Merge pull request #125029 from neolit123/1.31-enable-v1beta4

kubeadm: enable the v1beta4 API
2024-06-17 01:12:22 -07:00
parent ef9965ebc6 09078d4810
commit c142814f6c
71 changed files with 789 additions and 287 deletions
--- a/cmd/kubeadm/app/apis/kubeadm/fuzzer/fuzzer.go
+++ b/cmd/kubeadm/app/apis/kubeadm/fuzzer/fuzzer.go
@@ -89,13 +89,11 @@ func fuzzClusterConfiguration(obj *kubeadm.ClusterConfiguration, c fuzz.Continue
 	obj.CIImageRepository = "" // This fields doesn't exists in public API >> using default to get the roundtrip test pass
 	obj.KubernetesVersion = "qux"
 	obj.CIKubernetesVersion = "" // This fields doesn't exists in public API >> using default to get the roundtrip test pass
-	obj.APIServer.TimeoutForControlPlane = &metav1.Duration{
-		Duration: 0,
-	}
-	obj.ControllerManager.ExtraEnvs = []kubeadm.EnvVar{}
-	obj.APIServer.ExtraEnvs = []kubeadm.EnvVar{}
-	obj.Scheduler.ExtraEnvs = []kubeadm.EnvVar{}
-	obj.Etcd.Local.ExtraEnvs = []kubeadm.EnvVar{}
+	obj.APIServer.TimeoutForControlPlane = &metav1.Duration{}
+	obj.ControllerManager.ExtraEnvs = nil
+	obj.APIServer.ExtraEnvs = nil
+	obj.Scheduler.ExtraEnvs = nil
+	obj.Etcd.Local.ExtraEnvs = nil
 	obj.EncryptionAlgorithm = kubeadm.EncryptionAlgorithmRSA2048
 	obj.Proxy.Disabled = false
 	obj.CertificateValidityPeriod = &metav1.Duration{Duration: constants.CertificateValidityPeriod}
--- a/cmd/kubeadm/app/apis/kubeadm/scheme/scheme.go
+++ b/cmd/kubeadm/app/apis/kubeadm/scheme/scheme.go
@@ -44,7 +44,5 @@ func AddToScheme(scheme *runtime.Scheme) {
 	utilruntime.Must(kubeadm.AddToScheme(scheme))
 	utilruntime.Must(v1beta3.AddToScheme(scheme))
 	utilruntime.Must(v1beta4.AddToScheme(scheme))
-	// TODO: https://github.com/kubernetes/kubeadm/issues/2890
-	// make v1beta4 highest priority
-	utilruntime.Must(scheme.SetVersionPriority(v1beta3.SchemeGroupVersion, v1beta4.SchemeGroupVersion))
+	utilruntime.Must(scheme.SetVersionPriority(v1beta4.SchemeGroupVersion, v1beta3.SchemeGroupVersion))
 }
--- a/cmd/kubeadm/app/apis/kubeadm/timeoututils.go
+++ b/cmd/kubeadm/app/apis/kubeadm/timeoututils.go
@@ -39,6 +39,12 @@ func SetDefaultTimeouts(t **Timeouts) {
 var (
 	activeTimeouts *Timeouts = nil
 	timeoutMutex             = &sync.RWMutex{}
+
+	// conversionTimeoutControlPlane is a variable used when converting the v1beta3 field
+	// ClusterConfiguration.APIServer.TimeoutForControlPlane to
+	// v1beta4 {Init|Join}Configuration.Timeouts.ControlPlaneComponentHealthCheck.
+	// TODO: remove this once v1beta3 is removed.
+	conversionTimeoutControlPlane *metav1.Duration
 )

 func init() {
@@ -58,3 +64,19 @@ func SetActiveTimeouts(timeouts *Timeouts) {
 	activeTimeouts = timeouts.DeepCopy()
 	timeoutMutex.Unlock()
 }
+
+// TODO: remove these once v1beta3 is removed
+
+// GetConversionTimeoutControlPlane returns conversionTimeoutControlPlane.
+func GetConversionTimeoutControlPlane() *metav1.Duration {
+	timeoutMutex.RLock()
+	defer timeoutMutex.RUnlock()
+	return conversionTimeoutControlPlane
+}
+
+// SetConversionTimeoutControlPlane stores t into conversionTimeoutControlPlane.
+func SetConversionTimeoutControlPlane(t *metav1.Duration) {
+	timeoutMutex.Lock()
+	conversionTimeoutControlPlane = t.DeepCopy()
+	timeoutMutex.Unlock()
+}
--- a/cmd/kubeadm/app/apis/kubeadm/types.go
+++ b/cmd/kubeadm/app/apis/kubeadm/types.go
@@ -592,7 +592,7 @@ type UpgradeApplyConfiguration struct {
 	// ImagePullPolicy specifies the policy for image pulling during kubeadm "upgrade apply" operations.
 	// The value of this field must be one of "Always", "IfNotPresent" or "Never".
 	// If this field is unset kubeadm will default it to "IfNotPresent", or pull the required images if not present on the host.
-	ImagePullPolicy v1.PullPolicy `json:"imagePullPolicy,omitempty"`
+	ImagePullPolicy v1.PullPolicy

 	// ImagePullSerial specifies if image pulling performed by kubeadm must be done serially or in parallel.
 	ImagePullSerial *bool
@@ -632,7 +632,7 @@ type UpgradeNodeConfiguration struct {
 	// ImagePullPolicy specifies the policy for image pulling during kubeadm "upgrade node" operations.
 	// The value of this field must be one of "Always", "IfNotPresent" or "Never".
 	// If this field is unset kubeadm will default it to "IfNotPresent", or pull the required images if not present on the host.
-	ImagePullPolicy v1.PullPolicy `json:"imagePullPolicy,omitempty"`
+	ImagePullPolicy v1.PullPolicy

 	// ImagePullSerial specifies if image pulling performed by kubeadm must be done serially or in parallel.
 	ImagePullSerial *bool
@@ -752,6 +752,6 @@ type Timeouts struct {
 	// for a joining node.
 	Discovery *metav1.Duration

-	// UpgradeManifests is the timeout for upgradring static Pod manifests
+	// UpgradeManifests is the timeout for upgrading static Pod manifests.
 	UpgradeManifests *metav1.Duration
 }
--- a/cmd/kubeadm/app/apis/kubeadm/v1beta3/conversion.go
+++ b/cmd/kubeadm/app/apis/kubeadm/v1beta3/conversion.go
@@ -77,12 +77,14 @@ func Convert_v1beta3_ClusterConfiguration_To_kubeadm_ClusterConfiguration(in *Cl
 	out.EncryptionAlgorithm = kubeadm.EncryptionAlgorithmRSA2048
 	out.CertificateValidityPeriod = &metav1.Duration{Duration: constants.CertificateValidityPeriod}
 	out.CACertificateValidityPeriod = &metav1.Duration{Duration: constants.CACertificateValidityPeriod}
+	if in.APIServer.TimeoutForControlPlane != nil && in.APIServer.TimeoutForControlPlane.Duration != 0 {
+		kubeadm.SetConversionTimeoutControlPlane(in.APIServer.TimeoutForControlPlane)
+	}
 	return autoConvert_v1beta3_ClusterConfiguration_To_kubeadm_ClusterConfiguration(in, out, s)
 }

-// Convert_v1beta3_ControlPlaneComponent_To_kubeadm_ControlPlaneComponent is required due to the missing ControlPlaneComponent.ExtraEnvs in v1beta3.
+// Convert_v1beta3_ControlPlaneComponent_To_kubeadm_ControlPlaneComponent is required due to the different ControlPlaneComponent.ExtraArgs in v1beta3.
 func Convert_v1beta3_ControlPlaneComponent_To_kubeadm_ControlPlaneComponent(in *ControlPlaneComponent, out *kubeadm.ControlPlaneComponent, s conversion.Scope) error {
-	out.ExtraEnvs = []kubeadm.EnvVar{}
 	out.ExtraArgs = convertToArgs(in.ExtraArgs)
 	return autoConvert_v1beta3_ControlPlaneComponent_To_kubeadm_ControlPlaneComponent(in, out, s)
 }
@@ -93,9 +95,8 @@ func Convert_kubeadm_ControlPlaneComponent_To_v1beta3_ControlPlaneComponent(in *
 	return autoConvert_kubeadm_ControlPlaneComponent_To_v1beta3_ControlPlaneComponent(in, out, s)
 }

-// Convert_v1beta3_LocalEtcd_To_kubeadm_LocalEtcd is required due to the missing LocalEtcd.ExtraEnvs in v1beta3.
+// Convert_v1beta3_LocalEtcd_To_kubeadm_LocalEtcd is required due to the different LocalEtcd.Args in v1beta3.
 func Convert_v1beta3_LocalEtcd_To_kubeadm_LocalEtcd(in *LocalEtcd, out *kubeadm.LocalEtcd, s conversion.Scope) error {
-	out.ExtraEnvs = []kubeadm.EnvVar{}
 	out.ExtraArgs = convertToArgs(in.ExtraArgs)
 	return autoConvert_v1beta3_LocalEtcd_To_kubeadm_LocalEtcd(in, out, s)
 }
@@ -125,7 +126,7 @@ func Convert_kubeadm_DNS_To_v1beta3_DNS(in *kubeadm.DNS, out *DNS, s conversion.
 }

 // convertToArgs takes a argument map and converts it to a slice of arguments.
-// Te resulting argument slice is sorted alpha-numerically.
+// The resulting argument slice is sorted alpha-numerically.
 func convertToArgs(in map[string]string) []kubeadm.Arg {
 	if in == nil {
 		return nil
--- a/cmd/kubeadm/app/apis/kubeadm/v1beta3/doc.go
+++ b/cmd/kubeadm/app/apis/kubeadm/v1beta3/doc.go
@@ -22,6 +22,9 @@ limitations under the License.
 // Package v1beta3 defines the v1beta3 version of the kubeadm configuration file format.
 // This version improves on the v1beta2 format by fixing some minor issues and adding a few new fields.
 //
+// DEPRECATED: v1beta3 is deprecated in favor of v1beta4 and will be removed in a future release, 1.34 or later.
+// Please migrate.
+//
 // A list of changes since v1beta2:
 //   - The deprecated "ClusterConfiguration.useHyperKubeImage" field has been removed.
 //     Kubeadm no longer supports the hyperkube image.
@@ -280,6 +283,3 @@ limitations under the License.
 //
 // - APIEndpoint, that represents the endpoint of the instance of the API server to be eventually deployed on this node.
 package v1beta3 // import "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
-
-//TODO: The BootstrapTokenString object should move out to either k8s.io/client-go or k8s.io/api in the future
-//(probably as part of Bootstrap Tokens going GA). It should not be staged under the kubeadm API as it is now.
--- a/cmd/kubeadm/app/apis/kubeadm/v1beta4/conversion.go
+++ b/cmd/kubeadm/app/apis/kubeadm/v1beta4/conversion.go
@@ -25,7 +25,12 @@ import (

 // Convert_kubeadm_InitConfiguration_To_v1beta4_InitConfiguration converts a private InitConfiguration to a public InitConfiguration.
 func Convert_kubeadm_InitConfiguration_To_v1beta4_InitConfiguration(in *kubeadm.InitConfiguration, out *InitConfiguration, s conversion.Scope) error {
-	return autoConvert_kubeadm_InitConfiguration_To_v1beta4_InitConfiguration(in, out, s)
+	err := autoConvert_kubeadm_InitConfiguration_To_v1beta4_InitConfiguration(in, out, s)
+	timeoutControlPlane := kubeadm.GetConversionTimeoutControlPlane() // Remove with v1beta3.
+	if timeoutControlPlane != nil {
+		out.Timeouts.ControlPlaneComponentHealthCheck = timeoutControlPlane
+	}
+	return err
 }

 // Convert_v1beta4_InitConfiguration_To_kubeadm_InitConfiguration converts a public InitConfiguration to a private InitConfiguration.
@@ -46,8 +51,9 @@ func Convert_kubeadm_APIServer_To_v1beta4_APIServer(in *kubeadm.APIServer, out *

 // Convert_v1beta4_ClusterConfiguration_To_kubeadm_ClusterConfiguration is required due to missing TimeoutForControlPlane in v1beta4
 func Convert_v1beta4_ClusterConfiguration_To_kubeadm_ClusterConfiguration(in *ClusterConfiguration, out *kubeadm.ClusterConfiguration, s conversion.Scope) error {
+	err := autoConvert_v1beta4_ClusterConfiguration_To_kubeadm_ClusterConfiguration(in, out, s)
 	out.APIServer.TimeoutForControlPlane = &metav1.Duration{}
-	return autoConvert_v1beta4_ClusterConfiguration_To_kubeadm_ClusterConfiguration(in, out, s)
+	return err
 }

 // Convert_v1beta4_JoinConfiguration_To_kubeadm_JoinConfiguration converts a public JoinConfiguration to a private JoinConfiguration.
@@ -57,6 +63,16 @@ func Convert_v1beta4_JoinConfiguration_To_kubeadm_JoinConfiguration(in *JoinConf
 	return err
 }

+// Convert_kubeadm_JoinConfiguration_To_v1beta4_JoinConfiguration converts a private JoinConfinguration to a public JoinCOnfiguration.
+func Convert_kubeadm_JoinConfiguration_To_v1beta4_JoinConfiguration(in *kubeadm.JoinConfiguration, out *JoinConfiguration, s conversion.Scope) error {
+	err := autoConvert_kubeadm_JoinConfiguration_To_v1beta4_JoinConfiguration(in, out, s)
+	timeoutControlPlane := kubeadm.GetConversionTimeoutControlPlane() // Remove with v1beta3.
+	if timeoutControlPlane != nil {
+		out.Timeouts.ControlPlaneComponentHealthCheck = timeoutControlPlane
+	}
+	return err
+}
+
 // Convert_kubeadm_Discovery_To_v1beta4_Discovery is required because there is no Discovery.Timeout in v1beta4
 func Convert_kubeadm_Discovery_To_v1beta4_Discovery(in *kubeadm.Discovery, out *Discovery, s conversion.Scope) error {
 	return autoConvert_kubeadm_Discovery_To_v1beta4_Discovery(in, out, s)
--- a/cmd/kubeadm/app/apis/kubeadm/v1beta4/doc.go
+++ b/cmd/kubeadm/app/apis/kubeadm/v1beta4/doc.go
@@ -24,11 +24,11 @@ limitations under the License.
 //
 // A list of changes since v1beta3:
 //
-//   - TODO https://github.com/kubernetes/kubeadm/issues/2890
 //   - Support custom environment variables in control plane components under `ClusterConfiguration`.
 //     Use `APIServer.ExtraEnvs`, `ControllerManager.ExtraEnvs`, `Scheduler.ExtraEnvs`, `Etcd.Local.ExtraEnvs`.
-//   - The ResetConfiguration API type is now supported in v1beta4. Users are able to reset a node by passing a --config file to "kubeadm reset".
-//   - `dry-run` mode in is now configurable in InitConfiguration and JoinConfiguration config files.
+//   - The ResetConfiguration API type is now supported in v1beta4. Users are able to reset a node by passing
+//     a --config file to "kubeadm reset".
+//   - `dry-run` mode in is now configurable in InitConfiguration and JoinConfiguration.
 //   - Replace the existing string/string extra argument maps with structured extra arguments that support duplicates.
 //     The change applies to `ClusterConfiguration` - `APIServer.ExtraArgs, `ControllerManager.ExtraArgs`,
 //     `Scheduler.ExtraArgs`, `Etcd.Local.ExtraArgs`. Also to `NodeRegistrationOptions.KubeletExtraArgs`.
@@ -43,7 +43,9 @@ limitations under the License.
 //     Usage of component configuration for kubelet and kube-proxy, InitConfiguration and ClusterConfiguration is deprecated
 //     and will be ignored when passing --config to upgrade subcommands.
 //   - Add a `Timeouts` structure to `InitConfiguration`, `JoinConfiguration`, `ResetConfiguration` and `UpgradeConfiguration`
-//     that can be used to configure various timeouts.
+//     that can be used to configure various timeouts. The `ClusterConfiguration.TimeoutForControlPlane` field is replaced
+//     by `Timeouts.ControlPlaneComponentHealthCheck`. The `JoinConfiguration.Discovery.Timeout` is replaced by
+//     `Timeouts.Discovery`.
 //   - Add a `CertificateValidityPeriod` and `CACertificateValidityPeriod` fields to `ClusterConfiguration`. These fields
 //     can be used to control the validity period of certificates generated by kubeadm during sub-commands such as `init`,
 //     `join`, `upgrade` and `certs`. Default values continue to be 1 year for non-CA certificates and 10 years for CA
@@ -54,8 +56,7 @@ limitations under the License.
 //   - kubeadm v1.15.x and newer can be used to migrate from v1beta1 to v1beta2.
 //   - kubeadm v1.22.x and newer no longer support v1beta1 and older APIs, but can be used to migrate v1beta2 to v1beta3.
 //   - kubeadm v1.27.x and newer no longer support v1beta2 and older APIs.
-//   - TODO: https://github.com/kubernetes/kubeadm/issues/2890
-//     add version that can be used to convert to v1beta4
+//   - kubeadm v1.31.x and newer can be used to migrate from v1beta3 to v1beta4.
 //
 // # Basics
 //
@@ -82,10 +83,18 @@ limitations under the License.
 //	apiVersion: kubeadm.k8s.io/v1beta4
 //	kind: JoinConfiguration
 //
+//	apiVersion: kubeadm.k8s.io/v1beta4
+//	kind: ResetConfiguration
+//
+//	apiVersion: kubeadm.k8s.io/v1beta4
+//	kind: UpgradeConfiguration
+//
 // To print the defaults for "init" and "join" actions use the following commands:
 //
 //	kubeadm config print init-defaults
 //	kubeadm config print join-defaults
+//	kubeadm config print reset-defaults
+//	kubeadm config print upgrade-defaults
 //
 // The list of configuration types that must be included in a configuration file depends by the action you are
 // performing (init or join) and by the configuration options you are going to use (defaults or advanced customization).
@@ -193,16 +202,21 @@ limitations under the License.
 //	    value: "someValue"
 //	    effect: "NoSchedule"
 //	  kubeletExtraArgs:
-//	    v: 4
+//	  - name: "v"
+//	    value: "5"
 //	  ignorePreflightErrors:
 //	  - IsPrivilegedUser
 //	  imagePullPolicy: "IfNotPresent"
+//	  imagePullSerial: true
 //	localAPIEndpoint:
 //	  advertiseAddress: "10.100.0.1"
 //	  bindPort: 6443
 //	certificateKey: "e6a2eb8581237ab72a4f494f30285ec12a9694d750b9785706a83bfcbbbd2204"
 //	skipPhases:
-//	- addon/kube-proxy
+//	- preflight
+//	timeouts:
+//	  controlPlaneComponentHealthCheck: "60s"
+//	  kubernetesAPICall: "40s"
 //	---
 //	apiVersion: kubeadm.k8s.io/v1beta4
 //	kind: ClusterConfiguration
@@ -213,9 +227,13 @@ limitations under the License.
 //	    imageTag: "3.2.24"
 //	    dataDir: "/var/lib/etcd"
 //	    extraArgs:
-//	      listen-client-urls: "http://10.100.0.1:2379"
+//	    - name: "listen-client-urls"
+//	      value: "http://10.100.0.1:2379"
+//	    extraEnvs:
+//	    - name: "SOME_VAR"
+//	      value: "SOME_VALUE"
 //	    serverCertSANs:
-//	    -  "ec2-10-100-0-1.compute-1.amazonaws.com"
+//	    - "ec2-10-100-0-1.compute-1.amazonaws.com"
 //	    peerCertSANs:
 //	    - "10.100.0.1"
 //	  # external:
@@ -233,7 +251,11 @@ limitations under the License.
 //	controlPlaneEndpoint: "10.100.0.1:6443"
 //	apiServer:
 //	  extraArgs:
-//	    authorization-mode: "Node,RBAC"
+//	  - name: "authorization-mode"
+//	    value: "Node,RBAC"
+//	  extraEnvs:
+//	  - name: "SOME_VAR"
+//	    value: "SOME_VALUE"
 //	  extraVolumes:
 //	  - name: "some-volume"
 //	    hostPath: "/etc/some-path"
@@ -243,10 +265,10 @@ limitations under the License.
 //	  certSANs:
 //	  - "10.100.1.1"
 //	  - "ec2-10-100-0-1.compute-1.amazonaws.com"
-//	  timeoutForControlPlane: 4m0s
 //	controllerManager:
 //	  extraArgs:
-//	    "node-cidr-mask-size": "20"
+//	  - name: "node-cidr-mask-size"
+//	    value: "20"
 //	  extraVolumes:
 //	  - name: "some-volume"
 //	    hostPath: "/etc/some-path"
@@ -255,7 +277,8 @@ limitations under the License.
 //	    pathType: File
 //	scheduler:
 //	  extraArgs:
-//	    address: "10.100.0.1"
+//	  - name: "address"
+//	    value: "10.100.0.1"
 //	  extraVolumes:
 //	  - name: "some-volume"
 //	    hostPath: "/etc/some-path"
@@ -265,6 +288,11 @@ limitations under the License.
 //	certificatesDir: "/etc/kubernetes/pki"
 //	imageRepository: "registry.k8s.io"
 //	clusterName: "example-cluster"
+//	encryptionAlgorithm: "ECDSA-P256"
+//	dns:
+//	  disabled: true # disable CoreDNS
+//	proxy:
+//	  disabled: true # disable kube-proxy
 //	---
 //	apiVersion: kubelet.config.k8s.io/v1beta1
 //	kind: KubeletConfiguration
@@ -280,7 +308,12 @@ limitations under the License.
 //
 //	apiVersion: kubeadm.k8s.io/v1beta4
 //	kind: JoinConfiguration
-//	   ...
+//	discovery:
+//	  bootstrapToken:
+//	    apiServerEndpoint: some-address:6443
+//	    token: abcdef.0123456789abcdef
+//	    unsafeSkipCAVerification: true
+//	  tlsBootstrapToken: abcdef.0123456789abcdef
 //
 // The JoinConfiguration type should be used to configure runtime settings, that in case of kubeadm join
 // are the discovery method used for accessing the cluster info and all the setting which are specific
@@ -291,7 +324,31 @@ limitations under the License.
 // node only (e.g. the node ip).
 //
 // - APIEndpoint, that represents the endpoint of the instance of the API server to be eventually deployed on this node.
+//
+// # Kubeadm reset configuration types
+//
+// When executing kubeadm reset with the --config option, the ResetConfiguration type should be provided.
+//
+//	apiVersion: kubeadm.k8s.io/v1beta4
+//	kind: ResetConfiguration
+//	   ...
+//
+// # Kubeadm upgrade configuration types
+//
+// When executing kubeadm upgrade with the --config option, the UpgradeConfiguration type should be provided.
+//
+//	apiVersion: kubeadm.k8s.io/v1beta4
+//	kind: UpgradeConfiguration
+//	apply:
+//	  ...
+//	diff:
+//	  ...
+//	node:
+//	  ...
+//	plan:
+//	  ...
+//
+// The UpgradeConfiguration structure includes a few substructures that only apply to different subcommands of "kubeadm upgrade".
+// For example, the "apply" substructure will be used with the "kubeadm upgrade apply" subcommand and all other substructures
+// will be ignored in such a case.
 package v1beta4 // import "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
-
-//TODO: The BootstrapTokenString object should move out to either k8s.io/client-go or k8s.io/api in the future
-//(probably as part of Bootstrap Tokens going GA). It should not be staged under the kubeadm API as it is now.
--- a/cmd/kubeadm/app/apis/kubeadm/v1beta4/types.go
+++ b/cmd/kubeadm/app/apis/kubeadm/v1beta4/types.go
@@ -607,7 +607,7 @@ type Timeouts struct {
 	// +optional
 	Discovery *metav1.Duration `json:"discovery,omitempty"`

-	// UpgradeManifests is the timeout for upgradring static Pod manifests
+	// UpgradeManifests is the timeout for upgrading static Pod manifests.
 	// Default: 5m
 	UpgradeManifests *metav1.Duration `json:"upgradeManifests,omitempty"`
 }
@@ -662,7 +662,7 @@ type UpgradeApplyConfiguration struct {

 	// SkipPhases is a list of phases to skip during command execution.
 	// NOTE: This field is currently ignored for "kubeadm upgrade apply", but in the future it will be supported.
-	SkipPhases []string
+	SkipPhases []string `json:"skipPhases,omitempty"`

 	// ImagePullPolicy specifies the policy for image pulling during kubeadm "upgrade apply" operations.
 	// The value of this field must be one of "Always", "IfNotPresent" or "Never".
--- a/cmd/kubeadm/app/apis/kubeadm/v1beta4/zz_generated.conversion.go
+++ b/cmd/kubeadm/app/apis/kubeadm/v1beta4/zz_generated.conversion.go
@@ -159,11 +159,6 @@ func RegisterConversions(s *runtime.Scheme) error {
 	}); err != nil {
 		return err
 	}
-	if err := s.AddGeneratedConversionFunc((*kubeadm.JoinConfiguration)(nil), (*JoinConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error {
-		return Convert_kubeadm_JoinConfiguration_To_v1beta4_JoinConfiguration(a.(*kubeadm.JoinConfiguration), b.(*JoinConfiguration), scope)
-	}); err != nil {
-		return err
-	}
 	if err := s.AddGeneratedConversionFunc((*JoinControlPlane)(nil), (*kubeadm.JoinControlPlane)(nil), func(a, b interface{}, scope conversion.Scope) error {
 		return Convert_v1beta4_JoinControlPlane_To_kubeadm_JoinControlPlane(a.(*JoinControlPlane), b.(*kubeadm.JoinControlPlane), scope)
 	}); err != nil {
@@ -309,6 +304,11 @@ func RegisterConversions(s *runtime.Scheme) error {
 	}); err != nil {
 		return err
 	}
+	if err := s.AddConversionFunc((*kubeadm.JoinConfiguration)(nil), (*JoinConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error {
+		return Convert_kubeadm_JoinConfiguration_To_v1beta4_JoinConfiguration(a.(*kubeadm.JoinConfiguration), b.(*JoinConfiguration), scope)
+	}); err != nil {
+		return err
+	}
 	if err := s.AddConversionFunc((*ClusterConfiguration)(nil), (*kubeadm.ClusterConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error {
 		return Convert_v1beta4_ClusterConfiguration_To_kubeadm_ClusterConfiguration(a.(*ClusterConfiguration), b.(*kubeadm.ClusterConfiguration), scope)
 	}); err != nil {
@@ -768,11 +768,6 @@ func autoConvert_kubeadm_JoinConfiguration_To_v1beta4_JoinConfiguration(in *kube
 	return nil
 }

-// Convert_kubeadm_JoinConfiguration_To_v1beta4_JoinConfiguration is an autogenerated conversion function.
-func Convert_kubeadm_JoinConfiguration_To_v1beta4_JoinConfiguration(in *kubeadm.JoinConfiguration, out *JoinConfiguration, s conversion.Scope) error {
-	return autoConvert_kubeadm_JoinConfiguration_To_v1beta4_JoinConfiguration(in, out, s)
-}
-
 func autoConvert_v1beta4_JoinControlPlane_To_kubeadm_JoinControlPlane(in *JoinControlPlane, out *kubeadm.JoinControlPlane, s conversion.Scope) error {
 	if err := Convert_v1beta4_APIEndpoint_To_kubeadm_APIEndpoint(&in.LocalAPIEndpoint, &out.LocalAPIEndpoint, s); err != nil {
 		return err
--- a/cmd/kubeadm/app/apis/kubeadm/validation/validation.go
+++ b/cmd/kubeadm/app/apis/kubeadm/validation/validation.go
@@ -40,7 +40,7 @@ import (

 	bootstraptokenv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/bootstraptoken/v1"
 	"k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	kubeadmcmdoptions "k8s.io/kubernetes/cmd/kubeadm/app/cmd/options"
 	"k8s.io/kubernetes/cmd/kubeadm/app/componentconfigs"
 	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
@@ -766,11 +766,17 @@ func ValidateImagePullPolicy(policy corev1.PullPolicy, fldPath *field.Path) fiel
 func ValidateUpgradeConfiguration(c *kubeadm.UpgradeConfiguration) field.ErrorList {
 	allErrs := field.ErrorList{}
 	if c.Apply.Patches != nil {
-		allErrs = append(allErrs, ValidateAbsolutePath(c.Apply.Patches.Directory, field.NewPath("patches").Child("directory"))...)
+		allErrs = append(allErrs, ValidateAbsolutePath(c.Apply.Patches.Directory,
+			field.NewPath("apply").Child("patches").Child("directory"))...)
 	}
 	if c.Node.Patches != nil {
-		allErrs = append(allErrs, ValidateAbsolutePath(c.Node.Patches.Directory, field.NewPath("patches").Child("directory"))...)
+		allErrs = append(allErrs, ValidateAbsolutePath(c.Node.Patches.Directory,
+			field.NewPath("node").Child("patches").Child("directory"))...)
 	}
+	allErrs = append(allErrs, ValidateImagePullPolicy(c.Apply.ImagePullPolicy,
+		field.NewPath("apply").Child("imagePullPolicy"))...)
+	allErrs = append(allErrs, ValidateImagePullPolicy(c.Node.ImagePullPolicy,
+		field.NewPath("node").Child("imagePullPolicy"))...)
 	return allErrs
 }

--- a/cmd/kubeadm/app/apis/kubeadm/validation/validation_test.go
+++ b/cmd/kubeadm/app/apis/kubeadm/validation/validation_test.go
@@ -30,7 +30,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/validation/field"

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 )

@@ -1591,3 +1591,91 @@ func TestValidateCertValidity(t *testing.T) {
 		}
 	}
 }
+
+func TestValidateResetConfiguration(t *testing.T) {
+	var tests = []struct {
+		name           string
+		cfg            *kubeadmapi.ResetConfiguration
+		expectedErrors int
+	}{
+		{
+			name: "expect 3 errors",
+			cfg: &kubeadmapi.ResetConfiguration{
+				CRISocket:       "foo",
+				CertificatesDir: "bar",
+				UnmountFlags:    []string{"baz"},
+			},
+			expectedErrors: 3,
+		},
+		{
+			name: "expect 0 errors",
+			cfg: &kubeadmapi.ResetConfiguration{
+				CRISocket:       fmt.Sprintf("%s:///var/run/containerd/containerd.sock", kubeadmapiv1.DefaultContainerRuntimeURLScheme),
+				CertificatesDir: "/foo/bar", // this is work on Windows too because of the local isAbs()
+				UnmountFlags:    []string{kubeadmapi.UnmountFlagMNTForce},
+			},
+			expectedErrors: 0,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			actual := ValidateResetConfiguration(tc.cfg)
+			if len(actual) != tc.expectedErrors {
+				t.Errorf("expected errors: %d, got: %+v", tc.expectedErrors, actual)
+			}
+		})
+	}
+}
+
+func TestValidateUpgradeConfiguration(t *testing.T) {
+	var tests = []struct {
+		name           string
+		cfg            *kubeadmapi.UpgradeConfiguration
+		expectedErrors int
+	}{
+		{
+			name: "expect 4 errors",
+			cfg: &kubeadmapi.UpgradeConfiguration{
+				Apply: kubeadmapi.UpgradeApplyConfiguration{
+					Patches: &kubeadmapi.Patches{
+						Directory: "foo",
+					},
+					ImagePullPolicy: "bar",
+				},
+				Node: kubeadmapi.UpgradeNodeConfiguration{
+					Patches: &kubeadmapi.Patches{
+						Directory: "foo",
+					},
+					ImagePullPolicy: "bar",
+				},
+			},
+			expectedErrors: 4,
+		},
+		{
+			name: "expect 0 errors",
+			cfg: &kubeadmapi.UpgradeConfiguration{
+				Apply: kubeadmapi.UpgradeApplyConfiguration{
+					Patches: &kubeadmapi.Patches{
+						Directory: "/foo/bar",
+					},
+					ImagePullPolicy: corev1.PullAlways,
+				},
+				Node: kubeadmapi.UpgradeNodeConfiguration{
+					Patches: &kubeadmapi.Patches{
+						Directory: "/foo/bar",
+					},
+					ImagePullPolicy: corev1.PullAlways,
+				},
+			},
+			expectedErrors: 0,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			actual := ValidateUpgradeConfiguration(tc.cfg)
+			if len(actual) != tc.expectedErrors {
+				t.Errorf("expected errors: %d, got: %+v", tc.expectedErrors, actual)
+			}
+		})
+	}
+}
--- a/cmd/kubeadm/app/cmd/certs.go
+++ b/cmd/kubeadm/app/cmd/certs.go
@@ -36,7 +36,7 @@ import (

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 	kubeadmscheme "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/scheme"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	outputapischeme "k8s.io/kubernetes/cmd/kubeadm/app/apis/output/scheme"
 	outputapiv1alpha3 "k8s.io/kubernetes/cmd/kubeadm/app/apis/output/v1alpha3"
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/options"
--- a/cmd/kubeadm/app/cmd/certs_test.go
+++ b/cmd/kubeadm/app/cmd/certs_test.go
@@ -47,7 +47,7 @@ import (
 	"k8s.io/client-go/tools/clientcmd"

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	outputapiv1alpha3 "k8s.io/kubernetes/cmd/kubeadm/app/apis/output/v1alpha3"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	certsphase "k8s.io/kubernetes/cmd/kubeadm/app/phases/certs"
--- a/cmd/kubeadm/app/cmd/config.go
+++ b/cmd/kubeadm/app/cmd/config.go
@@ -35,7 +35,6 @@ import (

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 	kubeadmscheme "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/scheme"
-	kubeadmapiv1old "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
 	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	outputapischeme "k8s.io/kubernetes/cmd/kubeadm/app/apis/output/scheme"
 	outputapiv1alpha3 "k8s.io/kubernetes/cmd/kubeadm/app/apis/output/v1alpha3"
@@ -94,6 +93,7 @@ func newCmdConfigPrint(out io.Writer) *cobra.Command {
 	cmd.AddCommand(newCmdConfigPrintInitDefaults(out))
 	cmd.AddCommand(newCmdConfigPrintJoinDefaults(out))
 	cmd.AddCommand(newCmdConfigPrintResetDefaults(out))
+	cmd.AddCommand(newCmdConfigPrintUpgradeDefaults(out))
 	return cmd
 }

@@ -112,6 +112,11 @@ func newCmdConfigPrintResetDefaults(out io.Writer) *cobra.Command {
 	return newCmdConfigPrintActionDefaults(out, "reset", getDefaultResetConfigBytes)
 }

+// newCmdConfigPrintUpgradeDefaults returns cobra.Command for "kubeadm config print upgrade-defaults" command
+func newCmdConfigPrintUpgradeDefaults(out io.Writer) *cobra.Command {
+	return newCmdConfigPrintActionDefaults(out, "upgrade", getDefaultUpgradeConfigBytes)
+}
+
 func newCmdConfigPrintActionDefaults(out io.Writer, action string, configBytesProc func() ([]byte, error)) *cobra.Command {
 	kinds := []string{}
 	cmd := &cobra.Command{
@@ -207,16 +212,16 @@ func getDefaultInitConfigBytes() ([]byte, error) {
 		return []byte{}, err
 	}

-	return configutil.MarshalKubeadmConfigObject(internalcfg, kubeadmapiv1old.SchemeGroupVersion)
+	return configutil.MarshalKubeadmConfigObject(internalcfg, kubeadmapiv1.SchemeGroupVersion)
 }

 func getDefaultNodeConfigBytes() ([]byte, error) {
 	opts := configutil.LoadOrDefaultConfigurationOptions{
 		SkipCRIDetect: true,
 	}
-	internalcfg, err := configutil.DefaultedJoinConfiguration(&kubeadmapiv1old.JoinConfiguration{
-		Discovery: kubeadmapiv1old.Discovery{
-			BootstrapToken: &kubeadmapiv1old.BootstrapTokenDiscovery{
+	internalcfg, err := configutil.DefaultedJoinConfiguration(&kubeadmapiv1.JoinConfiguration{
+		Discovery: kubeadmapiv1.Discovery{
+			BootstrapToken: &kubeadmapiv1.BootstrapTokenDiscovery{
 				Token:                    configutil.PlaceholderToken.Token.String(),
 				APIServerEndpoint:        "kube-apiserver:6443",
 				UnsafeSkipCAVerification: true, // TODO: UnsafeSkipCAVerification: true needs to be set for validation to pass, but shouldn't be recommended as the default
@@ -227,7 +232,7 @@ func getDefaultNodeConfigBytes() ([]byte, error) {
 		return []byte{}, err
 	}

-	return configutil.MarshalKubeadmConfigObject(internalcfg, kubeadmapiv1old.SchemeGroupVersion)
+	return configutil.MarshalKubeadmConfigObject(internalcfg, kubeadmapiv1.SchemeGroupVersion)
 }

 func getDefaultResetConfigBytes() ([]byte, error) {
@@ -242,6 +247,18 @@ func getDefaultResetConfigBytes() ([]byte, error) {
 	return configutil.MarshalKubeadmConfigObject(internalcfg, kubeadmapiv1.SchemeGroupVersion)
 }

+func getDefaultUpgradeConfigBytes() ([]byte, error) {
+	opts := configutil.LoadOrDefaultConfigurationOptions{
+		SkipCRIDetect: true,
+	}
+	internalcfg, err := configutil.DefaultedUpgradeConfiguration(&kubeadmapiv1.UpgradeConfiguration{}, opts)
+	if err != nil {
+		return []byte{}, err
+	}
+
+	return configutil.MarshalKubeadmConfigObject(internalcfg, kubeadmapiv1.SchemeGroupVersion)
+}
+
 // newCmdConfigMigrate returns cobra.Command for "kubeadm config migrate" command
 func newCmdConfigMigrate(out io.Writer) *cobra.Command {
 	var oldCfgPath, newCfgPath string
@@ -263,7 +280,7 @@ func newCmdConfigMigrate(out io.Writer) *cobra.Command {

 			In other words, the output of this command is what kubeadm actually would read internally if you
 			submitted this file to "kubeadm init"
-		`), kubeadmapiv1old.SchemeGroupVersion, kubeadmapiv1old.SchemeGroupVersion),
+		`), kubeadmapiv1.SchemeGroupVersion, kubeadmapiv1.SchemeGroupVersion),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if len(oldCfgPath) == 0 {
 				return errors.New("the --old-config flag is mandatory")
@@ -313,7 +330,7 @@ func newCmdConfigValidate(out io.Writer) *cobra.Command {

 			In this version of kubeadm, the following API versions are supported:
 			- %s
-		`), kubeadmapiv1old.SchemeGroupVersion),
+		`), kubeadmapiv1.SchemeGroupVersion),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if len(cfgPath) == 0 {
 				return errors.Errorf("the --%s flag is mandatory", options.CfgPath)
@@ -352,9 +369,9 @@ func newCmdConfigImages(out io.Writer) *cobra.Command {

 // newCmdConfigImagesPull returns the `kubeadm config images pull` command
 func newCmdConfigImagesPull() *cobra.Command {
-	externalClusterCfg := &kubeadmapiv1old.ClusterConfiguration{}
+	externalClusterCfg := &kubeadmapiv1.ClusterConfiguration{}
 	kubeadmscheme.Scheme.Default(externalClusterCfg)
-	externalInitCfg := &kubeadmapiv1old.InitConfiguration{}
+	externalInitCfg := &kubeadmapiv1.InitConfiguration{}
 	kubeadmscheme.Scheme.Default(externalInitCfg)
 	var cfgPath, featureGatesString string
 	var err error
@@ -399,7 +416,7 @@ func PullControlPlaneImages(runtime utilruntime.ContainerRuntime, cfg *kubeadmap

 // newCmdConfigImagesList returns the "kubeadm config images list" command
 func newCmdConfigImagesList(out io.Writer, mockK8sVersion *string) *cobra.Command {
-	externalcfg := &kubeadmapiv1old.ClusterConfiguration{}
+	externalcfg := &kubeadmapiv1.ClusterConfiguration{}
 	kubeadmscheme.Scheme.Default(externalcfg)
 	var cfgPath, featureGatesString string
 	var err error
@@ -441,8 +458,8 @@ func newCmdConfigImagesList(out io.Writer, mockK8sVersion *string) *cobra.Comman
 }

 // NewImagesList returns the underlying struct for the "kubeadm config images list" command
-func NewImagesList(cfgPath string, cfg *kubeadmapiv1old.ClusterConfiguration) (*ImagesList, error) {
-	initcfg, err := configutil.LoadOrDefaultInitConfiguration(cfgPath, &kubeadmapiv1old.InitConfiguration{}, cfg, configutil.LoadOrDefaultConfigurationOptions{
+func NewImagesList(cfgPath string, cfg *kubeadmapiv1.ClusterConfiguration) (*ImagesList, error) {
+	initcfg, err := configutil.LoadOrDefaultInitConfiguration(cfgPath, &kubeadmapiv1.InitConfiguration{}, cfg, configutil.LoadOrDefaultConfigurationOptions{
 		SkipCRIDetect: true,
 	})
 	if err != nil {
@@ -498,7 +515,7 @@ func (i *ImagesList) Run(out io.Writer, printer output.Printer) error {
 }

 // AddImagesCommonConfigFlags adds the flags that configure kubeadm (and affect the images kubeadm will use)
-func AddImagesCommonConfigFlags(flagSet *flag.FlagSet, cfg *kubeadmapiv1old.ClusterConfiguration, cfgPath *string, featureGatesString *string) {
+func AddImagesCommonConfigFlags(flagSet *flag.FlagSet, cfg *kubeadmapiv1.ClusterConfiguration, cfgPath *string, featureGatesString *string) {
 	options.AddKubernetesVersionFlag(flagSet, &cfg.KubernetesVersion)
 	options.AddFeatureGatesStringFlag(flagSet, featureGatesString)
 	options.AddImageMetaFlags(flagSet, &cfg.ImageRepository)
--- a/cmd/kubeadm/app/cmd/config_test.go
+++ b/cmd/kubeadm/app/cmd/config_test.go
@@ -31,7 +31,7 @@ import (
 	"github.com/lithammer/dedent"
 	"github.com/spf13/cobra"

-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	outputapischeme "k8s.io/kubernetes/cmd/kubeadm/app/apis/output/scheme"
 	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	kubeadmutil "k8s.io/kubernetes/cmd/kubeadm/app/util"
--- a/cmd/kubeadm/app/cmd/init.go
+++ b/cmd/kubeadm/app/cmd/init.go
@@ -31,7 +31,7 @@ import (

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 	kubeadmscheme "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/scheme"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/validation"
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/options"
 	phases "k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/init"
--- a/cmd/kubeadm/app/cmd/init_test.go
+++ b/cmd/kubeadm/app/cmd/init_test.go
@@ -34,7 +34,7 @@ import (

 	bootstraptokenv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/bootstraptoken/v1"
 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/options"
 	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 )
--- a/cmd/kubeadm/app/cmd/join.go
+++ b/cmd/kubeadm/app/cmd/join.go
@@ -37,7 +37,7 @@ import (

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 	kubeadmscheme "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/scheme"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/validation"
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/options"
 	phases "k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/join"
--- a/cmd/kubeadm/app/cmd/join_test.go
+++ b/cmd/kubeadm/app/cmd/join_test.go
@@ -34,8 +34,9 @@ import (
 	"k8s.io/utils/ptr"

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/options"
+	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	kubeconfigutil "k8s.io/kubernetes/cmd/kubeadm/app/util/kubeconfig"
 )

@@ -233,7 +234,7 @@ func TestNewJoinData(t *testing.T) {
 								UnsafeSkipCAVerification: true,
 							},
 							TLSBootstrapToken: "abcdef.0123456789abcdef",
-							Timeout:           &metav1.Duration{Duration: kubeadmapiv1.DefaultDiscoveryTimeout},
+							Timeout:           &metav1.Duration{Duration: constants.DiscoveryTimeout},
 						},
 						ControlPlane: &kubeadmapi.JoinControlPlane{
 							CertificateKey: "c39a18bae4a72e71b178661f437363da218a3efb83ddb03f1cd91d9ae1da41bd",
--- a/cmd/kubeadm/app/cmd/kubeconfig.go
+++ b/cmd/kubeadm/app/cmd/kubeconfig.go
@@ -25,7 +25,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/klog/v2"

-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/options"
 	cmdutil "k8s.io/kubernetes/cmd/kubeadm/app/cmd/util"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
--- a/cmd/kubeadm/app/cmd/kubeconfig_test.go
+++ b/cmd/kubeadm/app/cmd/kubeconfig_test.go
@@ -28,7 +28,7 @@ import (
 	"k8s.io/client-go/tools/clientcmd"
 	"sigs.k8s.io/yaml"

-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	kubeadmutil "k8s.io/kubernetes/cmd/kubeadm/app/util"
 	"k8s.io/kubernetes/cmd/kubeadm/app/util/pkiutil"
--- a/cmd/kubeadm/app/cmd/options/argslice.go
+++ b/cmd/kubeadm/app/cmd/options/argslice.go
@@ -0,0 +1,73 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package options
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/pkg/errors"
+
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
+)
+
+type argSlice struct {
+	args *[]kubeadmapiv1.Arg
+}
+
+func newArgSlice(args *[]kubeadmapiv1.Arg) *argSlice {
+	return &argSlice{args: args}
+}
+
+// String implements github.com/spf13/pflag.Value
+func (s *argSlice) String() string {
+	if s == nil || s.args == nil || len(*s.args) == 0 {
+		return ""
+	}
+
+	pairs := make([]string, 0, len(*s.args))
+	for _, a := range *s.args {
+		pairs = append(pairs, fmt.Sprintf("%s=%s", a.Name, a.Value))
+	}
+
+	return strings.Join(pairs, ",")
+}
+
+// Set implements github.com/spf13/pflag.Value
+func (s *argSlice) Set(value string) error {
+	if s.args == nil {
+		s.args = &[]kubeadmapiv1.Arg{}
+	}
+
+	pairs := strings.Split(value, ",")
+
+	for _, p := range pairs {
+		m := strings.Split(p, "=")
+		if len(m) != 2 {
+			return errors.Errorf("malformed key=value pair in flag value: %s", value)
+		}
+		arg := kubeadmapiv1.Arg{Name: m[0], Value: m[1]}
+		*s.args = append(*s.args, arg)
+	}
+
+	return nil
+}
+
+// Type implements github.com/spf13/pflag.Value
+func (s *argSlice) Type() string {
+	return "[]kubeadmapiv1.Arg"
+}
--- a/cmd/kubeadm/app/cmd/options/argslice_test.go
+++ b/cmd/kubeadm/app/cmd/options/argslice_test.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package options
+
+import (
+	"reflect"
+	"testing"
+
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
+)
+
+func TestArgSliceStringSet(t *testing.T) {
+	tests := []struct {
+		name   string
+		input  *[]kubeadmapiv1.Arg
+		output string
+	}{
+		// a test case with nil is input is not needed because ExtraArgs are never nil in ClusterConfiguration
+		{
+			name:   "no args",
+			input:  &[]kubeadmapiv1.Arg{},
+			output: "",
+		},
+		{
+			name: "one arg",
+			input: &[]kubeadmapiv1.Arg{
+				{Name: "foo", Value: "bar"},
+			},
+			output: "foo=bar",
+		},
+		{
+			name: "two args",
+			input: &[]kubeadmapiv1.Arg{
+				{Name: "foo", Value: "bar"},
+				{Name: "baz", Value: "qux"},
+			},
+			output: "foo=bar,baz=qux",
+		},
+		{
+			name: "three args with a duplicate",
+			input: &[]kubeadmapiv1.Arg{
+				{Name: "foo", Value: "bar"},
+				{Name: "foo", Value: "qux"},
+				{Name: "baz", Value: "qux"},
+			},
+			output: "foo=bar,foo=qux,baz=qux",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := newArgSlice(tt.input)
+			gotString := s.String()
+			if ok := reflect.DeepEqual(gotString, tt.output); !ok {
+				t.Errorf("String()\ngot: %v\noutput: %v", gotString, tt.output)
+			}
+			_ = s.Set(gotString)
+			if ok := reflect.DeepEqual(s.args, tt.input); !ok {
+				t.Errorf("Set()\ngot: %+v\noutput: %+v", s.args, tt.input)
+			}
+		})
+	}
+}
--- a/cmd/kubeadm/app/cmd/options/generic.go
+++ b/cmd/kubeadm/app/cmd/options/generic.go
@@ -17,11 +17,12 @@ limitations under the License.
 package options

 import (
+	"fmt"
 	"strings"

 	"github.com/spf13/pflag"

-	cliflag "k8s.io/component-base/cli/flag"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"

 	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	"k8s.io/kubernetes/cmd/kubeadm/app/features"
@@ -53,13 +54,19 @@ func AddIgnorePreflightErrorsFlag(fs *pflag.FlagSet, ignorePreflightErrors *[]st
 }

 // AddControlPlanExtraArgsFlags adds the ExtraArgs flags for control plane components
-func AddControlPlanExtraArgsFlags(fs *pflag.FlagSet, apiServerExtraArgs, controllerManagerExtraArgs, schedulerExtraArgs *map[string]string) {
-	// TODO: https://github.com/kubernetes/kubeadm/issues/1601
-	// Either deprecate these flags or handle duplicate keys.
-	// Currently the map[string]string returned by NewMapStringString() doesn't allow this.
-	fs.Var(cliflag.NewMapStringString(apiServerExtraArgs), APIServerExtraArgs, "A set of extra flags to pass to the API Server or override default ones in form of <flagname>=<value>")
-	fs.Var(cliflag.NewMapStringString(controllerManagerExtraArgs), ControllerManagerExtraArgs, "A set of extra flags to pass to the Controller Manager or override default ones in form of <flagname>=<value>")
-	fs.Var(cliflag.NewMapStringString(schedulerExtraArgs), SchedulerExtraArgs, "A set of extra flags to pass to the Scheduler or override default ones in form of <flagname>=<value>")
+func AddControlPlanExtraArgsFlags(fs *pflag.FlagSet, apiServerExtraArgs, controllerManagerExtraArgs, schedulerExtraArgs *[]kubeadmapiv1.Arg) {
+	// TODO: these flags are deprecated, remove them and related logic:
+	// - AddControlPlanExtraArgsFlag()
+	// - files app/cmd/options/argslice*.go
+	// - options.*ExtraArgs
+	// - usages in app/cmd/init.go and app/cmd/phases/init/controlplane.go
+	fs.Var(newArgSlice(apiServerExtraArgs), APIServerExtraArgs, "A set of extra flags to pass to the API Server or override default ones in form of <flagname>=<value>")
+	fs.Var(newArgSlice(controllerManagerExtraArgs), ControllerManagerExtraArgs, "A set of extra flags to pass to the Controller Manager or override default ones in form of <flagname>=<value>")
+	fs.Var(newArgSlice(schedulerExtraArgs), SchedulerExtraArgs, "A set of extra flags to pass to the Scheduler or override default ones in form of <flagname>=<value>")
+	const future = "This flag will be removed in a future version"
+	_ = fs.MarkDeprecated(APIServerExtraArgs, fmt.Sprintf("use 'ClusterConfiguration.apiServer.extraArgs' instead. %s", future))
+	_ = fs.MarkDeprecated(ControllerManagerExtraArgs, fmt.Sprintf("use 'ClusterConfiguration.controllerManager.extraArgs' instead. %s", future))
+	_ = fs.MarkDeprecated(SchedulerExtraArgs, fmt.Sprintf("use 'ClusterConfiguration.scheduler.extraArgs' instead. %s", future))
 }

 // AddImageMetaFlags adds the --image-repository flag to the given flagset
--- a/cmd/kubeadm/app/cmd/options/token.go
+++ b/cmd/kubeadm/app/cmd/options/token.go
@@ -25,7 +25,7 @@ import (
 	bootstrapapi "k8s.io/cluster-bootstrap/token/api"

 	bootstraptokenv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/bootstraptoken/v1"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 )

 // NewBootstrapTokenOptions creates a new BootstrapTokenOptions object with the default values
--- a/cmd/kubeadm/app/cmd/phases/init/certs.go
+++ b/cmd/kubeadm/app/cmd/phases/init/certs.go
@@ -25,7 +25,7 @@ import (

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 	kubeadmscheme "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/scheme"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/options"
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow"
 	cmdutil "k8s.io/kubernetes/cmd/kubeadm/app/cmd/util"
@@ -39,7 +39,7 @@ var (
 	saKeyLongDesc = fmt.Sprintf(cmdutil.LongDesc(`
 		Generate the private key for signing service account tokens along with its public key, and save them into
 		%s and %s files.
-		
+
 		If both files already exist, kubeadm skips the generation step and existing files will be used.
 		`), kubeadmconstants.ServiceAccountPrivateKeyName, kubeadmconstants.ServiceAccountPublicKeyName)

--- a/cmd/kubeadm/app/cmd/phases/reset/cleanupnode.go
+++ b/cmd/kubeadm/app/cmd/phases/reset/cleanupnode.go
@@ -27,7 +27,7 @@ import (

 	"k8s.io/klog/v2"

-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/options"
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
--- a/cmd/kubeadm/app/cmd/phases/reset/removeetcdmember.go
+++ b/cmd/kubeadm/app/cmd/phases/reset/removeetcdmember.go
@@ -27,7 +27,7 @@ import (

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 	"k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/scheme"
-	"k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/options"
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/workflow"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
@@ -108,7 +108,7 @@ func getEtcdDataDir(manifestPath string, cfg *kubeadmapi.InitConfiguration) (str
 	if _, err := os.Stat(manifestPath); os.IsNotExist(err) {
 		// Fall back to use the default cluster config if etcd.yaml doesn't exist, this could happen that
 		// etcd.yaml is removed by other reset phases, e.g. cleanup-node.
-		cfg := &v1beta3.ClusterConfiguration{}
+		cfg := &kubeadmapiv1.ClusterConfiguration{}
 		scheme.Scheme.Default(cfg)
 		return cfg.Etcd.Local.DataDir, nil
 	}
--- a/cmd/kubeadm/app/cmd/phases/util.go
+++ b/cmd/kubeadm/app/cmd/phases/util.go
@@ -19,7 +19,7 @@ package phases
 import (
 	"k8s.io/component-base/version"

-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 )

 // SetKubernetesVersion gets the current Kubeadm version and sets it as KubeadmVersion in the config,
--- a/cmd/kubeadm/app/cmd/phases/util_test.go
+++ b/cmd/kubeadm/app/cmd/phases/util_test.go
@@ -20,8 +20,7 @@ import (
 	"testing"

 	"k8s.io/component-base/version"
-
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 )

 func TestSetKubernetesVersion(t *testing.T) {
--- a/cmd/kubeadm/app/cmd/reset.go
+++ b/cmd/kubeadm/app/cmd/reset.go
@@ -32,8 +32,7 @@ import (

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 	kubeadmscheme "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/scheme"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
-	"k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/validation"
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/options"
 	phases "k8s.io/kubernetes/cmd/kubeadm/app/cmd/phases/reset"
@@ -66,7 +65,7 @@ type resetOptions struct {
 	kubeconfigPath        string
 	cfgPath               string
 	ignorePreflightErrors []string
-	externalcfg           *v1beta4.ResetConfiguration
+	externalcfg           *kubeadmapiv1.ResetConfiguration
 	skipCRIDetect         bool
 }

@@ -89,7 +88,7 @@ type resetData struct {
 // newResetOptions returns a struct ready for being used for creating cmd join flags.
 func newResetOptions() *resetOptions {
 	// initialize the public kubeadm config API by applying defaults
-	externalcfg := &v1beta4.ResetConfiguration{}
+	externalcfg := &kubeadmapiv1.ResetConfiguration{}
 	// Apply defaults
 	kubeadmscheme.Scheme.Default(externalcfg)
 	return &resetOptions{
--- a/cmd/kubeadm/app/cmd/token.go
+++ b/cmd/kubeadm/app/cmd/token.go
@@ -40,7 +40,7 @@ import (

 	bootstraptokenv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/bootstraptoken/v1"
 	kubeadmscheme "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/scheme"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/validation"
 	outputapischeme "k8s.io/kubernetes/cmd/kubeadm/app/apis/output/scheme"
 	outputapiv1alpha3 "k8s.io/kubernetes/cmd/kubeadm/app/apis/output/v1alpha3"
--- a/cmd/kubeadm/app/cmd/token_test.go
+++ b/cmd/kubeadm/app/cmd/token_test.go
@@ -32,7 +32,7 @@ import (
 	"k8s.io/client-go/tools/clientcmd"

 	bootstraptokenv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/bootstraptoken/v1"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	outputapischeme "k8s.io/kubernetes/cmd/kubeadm/app/apis/output/scheme"
 	outputapiv1alpha3 "k8s.io/kubernetes/cmd/kubeadm/app/apis/output/v1alpha3"
 	cmdutil "k8s.io/kubernetes/cmd/kubeadm/app/cmd/util"
--- a/cmd/kubeadm/app/cmd/upgrade/common.go
+++ b/cmd/kubeadm/app/cmd/upgrade/common.go
@@ -35,8 +35,7 @@ import (
 	"k8s.io/utils/ptr"

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
-	"k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/validation"
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/options"
 	cmdutil "k8s.io/kubernetes/cmd/kubeadm/app/cmd/util"
@@ -53,7 +52,7 @@ import (

 // enforceRequirements verifies that it's okay to upgrade and then returns the variables needed for the rest of the procedure
 func enforceRequirements(flagSet *pflag.FlagSet, flags *applyPlanFlags, args []string, dryRun bool, upgradeApply bool, printer output.Printer) (clientset.Interface, upgrade.VersionGetter, *kubeadmapi.InitConfiguration, *kubeadmapi.UpgradeConfiguration, error) {
-	externalCfg := &v1beta4.UpgradeConfiguration{}
+	externalCfg := &kubeadmapiv1.UpgradeConfiguration{}
 	opt := configutil.LoadOrDefaultConfigurationOptions{}
 	upgradeCfg, err := configutil.LoadOrDefaultUpgradeConfiguration(flags.cfgPath, externalCfg, opt)
 	if err != nil {
--- a/cmd/kubeadm/app/cmd/upgrade/common_test.go
+++ b/cmd/kubeadm/app/cmd/upgrade/common_test.go
@@ -27,7 +27,7 @@ import (
 	"github.com/spf13/pflag"

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/preflight"
 	"k8s.io/kubernetes/cmd/kubeadm/app/util/output"
 	testutil "k8s.io/kubernetes/cmd/kubeadm/test"
@@ -153,6 +153,7 @@ func TestPrintConfiguration(t *testing.T) {
 	kind: ClusterConfiguration
 	kubernetesVersion: v1.7.1
 	networking: {}
+	proxy: {}
 	scheduler: {}
 `, kubeadmapiv1.SchemeGroupVersion.String())),
 		},
@@ -185,6 +186,7 @@ func TestPrintConfiguration(t *testing.T) {
 	kubernetesVersion: v1.7.1
 	networking:
 	  serviceSubnet: 10.96.0.1/12
+	proxy: {}
 	scheduler: {}
 `),
 		},
--- a/cmd/kubeadm/app/componentconfigs/fakeconfig_test.go
+++ b/cmd/kubeadm/app/componentconfigs/fakeconfig_test.go
@@ -24,6 +24,7 @@ import (
 	"testing"
 	"time"

+	"github.com/google/go-cmp/cmp"
 	"github.com/lithammer/dedent"

 	v1 "k8s.io/api/core/v1"
@@ -34,7 +35,7 @@ import (

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 	kubeadmscheme "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/scheme"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	outputapiv1alpha3 "k8s.io/kubernetes/cmd/kubeadm/app/apis/output/v1alpha3"
 	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	kubeadmutil "k8s.io/kubernetes/cmd/kubeadm/app/util"
@@ -193,11 +194,12 @@ var (
 		obj  kubeadmapiv1.ClusterConfiguration
 	}{
 		yaml: dedent.Dedent(fmt.Sprintf(`
-			apiServer:
-			  timeoutForControlPlane: 4m
 			apiVersion: %s
 			certificatesDir: /etc/kubernetes/pki
 			clusterName: LeCluster
+			encryptionAlgorithm: "RSA-2048"
+			certificateValidityPeriod: "8760h0m0s"
+			caCertificateValidityPeriod: "87600h0m0s"
 			controllerManager: {}
 			etcd:
 			  local:
@@ -208,6 +210,7 @@ var (
 			networking:
 			  dnsDomain: cluster.local
 			  serviceSubnet: 10.96.0.0/12
+			proxy: {}
 			scheduler: {}
 		`, kubeadmapiv1.SchemeGroupVersion.String())),
 		obj: kubeadmapiv1.ClusterConfiguration{
@@ -228,10 +231,12 @@ var (
 					DataDir: "/var/lib/etcd",
 				},
 			},
-			APIServer: kubeadmapiv1.APIServer{
-				TimeoutForControlPlane: &metav1.Duration{
-					Duration: 4 * time.Minute,
-				},
+			EncryptionAlgorithm: kubeadmapiv1.EncryptionAlgorithmRSA2048,
+			CertificateValidityPeriod: &metav1.Duration{
+				Duration: time.Hour * 8760,
+			},
+			CACertificateValidityPeriod: &metav1.Duration{
+				Duration: time.Hour * 87600,
 			},
 		},
 	}
@@ -269,6 +274,7 @@ func TestConfigBaseMarshal(t *testing.T) {
 			kind: ClusterConfiguration
 			kubernetesVersion: 1.2.3
 			networking: {}
+			proxy: {}
 			scheduler: {}
 		`, kubeadmapiv1.SchemeGroupVersion.String())))

@@ -301,8 +307,8 @@ func TestConfigBaseUnmarshal(t *testing.T) {
 			t.Fatalf("unexpected failure of Unmarshal: %v", err)
 		}

-		if !reflect.DeepEqual(got, expected) {
-			t.Fatalf("Missmatch between expected and got:\nExpected:\n%v\n---\nGot:\n%v", expected, got)
+		if diff := cmp.Diff(expected.config, got.config); diff != "" {
+			t.Fatalf("Unexpected diff (-expected,+got):\n%s", diff)
 		}
 	})
 }
--- a/cmd/kubeadm/app/componentconfigs/kubelet.go
+++ b/cmd/kubeadm/app/componentconfigs/kubelet.go
@@ -26,7 +26,7 @@ import (
 	"k8s.io/utils/ptr"

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 )

--- a/cmd/kubeadm/app/componentconfigs/kubelet_test.go
+++ b/cmd/kubeadm/app/componentconfigs/kubelet_test.go
@@ -32,7 +32,7 @@ import (
 	"k8s.io/utils/ptr"

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 )

--- a/cmd/kubeadm/app/componentconfigs/kubeproxy.go
+++ b/cmd/kubeadm/app/componentconfigs/kubeproxy.go
@@ -24,7 +24,7 @@ import (
 	netutils "k8s.io/utils/net"

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
 )

--- a/cmd/kubeadm/app/componentconfigs/kubeproxy_test.go
+++ b/cmd/kubeadm/app/componentconfigs/kubeproxy_test.go
@@ -31,7 +31,7 @@ import (
 	kubeproxyconfig "k8s.io/kube-proxy/config/v1alpha1"

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 )

--- a/cmd/kubeadm/app/discovery/discovery.go
+++ b/cmd/kubeadm/app/discovery/discovery.go
@@ -25,7 +25,7 @@ import (
 	"k8s.io/klog/v2"

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/discovery/file"
 	"k8s.io/kubernetes/cmd/kubeadm/app/discovery/https"
 	"k8s.io/kubernetes/cmd/kubeadm/app/discovery/token"
--- a/cmd/kubeadm/app/discovery/token/token.go
+++ b/cmd/kubeadm/app/discovery/token/token.go
@@ -37,7 +37,7 @@ import (

 	bootstraptokenv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/bootstraptoken/v1"
 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	kubeconfigutil "k8s.io/kubernetes/cmd/kubeadm/app/util/kubeconfig"
 	"k8s.io/kubernetes/cmd/kubeadm/app/util/pubkeypin"
--- a/cmd/kubeadm/app/images/images.go
+++ b/cmd/kubeadm/app/images/images.go
@@ -22,7 +22,7 @@ import (
 	"k8s.io/klog/v2"

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1beta3 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	kubeadmutil "k8s.io/kubernetes/cmd/kubeadm/app/util"
 )
@@ -49,7 +49,7 @@ func GetDNSImage(cfg *kubeadmapi.ClusterConfiguration) string {
 		dnsImageRepository = cfg.DNS.ImageRepository
 	}
 	// Handle the renaming of the official image from "registry.k8s.io/coredns" to "registry.k8s.io/coredns/coredns
-	if dnsImageRepository == kubeadmapiv1beta3.DefaultImageRepository {
+	if dnsImageRepository == kubeadmapiv1.DefaultImageRepository {
 		dnsImageRepository = fmt.Sprintf("%s/coredns", dnsImageRepository)
 	}
 	// DNS uses an imageTag that corresponds to the DNS version matching the Kubernetes version
--- a/cmd/kubeadm/app/images/images_test.go
+++ b/cmd/kubeadm/app/images/images_test.go
@@ -22,7 +22,7 @@ import (

 	"github.com/stretchr/testify/assert"
 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1beta3 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 )

@@ -322,9 +322,9 @@ func TestGetDNSImage(t *testing.T) {
 			},
 		},
 		{
-			expected: kubeadmapiv1beta3.DefaultImageRepository + "/coredns/coredns:v1.11.1",
+			expected: kubeadmapiv1.DefaultImageRepository + "/coredns/coredns:v1.11.1",
 			cfg: &kubeadmapi.ClusterConfiguration{
-				ImageRepository: kubeadmapiv1beta3.DefaultImageRepository,
+				ImageRepository: kubeadmapiv1.DefaultImageRepository,
 				DNS:             kubeadmapi.DNS{},
 			},
 		},
--- a/cmd/kubeadm/app/phases/upgrade/staticpods_test.go
+++ b/cmd/kubeadm/app/phases/upgrade/staticpods_test.go
@@ -34,7 +34,7 @@ import (
 	certutil "k8s.io/client-go/util/cert"

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	certsphase "k8s.io/kubernetes/cmd/kubeadm/app/phases/certs"
 	"k8s.io/kubernetes/cmd/kubeadm/app/phases/certs/renewal"
--- a/cmd/kubeadm/app/phases/uploadconfig/uploadconfig.go
+++ b/cmd/kubeadm/app/phases/uploadconfig/uploadconfig.go
@@ -25,7 +25,7 @@ import (
 	clientset "k8s.io/client-go/kubernetes"

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	"k8s.io/kubernetes/cmd/kubeadm/app/util/apiclient"
 	configutil "k8s.io/kubernetes/cmd/kubeadm/app/util/config"
--- a/cmd/kubeadm/app/preflight/checks_test.go
+++ b/cmd/kubeadm/app/preflight/checks_test.go
@@ -38,7 +38,7 @@ import (
 	fakeexec "k8s.io/utils/exec/testing"

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	configutil "k8s.io/kubernetes/cmd/kubeadm/app/util/config"
 )

--- a/cmd/kubeadm/app/util/config/cluster.go
+++ b/cmd/kubeadm/app/util/config/cluster.go
@@ -37,7 +37,7 @@ import (

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 	kubeadmscheme "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/scheme"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/componentconfigs"
 	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	"k8s.io/kubernetes/cmd/kubeadm/app/util/apiclient"
--- a/cmd/kubeadm/app/util/config/cluster_test.go
+++ b/cmd/kubeadm/app/util/config/cluster_test.go
@@ -37,7 +37,8 @@ import (
 	clienttesting "k8s.io/client-go/testing"

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1old "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/componentconfigs"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	testresources "k8s.io/kubernetes/cmd/kubeadm/test/resources"
@@ -49,11 +50,20 @@ var cfgFiles = map[string][]byte{
 	"InitConfiguration_v1beta3": []byte(fmt.Sprintf(`
 apiVersion: %s
 kind: InitConfiguration
-`, kubeadmapiv1.SchemeGroupVersion.String())),
+`, kubeadmapiv1old.SchemeGroupVersion.String())),
 	"ClusterConfiguration_v1beta3": []byte(fmt.Sprintf(`
 apiVersion: %s
 kind: ClusterConfiguration
 kubernetesVersion: %s
+`, kubeadmapiv1old.SchemeGroupVersion.String(), k8sVersionString)),
+	"InitConfiguration_v1beta4": []byte(fmt.Sprintf(`
+apiVersion: %s
+kind: InitConfiguration
+`, kubeadmapiv1.SchemeGroupVersion.String())),
+	"ClusterConfiguration_v1beta4": []byte(fmt.Sprintf(`
+apiVersion: %s
+kind: ClusterConfiguration
+kubernetesVersion: %s
 `, kubeadmapiv1.SchemeGroupVersion.String(), k8sVersionString)),
 	"Kube-proxy_componentconfig": []byte(`
 apiVersion: kubeproxy.config.k8s.io/v1alpha1
@@ -509,7 +519,7 @@ func TestGetInitConfigurationFromCluster(t *testing.T) {
 			expectedError: true,
 		},
 		{
-			name: "valid v1beta3 - new control plane == false", // InitConfiguration composed with data from different places, with also node specific information
+			name: "valid v1beta4 - new control plane == false", // InitConfiguration composed with data from different places, with also node specific information
 			staticPods: []testresources.FakeStaticPod{
 				{
 					NodeName:  nodeName,
@@ -523,7 +533,7 @@ func TestGetInitConfigurationFromCluster(t *testing.T) {
 				{
 					Name: kubeadmconstants.KubeadmConfigConfigMap, // ClusterConfiguration from kubeadm-config.
 					Data: map[string]string{
-						kubeadmconstants.ClusterConfigurationConfigMapKey: string(cfgFiles["ClusterConfiguration_v1beta3"]),
+						kubeadmconstants.ClusterConfigurationConfigMapKey: string(cfgFiles["ClusterConfiguration_v1beta4"]),
 					},
 				},
 				{
@@ -567,7 +577,7 @@ func TestGetInitConfigurationFromCluster(t *testing.T) {
 				{
 					Name: kubeadmconstants.KubeadmConfigConfigMap, // ClusterConfiguration from kubeadm-config.
 					Data: map[string]string{
-						kubeadmconstants.ClusterConfigurationConfigMapKey: string(cfgFiles["ClusterConfiguration_v1beta3"]),
+						kubeadmconstants.ClusterConfigurationConfigMapKey: string(cfgFiles["ClusterConfiguration_v1beta4"]),
 					},
 				},
 				{
--- a/cmd/kubeadm/app/util/config/common.go
+++ b/cmd/kubeadm/app/util/config/common.go
@@ -37,7 +37,6 @@ import (

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 	kubeadmscheme "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/scheme"
-	kubeadmapiv1old "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
 	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/cmd/options"
 	"k8s.io/kubernetes/cmd/kubeadm/app/componentconfigs"
@@ -75,6 +74,7 @@ func validateSupportedVersion(gv schema.GroupVersion, allowDeprecated, allowExpe
 	// v1.15: v1beta1 read-only, writes only v1beta2 config. Errors if the user tries to use v1alpha1, v1alpha2 or v1alpha3
 	// v1.22: v1beta2 read-only, writes only v1beta3 config. Errors if the user tries to use v1beta1 and older
 	// v1.27: only v1beta3 config. Errors if the user tries to use v1beta2 and older
+	// v1.31: v1beta3 read-only, writes only v1beta4 config, errors if the user tries to use older APIs.
 	oldKnownAPIVersions := map[string]string{
 		"kubeadm.k8s.io/v1alpha1": "v1.11",
 		"kubeadm.k8s.io/v1alpha2": "v1.12",
@@ -83,15 +83,13 @@ func validateSupportedVersion(gv schema.GroupVersion, allowDeprecated, allowExpe
 		"kubeadm.k8s.io/v1beta2":  "v1.22",
 	}

-	// v1.28: v1beta4 is released as experimental
-	experimentalAPIVersions := map[string]string{
-		// TODO: https://github.com/kubernetes/kubeadm/issues/2890
-		// remove this from experimental once v1beta4 is released
-		"kubeadm.k8s.io/v1beta4": "v1.28",
-	}
+	// Experimental API versions are present here until released. Can be used only if allowed.
+	experimentalAPIVersions := map[string]string{}

-	// Deprecated API versions are supported by us, but can only be used for migration.
-	deprecatedAPIVersions := map[string]struct{}{}
+	// Deprecated API versions are supported until removed. They throw a warning.
+	deprecatedAPIVersions := map[string]struct{}{
+		"kubeadm.k8s.io/v1beta3": {},
+	}

 	gvString := gv.String()

@@ -272,7 +270,8 @@ func MigrateOldConfig(oldConfig []byte, allowExperimental bool, mutators migrate
 		return []byte{}, err
 	}

-	gv := kubeadmapiv1old.SchemeGroupVersion
+	gv := kubeadmapiv1.SchemeGroupVersion
+	// Update GV to an experimental version if needed
 	if allowExperimental {
 		gv = kubeadmapiv1.SchemeGroupVersion
 	}
--- a/cmd/kubeadm/app/util/config/common_test.go
+++ b/cmd/kubeadm/app/util/config/common_test.go
@@ -19,10 +19,12 @@ package config
 import (
 	"fmt"
 	"reflect"
+	"strings"
 	"testing"
 	"time"

 	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/lithammer/dedent"

 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -98,14 +100,6 @@ func TestValidateSupportedVersion(t *testing.T) {
 				Group:   KubeadmGroupName,
 				Version: "v1beta4",
 			},
-			allowExperimental: true,
-		},
-		{
-			gv: schema.GroupVersion{
-				Group:   KubeadmGroupName,
-				Version: "v1beta4",
-			},
-			expectedErr: true,
 		},
 	}

@@ -221,13 +215,14 @@ func TestVerifyAPIServerBindAddress(t *testing.T) {
 }

 // NOTE: do not delete this test once an older API is removed and there is only one API left.
-// Update the inline "gv" and "gvExperimental" variables, to have the GroupVersion String of
-// the API to be tested. If there are no experimental APIs make "gvExperimental" point to
-// an non-experimental API.
+// Update the inline "gv" and "gvNew" variables, to have the GroupVersion String of
+// the API to be tested. If there are no new APIs make "gvNew" point to the old API.
+// If an experimental API has to be tested, use the 'allowExperimental' option
+// and add negative and positive test cases for the experimental API.
 func TestMigrateOldConfig(t *testing.T) {
 	var (
-		gv             = kubeadmapiv1old.SchemeGroupVersion.String()
-		gvExperimental = kubeadmapiv1.SchemeGroupVersion.String()
+		gv    = kubeadmapiv1old.SchemeGroupVersion.String()
+		gvNew = kubeadmapiv1.SchemeGroupVersion.String()
 	)
 	tests := []struct {
 		name              string
@@ -273,6 +268,7 @@ func TestMigrateOldConfig(t *testing.T) {
 			oldCfg: dedent.Dedent(fmt.Sprintf(`
 			apiVersion: %s
 			kind: ClusterConfiguration
+			kubernetesVersion: v1.10.0
 			`, gv)),
 			expectedKinds: []string{
 				constants.InitConfigurationKind,
@@ -304,6 +300,7 @@ func TestMigrateOldConfig(t *testing.T) {
 			---
 			apiVersion: %[1]s
 			kind: ClusterConfiguration
+			kubernetesVersion: v1.10.0
 			`, gv)),
 			expectedKinds: []string{
 				constants.InitConfigurationKind,
@@ -337,6 +334,7 @@ func TestMigrateOldConfig(t *testing.T) {
 			oldCfg: dedent.Dedent(fmt.Sprintf(`
 			apiVersion: %s
 			kind: ClusterConfiguration
+			kubernetesVersion: v1.10.0
 			---
 			apiVersion: %[1]s
 			kind: JoinConfiguration
@@ -361,6 +359,7 @@ func TestMigrateOldConfig(t *testing.T) {
 			---
 			apiVersion: %[1]s
 			kind: ClusterConfiguration
+			kubernetesVersion: v1.10.0
 			---
 			apiVersion: %[1]s
 			kind: JoinConfiguration
@@ -385,6 +384,7 @@ func TestMigrateOldConfig(t *testing.T) {
 			---
 			apiVersion: %[1]s
 			kind: ClusterConfiguration
+			kubernetesVersion: v1.10.0
 			---
 			apiVersion: %[1]s
 			kind: JoinConfiguration
@@ -407,101 +407,226 @@ func TestMigrateOldConfig(t *testing.T) {
 			},
 			expectErr: false,
 		},
-		{
-			name: "ClusterConfiguration gets migrated from experimental API",
-			oldCfg: dedent.Dedent(fmt.Sprintf(`
-			apiVersion: %s
-			kind: ClusterConfiguration
-			`, gvExperimental)),
-			expectedKinds: []string{
-				constants.InitConfigurationKind,
-				constants.ClusterConfigurationKind,
-			},
-			allowExperimental: true,
-			expectErr:         false,
-		},
-		{
-			name: "ClusterConfiguration from experimental API cannot be migrated",
-			oldCfg: dedent.Dedent(fmt.Sprintf(`
-			apiVersion: %s
-			kind: ClusterConfiguration
-			`, gvExperimental)),
-			allowExperimental: false,
-			expectErr:         true,
-		},
-		{
-			name: "ResetConfiguration gets migrated from experimental API",
-			oldCfg: dedent.Dedent(fmt.Sprintf(`
-			apiVersion: %s
-			kind: ResetConfiguration
-			force: true
-			cleanupTmpDir: true
-			criSocket: unix:///var/run/containerd/containerd.sock
-			certificatesDir: /etc/kubernetes/pki
-			`, gvExperimental)),
-			expectedKinds: []string{
-				constants.ResetConfigurationKind,
-			},
-			allowExperimental: true,
-			expectErr:         false,
-		},
-		{
-			name: "ResetConfiguration from experimental API cannot be migrated",
-			oldCfg: dedent.Dedent(fmt.Sprintf(`
-			apiVersion: %s
-			kind: ResetConfiguration
-			`, gvExperimental)),
-			allowExperimental: false,
-			expectErr:         true,
-		},
 	}

 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			b, err := MigrateOldConfig([]byte(test.oldCfg), test.allowExperimental, defaultEmptyMigrateMutators())
-			if test.expectErr {
-				if err == nil {
-					t.Fatalf("unexpected success:\n%s", b)
+			if test.expectErr != (err != nil) {
+				t.Fatalf("expected error: %v, got: %v", test.expectErr, err != nil)
+			}
+			gvks, err := kubeadmutil.GroupVersionKindsFromBytes(b)
+			if err != nil {
+				t.Fatalf("unexpected error returned by GroupVersionKindsFromBytes: %v", err)
+			}
+			if len(gvks) != len(test.expectedKinds) {
+				t.Fatalf("length mismatch between resulting gvks and expected kinds:\n\tlen(gvks)=%d\n\tlen(expectedKinds)=%d",
+					len(gvks), len(test.expectedKinds))
+			}
+			for _, expectedKind := range test.expectedKinds {
+				if !kubeadmutil.GroupVersionKindsHasKind(gvks, expectedKind) {
+					t.Fatalf("migration failed to produce config kind: %s", expectedKind)
 				}
-			} else {
-				if err != nil {
-					t.Fatalf("unexpected failure: %v", err)
-				}
-				gvks, err := kubeadmutil.GroupVersionKindsFromBytes(b)
-				if err != nil {
-					t.Fatalf("unexpected error returned by GroupVersionKindsFromBytes: %v", err)
-				}
-				if len(gvks) != len(test.expectedKinds) {
-					t.Fatalf("length mismatch between resulting gvks and expected kinds:\n\tlen(gvks)=%d\n\tlen(expectedKinds)=%d",
-						len(gvks), len(test.expectedKinds))
-				}
-				for _, expectedKind := range test.expectedKinds {
-					if !kubeadmutil.GroupVersionKindsHasKind(gvks, expectedKind) {
-						t.Fatalf("migration failed to produce config kind: %s", expectedKind)
-					}
-				}
-				expectedGV := gv
-				if test.allowExperimental {
-					expectedGV = gvExperimental
-				}
-				for _, gvk := range gvks {
-					if gvk.GroupVersion().String() != expectedGV {
-						t.Errorf("GV mismatch, expected GV: %s, got GV: %s", expectedGV, gvk.GroupVersion().String())
-					}
+			}
+			expectedGV := gvNew
+			if test.allowExperimental {
+				expectedGV = gvNew
+			}
+			for _, gvk := range gvks {
+				if gvk.GroupVersion().String() != expectedGV {
+					t.Errorf("GV mismatch, expected GV: %s, got GV: %s", expectedGV, gvk.GroupVersion().String())
 				}
 			}
 		})
 	}
 }

+// Test the migration of all breaking changes in v1beta4, marked as "MIGRATED" in the YAML below:
+// - ExtraArgs
+// - ClusterConfiguration.APIServer.TimeoutForControlPlane -> {Init|Join}Configuration.Timeout.ControlPlaneComponentHealthCheck
+// - JoinConfiguration.Discovery.Timeout -> JoinConfiguration.Timeout.Discovery
+func TestMigrateV1Beta3WithBreakingChanges(t *testing.T) {
+	var (
+		gv    = kubeadmapiv1old.SchemeGroupVersion.String()
+		gvNew = kubeadmapiv1.SchemeGroupVersion.String()
+
+		input = dedent.Dedent(fmt.Sprintf(`
+		apiVersion: %s
+		bootstrapTokens:
+		- groups:
+		  - system:bootstrappers:kubeadm:default-node-token
+		  token: n32eo4.cci2j99rnn8fmv42
+		  ttl: 24h0m0s
+		  usages:
+		  - signing
+		  - authentication
+		kind: InitConfiguration
+		localAPIEndpoint:
+		  advertiseAddress: 1.2.3.4
+		  bindPort: 6443
+		nodeRegistration:
+		  criSocket: unix:///some-socket-path
+		  kubeletExtraArgs: # MIGRATED
+		    foo: bar
+		  name: node
+		---
+		apiServer:
+		  timeoutForControlPlane: 2m32s # MIGRATED
+		  extraArgs: # MIGRATED
+		    foo: bar
+		apiVersion: %[1]s
+		controllerManager:
+		  extraArgs: # MIGRATED
+		    foo: bar
+		etcd:
+		  local:
+		    extraArgs: # MIGRATED
+		      foo: bar
+		kind: ClusterConfiguration
+		kubernetesVersion: v1.10.0
+		scheduler:
+		  extraArgs: # MIGRATED
+		    foo: bar
+		---
+		apiVersion: %[1]s
+		kind: JoinConfiguration
+		nodeRegistration:
+		  criSocket: unix:///some-socket-path
+		  imagePullPolicy: IfNotPresent
+		  kubeletExtraArgs: # MIGRATED
+		    foo: baz
+		  name: foo
+		  taints: null
+		discovery:
+		  bootstrapToken:
+		    apiServerEndpoint: some-address:6443
+		    token: abcdef.0123456789abcdef
+		    unsafeSkipCAVerification: true
+		  tlsBootstrapToken: abcdef.0123456789abcdef
+		  timeout: 2m10s # MIGRATED
+		`, gv))
+
+		expectedOutput = dedent.Dedent(fmt.Sprintf(`
+		apiVersion: %s
+		bootstrapTokens:
+		- groups:
+		  - system:bootstrappers:kubeadm:default-node-token
+		  token: n32eo4.cci2j99rnn8fmv42
+		  ttl: 24h0m0s
+		  usages:
+		  - signing
+		  - authentication
+		kind: InitConfiguration
+		localAPIEndpoint:
+		  advertiseAddress: 1.2.3.4
+		  bindPort: 6443
+		nodeRegistration:
+		  criSocket: unix:///some-socket-path
+		  imagePullPolicy: IfNotPresent
+		  imagePullSerial: true
+		  kubeletExtraArgs:
+		  - name: foo
+		    value: bar
+		  name: node
+		  taints:
+		  - effect: NoSchedule
+		    key: node-role.kubernetes.io/control-plane
+		timeouts:
+		  controlPlaneComponentHealthCheck: 2m32s
+		  discovery: 5m0s
+		  etcdAPICall: 2m0s
+		  kubeletHealthCheck: 4m0s
+		  kubernetesAPICall: 1m0s
+		  tlsBootstrap: 5m0s
+		  upgradeManifests: 5m0s
+		---
+		apiServer:
+		  extraArgs:
+		  - name: foo
+		    value: bar
+		apiVersion: %[1]s
+		caCertificateValidityPeriod: 87600h0m0s
+		certificateValidityPeriod: 8760h0m0s
+		certificatesDir: /etc/kubernetes/pki
+		clusterName: kubernetes
+		controllerManager:
+		  extraArgs:
+		  - name: foo
+		    value: bar
+		dns: {}
+		encryptionAlgorithm: RSA-2048
+		etcd:
+		  local:
+		    dataDir: /var/lib/etcd
+		    extraArgs:
+		    - name: foo
+		      value: bar
+		imageRepository: registry.k8s.io
+		kind: ClusterConfiguration
+		kubernetesVersion: v1.10.0
+		networking:
+		  dnsDomain: cluster.local
+		  serviceSubnet: 10.96.0.0/12
+		proxy: {}
+		scheduler:
+		  extraArgs:
+		  - name: foo
+		    value: bar
+		---
+		apiVersion: %[1]s
+		caCertPath: /etc/kubernetes/pki/ca.crt
+		discovery:
+		  bootstrapToken:
+		    apiServerEndpoint: some-address:6443
+		    token: abcdef.0123456789abcdef
+		    unsafeSkipCAVerification: true
+		  tlsBootstrapToken: abcdef.0123456789abcdef
+		kind: JoinConfiguration
+		nodeRegistration:
+		  criSocket: unix:///some-socket-path
+		  imagePullPolicy: IfNotPresent
+		  imagePullSerial: true
+		  kubeletExtraArgs:
+		  - name: foo
+		    value: baz
+		  name: foo
+		  taints: null
+		timeouts:
+		  controlPlaneComponentHealthCheck: 2m32s
+		  discovery: 2m10s
+		  etcdAPICall: 2m0s
+		  kubeletHealthCheck: 4m0s
+		  kubernetesAPICall: 1m0s
+		  tlsBootstrap: 5m0s
+		  upgradeManifests: 5m0s
+		`, gvNew))
+	)
+
+	b, err := MigrateOldConfig([]byte(input), false, defaultEmptyMigrateMutators())
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// Trim one leading new line as MigrateOldConfig does the same
+	expectedOutput = strings.TrimLeft(expectedOutput, "\n")
+
+	// Split string lines in the diff
+	diff := cmp.Diff(expectedOutput, string(b), cmpopts.AcyclicTransformer("multiline", func(s string) []string {
+		return strings.Split(s, "\n")
+	}))
+	if len(diff) > 0 {
+		t.Fatalf("unexpected diff (-want,+got):\n%s", diff)
+	}
+}
+
 // NOTE: do not delete this test once an older API is removed and there is only one API left.
-// Update the inline "gv" and "gvExperimental" variables, to have the GroupVersion String of
-// the API to be tested. If there are no experimental APIs make "gvExperimental" point to
+// Update the inline "gv" and "gvNew" variables, to have the GroupVersion String of
+// the API to be tested. If there are no experimental APIs make "gvNew" point to
 // an non-experimental API.
 func TestValidateConfig(t *testing.T) {
 	var (
-		gv             = kubeadmapiv1old.SchemeGroupVersion.String()
-		gvExperimental = kubeadmapiv1.SchemeGroupVersion.String()
+		gv    = kubeadmapiv1old.SchemeGroupVersion.String()
+		gvNew = kubeadmapiv1.SchemeGroupVersion.String()
 	)
 	tests := []struct {
 		name              string
@@ -556,18 +681,8 @@ func TestValidateConfig(t *testing.T) {
 			cfg: dedent.Dedent(fmt.Sprintf(`
 			apiVersion: %s
 			kind: InitConfiguration
-			`, gvExperimental)),
-			expectedError:     false,
-			allowExperimental: true,
-		},
-		{
-			name: "invalid: experimental API",
-			cfg: dedent.Dedent(fmt.Sprintf(`
-			apiVersion: %s
-			kind: InitConfiguration
-			`, gvExperimental)),
-			expectedError:     true,
-			allowExperimental: false,
+			`, gvNew)),
+			expectedError: false,
 		},
 		{
 			name: "valid ResetConfiguration",
@@ -575,9 +690,8 @@ func TestValidateConfig(t *testing.T) {
 			apiVersion: %s
 			kind: ResetConfiguration
 			force: true
-			`, gvExperimental)),
-			expectedError:     false,
-			allowExperimental: true,
+			`, gvNew)),
+			expectedError: false,
 		},
 		{
 			name: "invalid field in ResetConfiguration",
@@ -585,18 +699,8 @@ func TestValidateConfig(t *testing.T) {
 			apiVersion: %s
 			kind: ResetConfiguration
 			foo: bar
-			`, gvExperimental)),
-			expectedError:     true,
-			allowExperimental: true,
-		},
-		{
-			name: "experimental API is not allowed in ResetConfiguration",
-			cfg: dedent.Dedent(fmt.Sprintf(`
-			apiVersion: %s
-			kind: ResetConfiguration
-			`, gvExperimental)),
-			expectedError:     true,
-			allowExperimental: false,
+			`, gvNew)),
+			expectedError: true,
 		},
 	}

--- a/cmd/kubeadm/app/util/config/initconfiguration.go
+++ b/cmd/kubeadm/app/util/config/initconfiguration.go
@@ -20,6 +20,7 @@ import (
 	"bytes"
 	"net"
 	"os"
+	"sort"
 	"strconv"
 	"strings"

@@ -37,7 +38,7 @@ import (
 	bootstraptokenv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/bootstraptoken/v1"
 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 	kubeadmscheme "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/scheme"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/validation"
 	"k8s.io/kubernetes/cmd/kubeadm/app/componentconfigs"
 	kubeadmconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
@@ -307,7 +308,19 @@ func documentMapToInitConfiguration(gvkmap kubeadmapi.DocumentMap, allowDeprecat
 	var initcfg *kubeadmapi.InitConfiguration
 	var clustercfg *kubeadmapi.ClusterConfiguration

-	for gvk, fileContent := range gvkmap {
+	// Sort the GVKs deterministically by GVK string.
+	// This allows ClusterConfiguration to be decoded first.
+	gvks := make([]schema.GroupVersionKind, 0, len(gvkmap))
+	for gvk := range gvkmap {
+		gvks = append(gvks, gvk)
+	}
+	sort.Slice(gvks, func(i, j int) bool {
+		return gvks[i].String() < gvks[j].String()
+	})
+
+	for _, gvk := range gvks {
+		fileContent := gvkmap[gvk]
+
 		// first, check if this GVK is supported and possibly not deprecated
 		if err := validateSupportedVersion(gvk.GroupVersion(), allowDeprecated, allowExperimental); err != nil {
 			return nil, err
--- a/cmd/kubeadm/app/util/config/initconfiguration_test.go
+++ b/cmd/kubeadm/app/util/config/initconfiguration_test.go
@@ -28,7 +28,7 @@ import (
 	"sigs.k8s.io/yaml"

 	"k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 )

@@ -79,6 +79,15 @@ kubernetesVersion: %s`, kubeadmapiv1.SchemeGroupVersion.String(), certDir, const
 				cfgFiles["Kubelet_componentconfig"],
 			}, []byte(constants.YAMLDocumentSeparator)),
 		},
+		{
+			name: "v1beta4.full",
+			fileContents: bytes.Join([][]byte{
+				cfgFiles["InitConfiguration_v1beta4"],
+				cfgFiles["ClusterConfiguration_v1beta4"],
+				cfgFiles["Kube-proxy_componentconfig"],
+				cfgFiles["Kubelet_componentconfig"],
+			}, []byte(constants.YAMLDocumentSeparator)),
+		},
 	}

 	for _, rt := range tests {
--- a/cmd/kubeadm/app/util/config/joinconfiguration.go
+++ b/cmd/kubeadm/app/util/config/joinconfiguration.go
@@ -26,7 +26,7 @@ import (

 	kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
 	kubeadmscheme "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/scheme"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/validation"
 	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	kubeadmutil "k8s.io/kubernetes/cmd/kubeadm/app/util"
--- a/cmd/kubeadm/app/util/config/joinconfiguration_test.go
+++ b/cmd/kubeadm/app/util/config/joinconfiguration_test.go
@@ -43,17 +43,17 @@ func TestLoadJoinConfigurationFromFile(t *testing.T) {
 			expectErr: true,
 		},
 		{
-			name: "Invalid v1beta3 causes error",
+			name: "Invalid v1beta4 causes error",
 			fileContents: dedent.Dedent(`
-				apiVersion: kubeadm.k8s.io/v1beta3
+				apiVersion: kubeadm.k8s.io/v1beta4
 				kind: JoinConfiguration
 			`),
 			expectErr: true,
 		},
 		{
-			name: "valid v1beta3 is loaded",
+			name: "valid v1beta4 is loaded",
 			fileContents: dedent.Dedent(`
-				apiVersion: kubeadm.k8s.io/v1beta3
+				apiVersion: kubeadm.k8s.io/v1beta4
 				kind: JoinConfiguration
 				caCertPath: /etc/kubernetes/pki/ca.crt
 				nodeRegistration:
--- a/cmd/kubeadm/app/util/config/strict/strict_test.go
+++ b/cmd/kubeadm/app/util/config/strict/strict_test.go
@@ -27,7 +27,7 @@ import (
 	kubeletconfigv1beta1 "k8s.io/kubelet/config/v1beta1"

 	kubeadmscheme "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/scheme"
-	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
+	kubeadmapiv1 "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta4"
 	"k8s.io/kubernetes/cmd/kubeadm/app/componentconfigs"
 	"k8s.io/kubernetes/cmd/kubeadm/app/constants"
 	"k8s.io/kubernetes/cmd/kubeadm/app/util/config/strict"
--- a/cmd/kubeadm/app/util/config/strict/testdata/invalid_casesensitive_field.yaml
+++ b/cmd/kubeadm/app/util/config/strict/testdata/invalid_casesensitive_field.yaml
@@ -1,3 +1,3 @@
-apiVersion: kubeadm.k8s.io/v1beta3
+apiVersion: kubeadm.k8s.io/v1beta4
 kind: ClusterConfiguration
 ControlPlaneEndpoint: test1
--- a/cmd/kubeadm/app/util/config/strict/testdata/invalid_duplicate_field_clustercfg.yaml
+++ b/cmd/kubeadm/app/util/config/strict/testdata/invalid_duplicate_field_clustercfg.yaml
@@ -1,4 +1,4 @@
-apiVersion: kubeadm.k8s.io/v1beta3
+apiVersion: kubeadm.k8s.io/v1beta4
 kind: ClusterConfiguration
 controlPlaneEndpoint: test1
 controlPlaneEndpoint: test2
--- a/cmd/kubeadm/app/util/config/strict/testdata/invalid_duplicate_field_initcfg.yaml
+++ b/cmd/kubeadm/app/util/config/strict/testdata/invalid_duplicate_field_initcfg.yaml
@@ -1,4 +1,4 @@
-apiVersion: kubeadm.k8s.io/v1beta3
+apiVersion: kubeadm.k8s.io/v1beta4
 kind: InitConfiguration
 bootstrapTokens:
 - token: "9a08jv.c0izixklcxtmnze7"
--- a/cmd/kubeadm/app/util/config/strict/testdata/invalid_duplicate_field_joincfg.yaml
+++ b/cmd/kubeadm/app/util/config/strict/testdata/invalid_duplicate_field_joincfg.yaml
@@ -1,4 +1,4 @@
-apiVersion: kubeadm.k8s.io/v1beta3
+apiVersion: kubeadm.k8s.io/v1beta4
 kind: JoinConfiguration
 caCertPath: relativepath
 caCertPath: relativepath
--- a/cmd/kubeadm/app/util/config/strict/testdata/invalid_unknown_field_clustercfg.yaml
+++ b/cmd/kubeadm/app/util/config/strict/testdata/invalid_unknown_field_clustercfg.yaml
@@ -1,3 +1,3 @@
-apiVersion: kubeadm.k8s.io/v1beta3
+apiVersion: kubeadm.k8s.io/v1beta4
 kind: ClusterConfiguration
 unknownField: test
--- a/cmd/kubeadm/app/util/config/strict/testdata/invalid_unknown_field_initcfg.yaml
+++ b/cmd/kubeadm/app/util/config/strict/testdata/invalid_unknown_field_initcfg.yaml
@@ -1,3 +1,3 @@
-apiVersion: kubeadm.k8s.io/v1beta3
+apiVersion: kubeadm.k8s.io/v1beta4
 kind: InitConfiguration
 unknownField: test
--- a/cmd/kubeadm/app/util/config/strict/testdata/invalid_unknown_field_joincfg.yaml
+++ b/cmd/kubeadm/app/util/config/strict/testdata/invalid_unknown_field_joincfg.yaml
@@ -1,3 +1,3 @@
-apiVersion: kubeadm.k8s.io/v1beta3
+apiVersion: kubeadm.k8s.io/v1beta4
 kind: JoinConfiguration
 unknownField: test
--- a/cmd/kubeadm/app/util/config/strict/testdata/valid_clustercfg.yaml
+++ b/cmd/kubeadm/app/util/config/strict/testdata/valid_clustercfg.yaml
@@ -1,3 +1,3 @@
-apiVersion: kubeadm.k8s.io/v1beta3
+apiVersion: kubeadm.k8s.io/v1beta4
 kind: ClusterConfiguration
 controlPlaneEndpoint: 202.0.100.1
--- a/cmd/kubeadm/app/util/config/strict/testdata/valid_initcfg.yaml
+++ b/cmd/kubeadm/app/util/config/strict/testdata/valid_initcfg.yaml
@@ -1,4 +1,4 @@
-apiVersion: kubeadm.k8s.io/v1beta3
+apiVersion: kubeadm.k8s.io/v1beta4
 kind: InitConfiguration
 bootstrapTokens:
 - token: "9a08jv.c0izixklcxtmnze7"
--- a/cmd/kubeadm/app/util/config/strict/testdata/valid_joincfg.yaml
+++ b/cmd/kubeadm/app/util/config/strict/testdata/valid_joincfg.yaml
@@ -1,3 +1,3 @@
-apiVersion: kubeadm.k8s.io/v1beta3
+apiVersion: kubeadm.k8s.io/v1beta4
 kind: JoinConfiguration
 caCertPath: relativepath
--- a/cmd/kubeadm/test/cmd/init_test.go
+++ b/cmd/kubeadm/test/cmd/init_test.go
@@ -155,6 +155,11 @@ func TestCmdInitConfig(t *testing.T) {
 			args:     "--config=testdata/init/v1beta3.yaml",
 			expected: true,
 		},
+		{
+			name:     "can load v1beta4 config",
+			args:     "--config=testdata/init/v1beta4.yaml",
+			expected: true,
+		},
 		{
 			name:     "don't allow mixed arguments v1beta3",
 			args:     "--kubernetes-version=1.11.0 --config=testdata/init/v1beta3.yaml",
--- a/cmd/kubeadm/test/cmd/testdata/init/current-component-config.yaml
+++ b/cmd/kubeadm/test/cmd/testdata/init/current-component-config.yaml
@@ -1,4 +1,4 @@
-apiVersion: kubeadm.k8s.io/v1beta3
+apiVersion: kubeadm.k8s.io/v1beta4
 kind: ClusterConfiguration
 ---
 apiVersion: kubelet.config.k8s.io/v1beta1
--- a/cmd/kubeadm/test/cmd/testdata/init/old-component-config.yaml
+++ b/cmd/kubeadm/test/cmd/testdata/init/old-component-config.yaml
@@ -1,4 +1,4 @@
-apiVersion: kubeadm.k8s.io/v1beta3
+apiVersion: kubeadm.k8s.io/v1beta4
 kind: ClusterConfiguration
 ---
 apiVersion: kubelet.config.k8s.io/v1alpha1
--- a/cmd/kubeadm/test/cmd/testdata/init/v1beta4.yaml
+++ b/cmd/kubeadm/test/cmd/testdata/init/v1beta4.yaml
@@ -0,0 +1,2 @@
+apiVersion: kubeadm.k8s.io/v1beta4
+kind: InitConfiguration