feat(update): felis update 报告 JRE 与 PostgreSQL（含停更提示），bootstrap 支持 FELIS_UPGRADE_DEPS=1 升级 k3s/cloudflared
This commit is contained in:
19 files changed
+790
-78
No files matched your search
+86
-16
@@ -60,10 +60,13 @@
|
||||
# FELIS_GO_SHA256 sha256 of that version's linux tarball for this host's architecture.
|
||||
# REQUIRED for a non-default FELIS_GO_VERSION; the default's is pinned.
|
||||
# FELIS_K3S_VERSION k3s release a fresh install gets (default: v1.36.4+k3s1). An
|
||||
# installed k3s is left alone.
|
||||
# installed k3s is left alone unless FELIS_UPGRADE_DEPS=1.
|
||||
# FELIS_CLOUDFLARED_VERSION / FELIS_CLOUDFLARED_SHA256 cloudflared release installed
|
||||
# when none is present (default: 2026.9.1, digests pinned); the
|
||||
# sha256 is REQUIRED for any other version
|
||||
# FELIS_UPGRADE_DEPS 1 moves an installed k3s and cloudflared to the versions above
|
||||
# (k3s one minor version at a time; neither is ever downgraded) and
|
||||
# restarts cloudflared-felis onto the new binary (default: 0)
|
||||
# FELIS_REPO_URL git URL to build from (raw script mode only)
|
||||
# FELIS_VERSION_BOOTSTRAP release|dev — which version to install (default: release).
|
||||
# release DOWNLOADS the prebuilt felis binary published for the newest
|
||||
@@ -227,18 +230,20 @@ FELIS_GO_VERSION="${FELIS_GO_VERSION:-$GO_PINNED_VERSION}"
|
||||
FELIS_GO_SHA256="${FELIS_GO_SHA256:-}"
|
||||
# cloudflared runs as root on the edge, so it gets the same treatment: a pinned release and
|
||||
# the sha256 GitHub lists for each asset. A different FELIS_CLOUDFLARED_VERSION has to bring
|
||||
# its own FELIS_CLOUDFLARED_SHA256. install_cloudflared only runs when the binary is absent;
|
||||
# upgrading an installed one is `felis update`'s report plus a manual swap.
|
||||
# its own FELIS_CLOUDFLARED_SHA256. An installed binary is replaced only under
|
||||
# FELIS_UPGRADE_DEPS=1; `felis update --cloudflared` reports when that would change it.
|
||||
CLOUDFLARED_PINNED_VERSION="2026.9.1"
|
||||
CLOUDFLARED_PINNED_SHA256_AMD64="03f1f25d1cc93b9ad6c60569d44060bc4f17ed97075760ed8cfca4b12dcd68cc"
|
||||
CLOUDFLARED_PINNED_SHA256_ARM64="3d97437c71848bd8df68041e12436b484a661d95073ea1937f01a845ce88faa3"
|
||||
CLOUDFLARED_PINNED_SHA256_ARM="093ffa3638ab2b636de63c43a8c68f96a69cf71f9699dd8277a91b160b0f4fc0"
|
||||
FELIS_CLOUDFLARED_VERSION="${FELIS_CLOUDFLARED_VERSION:-$CLOUDFLARED_PINNED_VERSION}"
|
||||
FELIS_CLOUDFLARED_SHA256="${FELIS_CLOUDFLARED_SHA256:-}"
|
||||
CLOUDFLARED_BIN=/usr/local/bin/cloudflared
|
||||
# The k3s release a fresh install gets, and the tag its install script is read from. The
|
||||
# script checks the k3s binary against that release's sha256sum file, so pinning the tag
|
||||
# pins both. An installed k3s is never touched; see docs/troubleshooting.md for upgrades.
|
||||
# pins both. An installed k3s moves only under FELIS_UPGRADE_DEPS=1.
|
||||
FELIS_K3S_VERSION="${FELIS_K3S_VERSION:-v1.36.4+k3s1}"
|
||||
FELIS_UPGRADE_DEPS="${FELIS_UPGRADE_DEPS:-0}"
|
||||
# The in-cluster registry's image, by digest. It must equal platform.defaultRegistryImage
|
||||
# (internal/platform/identities.go, TestBootstrapPinsTheRegistryImage): the renderer puts
|
||||
# that ref in the Deployment, and this script caches and pins the same ref in containerd.
|
||||
@@ -711,6 +716,16 @@ validate_settings() {
|
||||
esac
|
||||
[ "$(heap_megabytes "$FELIS_VELOCITY_XMX")" -ge 256 ] \
|
||||
|| die "FELIS_VELOCITY_XMX must be a heap size of at least 256M, written <n>M or <n>G (got '${FELIS_VELOCITY_XMX}')"
|
||||
case "$FELIS_UPGRADE_DEPS" in
|
||||
0|1) ;;
|
||||
*) die "FELIS_UPGRADE_DEPS must be 0 or 1 (got '${FELIS_UPGRADE_DEPS}')" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# version_newer reports whether version $1 sorts after $2 (a leading v is ignored).
|
||||
version_newer() {
|
||||
local a="${1#v}" b="${2#v}"
|
||||
[ "$a" != "$b" ] && [ "$(printf '%s\n%s\n' "$a" "$b" | sort -V | tail -n 1)" = "$a" ]
|
||||
}
|
||||
|
||||
# heap_megabytes prints a JVM heap size written <n>M or <n>G in megabytes, or 0 for any
|
||||
@@ -908,9 +923,25 @@ install_base() {
|
||||
}
|
||||
|
||||
install_cloudflared() {
|
||||
if command -v cloudflared >/dev/null 2>&1; then
|
||||
ok "cloudflared already installed"
|
||||
return 0
|
||||
local current="" path
|
||||
if path="$(command -v cloudflared 2>/dev/null)"; then
|
||||
current="$(cloudflared --version 2>/dev/null | awk '{ for (i = 1; i < NF; i++) if ($i == "version") { print $(i + 1); exit } }')"
|
||||
if [ "$current" = "$FELIS_CLOUDFLARED_VERSION" ]; then
|
||||
ok "cloudflared ${current} already installed"
|
||||
return 0
|
||||
fi
|
||||
if [ "$FELIS_UPGRADE_DEPS" != 1 ]; then
|
||||
ok "cloudflared ${current:-(version unreadable)} already installed; this release pins ${FELIS_CLOUDFLARED_VERSION} (FELIS_UPGRADE_DEPS=1 moves it)"
|
||||
return 0
|
||||
fi
|
||||
if [ "$path" != "$CLOUDFLARED_BIN" ]; then
|
||||
warn "cloudflared at ${path} was not installed by Felis; upgrade it the way it was installed"
|
||||
return 0
|
||||
fi
|
||||
if [ -n "$current" ] && version_newer "$current" "$FELIS_CLOUDFLARED_VERSION"; then
|
||||
ok "cloudflared ${current} is newer than the pinned ${FELIS_CLOUDFLARED_VERSION}; left as it is"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
local machine arch url tmp want have
|
||||
machine="$(uname -m)"
|
||||
@@ -932,9 +963,14 @@ install_cloudflared() {
|
||||
rm -f "$tmp"
|
||||
die "cloudflared-linux-${arch} ${FELIS_CLOUDFLARED_VERSION} hashes to ${have}, expected ${want}; refusing to install it"
|
||||
fi
|
||||
install -m 0755 "$tmp" /usr/local/bin/cloudflared
|
||||
install -m 0755 "$tmp" "$CLOUDFLARED_BIN"
|
||||
rm -f "$tmp"
|
||||
ok "cloudflared installed ($(cloudflared --version | head -n 1))"
|
||||
# The running tunnel keeps the old binary mapped until it restarts.
|
||||
if [ -n "$current" ] && systemctl is-active --quiet cloudflared-felis 2>/dev/null; then
|
||||
systemctl restart cloudflared-felis
|
||||
ok "cloudflared-felis restarted onto ${FELIS_CLOUDFLARED_VERSION}"
|
||||
fi
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
@@ -1060,16 +1096,19 @@ install_k3s() {
|
||||
configure_k3s_firewall
|
||||
|
||||
if [ -x "$K3S_BIN" ]; then
|
||||
ok "k3s already installed at ${K3S_BIN}"
|
||||
local current
|
||||
current="$("$K3S_BIN" --version 2>/dev/null | awk 'NR == 1 { print $3 }')"
|
||||
if [ "$current" = "$FELIS_K3S_VERSION" ]; then
|
||||
ok "k3s ${current} already installed at ${K3S_BIN}"
|
||||
elif [ "$FELIS_UPGRADE_DEPS" != 1 ]; then
|
||||
ok "k3s ${current:-(version unreadable)} already installed at ${K3S_BIN}; this release pins ${FELIS_K3S_VERSION} (FELIS_UPGRADE_DEPS=1 moves it)"
|
||||
elif k3s_upgrade_allowed "$current" "$FELIS_K3S_VERSION"; then
|
||||
log "upgrading k3s ${current} to ${FELIS_K3S_VERSION}; running pods keep running while it restarts"
|
||||
run_k3s_installer
|
||||
fi
|
||||
else
|
||||
log "installing k3s ${FELIS_K3S_VERSION} into ${K3S_BIN_DIR} (no traefik/servicelb/metrics-server)"
|
||||
# The script from the release's own tag rather than get.k3s.io, which serves whatever
|
||||
# master holds today. '+' is literal in a URL path, so the tag needs no escaping.
|
||||
curl -sfL --retry 5 --retry-delay 2 "https://raw.githubusercontent.com/k3s-io/k3s/${FELIS_K3S_VERSION}/install.sh" | \
|
||||
INSTALL_K3S_VERSION="$FELIS_K3S_VERSION" \
|
||||
INSTALL_K3S_BIN_DIR="$K3S_BIN_DIR" \
|
||||
INSTALL_K3S_EXEC="--disable traefik --disable servicelb --disable metrics-server --write-kubeconfig-mode 644" \
|
||||
sh -
|
||||
run_k3s_installer
|
||||
fi
|
||||
|
||||
[ -x "$K3S_BIN" ] || die "k3s installation completed but ${K3S_BIN} is missing"
|
||||
@@ -1080,6 +1119,37 @@ install_k3s() {
|
||||
wait_for_node_ready
|
||||
}
|
||||
|
||||
# The script from the release's own tag rather than get.k3s.io, which serves whatever
|
||||
# master holds today. '+' is literal in a URL path, so the tag needs no escaping. On an
|
||||
# installed k3s the same script replaces the binary in place and restarts the service.
|
||||
run_k3s_installer() {
|
||||
curl -sfL --retry 5 --retry-delay 2 "https://raw.githubusercontent.com/k3s-io/k3s/${FELIS_K3S_VERSION}/install.sh" | \
|
||||
INSTALL_K3S_VERSION="$FELIS_K3S_VERSION" \
|
||||
INSTALL_K3S_BIN_DIR="$K3S_BIN_DIR" \
|
||||
INSTALL_K3S_EXEC="--disable traefik --disable servicelb --disable metrics-server --write-kubeconfig-mode 644" \
|
||||
sh -
|
||||
}
|
||||
|
||||
# k3s_upgrade_allowed decides whether an installed k3s ($1) may move to $2. Kubernetes
|
||||
# supports upgrading one minor version at a time, so a larger jump stops the install
|
||||
# before anything changed; a newer installed k3s is left as it is.
|
||||
k3s_upgrade_allowed() {
|
||||
local current="$1" want="$2" cur_major cur_minor want_major want_minor rest
|
||||
IFS=. read -r cur_major cur_minor rest <<<"${current#v}"
|
||||
IFS=. read -r want_major want_minor rest <<<"${want#v}"
|
||||
case "${cur_major}${cur_minor}${want_major}${want_minor}" in
|
||||
""|*[!0-9]*) die "cannot compare the installed k3s '${current}' with ${want}; upgrade it by hand (docs/operations.md §4)" ;;
|
||||
esac
|
||||
if version_newer "$current" "$want"; then
|
||||
ok "k3s ${current} is newer than the pinned ${want}; left as it is"
|
||||
return 1
|
||||
fi
|
||||
if [ "$cur_major" != "$want_major" ] || [ "$((want_minor - cur_minor))" -gt 1 ]; then
|
||||
die "k3s ${current} -> ${want} skips a minor version, and Kubernetes upgrades one minor at a time. Rerun with FELIS_K3S_VERSION set to the newest v${cur_major}.$((cur_minor + 1)).x+k3sN release first (https://github.com/k3s-io/k3s/releases)"
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
# Waits for the (single) node to report Ready. Shared by the k3s install and the
|
||||
# registry-mirror restart below: both restart the agent, and a bootstrap that
|
||||
# proceeds early fails later with a misleading "not found"/timeout instead.
|
||||
|
||||
@@ -783,17 +783,22 @@ cfsum="$(printf 'stand-in cloudflared\n' | sha256sum | cut -d' ' -f1)"
|
||||
run_cf() { # FELIS_CLOUDFLARED_VERSION pinned-amd64-digest [FELIS_CLOUDFLARED_SHA256]
|
||||
FELIS_CLOUDFLARED_VERSION="$1" CLOUDFLARED_PINNED_VERSION=2026.9.1 CLOUDFLARED_PINNED_SHA256_AMD64="$2" \
|
||||
CLOUDFLARED_PINNED_SHA256_ARM64=unused CLOUDFLARED_PINNED_SHA256_ARM=unused \
|
||||
FELIS_CLOUDFLARED_SHA256="${3:-}" TMPDIR="$sdir" bash -c '
|
||||
FELIS_CLOUDFLARED_SHA256="${3:-}" TMPDIR="$sdir" CLOUDFLARED_BIN=/usr/local/bin/cloudflared \
|
||||
FELIS_UPGRADE_DEPS="${CF_UPGRADE:-0}" CF_PATH="${CF_PATH:-}" CF_HAVE="${CF_HAVE:-test}" \
|
||||
CF_ACTIVE="${CF_ACTIVE:-0}" bash -c '
|
||||
die() { printf "DIE: %s\n" "$*"; exit 1; }
|
||||
log() { printf "LOG: %s\n" "$*"; }
|
||||
ok() { printf "OK: %s\n" "$*"; }
|
||||
warn() { printf "WARN: %s\n" "$*"; }
|
||||
remember_temp() { :; }
|
||||
command() { return 1; }
|
||||
command() { [ -n "$CF_PATH" ] && [ "$1" = -v ] && [ "$2" = cloudflared ] && echo "$CF_PATH"; }
|
||||
uname() { echo x86_64; }
|
||||
cloudflared() { echo "cloudflared version test"; }
|
||||
cloudflared() { echo "cloudflared version ${CF_HAVE} (built 2026-01-01-0000 UTC)"; }
|
||||
curl() { printf "CURL: %s\n" "$*"; while [ "$#" -gt 1 ] && [ "$1" != "-o" ]; do shift; done
|
||||
printf "stand-in cloudflared\n" > "$2"; }
|
||||
install() { printf "INSTALL: %s\n" "$*"; }
|
||||
systemctl() { case "$1" in is-active) [ "$CF_ACTIVE" = 1 ] ;; *) printf "SYSTEMCTL: %s\n" "$*" ;; esac; }
|
||||
'"$(awk '/^version_newer\(\) \{/,/^}/' "$BS")"'
|
||||
'"$cfblock"'
|
||||
install_cloudflared'
|
||||
}
|
||||
@@ -806,12 +811,68 @@ case "$out" in *INSTALL:*) echo "FAIL: a refused cloudflared must not be install
|
||||
expect "another cloudflared version needs its own digest" "DIE: no pinned sha256 for cloudflared 2027.1.0" "$(run_cf 2027.1.0 "$cfsum")"
|
||||
expect "another cloudflared version installs with its digest" "INSTALL: -m 0755" "$(run_cf 2027.1.0 deadbeef "$cfsum")"
|
||||
|
||||
# An installed cloudflared moves only under FELIS_UPGRADE_DEPS=1, only when Felis put it
|
||||
# there, never backwards, and the running tunnel is restarted onto the new binary.
|
||||
out="$(CF_PATH=/usr/local/bin/cloudflared CF_HAVE=2026.9.1 run_cf 2026.9.1 "$cfsum")"
|
||||
expect "a cloudflared at the pin is left alone" "OK: cloudflared 2026.9.1 already installed" "$out"
|
||||
case "$out" in *CURL:*) echo "FAIL: a cloudflared at the pin must not be downloaded again"; fails=$((fails + 1)) ;; esac
|
||||
out="$(CF_PATH=/usr/local/bin/cloudflared CF_HAVE=2025.8.0 run_cf 2026.9.1 "$cfsum")"
|
||||
expect "an older cloudflared is reported without the flag" "this release pins 2026.9.1 (FELIS_UPGRADE_DEPS=1 moves it)" "$out"
|
||||
case "$out" in *CURL:*) echo "FAIL: an installed cloudflared must not move without FELIS_UPGRADE_DEPS=1"; fails=$((fails + 1)) ;; esac
|
||||
out="$(CF_UPGRADE=1 CF_ACTIVE=1 CF_PATH=/usr/local/bin/cloudflared CF_HAVE=2025.8.0 run_cf 2026.9.1 "$cfsum")"
|
||||
expect "FELIS_UPGRADE_DEPS=1 installs the pinned cloudflared over an older one" "INSTALL: -m 0755" "$out"
|
||||
expect "the running tunnel is restarted onto the new cloudflared" "SYSTEMCTL: restart cloudflared-felis" "$out"
|
||||
out="$(CF_UPGRADE=1 CF_PATH=/usr/local/bin/cloudflared CF_HAVE=2025.8.0 run_cf 2026.9.1 "$cfsum")"
|
||||
case "$out" in *SYSTEMCTL:*) echo "FAIL: a stopped cloudflared-felis must not be started by an upgrade"; fails=$((fails + 1)) ;; esac
|
||||
out="$(CF_UPGRADE=1 CF_PATH=/usr/bin/cloudflared CF_HAVE=2025.8.0 run_cf 2026.9.1 "$cfsum")"
|
||||
expect "a packaged cloudflared is left to its package manager" "WARN: cloudflared at /usr/bin/cloudflared was not installed by Felis" "$out"
|
||||
case "$out" in *CURL:*) echo "FAIL: a packaged cloudflared must not be overwritten"; fails=$((fails + 1)) ;; esac
|
||||
out="$(CF_UPGRADE=1 CF_PATH=/usr/local/bin/cloudflared CF_HAVE=2026.10.2 run_cf 2026.9.1 "$cfsum")"
|
||||
expect "a newer cloudflared is never downgraded" "cloudflared 2026.10.2 is newer than the pinned 2026.9.1" "$out"
|
||||
case "$out" in *CURL:*) echo "FAIL: a newer cloudflared must not be downgraded"; fails=$((fails + 1)) ;; esac
|
||||
|
||||
# k3s: the install script is read from the pinned tag, and told the same version.
|
||||
kblock="$(awk '/^install_k3s\(\) \{/,/^}/' "$BS")"
|
||||
kblock="$(awk '/^run_k3s_installer\(\) \{/,/^}/' "$BS")"
|
||||
expect "k3s's install script comes from the pinned tag" 'raw.githubusercontent.com/k3s-io/k3s/${FELIS_K3S_VERSION}/install.sh' "$kblock"
|
||||
expect "k3s's install script is told the pinned version" 'INSTALL_K3S_VERSION="$FELIS_K3S_VERSION"' "$kblock"
|
||||
case "$kblock" in *"https://get.k3s.io"*) echo "FAIL: get.k3s.io serves master's script; read it from the pinned tag"; fails=$((fails + 1)) ;; esac
|
||||
|
||||
# An installed k3s moves only under FELIS_UPGRADE_DEPS=1, one minor version at a time and
|
||||
# never backwards; the refusal names the release to go through first.
|
||||
kfake="$sdir/k3s"
|
||||
run_k3s() { # installed-version pinned-version [FELIS_UPGRADE_DEPS]
|
||||
printf '#!/bin/sh\necho "k3s version %s (0123abcd)"\necho "go version go1.26"\n' "$1" > "$kfake"
|
||||
chmod +x "$kfake"
|
||||
K3S_BIN="$kfake" FELIS_K3S_VERSION="$2" FELIS_UPGRADE_DEPS="${3:-0}" bash -c '
|
||||
die() { printf "DIE: %s\n" "$*"; exit 1; }
|
||||
log() { printf "LOG: %s\n" "$*"; }
|
||||
ok() { printf "OK: %s\n" "$*"; }
|
||||
configure_k3s_firewall() { :; }
|
||||
run_k3s_installer() { printf "INSTALLER: %s\n" "$FELIS_K3S_VERSION"; }
|
||||
systemctl() { :; }
|
||||
wait_for_node_ready() { :; }
|
||||
'"$(awk '/^version_newer\(\) \{/,/^}/' "$BS")"'
|
||||
'"$(awk '/^k3s_upgrade_allowed\(\) \{/,/^}/' "$BS")"'
|
||||
'"$(awk '/^install_k3s\(\) \{/,/^}/' "$BS")"'
|
||||
install_k3s'
|
||||
}
|
||||
out="$(run_k3s v1.36.4+k3s1 v1.36.4+k3s1 1)"
|
||||
expect "a k3s at the pin is left alone" "OK: k3s v1.36.4+k3s1 already installed" "$out"
|
||||
case "$out" in *INSTALLER:*) echo "FAIL: a k3s at the pin must not be reinstalled"; fails=$((fails + 1)) ;; esac
|
||||
out="$(run_k3s v1.35.2+k3s1 v1.36.4+k3s1)"
|
||||
expect "an older k3s is reported without the flag" "this release pins v1.36.4+k3s1 (FELIS_UPGRADE_DEPS=1 moves it)" "$out"
|
||||
case "$out" in *INSTALLER:*) echo "FAIL: an installed k3s must not move without FELIS_UPGRADE_DEPS=1"; fails=$((fails + 1)) ;; esac
|
||||
expect "FELIS_UPGRADE_DEPS=1 moves k3s up one minor" "INSTALLER: v1.36.4+k3s1" "$(run_k3s v1.35.2+k3s1 v1.36.4+k3s1 1)"
|
||||
expect "FELIS_UPGRADE_DEPS=1 moves k3s to a newer patch" "INSTALLER: v1.36.4+k3s1" "$(run_k3s v1.36.1+k3s2 v1.36.4+k3s1 1)"
|
||||
out="$(run_k3s v1.34.6+k3s1 v1.36.4+k3s1 1)"
|
||||
expect "a k3s upgrade that skips a minor is refused" "DIE: k3s v1.34.6+k3s1 -> v1.36.4+k3s1 skips a minor version" "$out"
|
||||
expect "the refusal names the minor to go through first" "newest v1.35.x+k3sN release first" "$out"
|
||||
case "$out" in *INSTALLER:*) echo "FAIL: a skipping k3s upgrade must not run the installer"; fails=$((fails + 1)) ;; esac
|
||||
out="$(run_k3s v1.37.0+k3s1 v1.36.4+k3s1 1)"
|
||||
expect "a newer k3s is never downgraded" "OK: k3s v1.37.0+k3s1 is newer than the pinned v1.36.4+k3s1" "$out"
|
||||
case "$out" in *INSTALLER:*) echo "FAIL: a newer k3s must not be downgraded"; fails=$((fails + 1)) ;; esac
|
||||
expect "an unreadable k3s version stops the upgrade" "DIE: cannot compare the installed k3s 'dev'" "$(run_k3s dev v1.36.4+k3s1 1)"
|
||||
|
||||
# --- a private repo without a token fails with the hint instead of prompting -------------
|
||||
# git asks for credentials on /dev/tty, where a piped install would sit waiting. Every
|
||||
# network git call goes through git_auth, so the switch belongs there.
|
||||
|
||||
Reference in new issue
Block a user