Updating cluster components and managed add-ons

Your IBM Cloud Kubernetes Service cluster comes with components, such as Ingress, that are installed automatically when you provision the cluster. By default, these components are updated automatically by IBM. However, you can disable automatic updates for some components and manually update them separately from the master and worker nodes.

Understanding cluster components

What default components can I update separately from the cluster?

You can optionally disable automatic updates for the following components:

Are there components that I can't update separately from the cluster?

Yes. Your cluster is deployed with the following managed components and associated resources that can't be changed, except to scale pods or edit configmaps for certain performance benefits. If you try to change one of these deployment components, their original settings are restored on a regular interval when they are updated with the cluster master. However, note that resources that you create that are associated with these components, such as Calico network policies that you create to be implemented by the Calico deployment components, are not updated.

  • calico components
  • coredns components
  • ibm-cloud-provider-ip
  • ibm-file-plugin
  • ibm-keepalived-watcher
  • ibm-master-proxy
  • ibm-storage-watcher
  • kubernetes-dashboard components (version 1.35 and earlier)
  • metrics-server
  • vpn
Can I install other plug-ins or add-ons than the default components?

Yes. IBM Cloud Kubernetes Service provides other plug-ins and add-ons that you can choose from to add capabilities to your cluster. For example, you might want to use Helm charts to install the block storage plug-in. Or you might want to enable IBM-managed add-ons in your cluster. You must update these Helm charts and add-ons separately by following the instructions in the Helm chart readme files or by following the steps to update managed add-ons.

Managing automatic updates for Fluentd

When you create a logging configuration for a source in your cluster to forward to an external server, a Fluentd component is created in your cluster. To change your logging or filter configurations, the Fluentd component must be at the latest version. By default, automatic updates to the component are enabled.

To run the following commands, you must have the Administrator IBM Cloud IAM platform access role for the cluster.

You can manage automatic updates of the Fluentd component in the following ways.

  • Check whether automatic updates are enabled by running the ibmcloud ks logging autoupdate get --cluster CLUSTER command.
  • Disable automatic updates by running the ibmcloud ks logging autoupdate disable command.
  • If automatic updates are disabled, but you need to change your configuration, you have two options:

    • Turn on automatic updates for your Fluentd pods.

      ibmcloud ks logging autoupdate enable --cluster CLUSTER

    • Force a one-time update when you use a logging command that includes the --force-update option. Your pods update to the latest version of the Fluentd component, but Fluentd does not update automatically going forward. Example command

      ibmcloud ks logging config update --cluster CLUSTER --id LOG-CONFIG-ID --type LOG-TYPE --force-update

Managing automatic updates for Ingress ALBs

Control when the Ingress application load balancer (ALB) component is updated. For information about keeping ALBs up-to-date, see Managing the Ingress ALB lifecycle.

Updating managed add-ons

Managed IBM Cloud Kubernetes Service cluster add-ons are an easy way to enhance your cluster with open-source capabilities, such as Istio. The version of the open-source tool that you add to your cluster is tested by IBM and approved for use in IBM Cloud Kubernetes Service. To update managed add-ons that you enabled in your cluster to the latest versions, see Updating managed add-ons.

Next steps

Return to Updating clusters, worker nodes, and cluster components to confirm that you completed each part of the update.