#为节点规划原地 OS 升级

containerd --version
runc --version
crictl --version
kubelet --version

kubectl cordon <node-name>
kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data

cat /etc/os-release
uname -r

echo "=== Base node configuration check ==="

# SELinux must be disabled. Record the value so that you can confirm the
# operating system upgrade did not turn it back on.
if command -v getenforce >/dev/null; then
  echo "SELinux: $(getenforce)"
else
  echo "SELinux: getenforce not available on this system"
fi

# AppArmor must be disabled. A missing unit means the system has no AppArmor at
# all, which is not the same as AppArmor being present but turned off.
if systemctl list-unit-files --no-legend apparmor.service 2>/dev/null | grep -q .; then
  echo "AppArmor: enabled=$(systemctl is-enabled apparmor.service 2>&1) active=$(systemctl is-active apparmor.service 2>&1)"
else
  echo "AppArmor: unit not present on this system"
fi

# firewalld. Same distinction as AppArmor.
if systemctl list-unit-files --no-legend firewalld.service 2>/dev/null | grep -q .; then
  echo "firewalld: enabled=$(systemctl is-enabled firewalld.service 2>&1) active=$(systemctl is-active firewalld.service 2>&1)"
  firewall-cmd --list-all 2>/dev/null || true
else
  echo "firewalld: unit not present on this system"
fi

# ufw. The unit reports active (exited) once it has ever run, so the unit state
# does not show whether the ruleset is enabled. Only ufw status does.
if command -v ufw >/dev/null; then
  ufw status verbose
else
  echo "ufw: not installed"
fi

# Swap must be disabled.
swapon --show
free -h | grep Swap

# /tmp must not be mounted with noexec.
mount | grep " /tmp "

# DefaultTasksMax must be infinity.
systemctl show --property=DefaultTasksMax

containerd --version
runc --version
crictl --version
kubelet --version

systemctl status containerd

date
timedatectl
cat /etc/resolv.conf

systemctl daemon-reload
systemctl restart kubelet
systemctl status kubelet

kubectl get node <node-name> --watch

kubectl uncordon <node-name>

kubectl get nodes
kubectl get pods -A -o wide | grep <node-name>