Traefik Mesh control plane and data plane version matching limits

Answer

Traefik Mesh requires the control plane and data plane images to share the same major.minor version (e.g., v1.2.x) to keep CRDs, webhooks and configuration in sync.

Confirmed facts

• The control plane installs the Mesh CRDs and conversion webhooks that are versioned to the release series.
• A data plane built from a different major/minor series may fail to register with those CRDs or reject configuration, leading to health‑check warnings or traffic blackouts.
• The project is now in maintenance mode; only critical bug fixes and security patches are provided for the latest released series, with no new feature development.

Likely explanation

Because the CRD schema and webhook versions are tied to the control plane’s release, the sidecar expects exactly that schema. A mismatch causes the API server to return conversion errors or the sidecar to ignore updates, which manifests as mesh status reporting “version mismatch”.

Steps to verify and align versions

1. Get the controller image tag:

   kubectl get deployment traefik-mesh-controller -n traefik-mesh -o jsonpath='{.spec.template.spec.containers[?(@.name=="controller")].image}'

2. Get the data plane image tag (sidecar/daemonset):

   kubectl get daemonset traefik-mesh -n traefik-mesh -o jsonpath='{..image}'

3. Compare the two tags; if the major.minor numbers differ, upgrade or downgrade the offending component to match the other side using the official Traefik Mesh upgrade guide.
4. Rollout the change (e.g., kubectl rollout restart deployment traefik-mesh-controller -n traefik-mesh and similar for the daemonset).
5. Verify mesh health:

   kubectl get meshstatus -n traefik-mesh

   and check controller logs for version‑mismatch warnings.

Support status and Kubernetes compatibility

• Traefik Mesh receives only critical bug fixes and security updates for the most recent released series; no new features are being added.
• Compatibility is tested against the Kubernetes versions that were current at each Mesh release. Newer Kubernetes versions that have removed deprecated APIs (e.g., v1.22+ removing certain beta APIs) may cause the Mesh CRDs or webhooks to fail unless you stay on a Mesh series that still supports those APIs.
• For new workload planning, verify your cluster’s Kubernetes version against the Mesh release notes; if you are on a version where the APIs used by Mesh have been deprecated and removed, you may need to stay on an older Kubernetes version or consider migrating to Traefik Proxy’s built‑in service mesh features.

Missing diagnostic detail

To give a definitive recommendation on whether your current Kubernetes version will cause API‑deprecation issues, please share your cluster’s Kubernetes version (output of kubectl version --short).