AKS auto upgrading on its own when it should not be

Question

Hello,

We disabled the auto upgrade schedule for Kubernetes, however the system seems to have performed an upgrade regardless of the setting. How come the upgrade still happened? We manually upgraded from 1.29 to 1.30.6 and now we are seeing 1.30.9. The audit logs show that the system upgraded.

Thank you,

Denis

Answer 1

Hi Denis Celigija,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Even if the upgrade feature is turned off, certain high-priority patches may be applied automatically to ensure the cluster remains secure and patch releases address bugs and vulnerabilities.

• AKS may still automatically update the Kubernetes version in certain cases, if we are running a deprecated version or a version that is end of support, AKS may automatically upgrade to a supported patch version, even if the automatic upgrade scheduler feature is off.
• Kubernetes releases new minor versions approximately every three months and for patch versions it is for sometimes its weekly based, and each version contains new features, bug fixes, and deprecations. Skipping versions may create Compatibility Issues and breakage in workloads.
• AKS Kubernetes version 1.31 is now in GA.
• AKS Kubernetes patch versions 1.29.11, 1.30.7,1.30.9, 1.31.2, and 1.31.3 are now available as per regions.

For more Information, see:

https://learn.microsoft.com/en-us/azure/aks/supported-kubernetes-versions?tabs=azure-cli#alias-minor-version

https://releases.aks.azure.com/#tabregion

If you found it helpful, could you kindly click the “Accept Answer and upvote” on the post.

If you have any further queries, please let us know we are glad to help you.

Thank you.

Answer 2

Hi Denis Celigija,

I can see in your screenshot that path mode is enabled

Even though you disabled the automatic upgrade schedule, AKS still automatically applies patch updates (such as 1.30.6 to 1.30.9) if your automatic upgrade type is set to "Patch" which is visible in your given image.

That is why minor version patches within the same major version (e.g. 1.30.x) are applied automatically, even if you did not explicitly schedule them. Change it.

If you want full manual control over patch upgrades, change the automatic upgrade type to "None" instead of "Patch."

Click on upgrade version

You will see automatic upgrade. Click on the drop down.

chose "Disabled" to have complete manual control of upgrades.

You can also do the same from CLI

az aks update --resource-group <your-resource-group> --name <your-cluster-name> --auto-upgrade-channel none

Now see it's disabled. Now you have full control to manually upgrade as per your convenience.

Please feel free to accept and upvote my answer if you found it helpful. Thanks!