If you are including "apt" recipe you don't have to create execute[apt-get upgrade -y] resource. Or if you don't want to include "apt" recipe, then use
execute "apt-get upgrade -y" do
command "apt-get upgrade -y"
action :run
end
But as run is default action, and name is default command, that can be shortened to
execute "apt-get upgrade -y"