Upgrade path and version skew
Current version, target version, intermediate steps and version gaps between components. The cluster audit describes the path in writing.
Second opinion beforehand
A planned upgrade or change is cross-checked before it is carried out.
Kubernetes upgrade at end of life and in emergencies
In short: a cluster on an expiring version is brought to a supported release one minor version at a time, in a maintenance window and with checked add-ons. As operations, as a single engagement or as a check beforehand.
- Upgrade path per minor version
- Maintenance window
- Single engagement or operations
- 24/7 monitoring in operations
Starting point
When an upgrade becomes a problem
Typical situations in which a cluster needs help with the upgrade.
The version is expiring
A minor version is maintained for roughly 14 months, after which support ends (patch releases).
Several versions behind
Minor versions cannot be skipped in kubeadm clusters (kubeadm). Three versions behind means three steps.
Add-ons and nodes no longer match
The kubelet may be at most three minor versions older than the kube-apiserver (version skew policy). CNI, ingress and storage must match the target version.
The upgrade was interrupted
Nodes stay NotReady or components run in different versions. The cluster is between two states.
Services
What the Kubernetes upgrade covers
From the upgrade path to the completed maintenance window. In operations, upgrades are part of the scope; individually they are commissioned by effort.
In the maintenance window
Kubernetes, operating systems and add-ons are tested and updated in the maintenance window.
Complete an interrupted upgrade
An interrupted upgrade is continued or rolled back, and version gaps are aligned.
Single engagements are contract work without a guaranteed response time. Response times come with Managed Kubernetes and a service level.
Process
Four steps to a supported version
Sequence as a single engagement. In operations, upgrades follow the agreed maintenance window.
- 01
Record the current state
Kubernetes version, distribution, add-ons, nodes and operating system. Access is discussed only after the assessment.
- 02
Define the path
Target version, intermediate steps and maintenance window are agreed before anything is changed.
- 03
Carry out in the maintenance window
Control plane, nodes and add-ons are tested and updated.
- 04
Document the result
Written result with findings and open items.
Assessment
In-house or supported upgrade
An upgrade is routine as long as the path is known. The assessment shows when external support becomes necessary.
In-house
In-house operation is enough when
- the team schedules upgrades in the calendar and has done them several times
- the version is within the support period and at most one minor step is missing
- add-ons, backups and the way back are documented
Support
Support makes sense when
- the version is at or past end of support
- several minor steps are pending or an upgrade was interrupted
- the team lacks experience with the path
Entry point
Upgrades in ongoing operations
Upgrades in the maintenance window are part of Managed Kubernetes, together with control plane and add-ons, backups with restore tests, CVE assessment and 24/7 monitoring. Monitoring runs 24/7, the response to P1 incidents follows the service level.
All prices are net and exclude statutory VAT. The offers are addressed to businesses. As of October 2026.
Alternatively
Single engagementKubernetes Support
Complete an upgrade or get a second opinion by effort, €120 excl. VAT per hour, no contract.
View support →Check beforehandCluster audit
Versions, upgrade path, backup and restore path. Configuration review, not a penetration test, from €1,490 excl. VAT one-time.
View audit →Frequently asked questions
Answers to the most important questions
- Active patch release series are maintained for roughly 14 months: twelve months of standard period followed by two months of maintenance mode. After that the series is end of life (patch releases). Current dates per version are in the Kubernetes upgrade guide.
- Not in kubeadm clusters: skipping minor versions when upgrading is unsupported (kubeadm). A cluster several versions behind is therefore raised in several steps.
- Describe the situation through the form. We assess the task and name the effort frame before work starts. Billing is by effort in support at €120 excl. VAT per hour. Without an operations contract there is no guaranteed response time and no on-call duty.
- In Managed Kubernetes operations, upgrades in the maintenance window are included: from €590 excl. VAT per cluster and month, including 3 worker nodes. As a single engagement, billing is by effort at €120 excl. VAT per hour during service hours.
- Existing clusters on Proxmox, bare metal and at cloud providers, including Amazon EKS and Azure AKS, regardless of distribution.
Knowledge
Guides and sources on upgrades
Version dates, upgrade path and adjacent services.
Guides
Primary sources
Related services
- Managed KubernetesOperations for existing and hosted clusters with upgrades, backups and hardening.
- Kubernetes supportHelp billed by effort without a standing contract.
- Kubernetes cluster auditConfiguration review with a report, not a penetration test.
- Kubernetes backup and restoreBackup layers with restore tests.
Reviews & projects
Operations that visibly relieve customers
Customer feedback on monitoring, updates, maintenance, support and stable production systems.
Networking & Provisioning
WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.
Steve KirchnerManaging Director, nextGYM GmbH
International
Built in Germany's Ruhr Valley. Running worldwide.
WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.
Selected projects
- LiveRemote access platform for distributed water treatment plantsABCO Water Systems · Australia · Secure Access & OT
- 81%AWS migration with substantially lower operating costsEVA Real Estate · UAE · Cloud exit & infrastructure
- 98%Provision new sites in minutes instead of hoursnextGYM GmbH · Germany · Automation & IoT

Read client reviews
Enquiry
Which version is running, and where should it go?
For a first assessment, version, infrastructure and target version are enough. We need access credentials only after an order.
- Straight with Timo and Robin - no sales team, no pitch
- A professional assessment of your situation
- Concrete next steps for infrastructure, software or AI
The conversation is free and non-binding.
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH

WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.


















