Which kubeadm command is run on a worker node during a cluster upgrade (after the control plane is already upgraded)?