mkectl upgrade
mkectl upgrade#
Upgrade the cluster
mkectl upgrade [flags]
Examples#
For MKE 4 minor/patch upgrades, use command:
mkectl upgrade --upgrade-version <version_to_upgrade_to> --backup-path <existing_backup_path> --output <path to output folder>
For MKE 3 -> MKE 4 upgrades, use command:
mkectl upgrade --hosts-path <path-to-hosts-yaml> --mke3-admin-username <admin-username> --mke3-admin-password <admin-password> --external-address <external-address> --output <path to output folder>
hosts.yaml example for MKE 3 -> MKE 4 upgrades:
hosts:
- address: <host1-external-ip>
port: <ssh-port>
user: <ssh-user>
keyPath: <path-to-ssh-key>
privateAddress: <node-internal-ip> # optional, sets kubelet's --node-ip
- address: <host2-external-ip>
port: <ssh-port>
user: <ssh-user>
keyPath: <path-to-ssh-key>
privateInterface: <node-network-interface> # optional, mutually exclusive with privateAddress
# when set, used to determine privateAddress
Options#
--backup-path string Path to an existing mke backup tar to be used for rollback. If not provided, then one will be taken automatically before the upgrade starts.
--bpf-dns-patch Patch DNS for tigera-operator in BPF mode to make EC2 DNS work in tigera-operator pods
--chart-registry string Chart registry URL to pull MKE 4 charts from. It must be an OCI-based registry and always start with "oci://", e.g. oci://example-registry.com:5000/mke (default "oci://ghcr.io/mirantiscontainers")
--chart-registry-ca-file string Path to the local CA cert file for the chart registry
--cni-check-port int32 Use specified port number for verifying networking availability post CNI install (default 80)
--cni-check-timeout int Use specified timeout(in minutes) around verifying networking availability post CNI install (default 15)
--cni-check-timeout-windows int Use specified timeout(in minutes) around verifying Windows networking (node CNI readiness, pod DNS, pod connectivity); only applied when the cluster has Windows hosts (default 25)
--concurrency int Maximum number of nodes to configure in parallel, set to 0 for unlimited (default 30)
--config-out string Write the updated MKE 4 config to the given path after a successful upgrade
-d, --data-dir string Path to use for storing kubernetes provider data. Defaults to /var/lib/k0s. Must end with /k0s. Ignored if used with mke4 upgrade. (default "/var/lib/k0s")
--disable-cluster-validation Disable cluster validation prior to taking a pre-ugprade backup for 4->4 upgrades
--dry-run Perform a dry run of the upgrade without making any changes to the cluster. Use with --output to write results to a directory.
--existing-envoy-gateway-class string Use the specified[pre-existing] gateway class from envoy gateway installation that is already functional. Only applicable to upgrade from MKE3 to MKE4 and only when user elects to use an existing envoy gateway class by specifying the use-existing-envoy-gateway flag
--external-address string Public IP address or domain name of load balancer for MKE 4 manager nodes after upgrade from MKE3. Specify gateway listener port if it is different from 443. May be a CPLB IP when --lb-virtual-ip-cidr is provided. Not applicable to upgrades from MKE4 to MKE4
--feature-gates string MKE operator feature gates list, formatted formatted as "key1=value1,key2=value2,..."
--force Bypass user confirmations. All swarm workloads and configurations will be lost. NOTE: This flag is only supported for upgrades from MKE 3
--gateway-http-node-port int Specifies the NodePort to use for HTTP for Gateway API.
--gateway-https-node-port int Specifies the NodePort to use for HTTPS for Gateway API.
-h, --help help for upgrade
--hosts-path string Path to the hosts.yaml. NOTE: This flag is only supported for upgrades from MKE 3
--image-registry string Image registry URL to pull MKE 4 images from, e.g. exåmple-registry.com:5000/mke (default "ghcr.io/mirantiscontainers")
--image-registry-ca-file string Path to the local CA cert file for the image registry
--k0rdent-upgrade-timeout-minutes int Use specified timeout(in minutes) for waiting for k0rdent upgrade step to complete (default 20)
--lb-virtual-ip-cidr stringArray Enable ControlPlaneLoadBalancing for MKE 3 to MKE 4 upgrade using the provided virtual IP CIDR. Specify multiple times to provide multiple virtual IP CIDRs.
--lease-adopt-stale if true, matching stale lease would be adopted instead of failing with error
--lease-renew-interval duration lease renew interval for cluster-wide/node operations, should be < leaseTTL (default 1m0s)
--lease-ttl duration lease TTL for cluster-wide/node operations (default 3m0s)
--mke3-admin-password string Admin password for the MKE 3 cluster. NOTE: This flag is only supported for upgrades from MKE 3
--mke3-admin-username string Admin username for the MKE 3 cluster. NOTE: This flag is only supported for upgrades from MKE 3
--mke3-airgapped Whether the MKE 3 cluster is airgapped. NOTE: This flag is only supported for upgrades from MKE 3
-o, --output string[="/home/runner/.local/state/mke/mke-upgrade"] Path to create the upgrade output files (summary, configs, checks). If the flag is not provided, they will be printed to standard output.
--remove-ingress-nginx By default, ingress-nginx is preserved upon upgrade from MKE3 to MKE4. This flag allows you to override that behavior.
--skip-addon-wait Do not wait for MKE addons to become deployed
--skip-cni-check Do not verify that networking is available
--skip-cpu-cores-check Do not run the check for sufficient CPU cores on nodes
--skip-image-presence-check Skip the image presence in registry check in airgap mode
--skip-os-check Skip the supported-OS-variant check. Use when nodes are running an OS patch level not yet on the supported list. The compatibility matrix in the docs remains the source of truth for officially supported variants.
--skip-total-memory-check Do not run the check for sufficient memory on nodes
--support-dump-no-sudo Use support dump commands without sudo for collecting support dump for the cluster
--support-dump-timeout int Use specified timeout(in minutes) around collecting support dump for the cluster (default 20)
--upgrade-timeout-minutes int Use specified timeout(in minutes) around the entirety of the upgrade (default 90)
--upgrade-version string Version of MKE to upgrade to. If not provided, the latest version will be used. (default "latest")
--use-existing-envoy-gateway Upon upgrade from MKE3 to MKE4, use existing envoy gateway installation and do not install the envoy-gateway addon.
Options inherited from parent commands#
-f, --file string path to the config file. Not needed for restore where config is loaded from the backup (default "mke4.yaml")
--kubeconfig string path to the kubeconfig file of the existing or restored cluster. DO NOT USE when creating a new cluster (default "/home/runner/.mke/mke.kubeconf")
-l, --logLevel string specify a log level (info, warn, debug, trace, error) (default "info")
--no-color when provided, disables colored output
--no-pretty-print when provided, disables pretty print output formatting
--version version[=true] --version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version