses of removed APIs Two alerts fire when an API is in use that will be removed in the release: APIRemovedInNextReleaseInUse - for APIs that will be removed in the OpenShift Container Platform release. APIRemovedInNextEUSReleaseInUse - for APIs that will be removed in the OpenShift Container Platform Extended Update Support (EUS) release. If either of these alerts are firing in your cluster, review the alerts and take action to clear the alerts by migrating manifests and API clients to use the new API version. Use the APIRequestCount API to get more information about which APIs are in use and which workloads are using removed APIs, because the alerts do not provide this information. Additionally, some APIs might not trigger these alerts but are still captured by APIRequestCount . The alerts are tuned to be less sensitive to avoid alerting fatigue in production systems. 5.2.2. Using APIRequestCount to identify uses of removed APIs You can use the APIRequestCount API to track API requests and review whether any of them are using one of the removed APIs. Prerequisites You must have access to the cluster as a user with the cluster-admin role. Procedure Run the following command and examine the REMOVEDINRELEASE column of the output to identify the removed APIs that are currently in use: USD oc get apirequestcounts Example output NAME REMOVEDINRELEASE REQUESTSINCURRENTHOUR REQUESTSINLAST24H ... poddisruptionbudgets.v1.policy 391 8114 poddisruptionbudgets.v1beta1.policy 1.25 2 23 podmonitors.v1.monitoring.coreos.com 3 70 podnetworkconnectivitychecks.v1alpha1.controlplane.operator.openshift.io 612 11748 pods.v1 1531 38634 podsecuritypolicies.v1beta1.policy 1.25 3 39 podtemplates.v1 2 79 preprovisioningimages.v1alpha1.metal3.io 2 39 priorityclasses.v1.scheduling.k8s.io 12 248 prioritylevelconfigurations.v1beta1.flowcontrol.apiserver.k8s.io 1.26 3 86 ... Important You can safely ignore the following entries that appear in the results: The system:serviceaccount:kube-system:generic-garbage-collector and the system:serviceaccount:kube-system:namespace-controller users might appear in the results because these services invoke all registered APIs when searching for resources to remove. The system:kube-controller-manager and system:cluster-policy-controller users might appear in the results because they walk through all resources while enforcing various policies. You can also use -o jsonpath to filter the results: USD oc get apirequestcounts -o jsonpath='{range .items[?(@.status.removedInRelease!="")]}{.status.removedInRelease}{"\t"}{.metadata.name}{"\n"}{end}' Example output 1.26 flowschemas.v1beta1.flowcontrol.apiserver.k8s.io 1.26 horizontalpodautoscalers.v2beta2.autoscaling 1.25 poddisruptionbudgets.v1beta1.policy 1.25 podsecuritypolicies.v1beta1.policy 1.26 prioritylevelconfigurations.v1beta1.flowcontrol.apiserver.k8s.io 5.2.3. Using APIRequestCount to identify which workloads are using the removed APIs You can examine the APIRequestCount resource for a given API version to help identify which workloads are using the API. Prerequisites You must have access to the cluster as a user with the cluster-admin role. Procedure Run the following command and examine the username and userAgent fields to help identify the workloads that are using the API: USD oc get apirequestcounts <resource>.<version>.<group> -o yaml For example: USD oc get apirequestcounts poddisruptionbudgets.v1beta1.policy -o yaml You can also use -o jsonpath to extract the username and userAgent values from an APIRequestCount resource: USD oc get apirequestcounts poddisruptionbudgets.v1beta1.policy \ -o jsonpath='{range .status.currentHour..byUser[*]}{..byVerb[*].verb}{","}{.username}{","}{.userAgent}{"\n"}{end}' \ | sort -k 2 -t, -u | column -t -s, -NVERBS,USERNAME,USERAGENT Example output VERBS USERNAME USERAGENT watch system:serviceaccount:openshift-operators:3scale-operator manager/v0.0.0 watch system:serviceaccount:openshift-operators:datadog-operator-controller-manager manager/v0.0.0 5.3. Migrating instances of removed APIs For information about how to migrate removed Kubernetes APIs, see the Deprecated API Migration Guide in the Kubernetes documentation. 5.4. Providing the administrator acknowledgment After you have evaluated your cluster for any removed APIs and have migrated any removed APIs, you can acknowledge that your cluster is ready to upgrade from OpenShift Container Platform 4.11 to 4.12. Warning Be aware that all responsibility falls on the administrator to ensure that all uses of removed APIs have been resolved and migrated as necessary before providing this administrator acknowledgment. OpenShift Container Platform can assist with the evaluation, but cannot identify all possible uses of removed APIs, especially idle workloads or external tools. Prerequisites You must have access to the cluster as a user with the cluster-admin role. Procedure Run the following command to acknowledge that you have completed the evaluation and your cluster is ready for the Kubernetes API removals in OpenShift Container Platform 4.12: USD oc -n openshift-config patch cm admin-acks --patch '{"data":{"ack-4.11-kube-1.25-api-removals-in-4.12":"true"}}' --type=merge

Commands:
oc get apirequestcounts
NAME REMOVEDINRELEASE REQUESTSINCURRENTHOUR REQUESTSINLAST24H poddisruptionbudgets.v1.policy 391 8114 poddisruptionbudgets.v1beta1.policy 1.25 2 23 podmonitors.v1.monitoring.coreos.com 3 70 podnetworkconnectivitychecks.v1alpha1.controlplane.operator.openshift.io 612 11748 pods.v1 1531 38634 podsecuritypolicies.v1beta1.policy 1.25 3 39 podtemplates.v1 2 79 preprovisioningimages.v1alpha1.metal3.io 2 39 priorityclasses.v1.scheduling.k8s.io 12 248 prioritylevelconfigurations.v1beta1.flowcontrol.apiserver.k8s.io 1.26 3 86
oc get apirequestcounts -o jsonpath='{range .items[?(@.status.removedInRelease!="")]}{.status.removedInRelease}{"\t"}{.metadata.name}{"\n"}{end}'
1.26 flowschemas.v1beta1.flowcontrol.apiserver.k8s.io 1.26 horizontalpodautoscalers.v2beta2.autoscaling 1.25 poddisruptionbudgets.v1beta1.policy 1.25 podsecuritypolicies.v1beta1.policy 1.26 prioritylevelconfigurations.v1beta1.flowcontrol.apiserver.k8s.io
oc get apirequestcounts <resource>.<version>.<group> -o yaml
oc get apirequestcounts poddisruptionbudgets.v1beta1.policy -o yaml
oc get apirequestcounts poddisruptionbudgets.v1beta1.policy -o jsonpath='{range .status.currentHour..byUser[*]}{..byVerb[*].verb}{","}{.username}{","}{.userAgent}{"\n"}{end}' | sort -k 2 -t, -u | column -t -s, -NVERBS,USERNAME,USERAGENT
VERBS USERNAME USERAGENT watch system:serviceaccount:openshift-operators:3scale-operator manager/v0.0.0 watch system:serviceaccount:openshift-operators:datadog-operator-controller-manager manager/v0.0.0
oc -n openshift-config patch cm admin-acks --patch '{"data":{"ack-4.11-kube-1.25-api-removals-in-4.12":"true"}}' --type=merge