ubuntu26.04，离线升级k8s，根据kubeadm的deb离线包 + 离线镜像，从现有k8s-v1.32.13升级到k8s-v1.33.9（NLB + 3 master + 2 worker节点）
ubuntu 26.04。
集群规划（5 节点）
master节点01，主机名：k8s-master-01，ip：172.21.64.36
master节点02，主机名：k8s-master-02，ip：172.21.64.37
master节点03，主机名：k8s-master-03，ip：172.21.64.38
工作节点01：主机名：k8s-worker-01，ip：172.21.64.39
工作节点02：主机名：k8s-worker-02，ip：172.21.64.40
| 机器名 | 内网 ip | 角色 |
| k8s-master-01 | 172.21.64.36 | master |
| k8s-master-02 | 172.21.64.37 | master |
| k8s-master-03 | 172.21.64.38 | master |
| k8s-worker-01 | 172.21.64.39 | worker |
| k8s-worker-02 | 172.21.64.40 | worker |
一，升级前准备离线包
1. 下载kubeadm -v1.33.9离线包
离线资源清单及下载流程参考：ubunbu 26.04，用bash脚本自动下载kubeadm的deb离线安装包
离线包目录结构：
/data/k8s/k8s-v1.33.9 ├── calico-images-v3.31.6.list ├── calico-images-v3.31.6.tar.gz ├── calico-v3.31.6.yaml ├── ingress-nginx-images-v1.14.5.list ├── ingress-nginx-images-v1.14.5.tar.gz ├── ingress-nginx-v1.14.5.yaml ├── k8s-debs │ ├── containerd.io_2.3.3-1~ubuntu.26.04~resolute_amd64.deb │ ├── cri-tools_1.33.0-1.1_amd64.deb │ ├── kubeadm_1.33.9-1.1_amd64.deb │ ├── kubectl_1.33.9-1.1_amd64.deb │ ├── kubelet_1.33.9-1.1_amd64.deb │ └── kubernetes-cni_1.6.0-1.1_amd64.deb ├── k8s-images-v1.33.9.list ├── k8s-images-v1.33.9.tar.gz └── k8s-offline.conf
2. 把离线包上传到所有节点
#!/bin/bash set -euo pipefail # 节点列表 nodes=( 172.21.64.36 172.21.64.37 172.21.64.38 172.21.64.39 172.21.64.40 ) src_dir="/data/k8s/k8s-v1.33.9" dst_dir="/data/k8s/k8s-v1.33.9" for ip in "${nodes[@]}"; do echo "=====================================" echo "处理节点 $ip" echo "=====================================" # 远程创建目录 ssh root@"$ip" "mkdir -p ${dst_dir}" # 同步全部离线资源 rsync -avz --progress ${src_dir}/ root@${ip}:${dst_dir}/ done echo "✅ 所有节点离线资源分发完成"
二，每个节点上备份etcd / 证书
# 1. 每个 master 上备份 etcd ETCDCTL_API=3 etcdctl snapshot save /opt/etcd-snapshot-$(date +%Y%m%d).db \ --endpoints=https://127.0.0.1:2379 \ --cacert=/etc/kubernetes/pki/etcd/ca.crt \ --cert=/etc/kubernetes/pki/etcd/server.crt \ --key=/etc/kubernetes/pki/etcd/server.key # 2. 确认 kubeadm-config 里的 imageRepository 没被改成加速器地址 # 如果改了，升级时会从加速器拉，离线环境会失败，要改回 registry.k8s.io kubectl get cm kubeadm-config -n kube-system -o yaml | grep imageRepository
三，升级
升级分三种角色：
| 节点 | 升级命令 |
| 第一个 master |
kubeadm upgrade plan kubeadm upgrade apply v1.33.9 |
| 其余 master | kubeadm upgrade node |
| worker | kubeadm upgrade node |
1. 【第一阶段，所有节点导入镜像】
1.1 所有节点导入镜像
cd /data/k8s/k8s-v1.33.9 # 导入镜像到 k8s.io 命名空间 nerdctl -n k8s.io load -i k8s-images-*.tar.gz nerdctl -n k8s.io load -i calico-images-*.tar.gz nerdctl -n k8s.io load -i ingress-nginx-images-*.tar.gz
1.2. 所有节点安装新版kubeadm（仅安装kubeadm，不要安装其它）
#所有节点安装新版kubeadm（仅安装kubeadm）
cd /data/k8s/k8s-v1.33.9/k8s-debs dpkg -i kubeadm_*.deb # 确认，应输出 v1.33.9 kubeadm version -o short
2.【第二阶段，master节点升级】
2.1 第一个 master（k8s-master-01）
这一步独占执行，不要在其他节点上同时做 upgrade 操作。
# 1. 备份 etcd（升级前最后一道保险） ETCDCTL_API=3 etcdctl snapshot save /data/k8s/etcd-snapshot-pre-upgrade.db \ --endpoints=https://127.0.0.1:2379 \ --cacert=/etc/kubernetes/pki/etcd/ca.crt \ --cert=/etc/kubernetes/pki/etcd/server.crt \ --key=/etc/kubernetes/pki/etcd/server.key # 2. 备份配置（防止 dpkg 覆盖） cp /etc/containerd/config.toml /etc/containerd/config.toml.bak # 3. 确认升级计划 kubeadm upgrade plan # 4. 执行控制平面升级（更新 apiserver/controller-manager/scheduler/etcd/coredns/kube-proxy 的 manifest） kubeadm upgrade apply v1.33.9 -y # 5. 升级 containerd（deb 包方式；如果是二进制 tar 包,则 tar -C /usr/local -xzf containerd-*.tar.gz） dpkg -i containerd.io_*.deb # 确认配置没被覆盖 diff /etc/containerd/config.toml /etc/containerd/config.toml.bak || true systemctl restart containerd # 6. 升级 kubelet + kubectl dpkg -i kubelet_*.deb kubectl_*.deb systemctl restart kubelet # 7. 等待节点 Ready kubectl get nodes k8s-master-01 # VERSION 应为 v1.33.9，STATUS Ready
2.2 其它 master节点
# 1. 备份配置（防止 dpkg 覆盖） cp /etc/containerd/config.toml /etc/containerd/config.toml.bak # 2. 升级本地控制平面静态 Pod + kubelet 配置 kubeadm upgrade node # 3. 升级 containerd dpkg -i containerd.io_*.deb diff /etc/containerd/config.toml /etc/containerd/config.toml.bak || true systemctl restart containerd # 4. 升级 kubelet + kubectl dpkg -i kubelet_*.deb kubectl_*.deb systemctl restart kubelet # 5. 确认 Ready 后再去下一个 master kubectl get nodes k8s-master-02
3. 【第三阶段，worker节点升级 】
worker 升级需要在 master-01 和 worker 本身 之间切换操作，穿插执行。以 k8s-worker-01 为例：
第 1 步：在 master-01 上 drain（腾空 worker）
kubectl drain k8s-worker-01 --ignore-daemonsets --delete-emptydir-data
第 2 步：在 k8s-worker-01 上执行升级
cd /data/k8s/k8v-v1.33.9/k8s-debs
# 先备份配置（防止 dpkg 覆盖） cp /etc/containerd/config.toml /etc/containerd/config.toml.bak # 升级 kubelet 配置 kubeadm upgrade node # 升级 containerd dpkg -i containerd.io_*.deb diff /etc/containerd/config.toml /etc/containerd/config.toml.bak || true systemctl restart containerd # 升级 kubelet + kubectl dpkg -i kubelet_*.deb kubectl_*.deb systemctl restart kubelet
第 3 步：回到 master-01 上 uncordon
kubectl uncordon k8s-worker-01
第 4 步：确认 Ready 后，对 k8s-worker-02 重复同样操作
4. 【第四阶段，在master-01节点升级calico 与ingress】
caliico与ingress 可以兼容三个大版本k8s，如果这个版本需要更新calico与 ingress。
把所有worker节点升级完后再升级calico 与 ingress
kubectl apply -f calico-v3.31.6.yaml kubectl apply -f ingress-nginx-v1.14.5.yaml
三，最终验证
所有节点升级完后：
kubectl get nodes -o wide # 5 个节点 VERSION 全部 v1.33.9，STATUS Ready kubectl get pods -n kube-system # 所有 Pod Running，没有 CrashLoopBackOff kubectl get pods -A | grep -v Running | grep -v Completed # 应该没有输出（除了正常的 Completed Job）
输出：
root@k8s-master-01:/data/k8s/k8s-v1.33.9/k8s-debs# kubectl get nodes -owide NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME k8s-master-01 Ready control-plane 17h v1.33.9 172.21.64.36 <none> Ubuntu 26.04 LTS 7.0.0-28-generic containerd://2.3.3 k8s-master-02 Ready control-plane 15h v1.33.9 172.21.64.37 <none> Ubuntu 26.04 LTS 7.0.0-28-generic containerd://2.3.3 k8s-master-03 Ready control-plane 15h v1.33.9 172.21.64.38 <none> Ubuntu 26.04 LTS 7.0.0-28-generic containerd://2.3.3 k8s-worker-01 Ready <none> 14h v1.33.9 172.21.64.39 <none> Ubuntu 26.04 LTS 7.0.0-28-generic containerd://2.3.3 k8s-worker-02 Ready <none> 14h v1.33.9 172.21.64.40 <none> Ubuntu 26.04 LTS 7.0.0-28-generic containerd://2.3.3 root@k8s-master-01:/data/k8s/k8s-v1.33.9/k8s-debs# kubectl get pod -A -owide NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES kube-system calico-kube-controllers-678b6c5f64-8lt4p 1/1 Running 2 (134m ago) 17h 192.168.151.134 k8s-master-01 <none> <none> kube-system calico-node-74l7c 1/1 Running 1 (40m ago) 14h 172.21.64.40 k8s-worker-02 <none> <none> kube-system calico-node-ccskt 1/1 Running 1 (40m ago) 14h 172.21.64.39 k8s-worker-01 <none> <none> kube-system calico-node-mvqx6 1/1 Running 1 (141m ago) 15h 172.21.64.37 k8s-master-02 <none> <none> kube-system calico-node-slmvj 1/1 Running 1 (155m ago) 17h 172.21.64.36 k8s-master-01 <none> <none> kube-system calico-node-xv5qh 1/1 Running 1 (139m ago) 15h 172.21.64.38 k8s-master-03 <none> <none> kube-system coredns-674b8bbfcf-9k624 1/1 Running 0 4m2s 192.168.183.129 k8s-master-03 <none> <none> kube-system coredns-674b8bbfcf-dqw49 1/1 Running 0 2m7s 192.168.36.194 k8s-worker-01 <none> <none> kube-system etcd-k8s-master-01 1/1 Running 2 (21m ago) 21m 172.21.64.36 k8s-master-01 <none> <none> kube-system etcd-k8s-master-02 1/1 Running 2 (9m11s ago) 9m11s 172.21.64.37 k8s-master-02 <none> <none> kube-system etcd-k8s-master-03 1/1 Running 2 (7m12s ago) 7m13s 172.21.64.38 k8s-master-03 <none> <none> kube-system kube-apiserver-k8s-master-01 1/1 Running 2 (21m ago) 21m 172.21.64.36 k8s-master-01 <none> <none> kube-system kube-apiserver-k8s-master-02 1/1 Running 2 (9m11s ago) 9m11s 172.21.64.37 k8s-master-02 <none> <none> kube-system kube-apiserver-k8s-master-03 1/1 Running 2 (7m12s ago) 7m13s 172.21.64.38 k8s-master-03 <none> <none> kube-system kube-controller-manager-k8s-master-01 1/1 Running 1 (21m ago) 21m 172.21.64.36 k8s-master-01 <none> <none> kube-system kube-controller-manager-k8s-master-02 1/1 Running 1 (9m11s ago) 9m11s 172.21.64.37 k8s-master-02 <none> <none> kube-system kube-controller-manager-k8s-master-03 1/1 Running 1 (7m12s ago) 7m13s 172.21.64.38 k8s-master-03 <none> <none> kube-system kube-proxy-6tfgz 1/1 Running 0 6m46s 172.21.64.36 k8s-master-01 <none> <none> kube-system kube-proxy-7dkxq 1/1 Running 0 7m12s 172.21.64.38 k8s-master-03 <none> <none> kube-system kube-proxy-k6s2r 1/1 Running 0 7m20s 172.21.64.37 k8s-master-02 <none> <none> kube-system kube-proxy-vk6p7 1/1 Running 0 7m18s 172.21.64.40 k8s-worker-02 <none> <none> kube-system kube-proxy-wqbvp 1/1 Running 0 7m19s 172.21.64.39 k8s-worker-01 <none> <none> kube-system kube-scheduler-k8s-master-01 1/1 Running 1 (21m ago) 21m 172.21.64.36 k8s-master-01 <none> <none> kube-system kube-scheduler-k8s-master-02 1/1 Running 1 (9m11s ago) 9m11s 172.21.64.37 k8s-master-02 <none> <none> kube-system kube-scheduler-k8s-master-03 1/1 Running 1 (7m12s ago) 7m13s 172.21.64.38 k8s-master-03 <none> <none>
浙公网安备 33010602011771号