diff --git a/hack/kind-up.sh b/hack/kind-up.sh
index c60eb4c7..6b6055b6 100755
--- a/hack/kind-up.sh
+++ b/hack/kind-up.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-# Copyright 2020-2022 the Pinniped contributors. All Rights Reserved.
+# Copyright 2020-2023 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
 set -euo pipefail
@@ -8,6 +8,6 @@ set -euo pipefail
 ROOT="$( cd "$( dirname "${BASH_SOURCE[0]}" )/.." && pwd )"
 cd "${ROOT}"
 
-# To choose a specific version of kube, add this option to the command below: `--image kindest/node:v1.18.8`.
+# To choose a specific version of kube, add this option to the command below: `--image kindest/node:v1.28.0`.
 # To debug the kind config, add this option to the command below: `-v 10`
 kind create cluster --config "hack/lib/kind-config/single-node.yaml" --name pinniped
diff --git a/hack/lib/update-codegen.sh b/hack/lib/update-codegen.sh
index 3b6af486..fdf2a8d1 100755
--- a/hack/lib/update-codegen.sh
+++ b/hack/lib/update-codegen.sh
@@ -47,15 +47,15 @@ ln -s "${ROOT}" "${GOPATH_ROOT}"
 ROOT="${GOPATH_ROOT}"
 cd "${ROOT}"
 
-# KUBE_VERSION is the full version (e.g., '1.19.0-rc.0').
+# KUBE_VERSION is the full version (e.g., '1.28.0-rc.0').
 KUBE_VERSION="${KUBE_VERSIONS[0]}"
 export KUBE_VERSION
 
-# KUBE_MINOR_VERSION is just the major/minor version (e.g., '1.19').
+# KUBE_MINOR_VERSION is just the major/minor version (e.g., '1.28').
 KUBE_MINOR_VERSION="$(echo "${KUBE_VERSION}" | cut -d"." -f1-2)"
 export KUBE_MINOR_VERSION
 
-# KUBE_MODULE_VERSION is just version of client libraries (e.g., 'v0.19.9-rc-0').
+# KUBE_MODULE_VERSION is just version of client libraries (e.g., 'v0.28.9-rc-0').
 KUBE_MODULE_VERSION="v0.$(echo "${KUBE_VERSION}" | cut -d '.' -f 2-)"
 export KUBE_MODULE_VERSION
 
diff --git a/hack/prepare-for-integration-tests.sh b/hack/prepare-for-integration-tests.sh
index 5db8ec97..921812e0 100755
--- a/hack/prepare-for-integration-tests.sh
+++ b/hack/prepare-for-integration-tests.sh
@@ -150,9 +150,9 @@ check_dependency htpasswd "Please install htpasswd. Should be pre-installed on M
 check_dependency openssl "Please install openssl. Should be pre-installed on MacOS."
 check_dependency nmap "Please install nmap. e.g. 'brew install nmap' for MacOS"
 
-# Require kubectl >= 1.18.x.
-if [ "$(kubectl version --client=true -o=json | grep gitVersion | cut -d '.' -f 2)" -lt 18 ]; then
-  log_error "kubectl >= 1.18.x is required, you have $(kubectl version --client=true --short | cut -d ':' -f2)"
+# Require kubectl >= 1.21.x.
+if [ "$(kubectl version --client=true -o=json | grep gitVersion | cut -d '.' -f 2)" -lt 21 ]; then
+  log_error "kubectl >= 1.21.x is required, you have $(kubectl version --client=true --short | cut -d ':' -f2)"
   exit 1
 fi
 
diff --git a/internal/clusterhost/clusterhost.go b/internal/clusterhost/clusterhost.go
index bfdbd6c7..32cea0a1 100644
--- a/internal/clusterhost/clusterhost.go
+++ b/internal/clusterhost/clusterhost.go
@@ -1,4 +1,4 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package clusterhost
@@ -15,7 +15,10 @@ const (
 	labelNodeRolePrefix  = "node-role.kubernetes.io/"
 	nodeLabelRole        = "kubernetes.io/node-role"
 	controlPlaneNodeRole = "control-plane"
-	// this role was deprecated by kubernetes 1.20.
+	// This role was deprecated by Kubernetes 1.20.
+	// https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.20.md#urgent-upgrade-notes
+	// This role will be removed in Kubernetes 1.24
+	// https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#urgent-upgrade-notes
 	masterNodeRole = "master"
 )