Upgrade the Kubelet on a Worker Node

Original Prepium guide · Written for Kubernetes v1.35 and checked against the official documentation on 6 October 2026. Use a disposable practice cluster. Practise on throwaway kubeadm VMs whose package repository already points at the minor release you want.

Upgrading a kubeadm worker node without breaking the version skew rules

A worker node carries three Kubernetes packages: kubeadm, the kubelet that actually runs Pods, and usually kubectl. Upgrading it is a fixed sequence: move the workloads away, upgrade the tool, let kubeadm refresh the node's kubelet configuration, upgrade and restart the kubelet, then let workloads back. Security tasks care because unpatched kubelets are an attack surface, and because a half-finished upgrade leaves a node cordoned or running the old binary.

control plane:  kubectl drain NODE ──────────────────────────────────────→ kubectl uncordon NODE
worker NODE:          upgrade kubeadm pkg → kubeadm upgrade node → upgrade kubelet+kubectl pkgs
                                                                 → daemon-reload → restart kubelet

1. Check where you are and what is allowed

kubectl get nodes -o wide
kubectl version
ssh practice-worker-2 'kubeadm version -o short; kubelet --version'

The VERSION column is each node's kubelet version. The skew policy sets the limits: a kubelet must never be newer than kube-apiserver, and may be up to three minor versions older. kubectl is supported within one minor version of the API server, either side. That is why the control plane is upgraded first and workers follow.

2. Drain the node

kubectl drain practice-worker-2 --ignore-daemonsets

Drain cordons the node (marks it unschedulable) and evicts its Pods, respecting PodDisruptionBudgets. It refuses to continue past DaemonSet Pods unless you pass --ignore-daemonsets, past Pods using emptyDir unless you accept data loss with --delete-emptydir-data, and past bare Pods without a controller unless you use --force. Read the error, decide, then add only the flag you need.

3. Upgrade on the worker itself

sudo apt-get update
sudo apt-cache madison kubeadm            # pick the exact 1.35.Z-* version string
sudo apt-mark unhold kubeadm
sudo apt-get install -y kubeadm='1.35.Z-*'
sudo apt-mark hold kubeadm
sudo kubeadm upgrade node
sudo apt-mark unhold kubelet kubectl
sudo apt-get install -y kubelet='1.35.Z-*' kubectl='1.35.Z-*'
sudo apt-mark hold kubelet kubectl
sudo systemctl daemon-reload
sudo systemctl restart kubelet

Replace 1.35.Z with a real version from the madison list. The packages are held so routine apt upgrade runs do not move them, which is why each install is wrapped in unhold and hold. On a worker, kubeadm upgrade node fetches the cluster's kubeadm configuration and upgrades the local kubelet configuration; it does not replace the kubelet binary, which is what the package install does. daemon-reload picks up any changed systemd unit files before the restart. The official guide runs kubeadm upgrade node before draining; either order works as long as the node is drained before the kubelet restarts.

4. Bring it back and verify

systemctl status kubelet --no-pager
kubectl uncordon practice-worker-2
kubectl get nodes practice-worker-2

Expect the node to report Ready with the new VERSION after the kubelet has re-registered. If it stays NotReady, read journalctl -xeu kubelet on the worker.

Common mistakes

• Upgrading kubeadm but forgetting the kubelet package: kubectl get nodes still shows the old VERSION.
• Installing the new kubelet and never restarting it: the old process keeps running.
• Forgetting uncordon: the node is Ready but still marked unschedulable (spec.unschedulable: true), so no new Pods land on it.
• Running apt-get install kubelet without a version: you get whatever is newest in the configured repository, not necessarily the version you planned or one the skew policy allows.

Cleanup: none beyond your practice VMs. References: Upgrading Linux nodes, Upgrading kubeadm clusters, Version skew policy, kubectl drain. Next, try the CKA control plane upgrade or kubelet hardening.