|
|
|
@ -24,7 +24,7 @@ Kubernetes versions are expressed as **x.y.z**,
|
|
|
|
|
where **x** is the major version, **y** is the minor version, and **z** is the patch version, following [Semantic Versioning](https://semver.org/) terminology.
|
|
|
|
|
For more information, see [Kubernetes Release Versioning](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/release/versioning.md#kubernetes-release-versioning).
|
|
|
|
|
|
|
|
|
|
The Kubernetes project maintains release branches for the most recent three minor releases ({{< skew latestVersion >}}, {{< skew prevMinorVersion >}}, {{< skew oldestMinorVersion >}}). Kubernetes 1.19 and newer receive approximately 1 year of patch support. Kubernetes 1.18 and older received approximately 9 months of patch support.
|
|
|
|
|
The Kubernetes project maintains release branches for the most recent three minor releases ({{< skew currentVersion >}}, {{< skew currentVersionAddMinor -1 >}}, {{< skew currentVersionAddMinor -2 >}}). Kubernetes 1.19 and newer receive approximately 1 year of patch support. Kubernetes 1.18 and older received approximately 9 months of patch support.
|
|
|
|
|
|
|
|
|
|
Applicable fixes, including security fixes, may be backported to those three release branches, depending on severity and feasibility.
|
|
|
|
|
Patch releases are cut from those branches at a [regular cadence](https://git.k8s.io/sig-release/releases/patch-releases.md#cadence), plus additional urgent releases, when required.
|
|
|
|
@ -41,8 +41,8 @@ In [highly-available (HA) clusters](/docs/setup/production-environment/tools/kub
|
|
|
|
|
|
|
|
|
|
Example:
|
|
|
|
|
|
|
|
|
|
* newest `kube-apiserver` is at **{{< skew latestVersion >}}**
|
|
|
|
|
* other `kube-apiserver` instances are supported at **{{< skew latestVersion >}}** and **{{< skew prevMinorVersion >}}**
|
|
|
|
|
* newest `kube-apiserver` is at **{{< skew currentVersion >}}**
|
|
|
|
|
* other `kube-apiserver` instances are supported at **{{< skew currentVersion >}}** and **{{< skew currentVersionAddMinor -1 >}}**
|
|
|
|
|
|
|
|
|
|
### kubelet
|
|
|
|
|
|
|
|
|
@ -50,8 +50,8 @@ Example:
|
|
|
|
|
|
|
|
|
|
Example:
|
|
|
|
|
|
|
|
|
|
* `kube-apiserver` is at **{{< skew latestVersion >}}**
|
|
|
|
|
* `kubelet` is supported at **{{< skew latestVersion >}}**, **{{< skew prevMinorVersion >}}**, and **{{< skew oldestMinorVersion >}}**
|
|
|
|
|
* `kube-apiserver` is at **{{< skew currentVersion >}}**
|
|
|
|
|
* `kubelet` is supported at **{{< skew currentVersion >}}**, **{{< skew currentVersionAddMinor -1 >}}**, and **{{< skew currentVersionAddMinor -2 >}}**
|
|
|
|
|
|
|
|
|
|
{{< note >}}
|
|
|
|
|
If version skew exists between `kube-apiserver` instances in an HA cluster, this narrows the allowed `kubelet` versions.
|
|
|
|
@ -59,8 +59,8 @@ If version skew exists between `kube-apiserver` instances in an HA cluster, this
|
|
|
|
|
|
|
|
|
|
Example:
|
|
|
|
|
|
|
|
|
|
* `kube-apiserver` instances are at **{{< skew latestVersion >}}** and **{{< skew prevMinorVersion >}}**
|
|
|
|
|
* `kubelet` is supported at **{{< skew prevMinorVersion >}}**, and **{{< skew oldestMinorVersion >}}** (**{{< skew latestVersion >}}** is not supported because that would be newer than the `kube-apiserver` instance at version **{{< skew prevMinorVersion >}}**)
|
|
|
|
|
* `kube-apiserver` instances are at **{{< skew currentVersion >}}** and **{{< skew currentVersionAddMinor -1 >}}**
|
|
|
|
|
* `kubelet` is supported at **{{< skew currentVersionAddMinor -1 >}}**, and **{{< skew currentVersionAddMinor -2 >}}** (**{{< skew currentVersion >}}** is not supported because that would be newer than the `kube-apiserver` instance at version **{{< skew currentVersionAddMinor -1 >}}**)
|
|
|
|
|
|
|
|
|
|
### kube-controller-manager, kube-scheduler, and cloud-controller-manager
|
|
|
|
|
|
|
|
|
@ -68,8 +68,8 @@ Example:
|
|
|
|
|
|
|
|
|
|
Example:
|
|
|
|
|
|
|
|
|
|
* `kube-apiserver` is at **{{< skew latestVersion >}}**
|
|
|
|
|
* `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` are supported at **{{< skew latestVersion >}}** and **{{< skew prevMinorVersion >}}**
|
|
|
|
|
* `kube-apiserver` is at **{{< skew currentVersion >}}**
|
|
|
|
|
* `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` are supported at **{{< skew currentVersion >}}** and **{{< skew currentVersionAddMinor -1 >}}**
|
|
|
|
|
|
|
|
|
|
{{< note >}}
|
|
|
|
|
If version skew exists between `kube-apiserver` instances in an HA cluster, and these components can communicate with any `kube-apiserver` instance in the cluster (for example, via a load balancer), this narrows the allowed versions of these components.
|
|
|
|
@ -77,9 +77,9 @@ If version skew exists between `kube-apiserver` instances in an HA cluster, and
|
|
|
|
|
|
|
|
|
|
Example:
|
|
|
|
|
|
|
|
|
|
* `kube-apiserver` instances are at **{{< skew latestVersion >}}** and **{{< skew prevMinorVersion >}}**
|
|
|
|
|
* `kube-apiserver` instances are at **{{< skew currentVersion >}}** and **{{< skew currentVersionAddMinor -1 >}}**
|
|
|
|
|
* `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` communicate with a load balancer that can route to any `kube-apiserver` instance
|
|
|
|
|
* `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` are supported at **{{< skew prevMinorVersion >}}** (**{{< skew latestVersion >}}** is not supported because that would be newer than the `kube-apiserver` instance at version **{{< skew prevMinorVersion >}}**)
|
|
|
|
|
* `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` are supported at **{{< skew currentVersionAddMinor -1 >}}** (**{{< skew currentVersion >}}** is not supported because that would be newer than the `kube-apiserver` instance at version **{{< skew currentVersionAddMinor -1 >}}**)
|
|
|
|
|
|
|
|
|
|
### kubectl
|
|
|
|
|
|
|
|
|
@ -87,8 +87,8 @@ Example:
|
|
|
|
|
|
|
|
|
|
Example:
|
|
|
|
|
|
|
|
|
|
* `kube-apiserver` is at **{{< skew latestVersion >}}**
|
|
|
|
|
* `kubectl` is supported at **{{< skew nextMinorVersion >}}**, **{{< skew latestVersion >}}**, and **{{< skew prevMinorVersion >}}**
|
|
|
|
|
* `kube-apiserver` is at **{{< skew currentVersion >}}**
|
|
|
|
|
* `kubectl` is supported at **{{< skew currentVersionAddMinor 1 >}}**, **{{< skew currentVersion >}}**, and **{{< skew currentVersionAddMinor -1 >}}**
|
|
|
|
|
|
|
|
|
|
{{< note >}}
|
|
|
|
|
If version skew exists between `kube-apiserver` instances in an HA cluster, this narrows the supported `kubectl` versions.
|
|
|
|
@ -96,27 +96,27 @@ If version skew exists between `kube-apiserver` instances in an HA cluster, this
|
|
|
|
|
|
|
|
|
|
Example:
|
|
|
|
|
|
|
|
|
|
* `kube-apiserver` instances are at **{{< skew latestVersion >}}** and **{{< skew prevMinorVersion >}}**
|
|
|
|
|
* `kubectl` is supported at **{{< skew latestVersion >}}** and **{{< skew prevMinorVersion >}}** (other versions would be more than one minor version skewed from one of the `kube-apiserver` components)
|
|
|
|
|
* `kube-apiserver` instances are at **{{< skew currentVersion >}}** and **{{< skew currentVersionAddMinor -1 >}}**
|
|
|
|
|
* `kubectl` is supported at **{{< skew currentVersion >}}** and **{{< skew currentVersionAddMinor -1 >}}** (other versions would be more than one minor version skewed from one of the `kube-apiserver` components)
|
|
|
|
|
|
|
|
|
|
## Supported component upgrade order
|
|
|
|
|
|
|
|
|
|
The supported version skew between components has implications on the order in which components must be upgraded.
|
|
|
|
|
This section describes the order in which components must be upgraded to transition an existing cluster from version **{{< skew prevMinorVersion >}}** to version **{{< skew latestVersion >}}**.
|
|
|
|
|
This section describes the order in which components must be upgraded to transition an existing cluster from version **{{< skew currentVersionAddMinor -1 >}}** to version **{{< skew currentVersion >}}**.
|
|
|
|
|
|
|
|
|
|
### kube-apiserver
|
|
|
|
|
|
|
|
|
|
Pre-requisites:
|
|
|
|
|
|
|
|
|
|
* In a single-instance cluster, the existing `kube-apiserver` instance is **{{< skew prevMinorVersion >}}**
|
|
|
|
|
* In an HA cluster, all `kube-apiserver` instances are at **{{< skew prevMinorVersion >}}** or **{{< skew latestVersion >}}** (this ensures maximum skew of 1 minor version between the oldest and newest `kube-apiserver` instance)
|
|
|
|
|
* The `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` instances that communicate with this server are at version **{{< skew prevMinorVersion >}}** (this ensures they are not newer than the existing API server version, and are within 1 minor version of the new API server version)
|
|
|
|
|
* `kubelet` instances on all nodes are at version **{{< skew prevMinorVersion >}}** or **{{< skew oldestMinorVersion >}}** (this ensures they are not newer than the existing API server version, and are within 2 minor versions of the new API server version)
|
|
|
|
|
* In a single-instance cluster, the existing `kube-apiserver` instance is **{{< skew currentVersionAddMinor -1 >}}**
|
|
|
|
|
* In an HA cluster, all `kube-apiserver` instances are at **{{< skew currentVersionAddMinor -1 >}}** or **{{< skew currentVersion >}}** (this ensures maximum skew of 1 minor version between the oldest and newest `kube-apiserver` instance)
|
|
|
|
|
* The `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` instances that communicate with this server are at version **{{< skew currentVersionAddMinor -1 >}}** (this ensures they are not newer than the existing API server version, and are within 1 minor version of the new API server version)
|
|
|
|
|
* `kubelet` instances on all nodes are at version **{{< skew currentVersionAddMinor -1 >}}** or **{{< skew currentVersionAddMinor -2 >}}** (this ensures they are not newer than the existing API server version, and are within 2 minor versions of the new API server version)
|
|
|
|
|
* Registered admission webhooks are able to handle the data the new `kube-apiserver` instance will send them:
|
|
|
|
|
* `ValidatingWebhookConfiguration` and `MutatingWebhookConfiguration` objects are updated to include any new versions of REST resources added in **{{< skew latestVersion >}}** (or use the [`matchPolicy: Equivalent` option](/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy) available in v1.15+)
|
|
|
|
|
* The webhooks are able to handle any new versions of REST resources that will be sent to them, and any new fields added to existing versions in **{{< skew latestVersion >}}**
|
|
|
|
|
* `ValidatingWebhookConfiguration` and `MutatingWebhookConfiguration` objects are updated to include any new versions of REST resources added in **{{< skew currentVersion >}}** (or use the [`matchPolicy: Equivalent` option](/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy) available in v1.15+)
|
|
|
|
|
* The webhooks are able to handle any new versions of REST resources that will be sent to them, and any new fields added to existing versions in **{{< skew currentVersion >}}**
|
|
|
|
|
|
|
|
|
|
Upgrade `kube-apiserver` to **{{< skew latestVersion >}}**
|
|
|
|
|
Upgrade `kube-apiserver` to **{{< skew currentVersion >}}**
|
|
|
|
|
|
|
|
|
|
{{< note >}}
|
|
|
|
|
Project policies for [API deprecation](/docs/reference/using-api/deprecation-policy/) and
|
|
|
|
@ -128,17 +128,17 @@ require `kube-apiserver` to not skip minor versions when upgrading, even in sing
|
|
|
|
|
|
|
|
|
|
Pre-requisites:
|
|
|
|
|
|
|
|
|
|
* The `kube-apiserver` instances these components communicate with are at **{{< skew latestVersion >}}** (in HA clusters in which these control plane components can communicate with any `kube-apiserver` instance in the cluster, all `kube-apiserver` instances must be upgraded before upgrading these components)
|
|
|
|
|
* The `kube-apiserver` instances these components communicate with are at **{{< skew currentVersion >}}** (in HA clusters in which these control plane components can communicate with any `kube-apiserver` instance in the cluster, all `kube-apiserver` instances must be upgraded before upgrading these components)
|
|
|
|
|
|
|
|
|
|
Upgrade `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` to **{{< skew latestVersion >}}**
|
|
|
|
|
Upgrade `kube-controller-manager`, `kube-scheduler`, and `cloud-controller-manager` to **{{< skew currentVersion >}}**
|
|
|
|
|
|
|
|
|
|
### kubelet
|
|
|
|
|
|
|
|
|
|
Pre-requisites:
|
|
|
|
|
|
|
|
|
|
* The `kube-apiserver` instances the `kubelet` communicates with are at **{{< skew latestVersion >}}**
|
|
|
|
|
* The `kube-apiserver` instances the `kubelet` communicates with are at **{{< skew currentVersion >}}**
|
|
|
|
|
|
|
|
|
|
Optionally upgrade `kubelet` instances to **{{< skew latestVersion >}}** (or they can be left at **{{< skew prevMinorVersion >}}** or **{{< skew oldestMinorVersion >}}**)
|
|
|
|
|
Optionally upgrade `kubelet` instances to **{{< skew currentVersion >}}** (or they can be left at **{{< skew currentVersionAddMinor -1 >}}** or **{{< skew currentVersionAddMinor -2 >}}**)
|
|
|
|
|
|
|
|
|
|
{{< note >}}
|
|
|
|
|
Before performing a minor version `kubelet` upgrade, [drain](/docs/tasks/administer-cluster/safely-drain-node/) pods from that node.
|
|
|
|
@ -160,7 +160,7 @@ Running a cluster with `kubelet` instances that are persistently two minor versi
|
|
|
|
|
|
|
|
|
|
Example:
|
|
|
|
|
|
|
|
|
|
If `kube-proxy` version is **{{< skew oldestMinorVersion >}}**:
|
|
|
|
|
If `kube-proxy` version is **{{< skew currentVersionAddMinor -2 >}}**:
|
|
|
|
|
|
|
|
|
|
* `kubelet` version must be at the same minor version as **{{< skew oldestMinorVersion >}}**.
|
|
|
|
|
* `kube-apiserver` version must be between **{{< skew oldestMinorVersion >}}** and **{{< skew latestVersion >}}**, inclusive.
|
|
|
|
|
* `kubelet` version must be at the same minor version as **{{< skew currentVersionAddMinor -2 >}}**.
|
|
|
|
|
* `kube-apiserver` version must be between **{{< skew currentVersionAddMinor -2 >}}** and **{{< skew currentVersion >}}**, inclusive.
|
|
|
|
|