{"asset": "kubernetes-version-skew-policy", "asset_type": "tolerance", "body": "The maximum version difference Kubernetes supports between cluster components, one record per governed component pair (kube-apiserver to kubelet, kube-proxy, kubectl, and the kube-controller-manager/kube-scheduler/cloud-controller-manager group, plus the kube-apiserver-to-kube-apiserver HA rule and the kube-proxy-to-kubelet rule), from the project's own version-skew-policy page. Answers 'how many minor versions behind can my kubelet be', 'can kubectl be newer than kube-apiserver', 'what must already be upgraded before I upgrade this component'. Getting this wrong during a rolling upgrade breaks node registration or blocks the upgrade path, usually discovered mid-rollout. The rule text is stable in structure release to release; the version numbers in the worked examples move with each Kubernetes minor release, so the numeric examples need re-verification on that cadence.\n", "description": "The maximum version difference Kubernetes supports between cluster components, one record per governed component pair (kube-apiserver to kubelet, kube-proxy, kubectl, and the kube-controller-manager/kube-scheduler/cloud-controller-manager group, plus the kube-apiserver-to-kube-apiserver HA rule and the kube-proxy-to-kubelet rule), from the project's own version-skew-policy page. Answers 'how many minor versions behind can my kubelet be', 'can kubectl be newer than kube-apiserver', 'what must already be upgraded before I upgrade this component'. Getting this wrong during a rolling upgrade breaks node registration or blocks the upgrade path, usually discovered mid-rollout. The rule text is stable in structure release to release; the version numbers in the worked examples move with each Kubernetes minor release, so the numeric examples need re-verification on that cadence.", "file": "index.md", "generated": true, "harvested": "2026-09-01", "key_field": "component_pair", "licence": "Source is the Kubernetes project's own documentation (kubernetes.io), a CNCF project. The page footer reads 'Documentation Distributed under CC BY 4.0'. We take the fact plus a short attributed quote linking back.", "sources": ["https://kubernetes.io/releases/version-skew-policy/"], "stale_after": "2026-12-30", "title": "Kubernetes component version skew policy: how far apart component versions can be in a supported cluster", "type": "dataset", "verified": false}
{"asset": "kubernetes-version-skew-policy", "body": "**Component pair:** kube-apiserver and kube-apiserver (HA instances)\n\n**Skew rule:** the newest and oldest kube-apiserver instances must be within one minor version\n\n**Max skew (minor versions):** 1\n\n**May the second component be newer?:** symmetric - the page bounds the gap between the newest and oldest instance without naming a governed side\n\n**Worked example:** newest kube-apiserver is at 1.37 other kube-apiserver instances are supported at 1.37 and 1.36\n\n> Example: newest kube-apiserver is at 1.37 other kube-apiserver instances are supported at 1.37 and 1.36\n\n**Newest release when captured:** 1.37\n\n> The Kubernetes project maintains release branches for the most recent three minor releases (1.37, 1.36, 1.35).\n\n**Upgrade prerequisite:** In a single-instance cluster, the existing kube-apiserver instance is 1.36 In an HA cluster, all kube-apiserver instances are at 1.36 or 1.37\n\n> Pre-requisites: In a single-instance cluster, the existing kube-apiserver instance is 1.36 In an HA cluster, all kube-apiserver instances are at 1.36 or 1.37 (this ensures maximum skew of 1 minor version between the oldest and newest kube-apiserver instance)\n\n> the newest and oldest kube-apiserver instances must be within one minor version.\n\nSource: <https://kubernetes.io/releases/version-skew-policy/>\n", "component_pair": "kube-apiserver and kube-apiserver (HA instances)", "current_minor_release": "1.37", "file": "kube-apiserver-and-kube-apiserver-ha-instances.md", "generated": true, "harvested": "2026-09-01", "id": "kube-apiserver-and-kube-apiserver-ha-instances", "max_skew_minor_versions": "1", "newer_component_allowed": "symmetric - the page bounds the gap between the newest and oldest instance without naming a governed side", "quote_current_minor_release": "The Kubernetes project maintains release branches for the most recent three minor releases (1.37, 1.36, 1.35).", "quote_upgrade_prerequisite": "Pre-requisites: In a single-instance cluster, the existing kube-apiserver instance is 1.36 In an HA cluster, all kube-apiserver instances are at 1.36 or 1.37 (this ensures maximum skew of 1 minor version between the oldest and newest kube-apiserver instance)", "quote_worked_example": "Example: newest kube-apiserver is at 1.37 other kube-apiserver instances are supported at 1.37 and 1.36", "skew_rule": "the newest and oldest kube-apiserver instances must be within one minor version", "source_quote": "the newest and oldest kube-apiserver instances must be within one minor version.", "sources": ["https://kubernetes.io/releases/version-skew-policy/"], "stale_after": "2026-12-30", "title": "kube-apiserver and kube-apiserver (HA instances) \u2014 Kubernetes component version skew policy: how far apart component versions can be in a supported cluster", "type": "tolerance", "upgrade_prerequisite": "In a single-instance cluster, the existing kube-apiserver instance is 1.36 In an HA cluster, all kube-apiserver instances are at 1.36 or 1.37", "verified": false, "worked_example": "newest kube-apiserver is at 1.37 other kube-apiserver instances are supported at 1.37 and 1.36"}
{"asset": "kubernetes-version-skew-policy", "body": "**Component pair:** kube-apiserver and kube-controller-manager, kube-scheduler, or cloud-controller-manager\n\n**Skew rule:** They are expected to match the kube-apiserver minor version, but may be up to one minor version older (to allow live upgrades).\n\n**Max skew (minor versions):** 1\n\n**May the second component be newer?:** no - these components must not be newer than the kube-apiserver instances they communicate with\n\n**Worked example:** kube-apiserver is at 1.37 kube-controller-manager, kube-scheduler, and cloud-controller-manager are supported at 1.37 and 1.36\n\n> Example: kube-apiserver is at 1.37 kube-controller-manager, kube-scheduler, and cloud-controller-manager are supported at 1.37 and 1.36\n\n**Newest release when captured:** 1.37\n\n> The Kubernetes project maintains release branches for the most recent three minor releases (1.37, 1.36, 1.35).\n\n**HA cluster caveat:** If version skew exists between kube-apiserver instances in an HA cluster, and these components can communicate with any kube-apiserver instance in the cluster (for example, via a load balancer), this narrows the allowed versions of these components.\n\n> Note: If version skew exists between kube-apiserver instances in an HA cluster, and these components can communicate with any kube-apiserver instance in the cluster (for example, via a load balancer), this narrows the allowed versions of these components.\n\n**Upgrade prerequisite:** The kube-apiserver instances these components communicate with are at 1.37\n\n> Pre-requisites: The kube-apiserver instances these components communicate with are at 1.37 (in HA clusters in which these control plane components can communicate with any kube-apiserver instance in the cluster, all kube-apiserver instances must be upgraded before upgrading these components)\n\n> kube-controller-manager, kube-scheduler, and cloud-controller-manager must not be newer than the kube-apiserver instances they communicate with. They are expected to match the kube-apiserver minor version, but may be up to one minor version older (to allow live upgrades).\n\nSource: <https://kubernetes.io/releases/version-skew-policy/>\n", "component_pair": "kube-apiserver and kube-controller-manager, kube-scheduler, or cloud-controller-manager", "current_minor_release": "1.37", "file": "kube-apiserver-and-kube-controller-manager-kube-scheduler-or-cloud-controller-ma.md", "generated": true, "ha_cluster_caveat": "If version skew exists between kube-apiserver instances in an HA cluster, and these components can communicate with any kube-apiserver instance in the cluster (for example, via a load balancer), this narrows the allowed versions of these components.", "harvested": "2026-09-01", "id": "kube-apiserver-and-kube-controller-manager-kube-scheduler-or-cloud-controller-ma", "max_skew_minor_versions": "1", "newer_component_allowed": "no - these components must not be newer than the kube-apiserver instances they communicate with", "quote_current_minor_release": "The Kubernetes project maintains release branches for the most recent three minor releases (1.37, 1.36, 1.35).", "quote_ha_cluster_caveat": "Note: If version skew exists between kube-apiserver instances in an HA cluster, and these components can communicate with any kube-apiserver instance in the cluster (for example, via a load balancer), this narrows the allowed versions of these components.", "quote_upgrade_prerequisite": "Pre-requisites: The kube-apiserver instances these components communicate with are at 1.37 (in HA clusters in which these control plane components can communicate with any kube-apiserver instance in the cluster, all kube-apiserver instances must be upgraded before upgrading these components)", "quote_worked_example": "Example: kube-apiserver is at 1.37 kube-controller-manager, kube-scheduler, and cloud-controller-manager are supported at 1.37 and 1.36", "skew_rule": "They are expected to match the kube-apiserver minor version, but may be up to one minor version older (to allow live upgrades).", "source_quote": "kube-controller-manager, kube-scheduler, and cloud-controller-manager must not be newer than the kube-apiserver instances they communicate with. They are expected to match the kube-apiserver minor version, but may be up to one minor version older (to allow live upgrades).", "sources": ["https://kubernetes.io/releases/version-skew-policy/"], "stale_after": "2026-12-30", "title": "kube-apiserver and kube-controller-manager, kube-scheduler, or cloud-controller-manager \u2014 Kubernetes component version skew policy: how far apart component versions can be in a supported cluster", "type": "tolerance", "upgrade_prerequisite": "The kube-apiserver instances these components communicate with are at 1.37", "verified": false, "worked_example": "kube-apiserver is at 1.37 kube-controller-manager, kube-scheduler, and cloud-controller-manager are supported at 1.37 and 1.36"}
{"asset": "kubernetes-version-skew-policy", "body": "**Component pair:** kube-apiserver and kube-proxy\n\n**Skew rule:** kube-proxy may be up to three minor versions older than kube-apiserver\n\n**Max skew (minor versions):** 3\n\n**May the second component be newer?:** no - kube-proxy must not be newer than kube-apiserver\n\n**Exception for older versions:** kube-proxy < 1.25 may only be up to two minor versions older than kube-apiserver\n\n**Worked example:** kube-apiserver is at 1.37 kube-proxy is supported at 1.37, 1.36, 1.35, and 1.34\n\n> Example: kube-apiserver is at 1.37 kube-proxy is supported at 1.37, 1.36, 1.35, and 1.34\n\n**Newest release when captured:** 1.37\n\n> The Kubernetes project maintains release branches for the most recent three minor releases (1.37, 1.36, 1.35).\n\n**HA cluster caveat:** If version skew exists between kube-apiserver instances in an HA cluster, this narrows the allowed kube-proxy versions.\n\n> Note: If version skew exists between kube-apiserver instances in an HA cluster, this narrows the allowed kube-proxy versions.\n\n**Upgrade prerequisite:** The kube-apiserver instances kube-proxy communicates with are at 1.37\n\n> kube-proxy Pre-requisites: The kube-apiserver instances kube-proxy communicates with are at 1.37\n\n> kube-proxy must not be newer than kube-apiserver. kube-proxy may be up to three minor versions older than kube-apiserver (kube-proxy < 1.25 may only be up to two minor versions older than kube-apiserver).\n\nSource: <https://kubernetes.io/releases/version-skew-policy/>\n", "component_pair": "kube-apiserver and kube-proxy", "current_minor_release": "1.37", "file": "kube-apiserver-and-kube-proxy.md", "generated": true, "ha_cluster_caveat": "If version skew exists between kube-apiserver instances in an HA cluster, this narrows the allowed kube-proxy versions.", "harvested": "2026-09-01", "id": "kube-apiserver-and-kube-proxy", "legacy_version_exception": "kube-proxy < 1.25 may only be up to two minor versions older than kube-apiserver", "max_skew_minor_versions": "3", "newer_component_allowed": "no - kube-proxy must not be newer than kube-apiserver", "quote_current_minor_release": "The Kubernetes project maintains release branches for the most recent three minor releases (1.37, 1.36, 1.35).", "quote_ha_cluster_caveat": "Note: If version skew exists between kube-apiserver instances in an HA cluster, this narrows the allowed kube-proxy versions.", "quote_upgrade_prerequisite": "kube-proxy Pre-requisites: The kube-apiserver instances kube-proxy communicates with are at 1.37", "quote_worked_example": "Example: kube-apiserver is at 1.37 kube-proxy is supported at 1.37, 1.36, 1.35, and 1.34", "skew_rule": "kube-proxy may be up to three minor versions older than kube-apiserver", "source_quote": "kube-proxy must not be newer than kube-apiserver. kube-proxy may be up to three minor versions older than kube-apiserver (kube-proxy < 1.25 may only be up to two minor versions older than kube-apiserver).", "sources": ["https://kubernetes.io/releases/version-skew-policy/"], "stale_after": "2026-12-30", "title": "kube-apiserver and kube-proxy \u2014 Kubernetes component version skew policy: how far apart component versions can be in a supported cluster", "type": "tolerance", "upgrade_prerequisite": "The kube-apiserver instances kube-proxy communicates with are at 1.37", "verified": false, "worked_example": "kube-apiserver is at 1.37 kube-proxy is supported at 1.37, 1.36, 1.35, and 1.34"}
{"asset": "kubernetes-version-skew-policy", "body": "**Component pair:** kube-apiserver and kubectl\n\n**Skew rule:** kubectl is supported within one minor version (older or newer) of kube-apiserver.\n\n**Max skew (minor versions):** 1\n\n**May the second component be newer?:** yes - kubectl is supported one minor version older or newer than kube-apiserver\n\n**Worked example:** kube-apiserver is at 1.37 kubectl is supported at 1.38, 1.37, and 1.36\n\n> Example: kube-apiserver is at 1.37 kubectl is supported at 1.38, 1.37, and 1.36\n\n**Newest release when captured:** 1.37\n\n> The Kubernetes project maintains release branches for the most recent three minor releases (1.37, 1.36, 1.35).\n\n**HA cluster caveat:** If version skew exists between kube-apiserver instances in an HA cluster, this narrows the supported kubectl versions.\n\n> Note: If version skew exists between kube-apiserver instances in an HA cluster, this narrows the supported kubectl versions.\n\n> kubectl is supported within one minor version (older or newer) of kube-apiserver.\n\nSource: <https://kubernetes.io/releases/version-skew-policy/>\n", "component_pair": "kube-apiserver and kubectl", "current_minor_release": "1.37", "file": "kube-apiserver-and-kubectl.md", "generated": true, "ha_cluster_caveat": "If version skew exists between kube-apiserver instances in an HA cluster, this narrows the supported kubectl versions.", "harvested": "2026-09-01", "id": "kube-apiserver-and-kubectl", "max_skew_minor_versions": "1", "newer_component_allowed": "yes - kubectl is supported one minor version older or newer than kube-apiserver", "quote_current_minor_release": "The Kubernetes project maintains release branches for the most recent three minor releases (1.37, 1.36, 1.35).", "quote_ha_cluster_caveat": "Note: If version skew exists between kube-apiserver instances in an HA cluster, this narrows the supported kubectl versions.", "quote_worked_example": "Example: kube-apiserver is at 1.37 kubectl is supported at 1.38, 1.37, and 1.36", "skew_rule": "kubectl is supported within one minor version (older or newer) of kube-apiserver.", "source_quote": "kubectl is supported within one minor version (older or newer) of kube-apiserver.", "sources": ["https://kubernetes.io/releases/version-skew-policy/"], "stale_after": "2026-12-30", "title": "kube-apiserver and kubectl \u2014 Kubernetes component version skew policy: how far apart component versions can be in a supported cluster", "type": "tolerance", "verified": false, "worked_example": "kube-apiserver is at 1.37 kubectl is supported at 1.38, 1.37, and 1.36"}
{"asset": "kubernetes-version-skew-policy", "body": "**Component pair:** kube-apiserver and kubelet\n\n**Skew rule:** kubelet may be up to three minor versions older than kube-apiserver\n\n**Max skew (minor versions):** 3\n\n**May the second component be newer?:** no - kubelet must not be newer than kube-apiserver\n\n**Exception for older versions:** kubelet < 1.25 may only be up to two minor versions older than kube-apiserver\n\n**Worked example:** kube-apiserver is at 1.37 kubelet is supported at 1.37, 1.36, 1.35, and 1.34\n\n> Example: kube-apiserver is at 1.37 kubelet is supported at 1.37, 1.36, 1.35, and 1.34\n\n**Newest release when captured:** 1.37\n\n> The Kubernetes project maintains release branches for the most recent three minor releases (1.37, 1.36, 1.35).\n\n**HA cluster caveat:** If version skew exists between kube-apiserver instances in an HA cluster, this narrows the allowed kubelet versions.\n\n> Note: If version skew exists between kube-apiserver instances in an HA cluster, this narrows the allowed kubelet versions.\n\n**Upgrade prerequisite:** The kube-apiserver instances the kubelet communicates with are at 1.37\n\n> kubelet Pre-requisites: The kube-apiserver instances the kubelet communicates with are at 1.37\n\n> kubelet must not be newer than kube-apiserver. kubelet may be up to three minor versions older than kube-apiserver (kubelet < 1.25 may only be up to two minor versions older than kube-apiserver).\n\nSource: <https://kubernetes.io/releases/version-skew-policy/>\n", "component_pair": "kube-apiserver and kubelet", "current_minor_release": "1.37", "file": "kube-apiserver-and-kubelet.md", "generated": true, "ha_cluster_caveat": "If version skew exists between kube-apiserver instances in an HA cluster, this narrows the allowed kubelet versions.", "harvested": "2026-09-01", "id": "kube-apiserver-and-kubelet", "legacy_version_exception": "kubelet < 1.25 may only be up to two minor versions older than kube-apiserver", "max_skew_minor_versions": "3", "newer_component_allowed": "no - kubelet must not be newer than kube-apiserver", "quote_current_minor_release": "The Kubernetes project maintains release branches for the most recent three minor releases (1.37, 1.36, 1.35).", "quote_ha_cluster_caveat": "Note: If version skew exists between kube-apiserver instances in an HA cluster, this narrows the allowed kubelet versions.", "quote_upgrade_prerequisite": "kubelet Pre-requisites: The kube-apiserver instances the kubelet communicates with are at 1.37", "quote_worked_example": "Example: kube-apiserver is at 1.37 kubelet is supported at 1.37, 1.36, 1.35, and 1.34", "skew_rule": "kubelet may be up to three minor versions older than kube-apiserver", "source_quote": "kubelet must not be newer than kube-apiserver. kubelet may be up to three minor versions older than kube-apiserver (kubelet < 1.25 may only be up to two minor versions older than kube-apiserver).", "sources": ["https://kubernetes.io/releases/version-skew-policy/"], "stale_after": "2026-12-30", "title": "kube-apiserver and kubelet \u2014 Kubernetes component version skew policy: how far apart component versions can be in a supported cluster", "type": "tolerance", "upgrade_prerequisite": "The kube-apiserver instances the kubelet communicates with are at 1.37", "verified": false, "worked_example": "kube-apiserver is at 1.37 kubelet is supported at 1.37, 1.36, 1.35, and 1.34"}
{"asset": "kubernetes-version-skew-policy", "body": "**Component pair:** kubelet and kube-proxy\n\n**Skew rule:** kube-proxy may be up to three minor versions older or newer than the kubelet instance it runs alongside\n\n**Max skew (minor versions):** 3\n\n**May the second component be newer?:** yes - kube-proxy may be older or newer than the kubelet instance it runs alongside\n\n**Exception for older versions:** kube-proxy < 1.25 may only be up to two minor versions older or newer than the kubelet instance it runs alongside\n\n**Newest release when captured:** 1.37\n\n> The Kubernetes project maintains release branches for the most recent three minor releases (1.37, 1.36, 1.35).\n\n> kube-proxy may be up to three minor versions older or newer than the kubelet instance it runs alongside (kube-proxy < 1.25 may only be up to two minor versions older or newer than the kubelet instance it runs alongside).\n\nSource: <https://kubernetes.io/releases/version-skew-policy/>\n", "component_pair": "kubelet and kube-proxy", "current_minor_release": "1.37", "file": "kubelet-and-kube-proxy.md", "generated": true, "harvested": "2026-09-01", "id": "kubelet-and-kube-proxy", "legacy_version_exception": "kube-proxy < 1.25 may only be up to two minor versions older or newer than the kubelet instance it runs alongside", "max_skew_minor_versions": "3", "newer_component_allowed": "yes - kube-proxy may be older or newer than the kubelet instance it runs alongside", "quote_current_minor_release": "The Kubernetes project maintains release branches for the most recent three minor releases (1.37, 1.36, 1.35).", "skew_rule": "kube-proxy may be up to three minor versions older or newer than the kubelet instance it runs alongside", "source_quote": "kube-proxy may be up to three minor versions older or newer than the kubelet instance it runs alongside (kube-proxy < 1.25 may only be up to two minor versions older or newer than the kubelet instance it runs alongside).", "sources": ["https://kubernetes.io/releases/version-skew-policy/"], "stale_after": "2026-12-30", "title": "kubelet and kube-proxy \u2014 Kubernetes component version skew policy: how far apart component versions can be in a supported cluster", "type": "tolerance", "verified": false}