网络插件calico升级

确认当前版本

执行以下命令确认当前 calico 版本

kubectl describe deployment calico-kube-controllers -n kube-system

输出结果如下所示：

Name:               calico-kube-controllers
Namespace:          kube-system
CreationTimestamp:  Tue, 30 Mar 2021 09:06:33 +0800
Labels:             k8s-app=calico-kube-controllers
                    kubernetes.io/cluster-service=true
Annotations:        deployment.kubernetes.io/revision: 1
                    kubectl.kubernetes.io/last-applied-configuration:
                      {"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{},"labels":{"k8s-app":"calico-kube-controllers","kubernetes.io/clus...
Selector:           k8s-app=calico-kube-controllers,kubernetes.io/cluster-service=true
Replicas:           1 desired | 1 updated | 1 total | 1 available | 0 unavailable
StrategyType:       Recreate
MinReadySeconds:    0
Pod Template:
  Labels:           k8s-app=calico-kube-controllers
                    kubernetes.io/cluster-service=true
  Service Account:  calico-kube-controllers
  Containers:
   calico-kube-controllers:
    Image:      calico/kube-controllers:v3.7.3
    Port:       <none>
    Host Port:  <none>
    Limits:
      cpu:     100m
      memory:  256M
    Requests:
      cpu:      30m
      memory:   64M
    Readiness:  exec [/usr/bin/check-status -r] delay=0s timeout=1s period=10s #success=1 #failure=3
    Environment:
      ETCD_ENDPOINTS:     https://192.168.63.90:2379,https://192.168.63.91:2379,https://192.168.63.93:2379
      ETCD_CA_CERT_FILE:  /etc/calico/certs/ca_cert.crt
      ETCD_CERT_FILE:     /etc/calico/certs/cert.crt
      ETCD_KEY_FILE:      /etc/calico/certs/key.pem
    Mounts:
      /etc/calico/certs from etcd-certs (ro)
  Volumes:
   etcd-certs:
    Type:               HostPath (bare host directory volume)
    Path:               /etc/calico/certs
    HostPathType:
  Priority Class Name:  system-cluster-critical
Conditions:
  Type           Status  Reason
  ----           ------  ------
  Available      True    MinimumReplicasAvailable
  Progressing    True    NewReplicaSetAvailable
OldReplicaSets:  <none>
NewReplicaSet:   calico-kube-controllers-6bd4d89584 (1/1 replicas created)
Events:          <none>

清理已有安装

如上所示，calico镜像是 v3.7.3，要清理已有 calico 安装，执行命令：

# 如果版本号是 v3.7.3 或者 v3.7.x，则删除命令如下
kubectl delete -f calico-3.7.yaml

安装新版本

执行命令查看kubeadmin的配置

kubeadm config view

输出结果如下所示：

apiServer:
  certSANs:
  - kubernetes
  - kubernetes.default
  - kubernetes.default.svc
  - kubernetes.default.svc.cluster.local
  - 172.20.0.1
  - localhost
  - 127.0.0.1
  - master01
  - master02
  - master03
  - lb.kubesphere.local
  - 192.168.63.96
  - 192.168.63.90
  - 192.168.63.91
  - 192.168.63.92
  extraArgs:
    allow-privileged: "true"
    anonymous-auth: "True"
    apiserver-count: "3"
    authorization-mode: Node,RBAC
    bind-address: 0.0.0.0
    enable-aggregator-routing: "False"
    endpoint-reconciler-type: lease
    feature-gates: CSINodeInfo=true,VolumeSnapshotDataSource=true,ExpandCSIVolumes=true,RotateKubeletClientCertificate=true
    insecure-port: "0"
    kubelet-preferred-address-types: InternalDNS,InternalIP,Hostname,ExternalDNS,ExternalIP
    profiling: "False"
    request-timeout: 1m0s
    runtime-config: ""
    service-node-port-range: 30000-32767
    storage-backend: etcd3
  extraVolumes:
  - hostPath: /etc/pki/tls
    mountPath: /etc/pki/tls
    name: etc-pki-tls
    readOnly: true
  - hostPath: /etc/pki/ca-trust
    mountPath: /etc/pki/ca-trust
    name: etc-pki-ca-trust
    readOnly: true
  timeoutForControlPlane: 5m0s
apiVersion: kubeadm.k8s.io/v1beta2
certificatesDir: /etc/kubernetes/ssl
clusterName: cluster.local
controlPlaneEndpoint: lb.kubesphere.local:8443
controllerManager:
  extraArgs:
    bind-address: 0.0.0.0
    configure-cloud-routes: "false"
    experimental-cluster-signing-duration: 87600h
    feature-gates: CSINodeInfo=true,VolumeSnapshotDataSource=true,ExpandCSIVolumes=true,RotateKubeletClientCertificate=true
    node-cidr-mask-size: "24"
    node-monitor-grace-period: 40s
    node-monitor-period: 5s
    pod-eviction-timeout: 5m0s
    profiling: "False"
    terminated-pod-gc-threshold: "12500"
dns:
  imageRepository: coredns
  imageTag: 1.6.0
  type: CoreDNS
etcd:
  external:
    caFile: /etc/ssl/etcd/ssl/ca.pem
    certFile: /etc/ssl/etcd/ssl/node-master02.pem
    endpoints:
    - https://192.168.63.90:2379
    - https://192.168.63.91:2379
    - https://192.168.63.93:2379
    keyFile: /etc/ssl/etcd/ssl/node-master02-key.pem
imageRepository: kubesphere
kind: ClusterConfiguration
kubernetesVersion: v1.16.7
networking:
  dnsDomain: cluster.local
  podSubnet: 172.20.64.0/18
  serviceSubnet: 172.20.0.0/18
scheduler:
  extraArgs:
    bind-address: 0.0.0.0
    feature-gates: CSINodeInfo=true,VolumeSnapshotDataSource=true,ExpandCSIVolumes=true,RotateKubeletClientCertificate=true
useHyperKubeImage: true

执行以下命令，安装 calico 3.8.4，请注意，下面的 POD_SUBNET 环境变量来自于上面的输出结果：（输出结果中，podSubnet字段可能为空，这说明集群安装集群时使用了默认的配置，升级时，请仍然保留空值。）

# 命令行中环境变量 POD_SUBNET 的取值 172.20.64.0/18 来自于上一个命令的输出结果
export POD_SUBNET=172.20.64.0/18
wget https://kuboard.cn/install-script/calico/calico-3.8.yaml
sed -i "s#10\.233\.64\.0/18#${POD_SUBNET}#" calico-3.8.yaml
kubectl apply -f calico-3.8.yaml

此时可执行命令检查 calico 的版本：

kubectl describe deployment calico-kube-controllers -n kube-system