1 - Supported Package Versions — Ubuntu / Debian
The packages and versions provided by the KubeOps package repository for Ubuntu / Debian, and how to pin them.
This page lists the packages and versions available from the KubeOps package repository for Ubuntu 24.04 (the .deb pool). Use it to see which versions are supported and to pin the installed versions so an OS update cannot upgrade them.
Important
Not all of these versions are installed at once. The Kubernetes version is selected with kubernetesVersion in cluster-values.yaml (and kubeopsctl pull --kubernetesVersion <x.y.z>); kubeopsctl then installs the matching kubeadm, kubelet, kubectl, cri-tools and kubernetes-cni. For OIDC (dashboard SSO) you need kubeopsctl 2.1.0.0 or newer.
Kubernetes
| Package |
Supported versions |
kubeadm |
1.30.8, 1.31.6, 1.32.2, 1.32.3, 1.32.9, 1.32.10, 1.33.3, 1.33.5, 1.33.10, 1.34.1, 1.34.6, 1.35.0, 1.36.1 |
kubelet |
1.30.8, 1.31.6, 1.32.2, 1.32.3, 1.32.9, 1.32.10, 1.33.3, 1.33.5, 1.33.10, 1.34.1, 1.34.6, 1.35.0, 1.36.1 |
kubectl |
1.30.8, 1.31.6, 1.32.2, 1.32.3, 1.32.9, 1.32.10, 1.33.3, 1.33.5, 1.33.10, 1.34.1, 1.34.6, 1.35.0, 1.36.1 |
kubernetes-cni |
1.4.0, 1.5.1, 1.6.0, 1.7.1, 1.8.0, 1.9.1 |
cri-tools |
1.30.0, 1.31.0, 1.32.0, 1.33.0, 1.34.0, 1.35.0, 1.36.0 |
| Package |
Supported versions |
kosi |
2.12.1.0, 2.13.0.1, 2.13.0.2 |
kubeopsctl |
2.0.0.0, 2.0.1.0, 2.0.2.0, 2.0.3.0, 2.0.4.0, 2.0.5.0, 2.1.0.0 |
Helm
| Package |
Supported versions |
helm |
3.17.4 |
Container runtime and etcd
| Package |
Supported versions |
containerd |
1.7.24 |
etcdctl |
3.5.16, 3.5.21 |
etcdutl |
3.5.16, 3.5.21 |
podman |
4.9.3 |
Pre-release versions
⚠ Warning
The following are pre-release builds (Alpha / Beta / RC) and are not intended for production.
| Package |
Pre-release versions |
kosi |
2.14.0.4-Beta0, 2.15.0.4-Alpha5, 2.15.0.4-Beta0 |
kubeopsctl |
2.2.0.0-Alpha5, 2.2.0.0-Beta0 |
Pin the installed versions
After the packages are installed, hold them at the installed version so a later apt upgrade cannot upgrade them and break the cluster:
sudo apt-mark hold \
containerd podman \
kubelet kubeadm kubectl kubernetes-cni cri-tools \
helm kosi kubeopsctl
Note
kubeopsctl already holds kubelet, kubeadm and kubectl itself (it runs apt-mark hold/unhold on them around installs and upgrades), so for those three the hold is managed for you. The command above additionally covers kubernetes-cni, cri-tools, helm, kosi and kubeopsctl.
To release a hold later (for a controlled upgrade):
sudo apt-mark unhold \
containerd podman \
kubelet kubeadm kubectl kubernetes-cni cri-tools \
helm kosi kubeopsctl
Note
containerd is installed from the operating system repository or as a local package. podman is installed as a KOSI lima package. Both packages are included in the hold and unhold commands above. To generate the exact hold list from your repository, run the list-package-versions.sh helper with --pin.
2 - Supported Package Versions — Red Hat Enterprise Linux (RHEL)
The packages and versions provided by the KubeOps package repository for Red Hat Enterprise Linux, and how to pin them.
This page lists the packages and versions available from the KubeOps package repository for RHEL 9.6 / 9.7 (the .rpm pool). Use it to see which versions are supported and to pin the installed versions so an OS update cannot upgrade them.
Important
Not all of these versions are installed at once. The Kubernetes version is selected with kubernetesVersion in cluster-values.yaml (and kubeopsctl pull --kubernetesVersion <x.y.z>); kubeopsctl then installs the matching kubeadm, kubelet, kubectl, cri-tools and kubernetes-cni. For OIDC (dashboard SSO) you need kubeopsctl 2.1.0.0 or newer.
Kubernetes
| Package |
Supported versions |
kubeadm |
1.30.8, 1.31.6, 1.32.2, 1.32.3, 1.32.9, 1.32.10, 1.33.3, 1.33.5, 1.33.10, 1.34.1, 1.34.6, 1.35.0, 1.36.1 |
kubelet |
1.30.8, 1.31.6, 1.32.2, 1.32.3, 1.32.9, 1.32.10, 1.33.3, 1.33.5, 1.33.10, 1.34.1, 1.34.6, 1.35.0, 1.36.1 |
kubectl |
1.30.8, 1.31.6, 1.32.2, 1.32.3, 1.32.9, 1.32.10, 1.33.3, 1.33.5, 1.33.10, 1.34.1, 1.34.6, 1.35.0, 1.36.1 |
kubernetes-cni |
1.4.0, 1.5.0, 1.5.1, 1.6.0, 1.7.1, 1.8.0, 1.9.1 |
cri-tools |
1.30.1, 1.31.1, 1.32.0, 1.33.0, 1.34.0, 1.35.0, 1.36.0 |
Container runtime and etcd
| Package |
Supported versions |
containerd.io |
2.1.5 |
podman |
5.2.2 |
etcdctl |
3.5.16, 3.5.21 |
etcdutl |
3.5.16, 3.5.21 |
| Package |
Supported versions |
kosi |
2.12.1.0, 2.13.0.1, 2.13.0.2 |
kubeopsctl |
2.0.1.0, 2.0.2.0, 2.0.3.0, 2.0.4.0, 2.0.5.0, 2.1.0.0 |
Helm
| Package |
Supported versions |
helm |
3.17.4 |
Pre-release versions
⚠ Warning
The following are pre-release builds (Alpha / Beta / RC) and are not intended for production.
| Package |
Pre-release versions |
kosi |
2.14.0.4_Beta0, 2.15.0.4_Alpha5, 2.15.0.4_Beta0 |
kubeopsctl |
2.2.0.0_Alpha5, 2.2.0.0_Beta0 |
Pin the installed versions
On RHEL the KubeOps package repository is configured so that its packages are excluded from normal dnf transactions — the install commands have to pass --disableexcludes=kubeops-repo to override that exclusion. As a result a regular dnf update already leaves these packages untouched, so the cluster is protected out of the box.
⚠ Warning
Confirm the exact exclude= configuration in kubeops.repo (and /etc/dnf/dnf.conf) for your release. The versionlock step below is an additional safeguard on top of that exclusion.
To lock the installed versions explicitly, use the versionlock plugin after the packages are installed:
sudo dnf install -y python3-dnf-plugin-versionlock
sudo dnf versionlock add \
containerd.io podman kubelet kubeadm kubectl kubernetes-cni cri-tools \
etcdctl etcdutl helm kosi kubeopsctl conntrack-tools
Alternatively, exclude them explicitly on each update:
sudo dnf update --exclude=containerd.io,podman,kubelet,kubeadm,kubectl,kubernetes-cni,cri-tools,etcdctl,etcdutl,helm,kosi,kubeopsctl
Dependencies
The repository also provides the following compatibility/dependency packages (32-bit i686 runtime libraries), which are pulled in automatically: conntrack-tools (1.4.7), glibc (2.34), glibc-gconv-extra (2.34), libgcc (11.5.0), libmnl (1.0.4), libnetfilter_cthelper (1.0.0), libnetfilter_cttimeout (1.0.0), libnetfilter_queue (1.0.5), libnfnetlink (1.0.1).
Note
These are operating-system libraries. Do not version-lock glibc and the other system libraries — they should continue to receive OS security updates. Pin only the KubeOps and Kubernetes stack packages listed above.