How to Install kubectl on Ubuntu

In order to install kubectl on Ubuntu, you'll need to download the binary from dl.k8s.io with curl, make it executable, and install it to /usr/local/bin. This post walks through how that is done, why you might want to verify the checksum before running it, and how exactly the version skew rule between kubectl and your cluster works.

How do I install kubectl on Ubuntu?

Download the binary with curl from dl.k8s.io, make it executable, and install it to /usr/local/bin. No package manager and no Kubernetes cluster are needed to install the kubectl binary itself.

$ curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
$ chmod +x kubectl
$ sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl

That is literally the exact process described in the official installation instructions for kubectl – the stable.txt lookup in the URL ensures you'll always get the current stable release of kubectl without having to know the version number ahead of time.

Why do I need to verify the checksum before installing kubectl?

kubectl controls your Kubernetes cluster, and downloading a tampered or corrupted binary would be a problem. By downloading the matching .sha256 file and comparing the results with sha256sum, you can ensure that the binary is intact.

$ curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl.sha256"
$ echo "$(cat kubectl.sha256)  kubectl" | sha256sum --check

The step of verifying the checksum is part of the official docs for every platform covered, directly preceding the install command – sha256sum --check prints kubectl: OK if the binary hasn't been altered or truncated.

How do I check my kubectl version after installing?

Check your kubectl version with kubectl version --client. This only prints out the client version without attempting to contact the cluster, which allows you to verify the install even if you haven't configured a cluster yet.

$ kubectl version --client

Omitting --client will cause kubectl to attempt to connect to the cluster that the current context is pointing to, but will fail or hang if there isn't a cluster yet – --client is what makes this a useful command to check your install, as per the same documentation.

Does my kubectl version need to match my cluster's version?

No, but it should stay close. kubectl supports any version of a cluster that is within one minor version of its own version, either way.

As explained in the version skew policy, "you must use a kubectl version that is within one minor version difference of your cluster... using the latest compatible version of kubectl helps avoid unforeseen issues." In practice, this means that a version that is one version newer or one version older than the cluster is acceptable, anything further than that is not necessarily going to work.

How do I update kubectl to a newer version?

Download the binary with curl again, and install it with install. The new binary will overwrite the previous one located at /usr/local/bin/kubectl.

$ curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
$ sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl

Since the curl URL is always resolving to the most current stable release of kubectl, the entire process of the first step is all you need to do to update. There is no separate update process – no files need to be uninstalled or deleted first.

With our VPS plans and Bare Metal servers, you get access to an Ubuntu command line environment in which you can run kubectl against any clusters you might control from there.