自建 Kubernetes 安全升级 Hands-on

kubectl config current-context
kubectl version
kubectl get nodes -o wide
kubectl get pods -A -o wide
kubectl get pdb -A
kubectl get pvc -A
kubectl get events -A --sort-by=.metadata.creationTimestamp
kubectl get --raw='/readyz?verbose'

export TARGET_MINOR='1.N'
export TARGET_VERSION='1.N.P'

# 已采用 pkgs.k8s.io 的主机；先备份并检查现有源，避免重复配置。
cat /etc/apt/sources.list.d/kubernetes.list
sudo cp -a /etc/apt/sources.list.d/kubernetes.list /etc/apt/sources.list.d/kubernetes.list.before-upgrade
sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL "https://pkgs.k8s.io/core:/stable:/v${TARGET_MINOR}/deb/Release.key" -o /tmp/kubernetes-release.key
sudo gpg --dearmor --yes -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg /tmp/kubernetes-release.key
echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v${TARGET_MINOR}/deb/ /" | sudo tee /etc/apt/sources.list.d/kubernetes.list
sudo apt-get update
apt-cache madison kubeadm kubelet kubectl

export PKG_VERSION='1.N.P-1.1' # 替换为查询结果，三包均须存在
sudo apt-mark unhold kubeadm
sudo apt-get install -y "kubeadm=$PKG_VERSION" && sudo apt-mark hold kubeadm
kubeadm version
sudo kubeadm config images pull --kubernetes-version "v$TARGET_VERSION"

sudo kubeadm upgrade plan
# 人工核对目标、etcd/CoreDNS/kube-proxy 变化后执行，保留交互确认。
sudo kubeadm upgrade apply "v$TARGET_VERSION"

sudo kubeadm upgrade node

export NODE='替换为一个节点名'
kubectl get pods -A --field-selector "spec.nodeName=$NODE" -o wide
kubectl drain "$NODE" --ignore-daemonsets --timeout=15m

sudo apt-mark unhold kubelet kubectl
sudo apt-get install -y "kubelet=$PKG_VERSION" "kubectl=$PKG_VERSION" && sudo apt-mark hold kubelet kubectl
sudo systemctl daemon-reload
sudo systemctl restart kubelet
sudo systemctl is-active kubelet
sudo journalctl -u kubelet -n 60 --no-pager

kubectl get node "$NODE" -o wide
kubectl wait --for=condition=Ready "node/$NODE" --timeout=5m
kubectl uncordon "$NODE"
kubectl get pods -A -o wide

export CHECK_NS='orders'
export CHECK_DEPLOYMENT='orders-api'
kubectl -n "$CHECK_NS" get pods -o wide
export CHECK_POD='REPLACE_POD_ON_UPGRADED_NODE'
kubectl -n "$CHECK_NS" wait --for=condition=Ready "pod/$CHECK_POD" --timeout=5m
kubectl -n "$CHECK_NS" rollout status "deployment/$CHECK_DEPLOYMENT" --timeout=5m
kubectl -n "$CHECK_NS" get pod "$CHECK_POD" -o jsonpath='{.spec.nodeName}{"\n"}{range .status.containerStatuses[*]}{.name}{" ready="}{.ready}{" restarts="}{.restartCount}{" last="}{.lastState}{"\n"}{end}'
kubectl -n "$CHECK_NS" get events --field-selector "involvedObject.kind=Pod,involvedObject.name=$CHECK_POD" --sort-by=.metadata.creationTimestamp