Version Skew
A kubelet three minors behind can block the next control-plane minor upgrade. That limit does not itself block a patch within the current minor.
-
-
Kubernetes Isolation, Policy, and Upgrades
Additive permissions still deny unallowed access. Verify quota enforcement, policy scope and the distinction between minor upgrades and security patches.