This message was deleted.

I don't know, but I wouldn't be surprised if it's the order in which the kube api returns them.

Upstream Kubernetes requires that the kubelet must not be newer than the kube-apiserver. This is expressed in their version skew policy: https://kubernetes.io/releases/version-skew-policy/ Therefore the control planes must be upgraded first. For RKE2 this is achieved using the system-upgrade-controller. This controller executes upgrade plans and it's strongly recommended to have two separate plans, one for the control planes and one for the workers, with the plan for the workers waiting for the other one to complete before starting: https://docs.rke2.io/upgrade/automated_upgrade Harvester being a complete OS is a bit more complicated () but essentially the requirement to upgrade control planes first doesn't go away - except that some parts of the upgrade procedure, like preloading the new container images, can be done on all nodes regardless.