mkectl upgrade
mkectl upgrade#
Upgrade the cluster
mkectl upgrade [flags]
Examples#
For MKE 4 minor/patch upgrades, use command:
mkectl upgrade --upgrade-version <version_to_upgrade_to> --backup-path <existing_backup_path> --output <path to output folder>
For MKE 3 -> MKE 4 upgrades, use command:
mkectl upgrade --hosts-path <path-to-hosts-yaml> --mke3-admin-username <admin-username> --mke3-admin-password <admin-password> --external-address <external-address> --output <path to output folder>
hosts.yaml example for MKE 3 -> MKE 4 upgrades:
hosts:
- address: <host1-external-ip>
port: <ssh-port>
user: <ssh-user>
keyPath: <path-to-ssh-key>
privateAddress: <node-internal-ip> # optional, sets kubelet's --node-ip
- address: <host2-external-ip>
port: <ssh-port>
user: <ssh-user>
keyPath: <path-to-ssh-key>
privateInterface: <node-network-interface> # optional, mutually exclusive with privateAddress
# when set, used to determine privateAddress
Options#
--backup-path string Path to an existing mke backup tar to be used for rollback. If not provided, then one will be taken automatically before the upgrade starts.
--bpf-dns-patch Patch DNS for tigera-operator in BPF mode to make EC2 DNS work in tigera-operator pods
--chart-registry string Chart registry URL to pull MKE 4 charts from. It must be an OCI-based registry and always start with "oci://", e.g. oci://example-registry.com:5000/mke (default "oci://ghcr.io/mirantiscontainers")
--chart-registry-ca-file string Path to the local CA cert file for the chart registry
--chart-registry-password string Password for authenticating pulls from the chart registry. NOTE: only supported for upgrades from MKE 3; requires --chart-registry-username. May instead be set via the MKE_CHART_REGISTRY_PASSWORD environment variable.
--chart-registry-username string Username for authenticating pulls from the chart registry. NOTE: only supported for upgrades from MKE 3; requires --chart-registry-password
--check-ports Verify node-to-node connectivity for every required port before proceeding, and abort if any is blocked or held by a conflicting process. Equivalent to running 'mkectl check ports' first; adds an SSH round trip and a short-lived probe upload per node.
--cni-check-port int32 Use specified port number for verifying networking availability post CNI install (default 80)
--cni-check-timeout int Use specified timeout(in minutes) around verifying networking availability post CNI install (default 15)
--cni-check-timeout-windows int Use specified timeout(in minutes) around verifying Windows networking (node CNI readiness, pod DNS, pod connectivity); only applied when the cluster has Windows hosts (default 25)
--concurrency int Maximum number of nodes to configure in parallel, set to 0 for unlimited (default 30)
--config-out string Write the updated MKE 4 config to the given path after a successful upgrade
--config-snapshot-fallback string Which configuration the rollback backup bundles when the operator's config snapshot is not current: auto (the path's own policy), none (refuse any substitution, which stops the upgrade), last-known-good (the last fully reconciled snapshot), local (the client-supplied config), or live-unapplied (the spec as it stands, which the cluster has not successfully applied). live-unapplied is accepted here and nowhere else, and only makes sense when the outstanding change is known not to be what stopped the operator reconciling - the pre-upgrade check reports when the timestamps establish that (default "auto")
-d, --data-dir string Path to use for storing kubernetes provider data. Defaults to /var/lib/k0s. Must end with /k0s. Ignored if used with mke4 upgrade. (default "/var/lib/k0s")
--disable-cluster-validation Disable cluster validation prior to taking a pre-ugprade backup for 4->4 upgrades
--dry-run Perform a dry run of the upgrade without making any changes to the cluster. Use with --output to write results to a directory.
--existing-envoy-gateway-class string Use the specified[pre-existing] gateway class from envoy gateway installation that is already functional. Only applicable to upgrade from MKE3 to MKE4 and only when user elects to use an existing envoy gateway class by specifying the use-existing-envoy-gateway flag
--external-address string Public IP address or domain name of load balancer for MKE 4 manager nodes after upgrade from MKE3. Specify gateway listener port if it is different from 443. May be a CPLB IP when --lb-virtual-ip-cidr is provided. Not applicable to upgrades from MKE4 to MKE4
--feature-gates string MKE operator feature gates list, formatted formatted as "key1=value1,key2=value2,..."
--force Bypass user confirmations. All swarm workloads and configurations will be lost. NOTE: This flag is only supported for upgrades from MKE 3
--gateway-http-node-port int Specifies the NodePort to use for HTTP for Gateway API.
--gateway-https-node-port int Specifies the NodePort to use for HTTPS for Gateway API.
-h, --help help for upgrade
--hosts-path string Path to the hosts.yaml. NOTE: This flag is only supported for upgrades from MKE 3
--image-registry string Image registry URL to pull MKE 4 images from, e.g. exåmple-registry.com:5000/mke (default "ghcr.io/mirantiscontainers")
--image-registry-ca-file string Path to the local CA cert file for the image registry
--image-registry-password string Password for authenticating pulls from the image registry. NOTE: only supported for upgrades from MKE 3; requires --image-registry-username. May instead be set via the MKE_IMAGE_REGISTRY_PASSWORD environment variable.
--image-registry-username string Username for authenticating pulls from the image registry. NOTE: only supported for upgrades from MKE 3; requires --image-registry-password
--k0rdent-upgrade-timeout-minutes int Use specified timeout(in minutes) for waiting for k0rdent upgrade step to complete (default 20)
--lb-virtual-ip-cidr stringArray Enable ControlPlaneLoadBalancing for MKE 3 to MKE 4 upgrade using the provided virtual IP CIDR. Specify multiple times to provide multiple virtual IP CIDRs.
--lb-virtual-router-id int32 VRRP virtual router ID (1-255) for ControlPlaneLoadBalancing. Clusters sharing an L2 segment must not share it. Defaults to the last octet of the virtual IP that matches --external-address, falling back to the first virtual IP if none matches; a last octet of 0 wraps to 255.
--lease-adopt-stale if true, matching stale lease would be adopted instead of failing with error
--lease-renew-interval duration lease renew interval for cluster-wide/node operations, should be < leaseTTL (default 1m0s)
--lease-ttl duration lease TTL for cluster-wide/node operations (default 3m0s)
--mke3-admin-password string Admin password for the MKE 3 cluster. NOTE: This flag is only supported for upgrades from MKE 3
--mke3-admin-username string Admin username for the MKE 3 cluster. NOTE: This flag is only supported for upgrades from MKE 3
--mke3-airgapped Whether the MKE 3 cluster is airgapped. NOTE: This flag is only supported for upgrades from MKE 3
-o, --output string[="/home/runner/.local/state/mke/mke-upgrade"] Path to create the upgrade output files (summary, configs, checks). If the flag is not provided, they will be printed to standard output.
--port-probe-dir string Remote directory to upload and run the port probe from when --check-ports is set; use an exec-capable path when /tmp is mounted noexec (default "/tmp")
--remove-ingress-nginx By default, ingress-nginx is preserved upon upgrade from MKE3 to MKE4. This flag allows you to override that behavior.
--skip-addon-wait Do not wait for MKE addons to become deployed
--skip-backup-passphrase-secret Do not carry the MKE 3 backup passphrase into the MKE 4 Secret. Scheduled backups will fail until you create and label it yourself
--skip-cni-check Do not verify that networking is available
--skip-cpu-cores-check Do not run the check for sufficient CPU cores on nodes
--skip-image-presence-check Skip the image presence in registry check in airgap mode
--skip-os-check Skip the supported-OS-variant check. Use when nodes are running an OS patch level not yet on the supported list. The compatibility matrix in the docs remains the source of truth for officially supported variants.
--skip-total-memory-check Do not run the check for sufficient memory on nodes
--support-dump-no-sudo Use support dump commands without sudo for collecting support dump for the cluster
--support-dump-timeout int Use specified timeout(in minutes) around collecting support dump for the cluster (default 20)
--temp-dir string Directory on the controllers where k0s stages the pre-upgrade backup and, on rollback, unpacks it; it needs free space at least the size of the etcd database. Overrides spec.backup.tempDir; when both are empty k0s uses /tmp
--upgrade-timeout-minutes int Use specified timeout(in minutes) around the entirety of the upgrade (default 90)
--upgrade-version string Version of MKE to upgrade to. If not provided, the latest version will be used. (default "latest")
--use-existing-envoy-gateway Upon upgrade from MKE3 to MKE4, use existing envoy gateway installation and do not install the envoy-gateway addon.
Options inherited from parent commands#
-f, --file string path to the config file. Not needed for restore where config is loaded from the backup (default "mke4.yaml")
--kubeconfig string path to the kubeconfig file of the existing or restored cluster. DO NOT USE when creating a new cluster (default "/home/runner/.mke/mke.kubeconf")
-l, --logLevel string specify a log level (info, warn, debug, trace, error) (default "info")
--no-color when provided, disables colored output
--no-pretty-print when provided, disables pretty print output formatting
--version version[=true] --version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version