{"record":{"id":"34eec936eb5856b9","repo":"kubernetes/kops","slug":"kops-version-older-than-last-used-to-update-the-cl","errorCode":null,"errorMessage":"kops version older than last used to update the cluster","messagePattern":"kops version older than last used to update the cluster","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/apply_cluster.go","lineNumber":294,"sourceCode":"\n\tif !c.AllowKopsDowngrade {\n\t\tkopsVersionUpdatedBytes, err := configBase.Join(registry.PathKopsVersionUpdated).ReadFile(ctx)\n\t\tif err == nil {\n\t\t\tkopsVersionUpdated := strings.TrimSpace(string(kopsVersionUpdatedBytes))\n\t\t\tversion, err := semver.Parse(kopsVersionUpdated)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error parsing last kops version updated: %v\", err)\n\t\t\t}\n\t\t\tif version.GT(semver.MustParse(kopsbase.Version)) {\n\t\t\t\tfmt.Printf(\"\\n\")\n\t\t\t\tfmt.Printf(\"%s\\n\", starline)\n\t\t\t\tfmt.Printf(\"\\n\")\n\t\t\t\tfmt.Printf(\"The cluster was last updated by kops version %s\\n\", kopsVersionUpdated)\n\t\t\t\tfmt.Printf(\"To permit updating by the older version %s, run with the --allow-kops-downgrade flag\\n\", kopsbase.Version)\n\t\t\t\tfmt.Printf(\"\\n\")\n\t\t\t\tfmt.Printf(\"%s\\n\", starline)\n\t\t\t\tfmt.Printf(\"\\n\")\n\t\t\t\treturn nil, fmt.Errorf(\"kops version older than last used to update the cluster\")\n\t\t\t}\n\t\t} else if err != os.ErrNotExist {\n\t\t\treturn nil, fmt.Errorf(\"error reading last kops version used to update: %v\", err)\n\t\t}\n\t}\n\n\tcloud := c.Cloud\n\n\terr = validation.DeepValidate(c.Cluster, c.InstanceGroups, true, c.Clientset.VFSContext(), cloud)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif cluster.Spec.KubernetesVersion == \"\" {\n\t\treturn nil, fmt.Errorf(\"KubernetesVersion not set\")\n\t}\n\tif cluster.Spec.DNSZone == \"\" && cluster.PublishesDNSRecords() {\n\t\treturn nil, fmt.Errorf(\"DNSZone not set\")","sourceCodeStart":276,"sourceCodeEnd":312,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/apply_cluster.go#L276-L312","documentation":"Run() enforces downgrade protection: if the kops-version-updated marker records a version greater than the running kops binary's version, Run refuses to proceed. Updating a cluster with an older kops than the last one that touched it can silently revert resources, so it errors out and points to --allow-kops-downgrade.","triggerScenarios":"Running `kops update cluster` (or RunUpdateCluster/apply) with a binary older than the version recorded in <configBase>/kops-version-updated, without passing --allow-kops-downgrade.","commonSituations":"CI runner or local machine with a stale pinned kops binary after the cluster was updated by a newer release; pinning kops in a Dockerfile to an old tag; kops auto-updated elsewhere (e.g. kops update container) then an older tool runs the next update.","solutions":["Upgrade kops to at least the recorded version (kops get cluster shows it; or install the latest release) and rerun.","If downgrading intentionally, pass --allow-kops-downgrade to the update command.","Align CI tooling versions: check `kops version` against the cluster's last-updated version before running updates."],"exampleFix":"// before\nkops update cluster mycluster.example.com --yes\n// after\nkops update cluster mycluster.example.com --yes --allow-kops-downgrade","handlingStrategy":"validation","validationCode":"if kopsVersionUpdated.GT(semver.MustParse(kopsbase.Version)) && !opts.AllowKopsDowngrade {\n    return fmt.Errorf(\"upgrade kops to >= %s or pass --allow-kops-downgrade\", kopsVersionUpdated)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep kops version pinned to >= the cluster's last-updated version in CI images.","Check `kops version` against the marker before scripted updates.","Automate kops binary upgrades with the cluster upgrades."],"tags":["versioning","cli","downgrade"],"backgroundTag":"version-downgrade-not-allowed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}