升级 Azure Stack Hub 上的 Kubernetes 群集Upgrade a Kubernetes cluster on Azure Stack Hub

升级群集Upgrade a cluster

使用 AKS 引擎可升级最初使用工具部署的群集。The AKS engine allows you to upgrade the cluster that was originally deployed using the tool. 可使用 AKS 引擎维护群集。You can maintain the clusters using the AKS engine. 维护任务类似于任何 IaaS 系统。Your maintenance tasks are similar to any IaaS system. 需要注意新更新的可用性并使用 AKS 引擎应用这些更新。You should be aware of the availability of new updates and use the AKS engine to apply them.

升级命令将更新 Kubernetes 版本和基本 OS 映像。The upgrade command updates the Kubernetes version and the base OS image. 每次运行升级命令时,AKS 引擎会使用与所使用的 aks-engine 版本相关联的 AKS 基础映像,为群集的每个节点创建一个新 VM****。Every time that you run the upgrade command, for every node of the cluster, the AKS engine creates a new VM using the AKS Base Image associated to the version of aks-engine used. 可以使用 aks-engine upgrade 命令来维护群集中每个主节点和代理节点的货币。You can use the aks-engine upgrade command to maintain the currency of every master and agent node in your cluster.

Azure 不管理群集。Azure doesn't manage your cluster. 但可使用 Azure 提供的工具和 VM 映像来管理群集。But Azure provides the tool and VM image you can use to manage your cluster.

对于已部署的群集,升级包括:For a deployed cluster upgrades cover:

  • kubernetesKubernetes
  • Azure Stack Hub Kubernetes 提供程序Azure Stack Hub Kubernetes provider
  • 基本 OSBase OS

升级生产群集时,请考虑以下事项:When upgrading a production cluster, consider:

  • 是否为目标群集使用了正确的群集规范 (apimodel.json) 和资源组?Are you using the correct cluster specification (apimodel.json) and resource group for the target cluster?
  • 是否为客户端计算机使用了可靠的计算机来运行 AKS 引擎并从中执行升级操作?Are you using a reliable machine for the client machine to run the AKS engine and from which you are performing upgrade operations?
  • 请确保拥有可操作的备份群集。Make sure that you have a backup cluster and that it is operational.
  • 如果可能,请从 Azure Stack Hub 环境中的 VM 运行命令,以减少网络跃点和潜在的连接故障。If possible, run the command from a VM within the Azure Stack Hub environment to decrease the network hops and potential connectivity failures.
  • 请确保订阅有足够的空间来完成整个过程。Make sure that your subscription has enough space for the entire process. 相应进程将在此过程中分配新的 VM。The process allocates new VMs during the process.
  • 未规划系统更新或计划的任务。No system updates or scheduled tasks are planned.
  • 在精确配置为生产群集的群集上,设置分阶段升级,并在生产群集中执行此操作之前,在该群集上测试升级Set up a staged upgrade on a cluster that is configured exactly as the production cluster and test the upgrade there before doing so in your production cluster

升级到更新的 Kubernetes 版本的步骤Steps to upgrade to a newer Kubernetes version

备注

如果使用的是较新版本的 aks-engine 且应用市场提供映像,也将升级 AKS 基础映像。The AKS base image will also be upgrade if you are using a newer version of the aks-engine and the image is available in the marketplace.

下面的说明使用最少的步骤来执行升级。The following instructions use the minimum steps to perform the upgrade. 有关详细信息,请参阅升级 Kubernetes 群集一文。If would like additional detail, see the article Upgrading Kubernetes Clusters.

  1. 需要首先确定可用于升级的版本。You need to first determine the versions you can target for the upgrade. 此版本取决于当前拥有的版本,然后使用该版本值执行升级。This version depends on the version you currently have and then use that version value to perform the upgrade. 最新更新支持的 Kubernetes 版本为 1.14.7 和 1.15.10。The versions of Kubernetes supported in the latest update are 1.14.7 and 1.15.10. 按此表查看可用的升级:Follow this table for the upgrades available:
当前版本Current version 可用升级Upgrade available
1.14.71.14.7 1.15.101.15.10
1.14.81.14.8 1.15.101.15.10
1.15.41.15.4 1.15.101.15.10
1.15.51.15.5 1.15.101.15.10

有关 AKS 引擎、AKS 基础映像和 Kubernetes 版本的完整映射,请参阅受支持的 AKS 引擎版本For a complete mapping of AKS engine, AKS Base Image and Kubernetes versions see Supported AKS Engine Versions.

  1. 收集运行 upgrade 命令所需的信息。Collect the information you will need to run the upgrade command. 该升级使用以下参数:The upgrade uses the following parameters:

    参数Parameter 示例Example 说明Description
    azure-envazure-env AzureStackCloudAzureStackCloud 若要向 AKS 引擎指示目标平台是 Azure Stack Hub,请使用 AzureStackCloudTo indicate to AKS engine that your target platform is Azure Stack Hub use AzureStackCloud.
    locationlocation locallocal Azure Stack Hub 的区域名称。The region name for your Azure Stack Hub. 对于 ASDK,此区域设置为 localFor the ASDK, the region is set to local.
    resource-groupresource-group kube-rgkube-rg 输入新资源组的名称,或者选择现有资源组。Enter the name of a new resource group or select an existing resource group. 资源名称必须为字母数字,且必须小写。The resource name needs to be alphanumeric and lowercase.
    subscription-idsubscription-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 输入订阅 ID。Enter your Subscription ID. 有关详细信息,请参阅订阅套餐For more information, see Subscribe to an offer
    api-modelapi-model ./kubernetes-azurestack.json./kubernetes-azurestack.json 群集配置文件的路径或 API 模型。Path to the cluster configuration file, or API model.
    client-idclient-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 输入服务主体 GUID。Enter the service principal GUID. Azure Stack Hub 管理员创建服务主体时标识为应用程序 ID 的客户端 ID。The Client ID identified as the Application ID when your Azure Stack Hub administrator created the service principal.
    client-secretclient-secret xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 输入服务主体密码。Enter the service principal secret. 这是在创建服务时设置的客户端机密。This is the client secret you set up when creating your service.
    identity-systemidentity-system adfsadfs 可选。Optional. 如果使用 Active Directory 联合身份验证服务 (AD FS),请指定标识管理解决方案。Specify your identity management solution if you are using Active Directory Federated Services (AD FS).
  2. 准备好值后,请运行以下命令:With your values in place, run the following command:

    aks-engine upgrade \
    --azure-env AzureStackCloud \
    --location <for an ASDK is local> \
    --resource-group kube-rg \
    --subscription-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
    --api-model kube-rg/apimodel.json \
    --upgrade-version 1.13.5 \
    --client-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
    --client-secret xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
    --identity-system adfs # required if using AD FS
    
  3. 如果由于任何原因升级操作遇到故障,可以在解决问题后重新运行升级命令。If for any reason the upgrade operation encounters a failure, you can rerun the upgrade command after addressing the issue. AKS 引擎将继续从之前失败的操作开始运行。The AKS engine will resume the operation where it failed the previous time.

仅升级 OS 映像的步骤Steps to only upgrade the OS image

  1. 查看 supported-kubernetes-versions 表并确定是否有升级所需的 aks-engine 和 AKS 基础映像版本。Review the supported-kubernetes-versions table and determine if you have the version of aks-engine and AKS base Image that you plan for your upgrade. 查看 aks-engine 运行的版本:aks-engine versionTo view the version of aks-engine run: aks-engine version.
  2. 相应地升级 AKS 引擎,在安装了 aks-engine 的计算机中运行:./get-akse.sh --version vx.xx.x,并将 x.xx.x 替换为目标版本****。Upgrade your AKS engine accordingly, in the machine where you have installed aks-engine run: ./get-akse.sh --version vx.xx.x replacing x.xx.x with your targeted version.
  3. 要求 Azure Stack Hub 操作员在 Azure Stack Hub 市场中添加所需的计划使用的 AKS 基础映像版本。Ask your Azure Stack Hub operator to add the version of the AKS Base Image you need in the Azure Stack Hub Marketplace that you plan to use.
  4. 使用正在使用的 Kubernetes 版本运行 aks-engine upgrade 命令,但添加 --forceRun the aks-engine upgrade command using the same version of Kubernetes that you are already using, but add the --force. 可在强制升级中查看示例。You can see an example in Forcing an upgrade.

强制升级Forcing an upgrade

在某些情况下,可能需要强制实施群集升级。There may be conditions where you may want to force an upgrade of your cluster. 例如,在第一天,你使用最新 Kubernetes 版本在断开连接的环境中部署群集。For example, on day one you deploy a cluster in a disconnected environment using the latest Kubernetes version. 第二天,Ubuntu 发布了一个漏洞修补程序,Microsoft 为其生成了新的 AKS 基础映像****。The following day Ubuntu releases a patch to a vulnerability for which Microsoft generates a new AKS Base Image. 这时就可以使用已部署的 Kubernetes 版本强制进行升级来应用新映像。You can apply the new image by forcing an upgrade using the same Kubernetes version you already deployed.

aks-engine upgrade \
--azure-env AzureStackCloud   
--location <for an ASDK is local> \
--resource-group kube-rg \
--subscription-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
--api-model kube-rg/apimodel.json \
--upgrade-version 1.13.5 \
--client-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
--client-secret xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
--force

有关说明,请参阅强制升级For instructions, see Force upgrade.

后续步骤Next steps