Kubernetes v1.28.2 集群安装文档CentOS 7目录一、环境准备二、安装容器运行时containerd三、安装 kubeadm、kubelet、kubectl四、初始化控制平面节点Master五、安装 Calico 网络插件六、配置 kubectl七、加入工作节点Worker八、验证集群九、常见问题及解决方案一、环境准备1.1 节点规划角色主机名CPU内存数量控制平面节点k8s-master≥2核≥2GB1台工作节点k8s-worker-1≥2核≥2GB≥1台1.2 操作系统要求CentOS 7.x所有节点网络互通确保时间同步1.3 基础配置所有节点执行设置主机名# Master 节点执行hostnamectl set-hostname k8s-master# Worker 节点执行如有多个依次设置hostnamectl set-hostname k8s-worker-1配置 hosts 解析cat/etc/hostsEOF MASTER_IP k8s-master WORKER1_IP k8s-worker-1 EOF将MASTER_IP和WORKER1_IP替换为实际 IP 地址。关闭防火墙测试环境systemctl stop firewalld systemctl disable firewalld生产环境建议放通必要端口而非直接关闭详见第九节。关闭 SELinuxsetenforce0sed-is/SELINUXenforcing/SELINUXdisabled//etc/selinux/config关闭 Swapswapoff-ased-ris/.*swap.*/#//etc/fstab配置内核参数cat/etc/modules-load.d/k8s.confEOF overlay br_netfilter EOFmodprobe overlay modprobe br_netfiltercat/etc/sysctl.d/k8s.confEOF net.bridge.bridge-nf-call-iptables 1 net.bridge.bridge-nf-call-ip6tables 1 net.ipv4.ip_forward 1 EOFsysctl--system配置国内 YUM 源可选mv/etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.bakcurl-o/etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo yum makecache二、安装容器运行时containerd2.1 安装 containerd# 添加 Docker 官方源yuminstall-yyum-utils yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo# 安装 containerd注意包名是 containerd.ioyuminstall-ycontainerd.io2.2 配置 containerd# 生成默认配置mkdir-p/etc/containerd containerd config default/etc/containerd/config.toml# 启用 SystemdCgroupK8s 要求sed-is/SystemdCgroup false/SystemdCgroup true//etc/containerd/config.toml# 配置镜像加速器解决国内网络问题cat/etc/containerd/config.tomlEOF [plugins.io.containerd.grpc.v1.cri.registry.mirrors] [plugins.io.containerd.grpc.v1.cri.registry.mirrors.docker.io] endpoint [https://docker.mirrors.ustc.edu.cn, https://hub-mirror.c.163.com] [plugins.io.containerd.grpc.v1.cri.registry.mirrors.registry.k8s.io] endpoint [https://registry.aliyuncs.com/google_containers] EOF2.3 启动 containerdsystemctl restart containerd systemctlenablecontainerd systemctl status containerd2.4 安装 crictl可选用于调试VERSIONv1.28.0wgethttps://github.com/kubernetes-sigs/cri-tools/releases/download/$VERSION/crictl-$VERSION-linux-amd64.tar.gztarzxvf crictl-$VERSION-linux-amd64.tar.gz-C/usr/local/binrm-fcrictl-$VERSION-linux-amd64.tar.gz# 配置 crictlcat/etc/crictl.yamlEOF runtime-endpoint: unix:///run/containerd/containerd.sock image-endpoint: unix:///run/containerd/containerd.sock timeout: 10 EOF三、安装 kubeadm、kubelet、kubectl3.1 配置 Kubernetes YUM 源cat/etc/yum.repos.d/kubernetes.repoEOF [kubernetes] nameKubernetes baseurlhttps://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/ enabled1 gpgcheck1 repo_gpgcheck1 gpgkeyhttps://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg EOF3.2 安装指定版本yuminstall-ykubelet-1.28.2 kubeadm-1.28.2 kubectl-1.28.2# 锁定版本防止自动更新yuminstall-yyum-plugin-versionlock yum versionlock kubelet kubeadm kubectl# 启动 kubelet此时会循环重启等待 kubeadm 初始化systemctlenablekubelet systemctl start kubelet四、初始化控制平面节点Master4.1 执行初始化kubeadm init\--apiserver-advertise-addressMASTER_IP\--image-repositoryregistry.aliyuncs.com/google_containers\--pod-network-cidr10.244.0.0/16\--kubernetes-versionv1.28.2将MASTER_IP替换为 Master 节点的实际 IP 地址。4.2 配置 kubectlmkdir-p$HOME/.kubecp-i/etc/kubernetes/admin.conf$HOME/.kube/configchown$(id-u):$(id-g)$HOME/.kube/config4.3 保存 Join 命令初始化成功后会输出类似以下命令请务必保存kubeadmjoinMASTER_IP:6443--tokentoken--discovery-token-ca-cert-hash sha256:hash如忘记可执行kubeadm token create --print-join-command重新生成。五、安装 Calico 网络插件5.1 安装 Calicokubectl apply-fhttps://docs.projectcalico.org/v3.25/manifests/calico.yaml5.2 等待 Calico 启动# 监控 Pod 状态等待所有 Pod 变为 Runningwatch-n2kubectl get pods-nkube-system按CtrlC退出监控。5.3 如果只有单节点允许 Master 调度 Podkubectl taint nodes--allnode-role.kubernetes.io/control-plane-六、验证集群# 查看节点状态kubectl get nodes# 预期输出# NAME STATUS ROLES AGE VERSION# k8s-master Ready control-plane 10m v1.28.2# 查看所有系统 Podkubectl get pods-nkube-system所有节点状态为Ready、系统 Pod 均为Running即表示集群搭建成功。七、加入工作节点Worker在每个 Worker 节点上执行之前保存的kubeadm join命令kubeadmjoinMASTER_IP:6443--tokentoken--discovery-token-ca-cert-hash sha256:hash在 Master 节点验证kubectl get nodes# NAME STATUS ROLES AGE VERSION# k8s-master Ready control-plane 20m v1.28.2# k8s-worker-1 Ready none 2m v1.28.2八、集群测试8.1 部署测试 Podkubectl create deployment nginx-test--imagenginx kubectl expose deployment nginx-test--port80--typeNodePort kubectl get svc nginx-test8.2 清理测试资源kubectl delete deployment nginx-test kubectl delete svc nginx-test九、常见问题及解决方案9.1 镜像拉取失败问题failed to pull image registry.k8s.io/pause:3.6解决方案配置 containerd 镜像加速已在第二章配置或手动拉取镜像kubeadm config images pull --image-repositoryregistry.aliyuncs.com/google_containers --kubernetes-versionv1.28.29.2 节点一直是 NotReady原因网络插件未安装或未启动解决方案# 确认 Calico 是否正常运行kubectl get pods-nkube-system|grepcalico# 查看节点详细信息kubectl describenodek8s-master9.3 cgroup 驱动不一致解决方案确保 containerd 配置了SystemdCgroup truegrepSystemdCgroup /etc/containerd/config.toml# 应该显示 SystemdCgroup true9.4 生产环境防火墙配置Master 节点需要开放的端口firewall-cmd--permanent--add-port6443/tcp# Kubernetes API Serverfirewall-cmd--permanent--add-port2379-2380/tcp# etcdfirewall-cmd--permanent--add-port10250/tcp# Kubelet APIfirewall-cmd--reloadWorker 节点需要开放的端口firewall-cmd--permanent--add-port10250/tcp# Kubelet APIfirewall-cmd--permanent--add-port30000-32767/tcp# NodePortfirewall-cmd--reload十、集群信息摘要项目信息Kubernetes 版本v1.28.2容器运行时containerd网络插件Calico v3.25Pod 网段10.244.0.0/16Service 网段10.96.0.0/12 【Kubernetes 实战】（一）部署 Ruoyi-Cloud —— 环境准备
Kubernetes v1.28.2 集群安装文档CentOS 7目录一、环境准备二、安装容器运行时containerd三、安装 kubeadm、kubelet、kubectl四、初始化控制平面节点Master五、安装 Calico 网络插件六、配置 kubectl七、加入工作节点Worker八、验证集群九、常见问题及解决方案一、环境准备1.1 节点规划角色主机名CPU内存数量控制平面节点k8s-master≥2核≥2GB1台工作节点k8s-worker-1≥2核≥2GB≥1台1.2 操作系统要求CentOS 7.x所有节点网络互通确保时间同步1.3 基础配置所有节点执行设置主机名# Master 节点执行hostnamectl set-hostname k8s-master# Worker 节点执行如有多个依次设置hostnamectl set-hostname k8s-worker-1配置 hosts 解析cat/etc/hostsEOF MASTER_IP k8s-master WORKER1_IP k8s-worker-1 EOF将MASTER_IP和WORKER1_IP替换为实际 IP 地址。关闭防火墙测试环境systemctl stop firewalld systemctl disable firewalld生产环境建议放通必要端口而非直接关闭详见第九节。关闭 SELinuxsetenforce0sed-is/SELINUXenforcing/SELINUXdisabled//etc/selinux/config关闭 Swapswapoff-ased-ris/.*swap.*/#//etc/fstab配置内核参数cat/etc/modules-load.d/k8s.confEOF overlay br_netfilter EOFmodprobe overlay modprobe br_netfiltercat/etc/sysctl.d/k8s.confEOF net.bridge.bridge-nf-call-iptables 1 net.bridge.bridge-nf-call-ip6tables 1 net.ipv4.ip_forward 1 EOFsysctl--system配置国内 YUM 源可选mv/etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.bakcurl-o/etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo yum makecache二、安装容器运行时containerd2.1 安装 containerd# 添加 Docker 官方源yuminstall-yyum-utils yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo# 安装 containerd注意包名是 containerd.ioyuminstall-ycontainerd.io2.2 配置 containerd# 生成默认配置mkdir-p/etc/containerd containerd config default/etc/containerd/config.toml# 启用 SystemdCgroupK8s 要求sed-is/SystemdCgroup false/SystemdCgroup true//etc/containerd/config.toml# 配置镜像加速器解决国内网络问题cat/etc/containerd/config.tomlEOF [plugins.io.containerd.grpc.v1.cri.registry.mirrors] [plugins.io.containerd.grpc.v1.cri.registry.mirrors.docker.io] endpoint [https://docker.mirrors.ustc.edu.cn, https://hub-mirror.c.163.com] [plugins.io.containerd.grpc.v1.cri.registry.mirrors.registry.k8s.io] endpoint [https://registry.aliyuncs.com/google_containers] EOF2.3 启动 containerdsystemctl restart containerd systemctlenablecontainerd systemctl status containerd2.4 安装 crictl可选用于调试VERSIONv1.28.0wgethttps://github.com/kubernetes-sigs/cri-tools/releases/download/$VERSION/crictl-$VERSION-linux-amd64.tar.gztarzxvf crictl-$VERSION-linux-amd64.tar.gz-C/usr/local/binrm-fcrictl-$VERSION-linux-amd64.tar.gz# 配置 crictlcat/etc/crictl.yamlEOF runtime-endpoint: unix:///run/containerd/containerd.sock image-endpoint: unix:///run/containerd/containerd.sock timeout: 10 EOF三、安装 kubeadm、kubelet、kubectl3.1 配置 Kubernetes YUM 源cat/etc/yum.repos.d/kubernetes.repoEOF [kubernetes] nameKubernetes baseurlhttps://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/ enabled1 gpgcheck1 repo_gpgcheck1 gpgkeyhttps://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg EOF3.2 安装指定版本yuminstall-ykubelet-1.28.2 kubeadm-1.28.2 kubectl-1.28.2# 锁定版本防止自动更新yuminstall-yyum-plugin-versionlock yum versionlock kubelet kubeadm kubectl# 启动 kubelet此时会循环重启等待 kubeadm 初始化systemctlenablekubelet systemctl start kubelet四、初始化控制平面节点Master4.1 执行初始化kubeadm init\--apiserver-advertise-addressMASTER_IP\--image-repositoryregistry.aliyuncs.com/google_containers\--pod-network-cidr10.244.0.0/16\--kubernetes-versionv1.28.2将MASTER_IP替换为 Master 节点的实际 IP 地址。4.2 配置 kubectlmkdir-p$HOME/.kubecp-i/etc/kubernetes/admin.conf$HOME/.kube/configchown$(id-u):$(id-g)$HOME/.kube/config4.3 保存 Join 命令初始化成功后会输出类似以下命令请务必保存kubeadmjoinMASTER_IP:6443--tokentoken--discovery-token-ca-cert-hash sha256:hash如忘记可执行kubeadm token create --print-join-command重新生成。五、安装 Calico 网络插件5.1 安装 Calicokubectl apply-fhttps://docs.projectcalico.org/v3.25/manifests/calico.yaml5.2 等待 Calico 启动# 监控 Pod 状态等待所有 Pod 变为 Runningwatch-n2kubectl get pods-nkube-system按CtrlC退出监控。5.3 如果只有单节点允许 Master 调度 Podkubectl taint nodes--allnode-role.kubernetes.io/control-plane-六、验证集群# 查看节点状态kubectl get nodes# 预期输出# NAME STATUS ROLES AGE VERSION# k8s-master Ready control-plane 10m v1.28.2# 查看所有系统 Podkubectl get pods-nkube-system所有节点状态为Ready、系统 Pod 均为Running即表示集群搭建成功。七、加入工作节点Worker在每个 Worker 节点上执行之前保存的kubeadm join命令kubeadmjoinMASTER_IP:6443--tokentoken--discovery-token-ca-cert-hash sha256:hash在 Master 节点验证kubectl get nodes# NAME STATUS ROLES AGE VERSION# k8s-master Ready control-plane 20m v1.28.2# k8s-worker-1 Ready none 2m v1.28.2八、集群测试8.1 部署测试 Podkubectl create deployment nginx-test--imagenginx kubectl expose deployment nginx-test--port80--typeNodePort kubectl get svc nginx-test8.2 清理测试资源kubectl delete deployment nginx-test kubectl delete svc nginx-test九、常见问题及解决方案9.1 镜像拉取失败问题failed to pull image registry.k8s.io/pause:3.6解决方案配置 containerd 镜像加速已在第二章配置或手动拉取镜像kubeadm config images pull --image-repositoryregistry.aliyuncs.com/google_containers --kubernetes-versionv1.28.29.2 节点一直是 NotReady原因网络插件未安装或未启动解决方案# 确认 Calico 是否正常运行kubectl get pods-nkube-system|grepcalico# 查看节点详细信息kubectl describenodek8s-master9.3 cgroup 驱动不一致解决方案确保 containerd 配置了SystemdCgroup truegrepSystemdCgroup /etc/containerd/config.toml# 应该显示 SystemdCgroup true9.4 生产环境防火墙配置Master 节点需要开放的端口firewall-cmd--permanent--add-port6443/tcp# Kubernetes API Serverfirewall-cmd--permanent--add-port2379-2380/tcp# etcdfirewall-cmd--permanent--add-port10250/tcp# Kubelet APIfirewall-cmd--reloadWorker 节点需要开放的端口firewall-cmd--permanent--add-port10250/tcp# Kubelet APIfirewall-cmd--permanent--add-port30000-32767/tcp# NodePortfirewall-cmd--reload十、集群信息摘要项目信息Kubernetes 版本v1.28.2容器运行时containerd网络插件Calico v3.25Pod 网段10.244.0.0/16Service 网段10.96.0.0/12