升级策略
v1.20.15–>v1.21.14–>v1.22.16->1.23.16
升级k8s前需先升级flannel插件，Flannel v0.14.0 兼容 Kubernetes 1.17 至 1.20 版本
升级flannel插件
# 确定namespace
# 删除daemonset和configmap
# 删除文件
rm -rf /var/lib/cni && rm -rf /etc/cni/net.d/*
# download目标版本flannel
github.com/flannel-io/flannel/releases
# 重新编辑flannel
kubectl apply -f flannel.yaml
配置源
vim /etc/yum.repos.d/kubernetes.repo
[kubernetes]
......
yum clean all && yum makecache
确定升级版本
yum list --showduplicates kubeadm --disableexcludes=kubernetes
升级master，每次升级需替换版本
①所有 master 节点操作
# 升级kubeadm
yum install -y kubeadm-1.21.14-0 --disableexcludes=kubernetes # --disableexcludes=kubernetes：禁掉除了这个kubernetes之外的别的仓库
# 升级完成后验证版本
kubeadm version
# 验证升级计划。检查当前集群是否可被升级
kubeadm upgrade plan --ignore-preflight-errors=CoreDNSUnsupportedPlugins,CoreDNSMigration # kubeadm-config的CoreDNS 配置或版本信息存在差异导致计划无法执行，可忽略
# 将 master1 升级到目标版本
kubeadm upgrade apply v1.21.14 --ignore-preflight-errors=CoreDNSUnsupportedPlugins,CoreDNSMigration
升级时虚临时替换kubeadm-config的imageRepository: registry.cn-hangzhou.aliyuncs.com/google_containers，用于临时获取镜像
# 其他mstaer
kubeadm upgrade node
# 升级kubectl和kubelet
## 1.将当前节点标记为不可调度，并驱逐节点上的Pod
kubectl drain <节点名称> --ignore-daemonsets --delete-emptydir-data
##说明：
##--ignore-daemonsets 无视DaemonSet管理下的Pod。即--ignore-daemonsets往往需要指定的,这是
#因为deamonset会忽略unschedulable标签(使用kubectl drain时会自动给节点打上不可调度标签),
#由于deamonset控制器控制的pod被删除后可能马上又在此节点上启动起来,这样就会成为死循环。因此
#这里忽略daemonset。
## 2.升级kubelet和kubectl组件
yum install -y kubelet-1.21.14-0 kubectl-1.21.14-0 --disableexcludes=kubernetes
##说明： --disableexcludes=kubernetes：禁掉除了这个kubernetes之外的别的仓库
## 3.重启kubelet
systemctl daemon-reload && systemctl restart kubelet
## 4.恢复当前节点上的Pod调度，使其上线
kubectl uncordon <节点名称>
升级worker
# 升级kubeadm
yum install -y kubeadm-1.21.14-0 --disableexcludes=kubernetes
# 查看版本
kubeadm version
# 升级 node 节点
kubeadm upgrade node
# 设置节点不可调度并排空节点。只有1个worker节点时忽略此步，因为可能会报错
kubectl drain node1 --ignore-daemonsets
# 升级kubelet和kubectl组件
yum install -y kubelet-1.21.14-0 kubectl-1.21.14-0 --disableexcludes=kubernetes
# 重启kubelet
systemctl daemon-reload && systemctl restart kubelet
# 恢复当前节点上的Pod调度。只有1个worker节点时忽略此步
kubectl uncordon node1 # node1 为worker节点名称
重复执行上述步骤直到升级到指定版本
升级过程遇到问题
1、flannel版本过低，pod无法启动。
使用高版本flannel。
2、docker切换containerd
# [ERROR ImagePull]: failed to pull image registry.cn-hangzhou.aliyuncs.com/google_containers/kube-controller-manager:v1.24.16: output: time="2024-12-23T10:22:44+08:00" level=fatal msg="validate service connection: validate CRI v1 image API for endpoint \"unix:///var/run/dockershim.sock\": rpc error: code = Unimplemented desc = unknown service runtime.v1.ImageService", error: exit status 1
1、配置 /etc/containerd/config.toml
2、重启 systemctl restart containerd
3、更新 /etc/default/kubelet 或 /var/lib/kubelet/kubeadm-flags.env，确保 Kubelet 使用正确的 CRI 套接字：
KUBELET_EXTRA_ARGS="--container-runtime-endpoint=unix:///run/containerd/containerd.sock"
systemctl restart kubelet
# [ERROR ImagePull]: failed to pull image registry.cn-hangzhou.aliyuncs.com/google_containers/coredns:v1.8.6: output: time="2024-12-23T10:48:43+08:00" level=fatal msg="validate service connection: validate CRI v1 image API for endpoint \"unix:///var/run/dockershim.sock\": rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing: dial unix /var/run/dockershim.sock: connect: connection refused\""
ps aux | grep containerd
1、确保 /etc/crictl.yaml 配置正确（指向 containerd 的 socket）。
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
2、修改 /var/lib/kubelet/kubeadm-flags.env：
KUBELET_KUBEADM_ARGS="--container-runtime=remote --container-runtime-endpoint=unix:///run/containerd/containerd.sock --image-service-endpoint=unix:///run/containerd/containerd.sock"
3、重启
systemctl daemon-reload && systemctl restart kubelet
# Error: failed to parse kubelet flag: unknown flag: --network-plugin
1、编辑 /var/lib/kubelet/kubeadm-flags.env 或 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
去除 --network-plugin=cni
2、重启
systemctl daemon-reload && systemctl restart kubelet
# master
yum install -y kubeadm-1.21.14-0 --disableexcludes=kubernetes
yum install -y kubeadm-1.22.16-0 --disableexcludes=kubernetes
yum install -y kubeadm-1.23.16-0 --disableexcludes=kubernetes
yum install -y kubeadm-1.24.16-0 --disableexcludes=kubernetes
yum install -y kubeadm-1.25.6-0 --disableexcludes=kubernetes
kubeadm version
kubeadm upgrade plan --ignore-preflight-errors=CoreDNSUnsupportedPlugins,CoreDNSMigration
kubeadm upgrade apply v1.21.14 --ignore-preflight-errors=CoreDNSUnsupportedPlugins,CoreDNSMigration
kubeadm upgrade apply v1.22.16 --ignore-preflight-errors=CoreDNSUnsupportedPlugins,CoreDNSMigration
kubeadm upgrade apply v1.23.16 --ignore-preflight-errors=CoreDNSUnsupportedPlugins,CoreDNSMigration
kubeadm upgrade apply v1.24.16 --ignore-preflight-errors=CoreDNSUnsupportedPlugins,CoreDNSMigration
kubeadm upgrade apply v1.25.6 --ignore-preflight-errors=CoreDNSUnsupportedPlugins,CoreDNSMigration
kubeadm upgrade node
# 将当前节点标记为不可调度，并驱逐节点上的Pod
kubectl drain <节点名称> --ignore-daemonsets --delete-emptydir-data
yum install -y kubelet-1.21.14-0 kubectl-1.21.14-0 --disableexcludes=kubernetes
yum install -y kubelet-1.22.16-0 kubectl-1.22.16-0 --disableexcludes=kubernetes
yum install -y kubelet-1.23.16-0 kubectl-1.23.16-0 --disableexcludes=kubernetes
yum install -y kubelet-1.24.16-0 kubectl-1.24.16-0 --disableexcludes=kubernetes
yum install -y kubelet-1.25.6-0 kubectl-1.25.6-0 --disableexcludes=kubernetes
systemctl daemon-reload && systemctl restart kubelet
## 恢复当前节点上的Pod调度，使其上线
kubectl uncordon <节点名称>
# worker
yum install -y kubeadm-1.21.14-0 --disableexcludes=kubernetes
yum install -y kubeadm-1.22.16-0 --disableexcludes=kubernetes
yum install -y kubeadm-1.23.16-0 --disableexcludes=kubernetes
yum install -y kubeadm-1.24.16-0 --disableexcludes=kubernetes
yum install -y kubeadm-1.25.6-0 --disableexcludes=kubernetes
kubeadm version
kubeadm upgrade node
# 设置节点不可调度并排空节点。只有1个worker节点时忽略此步，因为可能会报错
kubectl drain node1 --ignore-daemonsets
yum install -y kubelet-1.21.14-0 kubectl-1.21.14-0 --disableexcludes=kubernetes
yum install -y kubelet-1.22.16-0 kubectl-1.22.16-0 --disableexcludes=kubernetes
yum install -y kubelet-1.23.16-0 kubectl-1.23.16-0 --disableexcludes=kubernetes
yum install -y kubelet-1.24.16-0 kubectl-1.24.16-0 --disableexcludes=kubernetes
yum install -y kubelet-1.25.6-0 kubectl-1.25.6-0 --disableexcludes=kubernetes
systemctl daemon-reload && systemctl restart kubelet
# 恢复当前节点上的Pod调度。只有1个worker节点时忽略此步
kubectl uncordon node1 # node1 为worker节点名称
