`apt-mark` - mark packages held (never upgraded by apt upgrade)

apt-mark hold|unhold|showhold PKG...

Options you will use

hold PKG: pin the installed version
unhold PKG: allow changes again
showhold: list held packages

Examples

$ sudo apt-mark unhold kubeadm && sudo apt-get install -y kubeadm=1.35.3-1.1 && sudo apt-mark hold kubeadm

the kubeadm upgrade step

Gotchas

kubeadm, kubelet and kubectl are held so a routine apt upgrade never upgrades Kubernetes behind your back. Installing a different version of a held package with -y fails: "Held packages were changed and -y was used."

Try apt-mark in a real terminal Free, in your browser - a real Ubuntu terminal to try it in, with missions that check your work.