Upgrade Scenarios#
MKE 4.1.5 introduced changes in how ingress and external access are managed, particularly around the use of load balancers and Gateway ports. Because ingress configurations can vary between environments, the upgrade process is not one-size-fits-all. Instead, it depends on whether ingress is enabled in the source cluster and whether it should be retained after the upgrade.
The information herein outlines the supported upgrade paths and required actions
for each scenario. It highlights when upgrades are possible, what infrastructure
adjustments (such as load balancer provisioning) are needed, and how to
correctly invoke the mkectl upgrade command with the appropriate parameters.
Carefully review the scenario that matches your current setup to ensure a smooth and successful upgrade and to avoid unsupported configurations.
From MKE 3.7.15+ and MKE 3.8.x#
MKE 3.7.15+ and 3.8.x clusters must first be upgraded to MKE 3.9.x before they can be upgraded to MKE 4.2.0. For more information, refer to Upgrade from MKE 3.7, 3.8, or 3.9.
From MKE 3.9#
| Ingress enabled in source | Ingress retained | Action | To invokemkectl upgrade |
|---|---|---|---|
| No | No | Provision a load balancer that maps from gateway-listener-port to gateway-https-node-port. |
mkectl upgrade --external-address <load-balancer-DNS>:<gateway-listener-port-number> --gateway-https-node-port <value> --gateway-http-node-port <value>. The three parameters are all required. The --gateway-listener-port parameter, however, is not allowed. If the Gateway listener port number is omitted from the --external-address parameter, port 443 is assumed. |
| No | Yes | Scenario not supported. If ingress-nginx was not initially enabled in the source MKE 3 cluster, it implies the --remove-ingress-nginx parameter even when it is not explicitly specified. |
NA |
| Yes | No | Provision a load balancer that maps from gateway-listener-port to either gateway-https-node-port, which takes precedence if specified, or to the configured HTTPS NodePort for ingress-controller. |
mkectl upgrade --external-address <load-balancer-DNS>:<gateway-listener-port-number> --gateway-https-node-port <value> --gateway-http-node-port <value>. The --external-address --gateway-https-node-port <value> and --gateway-http-node-port <value>, are optional; when they are not included, the values originally configured for ingress controller are carry forward. The --gateway-listener-port parameter is not allowed. If the Gateway listener port number is omitted from the --external-address parameter, port 443 is assumed. |
| Yes | Yes | Provisions a load balancer that maps from gateway-listener-port to gateway-https-node-port. |
mkectl upgrade --external-address <load-balancer-DNS>:<gateway-listener-port-number> --gateway-https-node-port <value> --gateway-http-node-port <value>. The three parameters are all required. The --gateway-listener-port parameter, however, is not allowed. If the Gateway listener port number is omitted from the --external-address parameter, port 443 is assumed. |
From MKE 4.1.2#
MKE 4.1.2 clusters must first be upgraded to MKE 4.1.3 before they can be upgraded to MKE 4.2.0. For more information.
From MKE 4.1.3#
| Ingress enabled in source | Ingress retained | Action | To invokemkectl upgrade |
|---|---|---|---|
| No | No | No action is necessary as MKE 4.1.5 will use the existing load balancer and Gateway NodePort configuration. | Do not use any of the gateway paramters with the mkectl upgrade command. |
| Yes | No | Scenario not supported. MKE 4.1.3 is limited to fresh installations, and beginning with that product version, ingress-nginx cannot be enabled on fresh MKE 4 installations. | NA |