Cluster updates

Cluster Updates under Administration shows where a cluster is, where it can go and what might block the way.

Providers#

Kubyl detects the provider in a fixed order: OpenShift (ClusterVersion), EKS, GKE, AKS, k3s, RKE2, Cluster API and then self-managed, which is read-only. Override it with updates.clusters.<id>.provider (openshift, eks, gke, aks, k3s, rke2, cluster_api or self_managed).

What you see#

• Current version, channel, update path, release notes, risks and conditions.
• OpenShift: ClusterOperators and machine config pools.
• k3s and RKE2: upgrade plans from system-upgrade-controller.
• EKS: add-ons. All providers: update history and How to update this cluster.
• Cluster API management clusters: workload clusters and their control plane and MachineDeployment versions.

The page has a version card (version, Kubernetes version, platform, cluster ID, support window, last update, conditions and a channel menu) and an update path graph. Targets are recommended, available, conditional or blocked, and selecting one shows its release notes, risks and the reasons it is blocked. Select with ↑ ↓ or J K. Pre-flight follows the selection. The page re-reads every 15 seconds while it is open, every 5 seconds during an update and right after a write. During an update the operators and pools come first and the pre-flight is hidden.

• OpenShift: a minor update is blocked while Upgradeable=False and every target while an update runs. Pre-flight also checks that operators are healthy, machine config pools are not paused or degraded, and shows the admin acknowledgements of the current minor with a copyable oc patch. Starting an update patches spec.desiredUpdate like oc adm upgrade --to; a conditional update is the equivalent of --allow-not-recommended.
• k3s and RKE2: versions come from the public channel server, progress from each Plan's nodes, and New plans… opens server and agent Plan templates in the YAML editor.
• Cluster API: version bumps follow the minor and control-plane-first rules, and you type the version. The provider has been tested against fixtures only.
• Self-managed clusters, and clouds without credentials or without the feature built in, show the version, nodes by role, documentation and a note saying why.

Pre-flight checks#

• PodDisruptionBudgets that would block a drain.
• Deprecated APIs that are still being requested (from OpenShift APIRequestCount, else Prometheus, else the API server's /metrics).
• Removed APIs in Helm manifests and in last-applied configurations.
• Node headroom for a drain.
• Version skew and minor-by-minor update rules.
• Compatibility of installed operators.

Update… is blocked on read-only clusters. The confirmation shows the cluster, provider, from and to versions, what changes (the patch and the oc command it matches) and the checks that failed or warn, with a checkbox per risk you accept and an "I've read the pre-flight results" box when a check failed. Updates cannot be undone. On PROD clusters you also type the cluster's name. A write runs once and is never retried, closing the dialog does not cancel it, and a failure shows the server's message in a toast. A check that cannot read says which verb and resource is missing.

Pre-flight needs up to 15 seconds for Prometheus discovery and the Helm list. The bundled table of removed APIs goes through Kubernetes 1.32. helm mapkubeapis is suggested for releases that use removed APIs. Cloud credentials come from aws configure export-credentials, gcloud auth print-access-token or az account get-access-token, are kept in memory only, and Kubyl refuses cmd.exe metacharacters in those arguments on Windows.