As neededkubernetes-post-upgrade

Post-Upgrade Validation Checklist

13 items ·11 critical ·2 warn ·0 info

How to use this checklist

Do not close the change until every item here passes. The failures that matter after an upgrade are usually in the add-ons, and they surface as workload symptoms hours later.

Mark an item N/A when it genuinely does not apply, and write down why. An unexplained N/A is the most common way a checklist stops working.

Sign-off

Every critical item must pass. A failing critical item blocks the deployment or the maintenance window; it is not a note for later. Record the date, the reviewer, and the disposition of every item that did not pass.

Critical11 items

Control-plane components and every kubelet report the expected version, and no node was missed.

kubectl get nodes -o custom-columns=NAME:.metadata.name,VERSION:.status.nodeInfo.kubeletVersion

Every node is Ready and schedulable — no node is left cordoned from the drain.
```
kubectl get nodes
```

etcd reports every member healthy with one leader and no alarms raised.

etcdctl endpoint status --cluster --write-out=table && etcdctl alarm list

Every kube-system Pod is Running and Ready, including the CNI and CSI DaemonSets on every node.
```
kubectl -n kube-system get pods
```
Application workloads are Running with the expected replica counts, and no Deployment is stuck mid-rollout.
```
kubectl get deploy -A | awk '$3!=$4'
```

In-cluster DNS resolves from a freshly created Pod, not only from Pods that predate the upgrade.

kubectl run post-upg-dns --rm -it --image=busybox:1.36 --restart=Never -- nslookup kubernetes.default

Pod-to-Pod, Pod-to-Service, and ingress paths are verified with an actual request, not inferred from Pod status.
A PVC can be provisioned, mounted, and deleted. CSI driver breakage after an upgrade is common and silent until something needs a volume.
NetworkPolicy is still enforced — verify by attempting a connection that should be blocked.
A brand-new Pod schedules, pulls its image, and passes its probes. This exercises more of the stack than any status check.
No alert is firing, and alerts that were silenced for the window have been un-silenced.

Warning2 items

The deprecated-API metric is checked again — the upgrade may have introduced new deprecation warnings for the next release.
```
kubectl get --raw /metrics | grep apiserver_requested_deprecated_apis
```
What went wrong, what took longer than expected, and what to change next time is written into the runbook while it is fresh.