CKSKubernetes 1.35

Exercises

Exercise: cordon, drain, upgrade a kubelet

updated 2026-10-22 by seed

Host: controlplane + worker · Time: 10 min · Domain: Cluster Hardening

Task

  • Drain worker safely (DaemonSets may stay).
  • Upgrade its kubelet and kubectl to the control-plane version.
  • Bring it back, uncordoned.

Acceptance criteria

  • kubectl get nodes -o wide shows the same version on both nodes.
  • The node is Ready,SchedulingDisabled → then Ready.

Solution

kubectl drain worker --ignore-daemonsets --delete-emptydir-data
ssh worker
sudo apt-mark unhold kubelet kubectl
sudo apt-get update && sudo apt-get install -y kubelet=<same-version> kubectl=<same-version>
sudo apt-mark hold kubelet kubectl
sudo systemctl daemon-reload && sudo systemctl restart kubelet
sudo kubeadm upgrade node          # only if the task says so
exit
kubectl uncordon worker
kubectl get nodes -o wide

Forgetting uncordon is the classic: everything else passes, the node stays
unschedulable.