diff --git a/cluster/hosts.go b/cluster/hosts.go
index c1103751..fd57c8a3 100644
--- a/cluster/hosts.go
+++ b/cluster/hosts.go
@@ -89,6 +89,14 @@ func (c *Cluster) SetUpHosts() error {
 	return nil
 }
 
+func CheckEtcdHostsChanged(kubeCluster, currentCluster *Cluster) error {
+	etcdChanged := hosts.IsHostListChanged(currentCluster.EtcdHosts, kubeCluster.EtcdHosts)
+	if etcdChanged {
+		return fmt.Errorf("Adding or removing Etcd nodes is not supported")
+	}
+	return nil
+}
+
 func checkEncryptedKey(sshKeyPath string) (ssh.Signer, error) {
 	logrus.Infof("[ssh] Checking private key")
 	key, err := hosts.ParsePrivateKey(privateKeyPath(sshKeyPath))
diff --git a/cluster/upgrade.go b/cluster/upgrade.go
index 79b12a15..e996c59e 100644
--- a/cluster/upgrade.go
+++ b/cluster/upgrade.go
@@ -3,6 +3,7 @@ package cluster
 import (
 	"fmt"
 
+	"github.com/rancher/rke/hosts"
 	"github.com/rancher/rke/k8s"
 	"github.com/rancher/rke/services"
 	"github.com/sirupsen/logrus"
@@ -48,3 +49,19 @@ func checkK8sNodesState(localConfigPath string) error {
 	logrus.Infof("[upgrade] All nodes are Ready")
 	return nil
 }
+
+func CheckHostsChangedOnUpgrade(kubeCluster, currentCluster *Cluster) error {
+	etcdChanged := hosts.IsHostListChanged(currentCluster.EtcdHosts, kubeCluster.EtcdHosts)
+	if etcdChanged {
+		return fmt.Errorf("Adding or removing Etcd nodes while upgrade is not supported")
+	}
+	cpChanged := hosts.IsHostListChanged(currentCluster.ControlPlaneHosts, kubeCluster.ControlPlaneHosts)
+	if cpChanged {
+		return fmt.Errorf("Adding or removing Control plane nodes while upgrade is not supported")
+	}
+	workerChanged := hosts.IsHostListChanged(currentCluster.WorkerHosts, kubeCluster.WorkerHosts)
+	if workerChanged {
+		return fmt.Errorf("Adding or removing Worker plane nodes while upgrade is not supported")
+	}
+	return nil
+}
diff --git a/cmd/cluster.go b/cmd/cluster.go
index ab73c034..4c1ba339 100644
--- a/cmd/cluster.go
+++ b/cmd/cluster.go
@@ -82,6 +82,10 @@ func ClusterUp(clusterFile string) (string, string, string, string, error) {
 		return APIURL, caCrt, clientCert, clientKey, err
 	}
 
+	if err := cluster.CheckEtcdHostsChanged(kubeCluster, currentCluster); err != nil {
+		return APIURL, caCrt, clientCert, clientKey, err
+	}
+
 	err = cluster.SetUpAuthentication(kubeCluster, currentCluster)
 	if err != nil {
 		return APIURL, caCrt, clientCert, clientKey, err
@@ -148,6 +152,10 @@ func ClusterUpgrade(clusterFile string) (string, string, string, string, error)
 	if currentCluster == nil {
 		return APIURL, caCrt, clientCert, clientKey, fmt.Errorf("Failed to get the current state of Kubernetes cluster")
 	}
+	// check if user try to add/remove hosts during upgrade
+	if err := cluster.CheckHostsChangedOnUpgrade(kubeCluster, currentCluster); err != nil {
+		return APIURL, caCrt, clientCert, clientKey, err
+	}
 	/*
 		kubeCluster is the cluster.yaml definition. It should have updated configuration
 		currentCluster is the current state fetched from kubernetes