CKA — Upgrade Control Plane

Control Plane Upgrade Steps

The control plane is always upgraded first, before any worker nodes.

Step 1 — Upgrade kubeadm

sudo apt-mark unhold kubeadm

# Update repository to target version
curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.30/deb/Release.key \
  | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg

echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.30/deb/ /' \
  | sudo tee /etc/apt/sources.list.d/kubernetes.list

sudo apt-get update
sudo apt-get install -y kubeadm=1.30.0-1.1
sudo apt-mark hold kubeadm

# Verify
kubeadm version

Step 2 — Plan the Upgrade

sudo kubeadm upgrade plan

This command:

• Checks the current cluster version
• Shows available upgrade versions
• Validates all components are healthy
• Warns about any issues

Step 3 — Apply the Upgrade

sudo kubeadm upgrade apply v1.30.0

This upgrades:

• kube-apiserver
• kube-controller-manager
• kube-scheduler
• kube-proxy
• CoreDNS
• etcd

Note: This does NOT upgrade kubelet or kubectl. You must do those manually.

Step 4 — Drain the Control Plane Node

kubectl drain <controlplane-node> --ignore-daemonsets --delete-emptydir-data

Step 5 — Upgrade kubelet and kubectl

sudo apt-mark unhold kubelet kubectl
sudo apt-get update
sudo apt-get install -y kubelet=1.30.0-1.1 kubectl=1.30.0-1.1
sudo apt-mark hold kubelet kubectl

# Restart kubelet
sudo systemctl daemon-reload
sudo systemctl restart kubelet

Step 6 — Uncordon the Control Plane

kubectl uncordon <controlplane-node>

Step 7 — Verify

kubectl get nodes
# controlplane   Ready   control-plane   ...   v1.30.0

What Gets Upgraded

Component	Upgraded by kubeadm upgrade apply	Upgraded manually
kube-apiserver	Yes
kube-controller-manager	Yes
kube-scheduler	Yes
kube-proxy	Yes
CoreDNS	Yes
etcd	Yes
kubelet		Yes
kubectl		Yes

---

Next: Upgrade Worker Nodes ->