CKA — Upgrade Worker Nodes

Worker Node Upgrade Process

Upgrade worker nodes one at a time after the control plane is fully upgraded. This ensures no downtime for applications with multiple replicas.

Step 1 — Drain the Worker Node

From the control plane:

kubectl drain <worker-node> --ignore-daemonsets --delete-emptydir-data

This safely evicts all Pods. Pods managed by Deployments and ReplicaSets are rescheduled to other nodes.

Step 2 — Upgrade kubeadm on the Worker

SSH to the worker node:

sudo apt-mark unhold kubeadm
sudo apt-get update
sudo apt-get install -y kubeadm=1.30.0-1.1
sudo apt-mark hold kubeadm

Step 3 — Upgrade the Node Configuration

sudo kubeadm upgrade node

On worker nodes, this upgrades the kubelet configuration. It does not run the full upgrade plan — that only runs on the control plane.

Step 4 — Upgrade kubelet and kubectl

sudo apt-mark unhold kubelet kubectl
sudo apt-get update
sudo apt-get install -y kubelet=1.30.0-1.1 kubectl=1.30.0-1.1
sudo apt-mark hold kubelet kubectl

sudo systemctl daemon-reload
sudo systemctl restart kubelet

Step 5 — Uncordon the Worker

From the control plane:

kubectl uncordon <worker-node>

Step 6 — Verify

kubectl get nodes
# worker01   Ready   <none>   ...   v1.30.0

Rolling Upgrade Strategy

Upgrade workers one at a time to maintain application availability:

Worker 1: Drain -> Upgrade -> Uncordon -> Verify
Worker 2: Drain -> Upgrade -> Uncordon -> Verify
Worker 3: Drain -> Upgrade -> Uncordon -> Verify

For clusters with many workers, you can upgrade multiple nodes simultaneously if your applications have enough replicas to tolerate the reduced capacity.

Key Differences: Control Plane vs Worker

Aspect	Control Plane	Worker Node
kubeadm command	kubeadm upgrade apply v1.30.0	kubeadm upgrade node
Upgrades components	API server, scheduler, CM, etcd, CoreDNS	kubelet configuration only
Order	First	After control plane
Drain from	Self (kubectl drain controlplane)	Control plane (kubectl drain worker)

---

Next: Verify Upgrade ->