This page explains how to upgrade GKE on-prem.
Target versions
Starting with GKE on-prem version 1.3.2, you can upgrade directly to any version that is in the same minor release or the next minor release. For example, you can upgrade from 1.3.2 to 1.3.5, or from 1.5.2 to 1.6.1.
If your current version is lower than 1.3.2, then you must do sequential upgrades to reach version 1.3.2 first. For example, to upgrade from 1.3.0 to 1.3.2, you must first upgrade from 1.3.0 to 1.3.1, and then from 1.3.1 to 1.3.2.
If you are upgrading from version 1.3.2 or later to a version that is not part of the next minor release, you must upgrade through one version of each minor release between your current version and your desired version. For example, if you are upgrading from version 1.3.2 to version 1.6.1, it is not possible to upgrade directly. You must first upgrade from version 1.3.2 to version 1.4.x, where x represents any patch release under that minor release. You can then upgrade to version 1.5.x, and finally to version 1.6.1.
Overview of the upgrade process
Download the
gkeadmtool. The version of
gkeadmmust be the same as the target version of your upgrade.
Use
gkeadmto upgrade your admin workstation.
From your admin workstation, upgrade your admin cluster.
From your admin workstation, upgrade your user clusters.
Upgrade policy
After you upgrade your admin cluster:
Any new user clusters that you create must have the same version as your admin cluster.
If you upgrade an existing user cluster, you must upgrade to the same version as your admin cluster.
Before you upgrade your admin cluster again, you must upgrade all of your user clusters to the same version as your current admin cluster.
Locating your configuration and information files
When you created your current admin workstation, you filled in an admin
workstation configuration file that was generated by
gkeadm create config.
The default name for this file is
admin-ws-config.yaml.
When you created your current admin workstation,
gkeadm created an information
file for you. The default name of this file is the same as the name of your
current admin workstation.
Locate your admin workstation configuration file and your information file. You
need them to do the steps in this guide. If these files are in your current
directory and they have their default names, then you won't need to specify
them when you run
gkeadm upgrade admin-workstation. If these files are in
another directory, or if you have changed the filenames, then you specify them
by using the
--config and
--info-file flags.
Upgrading your admin workstation
To upgrade your admin workstation, first download a new version of the
gkeadm
tool, and then use it to upgrade the configuration of your admin workstation.
The version of
gkeadm must match the target version of your upgrade.
Downloading
gkeadm
To download the current version of
gkeadm, follow the gkeadm download
instructions on the GKE on-prem page.
Upgrading your admin workstation configuration
gkeadm upgrade admin-workstation --config [AW_CONFIG_FILE] --info-file [INFO_FILE]
where:
[AW_CONFIG_FILE] is the path of your admin workstation configuration file. You can omit this flag if the file is in your current directory and has the name
admin-ws-config.yaml.
[INFO_FILE] is the path of your information file. You can omit this flag if the file is in your current directory. The default name of this file is the same as the name of your admin workstation.
The preceding command performs the following tasks:
Back up all files in the home directory of your current admin workstation. These include:
Your GKE on-prem configuration file. The default name of this file is
config.yaml.
The kubeconfig files for your admin cluster and your user clusters.
The root certificate for your vCenter server. Note that this file must have owner read and owner write permission.
The JSON key file for your allowlisted service account. Note that this file must have owner read and owner write permission.
The JSON key files for your connect-register, connect-agent, and logging-monitoring service accounts.
Create a new admin workstation, and copy all the backed-up files to the new admin workstation.
Delete the old admin workstation.
Removing the old admin workstation from
known_hosts
If your admin workstation has a static IP address, you need to remove your old
admin workstation from the
known_hosts file after upgrading your admin
workstation.
To remove the old admin workstation from
known_hosts:
ssh-keygen -R [ADMIN_WS_IP]
where [ADMIN_WS_IP] is the IP address of your admin workstation.
Setting the bundle path in your GKE on-prem configuration file
On your new admin workstation, open your GKE on-prem configuration
file. Set the value of
bundlepath to the path of the bundle file on your new
admin workstation:
bundlepath: "/var/lib/gke/bundles/gke-onprem-vsphere-[VERSION]-full.tgz"
where [VERSION] is the target version of your upgrade.
Updating the node OS image and Docker images
On your new admin workstation, run the following command:
gkectl prepare --config [CONFIG_FILE] [FLAGS]
where:
[CONFIG_FILE] is the GKE on-prem configuration file on your new admin workstation.
[FLAGS] is an optional set of flags. For example, you could include the
--skip-validation-infraflag to skip checking of your vSphere infrastructure.
The preceding command performs the following tasks:
If necessary, copy a new node OS image to your vSphere environment, and mark the OS image as a template.
If you have configured a private Docker registry, push updated Docker images to your private Docker registry.
Verify that enough IP addresses are available
Do the steps in this section on your new admin workstation.
Before you upgrade, be sure that you have enough IP addresses available for your clusters.
DHCP]
(Optional) Disabling new vSphere features
A new GKE on-prem version might include new features or support for specific VMware vSphere features. Sometimes, upgrading to a GKE on-prem version automatically enables such features. You learn about new features in GKE on-prem's Release notes. New features are sometimes surfaced in the GKE on-prem configuration file.
If you need to disable a new feature that is automatically enabled in a new GKE on-prem version and driven by the configuration file, perform the following steps before you upgrade your cluster:
From your upgraded admin workstation, create a new configuration file with a different name from your current configuration file:
gkectl create-config --config [CONFIG_NAME]
Open the new configuration file and make a note of the feature's field. Close the file.
Open your current configuration file and add the new feature's field. Set the value of the field to
falseor equivalent.
Save the configuration file.
Review the Release notes before you upgrade your clusters. You cannot declaratively change an existing cluster's configuration after you upgrade it.
Upgrading your admin cluster
Do the steps in this section on your new admin workstation.
Recall that the target version of your upgrade must be the same as your
gkeadm version. on your new admin workstation.
[FLAGS] is an optional set of flags. For example, you could include the
--skip-validation-infraflag to skip checking of your vSphere infrastructure.
Upgrading a user cluster
Do the steps in this section on your new admin workstation.
Recall that the target version of your upgrade must be the same as your
gkeadm version.
gkectl on your new admin workstation.
[FLAGS] is an optional set of flags. For example, you could include the
--skip-validation-infraflag to skip checking of your vSphere infrastructure.
Console
You can choose to register your user clusters with Cloud Console during installation or after you've created them. You can view and log in to your registered GKE on-prem clusters and your Google Kubernetes Engine clusters from Cloud Console's GKE menu.
When an upgrade becomes available for GKE on-prem user clusters,
a notification appears in Cloud Console. Clicking this notification
displays a list of available versions and a
gkectl command you can run to
upgrade the cluster:
Visit the GKE menu in Cloud Console.
Under the Notifications column for the user cluster, click Upgrade available, if available.
Copy the
gkectl upgrade clustercommand.
From your admin workstation, run the
gkectl upgrade clustercommand, where [ADMIN_CLUSTER_KUBECONFIG] is the admin cluster's kubeconfig file, [CLUSTER_NAME] is the name of the user cluster you're upgrading, and [CONFIG_FILE] is the GKE on-prem configuration file on your new admin workstation.
Resuming an upgrade
If a user cluster upgrade is interrupted
Resuming an admin cluster upgrade
You shouldn't interrupt an admin cluster upgrade. Currently, admin cluster upgrades aren't always resumable. If an admin cluster upgrade is interrupted for any reason, you should contact support for assistance.
Creating new user cluster after an upgrade
After you upgrade your admin workstation and your admin cluster, any new user clusters that you create must have the same version as the upgrade target version.
Known issues
The following known issues affect upgrading clusters..
Upgrading to version 1.1.0-gke.6 from version 1.0.2-gke.3: OIDC issue
Version 1.0.11, 1.0.1-gke.5, and 1.0.2-gke.3 clusters that have OpenID Connect (OIDC) configured cannot be upgraded to version 1.1.0-gke.6. This issue is fixed in version 1.1.1-gke.2.
If you configured a version 1.0.11, 1.0.1-gke.5, or 1.0.2-gke.3 cluster with OIDC during installation, you are not able to upgrade it. Instead, you should create new clusters.
Upgrading to version 1.0.2-gke.3 from version 1.0.11
If you want to use OIDC, the
clientsecret field is required even if you don't
want to log in to a cluster from Cloud Console. To use OIDC, you might
need to provide a placeholder value for
clientsecret:
oidc: clientsecret: "secret"
Nodes fail to complete their upgrade process
Appendix
About VMware DRS rules enabled in version 1.1.0-gke.6.
Before you upgrade, be sure that your vSphere environment meets the following conditions:
- VMware DRS is enabled. VMware DRS requires vSphere Enterprise Plus license edition. To learn how to enable DRS, see Enabling VMware DRS in a cluster
- The vSphere user account provided in the
vcenterfield has the
Host.Inventory.EditClusterpermission.
- There are at least three physical hosts available.
If your vSphere environment does not meet the preceding conditions, you can still upgrade, but for upgrading a user cluster from 1.3.x to 1.4.x, you need to disable anti-affinity groups. For more information, see this known issue in the GKE on-prem release notes.
Down time
About downtime during upgrades
Diagnosing cluster issues using
gkectl
Use
gkectl diagnosecommands to identify cluster issues
and share cluster information with Google. See
Diagnosing cluster issues.
Locating Cluster API logs in the admin cluster
If a VM fails to start after the admin control plane has started, you can try debugging this by inspecting the Cluster API controllers' logs in the admin cluster:
Find the name of the Cluster API controllers Pod in the
kube-systemnamespace, where [ADMIN_CLUSTER_KUBECONFIG] is the path to the admin cluster's kubeconfig file:
kubectl --kubeconfig [ADMIN_CLUSTER_KUBECONFIG] -n kube-system get pods | grep clusterapi-controllers
Open the Pod's logs, where [POD_NAME] is the name of the Pod. Optionally, use
grepor a similar tool to search for errors:
kubectl --kubeconfig [ADMIN_CLUSTER_KUBECONFIG] -n kube-system logs [POD_NAME] vsphere-controller-manager