Upgrade hop
Kubernetes 1.25 → 1.26
1.26 is itself end of life. If you are on 1.25 today, plan the whole path to a supported version (at least 1.35) with the upgrade planner.
1 · Fix removed APIs first
3 kinds stop being served in 1.26. Update manifests, charts and controllers to the replacement versions while the cluster still runs 1.25: the replacements are already served there.
| Kind | API version | Stops being served | Use instead |
|---|---|---|---|
| HorizontalPodAutoscaler | autoscaling/v2beta2 | 1.26 | autoscaling/v2 |
| FlowSchema | flowcontrol.apiserver.k8s.io/v1beta1 | 1.26 | flowcontrol.apiserver.k8s.io/v1 |
| PriorityLevelConfiguration | flowcontrol.apiserver.k8s.io/v1beta1 | 1.26 | flowcontrol.apiserver.k8s.io/v1 |
Field-level changes for each of these are on the API pages and in the official Deprecated API Migration Guide.
Check your files with the manifest checker; in a live cluster, the API server metric apiserver_requested_deprecated_apis shows which deprecated APIs clients still call.
2 · Other changes that can bite
Removed in 1.26
- CRI v1alpha2 support was removed from the kubelet; container runtimes must speak CRI v1 (containerd 1.6.0+).
- flowcontrol.apiserver.k8s.io/v1beta1 FlowSchema and PriorityLevelConfiguration are no longer served; move to v1beta2.
- autoscaling/v2beta2 HorizontalPodAutoscaler is no longer served; use autoscaling/v2.
- The in-tree GlusterFS volume plugin was removed.
- The in-tree OpenStack Cinder storage integration was removed; use the external cloud-provider-openstack and its CSI driver.
- kube-proxy's userspace mode was removed on Linux and Windows; --mode userspace now fails.
- Built-in Azure and Google Cloud authentication code was removed from client-go and kubectl; use credential plugins.
- Dynamic kubelet configuration was removed from the API server, and previously deprecated logging command-line flags were removed.
Deprecated in 1.26
- kubectl's --prune-whitelist flag is deprecated in favour of --prune-allowlist.
- The kube-apiserver --master-service-namespace flag, which had no effect, is formally deprecated.
- Unused kubectl run flags such as --cascade, --filename, --force, --grace-period, --kustomize, --recursive, --timeout and --wait are deprecated.
Our summary of the 1.26 release announcement (CC BY 4.0). Read the full changelog for your components.
3 · Upgrade in this order
- Prepare. Move every node to 1.24 or newer if any are older: a 1.26 API server supports kubelets back to 1.24 only. Upgrade to the newest 1.25 patch,
1.25.16. - kube-apiserver to 1.26 (in HA clusters, one instance at a time; old and new may differ by one minor during the roll). Use the newest patch,
1.26.15. - kube-controller-manager, kube-scheduler, cloud-controller-manager to 1.26, once every API server is on 1.26.
- kubelet on each node (drain first). Optional in this hop: kubelets from 1.24 to 1.26 all work with a 1.26 control plane.
- kube-proxy: no newer than the API server, and within the same window as the kubelet it runs beside.
- kubectl: 1.25 to 1.27 all talk to a 1.26 API server.
From the official version skew policy. Managed services run the control-plane steps for you; node pools are still yours to schedule.