Kubernetes skew: how far can a kubelet lag?
The Kubernetes version skew policy sets the limits. kubelet must not be newer than kube-apiserver, and it may be up to three minor versions older. kubectl is supported within one minor version, older or newer.
| kube-apiserver | kubelet | kubectl |
|---|---|---|
| 1.37 | 1.37, 1.36, 1.35, 1.34 | 1.38, 1.37, 1.36 |
Example
Illustrative. The control plane is on 1.36 and a node pool on 1.33: that's 3 minor versions, so it's inside the policy. Move the control plane to 1.37 first and the same pool is 4 behind and outside it. Upgrade the pool before the next control plane step.
Important
In an HA cluster, kube-apiserver instances must be within one minor version of each other. While they differ, the older instance sets the limit: with 1.37 and 1.36, kubelet 1.37 is not supported. The project keeps release branches for the most recent 3 minor releases, so a legal skew can still mean an unsupported version.
Before the next upgrade
- ☐ List apiserver version per cluster
- ☐ List kubelet version per node pool
- ☐ Count the minor versions between them
- ☐ Put node pools before the next control plane step
Gantt chart — lay out the upgrade order →
Source: kubernetes.io, Version Skew Policy.