diff --git a/.gitignore b/.gitignore
index 57c413f..b5f81e9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,3 +14,4 @@
 # Dependency directories (remove the comment below to include it)
 # vendor/
 bin/
+.vscode/
diff --git a/.vscode/configurationCache.log b/.vscode/configurationCache.log
new file mode 100644
index 0000000..0ee3133
--- /dev/null
+++ b/.vscode/configurationCache.log
@@ -0,0 +1 @@
+{"buildTargets":["all","controller-gen","deploy","docker-build","docker-push","fmt","generate","install","manager","manifests","release","run","test","undeploy","vet"],"launchTargets":[],"customConfigurationProvider":{"workspaceBrowse":{"browsePath":[],"compilerArgs":[]},"fileIndex":[]}}
\ No newline at end of file
diff --git a/.vscode/dryrun.log b/.vscode/dryrun.log
new file mode 100644
index 0000000..7805d68
--- /dev/null
+++ b/.vscode/dryrun.log
@@ -0,0 +1,10 @@
+make --dry-run --always-make --keep-going --print-directory
+make: Entering directory `/Users/pacoxu/git/gopath/src/k8s.io/kubeadm-operator'
+go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.8.0
+ 
+/Users/pacoxu/go/bin/controller-gen object:headerFile=./hack/boilerplate.go.txt paths="./..."
+go fmt ./...
+go vet ./...
+go build -o bin/manager main.go
+make: Leaving directory `/Users/pacoxu/git/gopath/src/k8s.io/kubeadm-operator'
+ 
diff --git a/.vscode/settings.json b/.vscode/settings.json
new file mode 100644
index 0000000..65e1ec0
--- /dev/null
+++ b/.vscode/settings.json
@@ -0,0 +1,3 @@
+{
+    "makefile.extensionOutputFolder": "./.vscode"
+}
\ No newline at end of file
diff --git a/.vscode/targets.log b/.vscode/targets.log
new file mode 100644
index 0000000..bad887a
--- /dev/null
+++ b/.vscode/targets.log
@@ -0,0 +1,365 @@
+make all --print-data-base --no-builtin-variables --no-builtin-rules --question
+# GNU Make 3.81
+# Copyright (C) 2006  Free Software Foundation, Inc.
+# This is free software; see the source for copying conditions.
+# There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+# This program built for i386-apple-darwin11.3.0
+ 
+
+# Make data base, printed on Thu May 19 22:39:00 2022
+
+# Variables
+
+# automatic
+<D = $(patsubst %/,%,$(dir $<))
+# automatic
+?F = $(notdir $?)
+# environment
+VSCODE_LOG_NATIVE = false
+# automatic
+?D = $(patsubst %/,%,$(dir $?))
+# automatic
+@D = $(patsubst %/,%,$(dir $@))
+# automatic
+@F = $(notdir $@)
+# makefile
+CURDIR := /Users/pacoxu/git/gopath/src/k8s.io/kubeadm-operator
+# makefile
+SHELL = /bin/sh
+# environment
+VSCODE_NLS_CONFIG = {"locale":"zh-cn","availableLanguages":{"*":"zh-cn"},"_languagePackId":"42e84e0914b17800d483f69e299e1b00.zh-cn","_translationsConfigFile":"/Users/pacoxu/Library/Application Support/Code/clp/42e84e0914b17800d483f69e299e1b00.zh-cn/tcf.json","_cacheRoot":"/Users/pacoxu/Library/Application Support/Code/clp/42e84e0914b17800d483f69e299e1b00.zh-cn","_resolvedLanguagePackCoreLocation":"/Users/pacoxu/Library/Application Support/Code/clp/42e84e0914b17800d483f69e299e1b00.zh-cn/c3511e6c69bb39013c4a4b7b9566ec1ca73fc4d5","_corruptedFile":"/Users/pacoxu/Library/Application Support/Code/clp/42e84e0914b17800d483f69e299e1b00.zh-cn/corrupted.info","_languagePackSupport":true}
+# environment
+_ = /usr/bin/make
+# makefile (from `Makefile', line 1)
+MAKEFILE_LIST :=  Makefile
+# environment
+VSCODE_AMD_ENTRYPOINT = vs/workbench/api/node/extensionHostProcess
+# environment
+VSCODE_VERBOSE_LOGGING = true
+# environment
+__CFBundleIdentifier = com.microsoft.VSCode
+# environment
+VSCODE_IPC_HOOK_EXTHOST = /var/folders/g7/ywncky4109zfc_6v5ww1fc2w0000gn/T/vscode-ipc-01d6ffe0-54e6-46b8-9010-0d5b07226452.sock
+# environment
+VSCODE_CWD = /
+# environment
+GOPROXY = https://proxy.golang.org,direct
+# environment
+PATH = /usr/local/opt/go@1.18/bin:/Users/pacoxu/git/gopath/src/k8s.io/kubernetes/third_party/etcd:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/go/bin
+# environment
+LSCOLORS = Gxfxcxdxbxegedabagacad
+# environment
+GOPATH = /Users/pacoxu/go
+# environment
+VSCODE_LOG_STACK = false
+# environment
+ELECTRON_RUN_AS_NODE = 1
+# default
+.FEATURES := target-specific order-only second-expansion else-if archives jobserver check-symlink
+# makefile (from `Makefile', line 72)
+CONTROLLER_GEN = $(GOBIN)/controller-gen
+# environment
+SSH_AUTH_SOCK = /private/tmp/com.apple.launchd.FlDNrnFngH/Listeners
+# automatic
+%F = $(notdir $%)
+# makefile (from `Makefile', line 9)
+GOBIN = $(shell go env GOPATH)/bin
+# environment
+VSCODE_PIPE_LOGGING = true
+# environment
+PWD = /Users/pacoxu/git/gopath/src/k8s.io/kubeadm-operator
+# environment
+ORIGINAL_XDG_CURRENT_DESKTOP = undefined
+# environment
+GOMODCACHE = /Users/pacoxu/go/pkg/mod
+# environment
+HOME = /Users/pacoxu
+# default
+MAKEFILEPATH = $(shell /usr/bin/xcode-select -print-path 2>/dev/null || echo /Developer)/Makefiles
+# environment
+VSCODE_CODE_CACHE_PATH = /Users/pacoxu/Library/Application Support/Code/CachedData/c3511e6c69bb39013c4a4b7b9566ec1ca73fc4d5
+# environment
+LOGNAME = pacoxu
+# environment
+APPLICATION_INSIGHTS_NO_DIAGNOSTIC_CHANNEL = true
+# environment
+ZSH = /Users/pacoxu/.oh-my-zsh
+# environment
+VSCODE_HANDLES_UNCAUGHT_ERRORS = true
+# automatic
+^D = $(patsubst %/,%,$(dir $^))
+# environment
+XPC_FLAGS = 0x0
+# makefile (from `Makefile', line 5)
+CRD_OPTIONS = "crd"
+# default
+MAKE = $(MAKE_COMMAND)
+# default
+MAKECMDGOALS := all
+# environment
+SHLVL = 1
+# default
+MAKE_VERSION := 3.81
+# environment
+USER = pacoxu
+# makefile
+.DEFAULT_GOAL := all
+# environment
+LESS = -R
+# automatic
+%D = $(patsubst %/,%,$(dir $%))
+# default
+MAKE_COMMAND := /Library/Developer/CommandLineTools/usr/bin/make
+# default
+.VARIABLES := 
+# environment
+TMPDIR = /var/folders/g7/ywncky4109zfc_6v5ww1fc2w0000gn/T/
+# automatic
+*F = $(notdir $*)
+# makefile (from `Makefile', line 3)
+IMG = daocloud.io/daocloud/kubeadm-operator:v0.0.3-dev
+# environment
+VSCODE_IPC_HOOK = /Users/pacoxu/Library/Application Support/Code/1.67.2-main.sock
+# makefile
+MAKEFLAGS = Rrqp
+# environment
+MFLAGS = -Rrqp
+# automatic
+*D = $(patsubst %/,%,$(dir $*))
+# environment
+XPC_SERVICE_NAME = application.com.microsoft.VSCode.58980345.58980351
+# automatic
++D = $(patsubst %/,%,$(dir $+))
+# automatic
++F = $(notdir $+)
+# environment
+__CF_USER_TEXT_ENCODING = 0x1F5:0x19:0x34
+# environment
+COMMAND_MODE = unix2003
+# environment
+GITHUB_USER = pacoxu
+# default
+MAKEFILES := 
+# automatic
+<F = $(notdir $<)
+# environment
+PAGER = less
+# environment
+LC_ALL = C
+# automatic
+^F = $(notdir $^)
+# default
+SUFFIXES := 
+# default
+.INCLUDE_DIRS = /usr/local/include
+# environment
+MAKELEVEL := 0
+# environment
+LANG = C
+# environment
+VSCODE_PID = 4957
+# variable set hash-table stats:
+# Load=74/1024=7%, Rehash=0, Collisions=2/106=2%
+
+# Pattern-specific Variable Values
+
+# No pattern-specific variable values.
+
+# Directories
+
+# . (device 16777221, inode 39096290): 22 files, no impossibilities.
+
+# 22 files, no impossibilities in 1 directories.
+
+# Implicit Rules
+
+# No implicit rules.
+
+# Files
+
+all: manager
+#  Command-line target.
+#  Implicit rule search has been done.
+#  File does not exist.
+#  File has been updated.
+#  Needs to be updated (-q is set).
+# variable set hash-table stats:
+# Load=0/32=0%, Rehash=0, Collisions=0/2=0%
+
+docker-build: test
+#  Implicit rule search has not been done.
+#  Modification time never checked.
+#  File has not been updated.
+#  commands to execute (from `Makefile', line 59):
+	docker build . -t ${IMG}
+	
+
+# Not a target:
+.SUFFIXES:
+#  Implicit rule search has not been done.
+#  Modification time never checked.
+#  File has not been updated.
+
+manager: generate fmt vet
+#  Implicit rule search has not been done.
+#  File does not exist.
+#  File has been updated.
+#  Needs to be updated (-q is set).
+# variable set hash-table stats:
+# Load=0/32=0%, Rehash=0, Collisions=0/2=0%
+#  commands to execute (from `Makefile', line 22):
+	go build -o bin/manager main.go
+	
+
+# Not a target:
+Makefile:
+#  Implicit rule search has been done.
+#  Last modified 2022-05-07 16:51:36
+#  File has been updated.
+#  Successfully updated.
+# variable set hash-table stats:
+# Load=0/32=0%, Rehash=0, Collisions=0/0=0%
+
+test: generate fmt vet manifests
+#  Implicit rule search has not been done.
+#  Modification time never checked.
+#  File has not been updated.
+#  commands to execute (from `Makefile', line 18):
+	go test ./... -coverprofile cover.out
+	
+
+vet:
+#  Implicit rule search has not been done.
+#  Modification time never checked.
+#  File has not been updated.
+#  commands to execute (from `Makefile', line 51):
+	go vet ./...
+	
+
+generate: controller-gen
+ 
+#  Implicit rule search has not been done.
+#  File does not exist.
+#  File has been updated.
+#  Needs to be updated (-q is set).
+# variable set hash-table stats:
+# Load=0/32=0%, Rehash=0, Collisions=0/2=0%
+#  commands to execute (from `Makefile', line 55):
+	$(CONTROLLER_GEN) object:headerFile=./hack/boilerplate.go.txt paths="./..."
+	
+
+undeploy: manifests
+#  Implicit rule search has not been done.
+#  Modification time never checked.
+#  File has not been updated.
+#  commands to execute (from `Makefile', line 38):
+	cd config/manager && kustomize edit set image controller=${IMG}
+	kustomize build config/default | kubectl delete -f -
+	
+
+manifests: controller-gen
+#  Implicit rule search has not been done.
+#  Modification time never checked.
+#  File has not been updated.
+#  commands to execute (from `Makefile', line 43):
+	$(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=config/crd/bases
+	
+
+release: docker-build docker-push
+#  Implicit rule search has not been done.
+#  Modification time never checked.
+#  File has not been updated.
+
+# Not a target:
+.DEFAULT:
+#  Implicit rule search has not been done.
+#  Modification time never checked.
+#  File has not been updated.
+
+run: generate fmt vet manifests
+#  Implicit rule search has not been done.
+#  Modification time never checked.
+#  File has not been updated.
+#  commands to execute (from `Makefile', line 26):
+	go run ./main.go
+	
+
+fmt:
+#  Implicit rule search has not been done.
+#  Modification time never checked.
+#  File has not been updated.
+#  commands to execute (from `Makefile', line 47):
+	go fmt ./...
+	
+
+deploy: manifests
+#  Implicit rule search has not been done.
+#  Modification time never checked.
+#  File has not been updated.
+#  commands to execute (from `Makefile', line 34):
+	cd config/manager && kustomize edit set image controller=${IMG}
+	kustomize build config/default | kubectl apply -f -
+	
+
+controller-gen:
+#  Implicit rule search has not been done.
+#  Implicit/static pattern stem: `'
+#  File does not exist.
+#  File has been updated.
+#  Needs to be updated (-q is set).
+# automatic
+# @ := controller-gen
+# automatic
+# % := 
+# automatic
+# * := 
+# automatic
+# + := 
+# automatic
+# | := 
+# automatic
+# < := 
+# automatic
+# ^ := 
+# automatic
+# ? := 
+# variable set hash-table stats:
+# Load=8/32=25%, Rehash=0, Collisions=1/10=10%
+#  commands to execute (from `Makefile', line 71):
+	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.8.0
+	
+
+docker-push:
+#  Implicit rule search has not been done.
+#  Modification time never checked.
+#  File has not been updated.
+#  commands to execute (from `Makefile', line 63):
+	docker push ${IMG}
+	
+
+install: manifests
+#  Implicit rule search has not been done.
+#  Modification time never checked.
+#  File has not been updated.
+#  commands to execute (from `Makefile', line 30):
+	kustomize build config/crd | kubectl apply -f -
+	
+
+# files hash-table stats:
+# Load=18/1024=2%, Rehash=0, Collisions=0/52=0%
+# VPATH Search Paths
+
+# No `vpath' search paths.
+
+# No general (`VPATH' variable) search path.
+
+# # of strings in strcache: 1
+# # of strcache buffers: 1
+# strcache size: total = 4096 / max = 4096 / min = 4096 / avg = 4096
+# strcache free: total = 4087 / max = 4087 / min = 4087 / avg = 4087
+
+# Finished Make data base on Thu May 19 22:39:00 2022
+
+ 
diff --git a/Dockerfile b/Dockerfile
index c4ef957..544122e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -22,9 +22,11 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build -a -o manager
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.m.daocloud.io/distroless/static:nonroot
+# distroless cannot run `kubeadm upgrade apply` smoothly
+# FROM gcr.m.daocloud.io/distroless/static:nonroot
+FROM docker.m.daocloud.io/centos
 WORKDIR /
 COPY --from=builder /workspace/manager .
-USER nonroot:nonroot
+# USER nonroot:nonroot
 
 ENTRYPOINT ["/manager"]
diff --git a/commands/kubeadm_upgrade_apply.go b/commands/kubeadm_upgrade_apply.go
index 5efee9b..15270f8 100644
--- a/commands/kubeadm_upgrade_apply.go
+++ b/commands/kubeadm_upgrade_apply.go
@@ -17,12 +17,31 @@ limitations under the License.
 package commands
 
 import (
+	"fmt"
+	"strings"
+
 	"github.com/go-logr/logr"
+	"github.com/pkg/errors"
 
 	operatorv1 "k8s.io/kubeadm/operator/api/v1alpha1"
 )
 
-// TODO this is a temporary hack to get the "kubeadm upgrade apply" to work
+// runKubeadmUpgradeApply runs the kubeadm upgrade apply command
 func runKubeadmUpgradeApply(spec *operatorv1.KubeadmUpgradeApplyCommandSpec, log logr.Logger) error {
+	var cmd *cmd
+	// TODO: add real dry run support
+	cmd = newCmd("kubeadm", "upgrade", "apply", spec.KubernetesVersion, "--yes", "--v=4")
+	if spec.DryRun {
+		cmd = newCmd("kubeadm", "upgrade", "apply", spec.KubernetesVersion, "--yes", "--dry-run", "--v=4")
+	}
+
+	lines, err := cmd.RunAndCapture()
+	if err != nil {
+		log.Error(err, "kubeadm upgrade apply failed", strings.Join(lines, "\n"))
+		return errors.WithStack(errors.WithMessage(err, strings.Join(lines, "\n")))
+	}
+
+	log.Info(fmt.Sprintf("%s", strings.Join(lines, "\n")))
+
 	return nil
 }
diff --git a/config/crd/bases/operator.kubeadm.x-k8s.io_operations.yaml b/config/crd/bases/operator.kubeadm.x-k8s.io_operations.yaml
index 5f59a43..bb89918 100644
--- a/config/crd/bases/operator.kubeadm.x-k8s.io_operations.yaml
+++ b/config/crd/bases/operator.kubeadm.x-k8s.io_operations.yaml
@@ -227,10 +227,21 @@ spec:
                                           kubeadmUpgradeApply:
                                             description: KubeadmUpgradeApplyCommandSpec
                                               provides...
+                                            properties:
+                                              dryRun:
+                                                description: for dry run mode
+                                                type: boolean
+                                              kubernetesVersion:
+                                                description: KubernetesVersion specifies
+                                                  the target kubernetes version If
+                                                  the version is empty, we will skip
+                                                  this command.
+                                                type: string
                                             type: object
                                           kubeadmUpgradeNode:
-                                            description: KubeadmUpgradeNodeCommandSpec
-                                              provides...
+                                            description: TODO download the specified
+                                              version bin and replace it in the node
+                                              KubeadmUpgradeNodeCommandSpec provides...
                                             type: object
                                           kubectlDrain:
                                             description: KubectlDrainCommandSpec provides...
@@ -249,10 +260,26 @@ spec:
                                           upgradeKubeadm:
                                             description: UpgradeKubeadmCommandSpec
                                               provides...
+                                            properties:
+                                              kubernetesVersion:
+                                                description: KubernetesVersion specifies
+                                                  the target kubernetes version If
+                                                  the version is empty, we will skip
+                                                  this command.
+                                                type: string
                                             type: object
                                           upgradeKubeletAndKubeactl:
-                                            description: UpgradeKubeletAndKubeactlCommandSpec
+                                            description: TODO download the specified
+                                              version bin and replace it in the node
+                                              UpgradeKubeletAndKubeactlCommandSpec
                                               provides...
+                                            properties:
+                                              kubernetesVersion:
+                                                description: KubernetesVersion specifies
+                                                  the target kubernetes version If
+                                                  the version is empty, we will skip
+                                                  this command.
+                                                type: string
                                             type: object
                                           wait:
                                             description: Wait pauses the execution
diff --git a/config/crd/bases/operator.kubeadm.x-k8s.io_runtimetaskgroups.yaml b/config/crd/bases/operator.kubeadm.x-k8s.io_runtimetaskgroups.yaml
index 6907b6f..55dc95a 100644
--- a/config/crd/bases/operator.kubeadm.x-k8s.io_runtimetaskgroups.yaml
+++ b/config/crd/bases/operator.kubeadm.x-k8s.io_runtimetaskgroups.yaml
@@ -184,9 +184,20 @@ spec:
                               type: object
                             kubeadmUpgradeApply:
                               description: KubeadmUpgradeApplyCommandSpec provides...
+                              properties:
+                                dryRun:
+                                  description: for dry run mode
+                                  type: boolean
+                                kubernetesVersion:
+                                  description: KubernetesVersion specifies the target
+                                    kubernetes version If the version is empty, we
+                                    will skip this command.
+                                  type: string
                               type: object
                             kubeadmUpgradeNode:
-                              description: KubeadmUpgradeNodeCommandSpec provides...
+                              description: TODO download the specified version bin
+                                and replace it in the node KubeadmUpgradeNodeCommandSpec
+                                provides...
                               type: object
                             kubectlDrain:
                               description: KubectlDrainCommandSpec provides...
@@ -203,9 +214,23 @@ spec:
                               type: object
                             upgradeKubeadm:
                               description: UpgradeKubeadmCommandSpec provides...
+                              properties:
+                                kubernetesVersion:
+                                  description: KubernetesVersion specifies the target
+                                    kubernetes version If the version is empty, we
+                                    will skip this command.
+                                  type: string
                               type: object
                             upgradeKubeletAndKubeactl:
-                              description: UpgradeKubeletAndKubeactlCommandSpec provides...
+                              description: TODO download the specified version bin
+                                and replace it in the node UpgradeKubeletAndKubeactlCommandSpec
+                                provides...
+                              properties:
+                                kubernetesVersion:
+                                  description: KubernetesVersion specifies the target
+                                    kubernetes version If the version is empty, we
+                                    will skip this command.
+                                  type: string
                               type: object
                             wait:
                               description: Wait pauses the execution on the next command
diff --git a/config/crd/bases/operator.kubeadm.x-k8s.io_runtimetasks.yaml b/config/crd/bases/operator.kubeadm.x-k8s.io_runtimetasks.yaml
index 0c2e0e9..6e6315f 100644
--- a/config/crd/bases/operator.kubeadm.x-k8s.io_runtimetasks.yaml
+++ b/config/crd/bases/operator.kubeadm.x-k8s.io_runtimetasks.yaml
@@ -66,9 +66,18 @@ spec:
                       type: object
                     kubeadmUpgradeApply:
                       description: KubeadmUpgradeApplyCommandSpec provides...
+                      properties:
+                        dryRun:
+                          description: for dry run mode
+                          type: boolean
+                        kubernetesVersion:
+                          description: KubernetesVersion specifies the target kubernetes
+                            version If the version is empty, we will skip this command.
+                          type: string
                       type: object
                     kubeadmUpgradeNode:
-                      description: KubeadmUpgradeNodeCommandSpec provides...
+                      description: TODO download the specified version bin and replace
+                        it in the node KubeadmUpgradeNodeCommandSpec provides...
                       type: object
                     kubectlDrain:
                       description: KubectlDrainCommandSpec provides...
@@ -85,9 +94,20 @@ spec:
                       type: object
                     upgradeKubeadm:
                       description: UpgradeKubeadmCommandSpec provides...
+                      properties:
+                        kubernetesVersion:
+                          description: KubernetesVersion specifies the target kubernetes
+                            version If the version is empty, we will skip this command.
+                          type: string
                       type: object
                     upgradeKubeletAndKubeactl:
-                      description: UpgradeKubeletAndKubeactlCommandSpec provides...
+                      description: TODO download the specified version bin and replace
+                        it in the node UpgradeKubeletAndKubeactlCommandSpec provides...
+                      properties:
+                        kubernetesVersion:
+                          description: KubernetesVersion specifies the target kubernetes
+                            version If the version is empty, we will skip this command.
+                          type: string
                       type: object
                     wait:
                       description: Wait pauses the execution on the next command for
diff --git a/controllers/util.go b/controllers/util.go
index a203449..bfa0bee 100644
--- a/controllers/util.go
+++ b/controllers/util.go
@@ -157,6 +157,8 @@ func createDaemonSet(c client.Client, operation *operatorv1.Operation, namespace
 							},
 							SecurityContext: &corev1.SecurityContext{
 								Privileged: pointer.BoolPtr(true),
+								// TODO use non-root user: currently the /etc/kubernetes need root permissions
+								// RunAsUser: pointer.Int64Ptr(0),
 							},
 							VolumeMounts: []corev1.VolumeMount{
 								{
@@ -167,6 +169,33 @@ func createDaemonSet(c client.Client, operation *operatorv1.Operation, namespace
 									Name:      "etc-kubernetes",
 									MountPath: "/etc/kubernetes",
 								},
+								// TODO: use a different volume for the certificates when kubeadm upgrade apply.
+								// "kubeadm upgrade node" may use different dirs
+								// var-lib-kubelet-pki is used by kubeadm upgrade apply to store the certificates
+								{
+									Name:      "var-lib-kubelet-pki",
+									MountPath: "/var/lib/kubelet/pki",
+								},
+								// crictl is used by kubeadm upgrade apply to check the binary like `crictl`
+								{
+									Name:      "crictl",
+									MountPath: "/usr/local/bin/crictl",
+								},
+								// cp is used by kubeadm upgrade apply to run command like `cp`
+								{
+									Name:      "cp",
+									MountPath: "/usr/bin/cp",
+								},
+								// run is used to check container runtime status
+								{
+									Name:      "run",
+									MountPath: "/run",
+								},
+								// /var/lib/etcd is for etcd back during kubeadm upgrade apply
+								{
+									Name:      "etcd-data-dir",
+									MountPath: "/var/lib/etcd",
+								},
 							},
 						},
 					},
@@ -191,6 +220,51 @@ func createDaemonSet(c client.Client, operation *operatorv1.Operation, namespace
 								},
 							},
 						},
+						{
+							Name: "var-lib-kubelet-pki",
+							VolumeSource: corev1.VolumeSource{
+								HostPath: &corev1.HostPathVolumeSource{
+									Path: "/var/lib/kubelet/pki",
+									Type: hostPathTypePtr(corev1.HostPathDirectory),
+								},
+							},
+						},
+						{
+							Name: "crictl",
+							VolumeSource: corev1.VolumeSource{
+								HostPath: &corev1.HostPathVolumeSource{
+									Path: "/usr/local/bin/crictl",
+									Type: hostPathTypePtr(corev1.HostPathFile),
+								},
+							},
+						},
+						{
+							Name: "cp",
+							VolumeSource: corev1.VolumeSource{
+								HostPath: &corev1.HostPathVolumeSource{
+									Path: "/usr/bin/cp",
+									Type: hostPathTypePtr(corev1.HostPathFile),
+								},
+							},
+						},
+						{
+							Name: "run",
+							VolumeSource: corev1.VolumeSource{
+								HostPath: &corev1.HostPathVolumeSource{
+									Path: "/run",
+									Type: hostPathTypePtr(corev1.HostPathDirectory),
+								},
+							},
+						},
+						{
+							Name: "etcd-data-dir",
+							VolumeSource: corev1.VolumeSource{
+								HostPath: &corev1.HostPathVolumeSource{
+									Path: "/var/lib/etcd",
+									Type: hostPathTypePtr(corev1.HostPathDirectory),
+								},
+							},
+						},
 					},
 				},
 			},
diff --git a/operations/util.go b/operations/util.go
index 3d80480..7c6c85f 100644
--- a/operations/util.go
+++ b/operations/util.go
@@ -25,7 +25,6 @@ import (
 )
 
 func createUpgradeApplyTaskGroup(operation *operatorv1.Operation, taskdeploymentOrder string, taskdeploymentName string) operatorv1.RuntimeTaskGroup {
-	dryRun := operation.Spec.GetTypedOperationExecutionMode() == operatorv1.OperationExecutionModeDryRun
 	gv := operatorv1.GroupVersion
 
 	labels := map[string]string{}