查看当前的系统环境信息
系统环境
# 系统版本
[root@k8smaster ~]# cat /etc/os-release
NAME="Kylin Linux Advanced Server"
VERSION="V10 (Halberd)"
ID="kylin"
VERSION_ID="V10"
PRETTY_NAME="Kylin Linux Advanced Server V10 (Halberd)"
ANSI_COLOR="0;31"
[root@k8smaster ~]# cat /etc/kylin-release
Kylin Linux Advanced Server release V10 (Halberd)
[root@k8smaster ~]# yum repolist
repo id repo name
docker-ce-stable Docker CE Stable - x86_64
ks10-adv-os Kylin Linux Advanced Server 10 - Os
ks10-adv-updates Kylin Linux Advanced Server 10 - Updates
kubernetes Kubernetes
[root@k8smaster ~]# cat /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
上述仓库的配置文件存在一个关键问题：阿里云的 Kubernetes YUM 镜像源路径已经变更，旧路径 kubernetes-el7-x86_64 可能已失效或不再更新（尤其是针对较新版本的 Kubernetes）。
⚠️ 主要风险
版本过旧/不可用：阿里云已将 Kubernetes 镜像迁移至新路径。旧路径通常只保留到 v1.28 左右的版本，无法安装 v1.29+ 等新版本。
GPG 校验关闭：gpgcheck=0 和 repo_gpgcheck=0 虽然方便，但在生产环境中存在安全风险。
# 查询当前配置最高支持的kubernetes的版本
# 查看 kubelet 的所有可用版本（kubelet 版本即 K8s 版本）
yum list available kubelet --showduplicates | grep -E "^kubelet" | awk '{print $2}' | sort -V
# 同时查看 kubeadm 和 kubectl 确保三件套版本一致
yum list available kubeadm kubectl --showduplicates | grep -E "^(kubeadm|kubectl)" | awk '{print $1, $2}' | sort -V
# 经查询最高支持到V1.28.2-0查看适配的版本信息
若上面查到的最高版本低于你需要的版本（如 < v1.29），请先更新 repo 文件：
# 备份原配置
cp /etc/yum.repos.d/kubernetes.repo /etc/yum.repos.d/kubernetes.repo.old
# 写入新版镜像源（以 v1.30 为例，可改为 v1.29/v1.31 等）
cat > /etc/yum.repos.d/kubernetes.repo << 'EOF'
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.30/rpm/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes-new/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes-new/doc/rpm-package-key.gpg
EOF
# 刷新缓存
yum clean all && yum makecache
# 再次查询
yum list available kubelet --showduplicates | grep -E "^kubelet" | awk '{print $2}' | sort -V3. 在线查看阿里云所有可用版本目录
无需修改本地配置，直接浏览镜像站目录结构：
# 查看所有可用的稳定版大版本
curl -s https://mirrors.aliyun.com/kubernetes-new/core/stable/ | grep -oP 'v[0-9]+\.[0-9]+' | sort -V
# 查看某个大版本下的具体小版本（以 v1.30 为例）
curl -s https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.30/rpm/ | grep -oP 'kubelet-[0-9][^"]+' | sort -V你的内核版本是 4.19.90（麒麟 V10 定制版），这是基于 Linux 4.19 LTS 的分支。以下是 Kubernetes 各版本对内核的最低要求及与你当前内核的兼容性分析：
📊 Kubernetes 版本与内核兼容性对照表
📌 结论：你的 4.19.90 内核可以运行 K8s v1.28 ~ v1.31 的所有版本，无需升级内核。
升级kubernetes
kubeadm 不支持跨小版本升级！必须分两步走：
v1.28.2 → v1.29.x → v1.30.x
1、升级前准备
# 确认当前版本
kubectl version
kubeadm version
# 确认节点状态全部 Ready
kubectl get nodes -o wide
# 确认组件健康
kubectl get pods -A
kubectl get --raw='/readyz?verbose'
# 确认容器运行时（1.24+ 不支持 dockershim）
kubectl get nodes -o wide # 看 CONTAINER-RUNTIME 列，应为 containerd://2、备份edtd（十分重要）
# 方式一：使用 kubeadm 自带的 etcd 快照备份
ETCD_POD=$(kubectl -n kube-system get pods -l component=etcd -o name | head -1)
kubectl -n kube-system exec $ETCD_POD -- etcdctl \
--endpoints=https://127.0.0.1:2379 \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/server.crt \
--key=/etc/kubernetes/pki/etcd/server.key \
snapshot save /var/lib/etcd/snapshot-$(date +%F-%H%M).db
# etcd 静态 Pod 默认将 /var/lib/etcd 挂载为宿主机目录，Pod 的 /var/lib/etcd 就是宿主机的 /var/lib/etcd，etcdctl snapshot save 写入的路径对宿主机直接可见
# 将快照拷贝出来异地保存
mkdir -p /backup/etcd
cp /var/lib/etcd/snapshot-*.db /backup/etcd/
ls -lh /backup/etcd/
# 方式二：直接冷备份整个 PKI 和配置（简单粗暴但有效）
mkdir -p /backup/k8s-$(date +%F)
cp -a /etc/kubernetes /backup/k8s-$(date +%F)/
cp -a /var/lib/etcd /backup/k8s-$(date +%F)/ # 需在 etcd 停止或低峰期操作3、查看版本的兼容性
# 各组件版本偏差要求：
# - kubeadm/kubectl: 与 kubelet 相差不超过 ±1 个小版本
# - kubelet: 不得高于 control-plane 版本
# - kube-proxy: 与 kubelet 同规则
# 检查 CNI 插件是否兼容 1.30（Flannel/Calico 主流版本均兼容）
kubectl -n kube-system get pods | grep -E "flannel|calico|cilium"第一阶段：v1.28.2 → v1.29.x
1.1 切换 yum 源到新版仓库（旧 el7 源没有 1.29+）
# 在所有节点执行（master + worker）
mv /etc/yum.repos.d/kubernetes.repo /etc/yum.repos.d/kubernetes.repo.old
cat > /etc/yum.repos.d/kubernetes.repo << 'EOF'
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.29/rpm/
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes-new/doc/rpm-package-key.gpg
EOF
yum clean all && yum makecache
# 查看 1.29 最新补丁版本（记下版本号，如 1.29.x-150500.1.1）
yum list available kubeadm --showduplicates | tail -5📌 注意：新源的版本号后缀格式变了，从
1.28.2-0变为1.29.x-150500.1.1这种格式。
1.2 升级 Master 节点的 kubeadm
# 仅在 master 节点执行
# 将 <version> 替换为上一步查到的 1.29 最新版本号（含后缀）
# 只取第2列（真正的版本号）
VERSION=$(yum list available kubeadm --showduplicates | grep 'kubeadm.x86_64' | tail -1 | awk '{print $2}')
echo "将安装版本: $VERSION"
# 预期输出: 将安装版本: 1.29.15-150500.1.1
# 安装
yum install -y kubeadm-$VERSION --disableexcludes=kuberneteskubeadm 装好后，记得同步升级三件套 kubelet 和 kubectl
# 查看可用版本确认一致
yum list available kubelet kubectl --showduplicates | grep "$VERSION"
# 安装
yum install -y kubelet-$VERSION kubectl-$VERSION --disableexcludes=kubernetes
# 重启 kubelet
systemctl daemon-reload && systemctl restart kubelet安装完成后执行 kubeadm version 确认版本为 1.29.15，然后继续 kubeadm upgrade plan
1.3 预检升级计划
[root@k8smaster ~]# kubeadm upgrade plan
[upgrade/config] Making sure the configuration is correct:
[upgrade/config] Reading configuration from the cluster...
[upgrade/config] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[preflight] Running pre-flight checks.
[upgrade] Running cluster health checks
[upgrade] Fetching available versions to upgrade to
[upgrade/versions] Cluster version: v1.28.2
[upgrade/versions] kubeadm version: v1.29.15
I0907 17:30:16.246502 989347 version.go:256] remote version is much newer: v1.37.0; falling back to: stable-1.29
[upgrade/versions] Target version: v1.29.15
[upgrade/versions] Latest version in the v1.28 series: v1.28.15
Components that must be upgraded manually after you have upgraded the control plane with 'kubeadm upgrade apply':
COMPONENT CURRENT TARGET
kubelet 2 x v1.28.2 v1.28.15
1 x v1.29.15 v1.28.15
Upgrade to the latest version in the v1.28 series:
COMPONENT CURRENT TARGET
kube-apiserver v1.28.2 v1.28.15
kube-controller-manager v1.28.2 v1.28.15
kube-scheduler v1.28.2 v1.28.15
kube-proxy v1.28.2 v1.28.15
CoreDNS v1.10.1 v1.11.1
etcd 3.5.9-0 3.5.16-0
You can now apply the upgrade by executing the following command:
kubeadm upgrade apply v1.28.15
_____________________________________________________________________
Components that must be upgraded manually after you have upgraded the control plane with 'kubeadm upgrade apply':
COMPONENT CURRENT TARGET
kubelet 2 x v1.28.2 v1.29.15
1 x v1.29.15 v1.29.15
Upgrade to the latest stable version:
COMPONENT CURRENT TARGET
kube-apiserver v1.28.2 v1.29.15
kube-controller-manager v1.28.2 v1.29.15
kube-scheduler v1.28.2 v1.29.15
kube-proxy v1.28.2 v1.29.15
CoreDNS v1.10.1 v1.11.1
etcd 3.5.9-0 3.5.16-0
You can now apply the upgrade by executing the following command:
kubeadm upgrade apply v1.29.15
_____________________________________________________________________
The table below shows the current state of component configs as understood by this version of kubeadm.
Configs that have a "yes" mark in the "MANUAL UPGRADE REQUIRED" column require manual config upgrade or
resetting to kubeadm defaults before a successful upgrade can be performed. The version to manually
upgrade to is denoted in the "PREFERRED VERSION" column.
API GROUP CURRENT VERSION PREFERRED VERSION MANUAL UPGRADE REQUIRED
kubeproxy.config.k8s.io v1alpha1 v1alpha1 no
kubelet.config.k8s.io v1beta1 v1beta1 no
_____________________________________________________________________
输出应显示可以升级到 v1.29.x，并列出各组件当前/目标版本。仔细检查有无报错，若有组件版本偏差过大会阻止升级。
1.4 执行控制平面升级
# 第一个 master 节点执行（多 master 时其余节点用 kubeadm upgrade node）
kubeadm upgrade apply v1.29.x # x 替换为实际补丁号
# 确认交互提示，输入 y
# 升级过程会自动更新 etcd、apiserver、controller-manager、scheduler 的静态 Pod
# 输出
[upgrade/config] Making sure the configuration is correct:
[upgrade/config] Reading configuration from the cluster...
[upgrade/config] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[preflight] Running pre-flight checks.
[upgrade] Running cluster health checks
[upgrade/version] You have chosen to change the cluster version to "v1.29.15"
[upgrade/versions] Cluster version: v1.28.2
[upgrade/versions] kubeadm version: v1.29.15
[upgrade] Are you sure you want to proceed? [y/N]: y
[upgrade/prepull] Pulling images required for setting up a Kubernetes cluster
[upgrade/prepull] This might take a minute or two, depending on the speed of your internet connection
[upgrade/prepull] You can also perform this action in beforehand using 'kubeadm config images pull'
W0907 17:35:09.226667 999187 checks.go:835] detected that the sandbox image "registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.6" of the container runtime is inconsistent with that used by kubeadm. It is recommended that using "registry.cn-hangzhou.aliyuncs.com/google_containers/pause:3.9" as the CRI sandbox image.
[upgrade/apply] Upgrading your Static Pod-hosted control plane to version "v1.29.15" (timeout: 5m0s)...
[upgrade/etcd] Upgrading to TLS for etcd
[upgrade/staticpods] Preparing for "etcd" upgrade
[upgrade/staticpods] Renewing etcd-server certificate
[upgrade/staticpods] Renewing etcd-peer certificate
[upgrade/staticpods] Renewing etcd-healthcheck-client certificate
[upgrade/staticpods] Moved new manifest to "/etc/kubernetes/manifests/etcd.yaml" and backed up old manifest to "/etc/kubernetes/tmp/kubeadm-backup-manifests-2026-09-07-17-35-15/etcd.yaml"
[upgrade/staticpods] Waiting for the kubelet to restart the component
[upgrade/staticpods] This might take a minute or longer depending on the component/version gap (timeout 5m0s)
[apiclient] Found 1 Pods for label selector component=etcd
[upgrade/staticpods] Component "etcd" upgraded successfully!
[upgrade/etcd] Waiting for etcd to become available
[upgrade/staticpods] Writing new Static Pod manifests to "/etc/kubernetes/tmp/kubeadm-upgraded-manifests386424153"
[upgrade/staticpods] Preparing for "kube-apiserver" upgrade
[upgrade/staticpods] Renewing apiserver certificate
[upgrade/staticpods] Renewing apiserver-kubelet-client certificate
[upgrade/staticpods] Renewing front-proxy-client certificate
[upgrade/staticpods] Renewing apiserver-etcd-client certificate
[upgrade/staticpods] Moved new manifest to "/etc/kubernetes/manifests/kube-apiserver.yaml" and backed up old manifest to "/etc/kubernetes/tmp/kubeadm-backup-manifests-2026-09-07-17-35-15/kube-apiserver.yaml"
[upgrade/staticpods] Waiting for the kubelet to restart the component
[upgrade/staticpods] This might take a minute or longer depending on the component/version gap (timeout 5m0s)
[apiclient] Found 1 Pods for label selector component=kube-apiserver
[upgrade/staticpods] Component "kube-apiserver" upgraded successfully!
[upgrade/staticpods] Preparing for "kube-controller-manager" upgrade
[upgrade/staticpods] Renewing controller-manager.conf certificate
[upgrade/staticpods] Moved new manifest to "/etc/kubernetes/manifests/kube-controller-manager.yaml" and backed up old manifest to "/etc/kubernetes/tmp/kubeadm-backup-manifests-2026-09-07-17-35-15/kube-controller-manager.yaml"
[upgrade/staticpods] Waiting for the kubelet to restart the component
[upgrade/staticpods] This might take a minute or longer depending on the component/version gap (timeout 5m0s)
[apiclient] Found 1 Pods for label selector component=kube-controller-manager
[upgrade/staticpods] Component "kube-controller-manager" upgraded successfully!
[upgrade/staticpods] Preparing for "kube-scheduler" upgrade
[upgrade/staticpods] Renewing scheduler.conf certificate
[upgrade/staticpods] Moved new manifest to "/etc/kubernetes/manifests/kube-scheduler.yaml" and backed up old manifest to "/etc/kubernetes/tmp/kubeadm-backup-manifests-2026-09-07-17-35-15/kube-scheduler.yaml"
[upgrade/staticpods] Waiting for the kubelet to restart the component
[upgrade/staticpods] This might take a minute or longer depending on the component/version gap (timeout 5m0s)
[apiclient] Found 1 Pods for label selector component=kube-scheduler
[upgrade/staticpods] Component "kube-scheduler" upgraded successfully!
[upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
[kubelet] Creating a ConfigMap "kubelet-config" in namespace kube-system with the configuration for the kubelets in the cluster
[upgrade] Backing up kubelet config file to /etc/kubernetes/tmp/kubeadm-kubelet-config2925336551/config.yaml
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubeconfig] Writing "admin.conf" kubeconfig file
[kubeconfig] Writing "super-admin.conf" kubeconfig file
[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to get nodes
[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
[bootstrap-token] Configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
[bootstrap-token] Configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
[addons] Applied essential addon: CoreDNS
[addons] Applied essential addon: kube-proxy
[upgrade/successful] SUCCESS! Your cluster was upgraded to "v1.29.15". Enjoy!
[upgrade/kubelet] Now that your control plane is upgraded, please proceed with upgrading your kubelets if you haven't already done so.
多 Master 场景：其余 master 节点只执行：
kubeadm upgrade node1.5 驱逐节点上的 Pod
# 将 <master-node-name> 替换为实际节点名（kubectl get nodes 查看）
kubectl drain k8smaster --ignore-daemonsets --delete-emptydir-data1.7 恢复节点调度
kubectl uncordon k8smaster1.8 升级 Worker 节点（逐个执行）
对每个 worker 节点重复以下步骤（一次一个，保证业务可用性）：
# ① 在 worker 节点上：切换源（同 1.1）+ 安装新版 kubeadm（同 1.2）
# ② 升级 kubelet 配置
kubeadm upgrade node
# ③ 在 master 上驱逐该 worker
kubectl drain <worker-node> --ignore-daemonsets
# ④ 在 worker 上升级 kubelet/kubectl 并重启（同 1.6）
# ⑤ 在 master 上恢复调度
kubectl uncordon <worker-node>
# ⑥ 验证该节点版本已变为 v1.29.x
kubectl get nodes1.9 验证第一阶段升级结果
kubectl get nodes -o wide # 所有节点 VERSION 应为 v1.29.x
kubectl get pods -A # 所有 Pod Running
kubectl get --raw='/readyz?verbose'
kubectl get componentstatuses 2>/dev/null || kubectl -n kube-system get pods⏸️ 建议在此版本稳定运行 1~3 天再进行第二阶段（测试环境可连续进行）。
🔄 第二阶段：v1.29.x → v1.30.x
流程与第一阶段完全相同，仅变更源地址和版本号：
2.1 切换源（所有节点）
cat > /etc/yum.repos.d/kubernetes.repo << 'EOF'
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.30/rpm/
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://mirrors.aliyun.com/kubernetes-new/doc/rpm-package-key.gpg
EOF
yum clean all && yum makecache2.2 重复升级流程
# Master 节点：
VERSION=$(yum list available kubeadm --showduplicates | grep 'kubeadm.x86_64' | tail -1 | awk '{print $2}')
yum install -y kubeadm-$VERSION --disableexcludes=kubernetes
yum install -y kubelet-$VERSION kubectl-$VERSION --disableexcludes=kubernetes
systemctl daemon-reload && systemctl restart kubelet
kubeadm upgrade plan
kubeadm upgrade apply v1.30.x # 多 master 的其余节点用 kubeadm upgrade node
kubectl drain k8smaster --ignore-daemonsets --delete-emptydir-data
kubectl uncordon k8smaster
# Worker 节点：逐个执行 kubeadm 升级 → drain → kubelet 升级 → uncordon
# （同 1.8 步骤）2.3 最终验证
kubectl get nodes -o wide # 全部 v1.30.x
kubectl get pods -A # 全部 Running
kubectl version # Server v1.30.x
kubeadm version # v1.30.x
kubelet --version # v1.30.x🔒 升级后加固
锁定版本，防止 yum update 意外升级
# 所有节点执行
yum install -y python3-dnf-plugin-versionlock 2>/dev/null || yum install -y yum-plugin-versionlock
yum versionlock add kubelet kubeadm kubectl再次备份 etcd（升级成功后的新状态）
# 同 0.2 步骤，保存一份 v1.30 状态的快照