Upgrade hop
Kubernetes 1.26 → 1.27
1.27 is itself end of life. If you are on 1.26 today, plan the whole path to a supported version (at least 1.35) with the upgrade planner.
1 · Fix removed APIs first
1 kind stops being served in 1.27. Update manifests, charts and controllers to the replacement versions while the cluster still runs 1.26: the replacements are already served there.
| Kind | API version | Stops being served | Use instead |
|---|---|---|---|
| CSIStorageCapacity | storage.k8s.io/v1beta1 | 1.27 | storage.k8s.io/v1 |
Field-level changes for each of these are on the API pages and in the official Deprecated API Migration Guide.
Check your files with the manifest checker; in a live cluster, the API server metric apiserver_requested_deprecated_apis shows which deprecated APIs clients still call.
2 · Other changes that can bite
Removed in 1.27
- storage.k8s.io/v1beta1 CSIStorageCapacity is no longer served; use storage.k8s.io/v1.
- Support for the alpha seccomp annotations was removed; set securityContext.seccompProfile instead.
- kube-apiserver --master-service-namespace was removed.
- kube-controller-manager --enable-taint-manager and --pod-eviction-timeout were removed; taint-based eviction stays on.
- Feature gates for features already GA were removed, including CSIMigration, CSIInlineVolume, EphemeralContainers, LocalStorageCapacityIsolation, NetworkPolicyEndPort, IdentifyPodOS, DaemonSetUpdateSurge and ControllerManagerLeaderMigration.
Deprecated in 1.27
- The SecurityContextDeny admission plugin was deprecated in this release (stated in the 1.30 announcement, which removed it).
Our summary of the 1.27 release announcement (CC BY 4.0). Read the full changelog for your components.
3 · Upgrade in this order
- Prepare. Move every node to 1.25 or newer if any are older: a 1.27 API server supports kubelets back to 1.25 only. Upgrade to the newest 1.26 patch,
1.26.15. - kube-apiserver to 1.27 (in HA clusters, one instance at a time; old and new may differ by one minor during the roll). Use the newest patch,
1.27.16. - kube-controller-manager, kube-scheduler, cloud-controller-manager to 1.27, once every API server is on 1.27.
- kubelet on each node (drain first). Optional in this hop: kubelets from 1.25 to 1.27 all work with a 1.27 control plane.
- kube-proxy: no newer than the API server, and within the same window as the kubelet it runs beside.
- kubectl: 1.26 to 1.28 all talk to a 1.27 API server.
From the official version skew policy. Managed services run the control-plane steps for you; node pools are still yours to schedule.