To upgrade Tanzu Kubernetes Grid with a standalone management cluster, you must first upgrade the standalone management cluster. You cannot upgrade workload clusters until you have upgraded the management cluster that manages them.
If you are running TKG with vSphere with Tanzu Supervisor, you do not follow this procedure. Instead, you upgrade the Supervisor as part of vSphere and update the Supervisor’s Kubernetes version by upgrading its TKrs.
ImportantTanzu Kubernetes Grid v2.4.x is the last version of TKG that supports upgrading existing standalone TKG management clusters on AWS and Azure. The ability to upgrade standalone TKG management clusters on AWS and Azure will be removed in the Tanzu Kubernetes Grid v2.5 release.
Starting from now, VMware recommends that you use Tanzu Mission Control to create native AWS EKS and Azure AKS clusters. However, upgrading existing standalone TKG management clusters on AWS and Azure remains fully supported for all TKG releases up to and including TKG v2.4.x.
For more information, see Deprecation of TKG Management and Workload Clusters on AWS and Azure in the VMware Tanzu Kubernetes Grid v2.4 Release Notes.
Upgrading the management cluster automatically upgrades the auto-managed packages that it runs.
NoteAfter you have installed the v2.2 CLI but before a standalone management cluster has been upgraded, all context-specific CLI command groups (
tanzu cluster
,tanzu kubernetes-release
) plus all of themanagement-cluster
plugin commands except fortanzu mc upgrade
andtanzu mc create
are unavailable and not included in Tanzu CLI--help
output.
Management clusters and workload clusters use client certificates to authenticate clients. These certificates are valid for one year. To renew them, upgrade your clusters at least once a year or rotate them manually as described in Renew Cluster Certificates (Standalone MC) or the VMware Knowledge Base article How to rotate certificates in a Tanzu Kubernetes Grid cluster.
tkg-system
package values.Run the tanzu login
command to see an interactive list of management clusters available for upgrade.
tanzu login
Select the management cluster that you want to upgrade. See List Management Clusters and Change Context for more information.
Get the admin credentials of the cluster. The Tanzu CLI alias mc
is short for management-cluster
.
tanzu mc kubeconfig get --admin
Connect kubectl
to the management cluster.
kubectl config use-context CLUSTER-NAME-admin@CLUSTER-NAME.
If the management cluster is running on Azure, set the AZURE_CLIENT_SECRET
environment variable before upgrading the cluster:
export AZURE_CLIENT_SECRET=YOUR-AZURE-CLIENT-SECRET
Run the tanzu mc upgrade
command and enter y
to confirm.
NoteAfter you run this command, non-admin users cannot log in to the associated workload clusters until the Pinniped pods finish restarting.
tanzu mc upgrade
If multiple base VM images in your IaaS account have the same version of Kubernetes that you are upgrading to, use the --os-name
option to specify the OS you want. See Selecting an OS During Cluster Upgrade for more information.
For example, on vSphere if you have uploaded both Photon and Ubuntu OVA templates with Kubernetes v1.25.7, specify --os-name ubuntu
to upgrade your management cluster to run on an Ubuntu VM.
tanzu mc upgrade --os-name ubuntu
To skip the confirmation step when you upgrade a cluster, specify the --yes
option.
tanzu mc upgrade --yes
The upgrade process first upgrades the Cluster API providers for vSphere, Amazon Web Services (AWS), or Azure that are running in the management cluster. Then, it upgrades the version of Kubernetes in all of the control plane and worker nodes of the management cluster.
ImportantWhile a management cluster is upgrading, do not run
tanzu cluster
ortanzu mc
commands against it or the workload clusters that it manages, for example from another bootstrap machine or shell window.
If the upgrade times out before it completes, run tanzu mc upgrade
again and specify the --timeout
option with a value greater than the default of 30 minutes.
tanzu mc upgrade --timeout 45m0s
NoteAfter you have installed the v2.2 CLI but before a management cluster has been upgraded, all context-specific CLI command groups (
tanzu cluster
,tanzu kubernetes-release
) plus all of themanagement-cluster
plugin commands except fortanzu mc upgrade
andtanzu mc create
are unavailable and not included in Tanzu CLI--help
output.
After the upgrade finishes, run the tanzu cluster list
command with the --include-management-cluster -A
options again to check that the management cluster has been upgraded.
tanzu cluster list --include-management-cluster -A
You see that the management cluster is now running the new version of Kubernetes, but that the workload clusters are still running previous versions of Kubernetes.
NAME NAMESPACE STATUS CONTROLPLANE WORKERS KUBERNETES ROLES PLA TKR
k8s-1-22-13-cluster default running 1/1 1/1 v1.22.13+vmware.1 <none> dev v1.22.13---vmware.1-tkg.1
k8s-1-23-10-cluster default running 1/1 1/1 v1.23.10+vmware.1 <none> dev v1.23.10---vmware.1-tkg.1
mgmt-cluster tkg-system running 1/1 1/1 v1.25.7+vmware.1 management dev v1.25.7---vmware.1-tkg.1
Regenerate the admin kubeconfig
:
tanzu management-cluster kubeconfig get --admin
The following is sample output of the command:
Credentials of cluster 'mgmt' have been saved
You can now access the cluster by running 'kubectl config use-context mgmt-admin@mgmt'
ImportantIf you don’t renew the
kubeconfig
after upgrading, you won’t be able to access the cluster once it expires.
You can now:
Upgrade the workload clusters that this management cluster manages.
Create new workload clusters. By default, any new clusters that you deploy with this management cluster will run the new default version of Kubernetes. However, if required, you can use the tanzu cluster create
command with the --tkr
option to deploy new clusters that run different versions of Kubernetes. For more information, see Multiple Kubernetes Versions.