- [`kops`](https://kops.sigs.k8s.io) defaults to 1.23.2, which will enable [Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) and require tokens on new clusters with Kubernetes >= 1.22. This will increase security by default, but may break some types of workloads. The default behaviour for `spec.kubeDNS.nodeLocalDNS.forwardToKubeDNS` has changed from `true` to `false`. Cilium now has `disable-cnp-status-updates: true` by default. Set this to false if you rely on the CiliumNetworkPolicy status fields. Support for Kubernetes 1.17, the Lyft CNI, Weave CNI on Kubernetes >= 1.23, CentOS 7 and 8, Debian 9, RHEL 7, and Ubuntu 16.05 (Xenial) has been removed. See the [1.22 release notes](https://kops.sigs.k8s.io/releases/1.22-notes/) and [1.23 release notes](https://kops.sigs.k8s.io/releases/1.23-notes/) for more details, including other significant changes.

- Mattermost has been upgraded to extended support version 6.3 as the previously
  packaged extended support version 5.37 is [reaching end of life](https://docs.mattermost.com/upgrade/extended-support-release.html).
  Migration may take some time, see the [changelog](https://docs.mattermost.com/install/self-managed-changelog.html#release-v6-3-extended-support-release)
  and [important upgrade notes](https://docs.mattermost.com/upgrade/important-upgrade-notes.html).

- The `writers.writePyPy2`/`writers.writePyPy3` and corresponding `writers.writePyPy2Bin`/`writers.writePyPy3Bin` convenience functions to create executable Python 2/3 scripts using the PyPy interpreter were added.

- Some improvements have been made to the `hadoop` module:
  - A `gatewayRole` option has been added, for deploying hadoop cluster configuration files to a node that does not have any active services
  - Support for older versions of hadoop have been added to the module
  - Overriding and extending site XML files has been made easier

- The auto-upgrade service now accepts persistent (default: true) parameter.
  By default auto-upgrade will now run immediately if it would have been triggered at least
  once during the time when the timer was inactive.

- Mastodon now uses `services.redis.servers` to start a new redis server, instead of using a global redis server.
  This improves compatibility with other services that use redis.

  Note that this will recreate the redis database, although according to the [Mastodon docs](https://docs.joinmastodon.org/admin/backups/),
  this is almost harmless:
  > Losing the Redis database is almost harmless: The only irrecoverable data will be the contents of the Sidekiq queues and scheduled retries of previously failed jobs.
  >  The home and list feeds are stored in Redis, but can be regenerated with tootctl.

  If you do want to save the redis database, you can use the following commands:
  ```bash
  redis-cli save
  cp /var/lib/redis/dump.rdb "/var/lib/redis-mastodon/dump.rdb"
  ```
- Peertube now uses services.redis.servers to start a new redis server, instead of using a global redis server.
  This improves compatibility with other services that use redis.

  Redis database is used for storage only cache and job queue. More information can be found here - [Peertube architecture](https://docs.joinpeertube.org/contribute-architecture).

  If you do want to save the redis database, you can use the following commands before upgrade OS:
  ```bash
  redis-cli save
  sudo mkdir /var/lib/redis-peertube
  sudo cp /var/lib/redis/dump.rdb /var/lib/redis-peertube/dump.rdb
  ```
- Added the `keter` NixOS module. Keter reverse proxies requests to your loaded application based on virtual hostnames.

- If you are using Wayland you can choose to use the Ozone Wayland support
  in Chrome and several Electron apps by setting the environment variable
  `NIXOS_OZONE_WL=1` (for example via
  `environment.sessionVariables.NIXOS_OZONE_WL = "1"`).
  This is not enabled by default because Ozone Wayland is
  still under heavy development and behavior is not always flawless.