Before deploymentkubernetes-pre-upgrade

Pre-Upgrade Checklist

12 items ·11 critical ·1 warn ·0 info

How to use this checklist

Work this list before the maintenance window, not during it. The items that most often stop an upgrade are the deprecated APIs and the CNI or CSI version matrix, and both take days to resolve rather than minutes.

Mark an item N/A when it genuinely does not apply, and write down why. An unexplained N/A is the most common way a checklist stops working.

Sign-off

Every critical item must pass. A failing critical item blocks the deployment or the maintenance window; it is not a note for later. Record the date, the reviewer, and the disposition of every item that did not pass.

Critical11 items

The target version is one minor version ahead of the current one. Skipping minors is not supported for the control plane.
```
kubectl version
```
The CHANGELOG and the release notes for the target version have been read, specifically the urgent-upgrade-notes section.
No workload uses an API version removed in the target release. Check the API server deprecation metrics as well as the manifests in Git.
```
kubectl get --raw /metrics | grep apiserver_requested_deprecated_apis
```
CNI, CSI, ingress controller, and every operator have a version that supports the target Kubernetes version, and the upgrade order is decided.
A fresh etcd snapshot has been taken, verified, and copied off-cluster, within hours of the window rather than days.
```
etcdctl snapshot save /backup/pre-upgrade-$(date +%F).db
```
No certificate expires during or shortly after the window. An upgrade plus an expiry in the same night is two incidents.
```
kubeadm certs check-expiration
```
The cluster is fully healthy before starting: every node Ready, no Pods in CrashLoopBackOff, no firing alerts.
```
kubectl get nodes && kubectl get pods -A --field-selector=status.phase!=Running
```
There is enough spare capacity to drain the largest node without leaving Pods Pending.
No PodDisruptionBudget will block a drain indefinitely. A PDB permitting zero disruptions must be fixed before, not during, the window.
```
kubectl get pdb -A -o custom-columns=NS:.metadata.namespace,NAME:.metadata.name,ALLOWED:.status.disruptionsAllowed
```
The upgrade has been performed on a non-production cluster of the same shape, and the notes from that run are to hand.
The rollback plan is written down and its limits are understood — a completed control-plane minor upgrade is not reversible in place.

Warning1 item

The window is agreed with service owners, the on-call rota knows, and change freeze conflicts have been checked.