Skip to navigation
Overview

Supported platforms and versions

View as Markdown

This page lists the Kubernetes versions, networking, infrastructure providers, node operating system and tools that this release of NVIDIA Kubernetes Engine (NVKE) supports. Values change between releases; the values below are checked against this release’s source. The node-image rows describe the repository’s reference image build.

In the Notes column, Pinned means NVKE builds, installs or stages exactly that version, and other versions are not supported. Range means NVKE accepts any version within the stated bounds. For what preview does and does not support, see Preview status and known limitations.

Kubernetes

ItemSupportedNotes
Kubernetes version1.36.3Pinned. Release qualification targets 1.36 (release/policy.yaml). The node image also stages nvke-kubeadm-distro packages for 1.34.2 and 1.35.3; those versions are not supported. Another patch release of 1.36 is not on the node.
Version formatX.Y.Z, with no leading vThe API and the site spec reject any other format.
Management cluster1.36.3Set once, in the site spec’s cluster.k8sVersion field, at bootstrap. nvkectl generate sitespec writes 1.36.3 unless you set it. The management cluster does not upgrade itself.
Workload cluster1.36.3controlPlaneKubernetesVersion is required and has no default. The API accepts any X.Y.Z, but nodes run only a version their node image carries.
Control-plane upgradeOne minor version up, or a later patch releaseRange. Downgrades and requests for the current version are rejected. The cluster must have a controlPlaneVIP, and only one upgrade runs at a time.
Worker node pool skewUp to 3 minor versions behind the control planeRange. Checked when you upgrade the control plane. A new node pool starts at the cluster’s version.
Upgrade target on NICoA registered release for the target versionThe upgrade selects a release for the target Kubernetes version with the same architecture, variant and Ubuntu version as the current one. It fails if none is registered, unless the current release sets the Kubernetes version at provisioning time.
OpenID Connect (OIDC) on a workload cluster1.30.0 or laterRange. Applies to enableOidc and nvkeOIDCAuth.
Fleet-wide OIDC providers on a workload cluster1.34.0 or laterRange. Applies to oidc.providers. A cluster created on an earlier version gets none.

Kubernetes feature gates

NVKE runs every Kubernetes component with the upstream default feature gates for its Kubernetes version. On the supported version, NVKE sets no --feature-gates flag on kube-apiserver, kube-controller-manager or kube-scheduler, and no featureGates in the kubelet or kube-proxy configuration. The same applies to the management cluster and to workload clusters.

Feature stageState in NVKENotes
General availability (GA)EnabledKubernetes locks most GA gates on, and removes them in a later release.
BetaThe upstream defaultMost beta gates are on by default upstream, and some are off. NVKE does not change either.
AlphaDisabledAlpha gates are off by default upstream. NVKE does not enable any.
Beta API versionsThe upstream defaultNVKE does not set --runtime-config, so beta API versions that are off by default upstream stay off.

The NVKE API and the site spec have no field to change a feature gate. The Kubernetes feature gates reference lists each gate’s stage and default for every Kubernetes version.

Container networking

Plugin or settingVersionNotes
ovn-kubernetes2.4.2Pinned. The NVIDIA distribution of OVN-Kubernetes, built from dsx-ai-factory/ovn-kubernetes. It is the Container Network Interface (CNI) plugin for workload clusters and the management cluster. The node image stages its charts and images packages. Pod hostPort is enabled.
Other cniVersion valuesNot in the node imageThe node agent installs the CNI from packages on the node, so another version needs a node image built with it.
IP familyIPv4Pod and service CIDRs are private IPv4 ranges, fixed when the cluster is created: /12 to /23 for pods, /12 to /24 for services. The defaults are 192.168.0.0/16 and 10.96.0.0/12. The API virtual IP address (VIP) is IPv4.

Infrastructure providers

ProviderVersionNotes
NVIDIA Infra Controller (NICo), through CAPNICoCAPNICo v0.0.45Pinned. The default infrastructure provider for workload clusters; LaunchLayer is also supported once enabled, see Infrastructure Providers. The install deploys this CAPNICo release with the reboot and repair settings NVKE uses. The local quickstart builds a development CAPNICo version from source instead.
Cluster API core, kubeadm bootstrap and kubeadm control planev1.13.6Pinned. One version covers clusterctl, the providers that clusterctl init installs on the management cluster, and the providers nvkectl installs in the seed cluster.
cert-managerThe version Cluster API v1.13.6 installsclusterctl init installs it.
Provisioned infrastructure providerBuilt from the same NVKE source as nvkectlRuns only in the seed cluster during bootstrap, to form the management cluster.

Node operating system

ItemSupportedNotes
Operating systemUbuntu 26.04 LTS or Ubuntu 24.04 LTSNo other release is supported. The reference Make build defaults to Ubuntu 26.04.1; set UBUNTU_RELEASE to select the installer point release. See the image build guide for release selection and verification.
CPU architecturesamd64, arm64Set ARCH=amd64 or ARCH=arm64 on the repository image Make target; image-native requires a matching Linux/KVM host.
Kernellinux-nvidia on amd64, linux-nvidia-64k on arm64Ubuntu’s NVIDIA-tuned kernel flavors.
Full-disk encryption (FDE)Opt-in reference build, amd64 and arm64, for evaluation onlyVARIANT=fde; follow the separate build and verification instructions. NVKR’s hosted pipeline also selects FDE images for both architectures; its local scripts/nvke-os-local.sh path builds only non-FDE. Nodes built from one FDE image share its volume encryption key, so the image does not protect data at rest; see Preview status and known limitations.
SPIFFE Runtime Environment (SPIRE) agent1.14.1, with TPM plugin 1.9.0Pinned. Installed on the node image for TPM node attestation.
Node agent (nvke-agent)Built from the NVKE checkout used for the imageInstalled and enabled on the node image. Listens on port 15005.

Build the OS image lists the build host requirements and Make targets; Build and host node OS images covers the build and HTTP(S) hosting. Register node images for provisioning covers the management-cluster configuration.

For NVKR’s separate build route, see its node image Definition.

Management and bootstrap tooling

Tool or hostVersionNotes
Bootstrap hostLinuxAny Linux host that reaches the nodes. It can be one of the nodes.
Container runtime on the bootstrap hostRootful nerdctl with containerdNo version is checked. Docker is not supported.
kindv0.32.0Pinned for continuous integration (CI) and the local quickstart. The bootstrap does not check the version.
kubectlv1.36.0Pinned for CI. The bootstrap does not check the version.
clusterctlv1.13.6Pinned. Match the Cluster API version above. The install reports a Cluster API of another version.
Helmv4.2.4Pinned. The install and the local quickstart need Helm 4; Helm 3 cannot install the charts. The install warns on another version.
Go, to build nvkectl and the NVKE images1.27.3 or laterRange. An older Go downloads 1.27.3 unless GOTOOLCHAIN=local is set. Also needs GNU Make.
Go, to build nvkr (NVKR)1.27.2Pinned in NVKR’s .go-version.
nvkectlLinux and macOS, amd64 and arm64nvkectl bootstrap site runs only on a Linux bootstrap host.
Management cluster nodesamd64, arm64All nodes of one architecture. The install reads it from the nodes and selects the release’s artifacts for it. NVKR’s maintained release builds the controller image for both architectures.
Local quickstart hostLinux, amd64 or arm64See Quickstart: evaluate locally with mock-NICo.

nvkectl compatibility

nvkectl is versioned on its own cli/vX.Y.Z tags, separately from the management plane. The nvkectl compatibility policy defines which commands, flags, exit codes and output formats are stable across releases. Build nvkectl from the same release as the management plane.