A security patch requires upgrading a kubeadm-managed highly available cluster. Which procedure best preserves operational control?

1. Follow supported version-skew and upgrade guidance, upgrading nodes in a controlled sequence
2. Delete etcd data before every node upgrade
3. Upgrade only kubectl and assume server vulnerabilities are removed
4. Skip several unsupported minor versions on all nodes simultaneously