本文基于Rocky Linux 10.2使用Kubeadm部署Kubernetes v1.36.3集群容器运行时选用Containerd网络插件使用Calico v3.32.1。全程包含详细命令、踩坑点与验证结果适合生产环境参考。rockLinux系统镜像下载链接镜像类型说明下载链接DVD 完整版包含所有常用软件包离线安装推荐约 10~12 GBhttps://mirrors.aliyun.com/rockylinux/10.2/isos/x86_64/Rocky-10.2-x86_64-dvd.isoBoot 网络安装版体积小约 1 GB安装时需联网下载软件包https://mirrors.aliyun.com/rockylinux/10.2/isos/x86_64/Rocky-10.2-x86_64-boot.isoMinimal 最小化版仅含基础系统适合服务器/容器场景https://mirrors.aliyun.com/rockylinux/10.2/isos/x86_64/Rocky-10.2-x86_64-minimal.iso一、环境准备1.1 主机规划主机名IP 地址角色master192.168.194.15control-planenode1192.168.194.16workernode2192.168.194.17workerharbor192.168.194.20镜像仓库可选1.2 基础系统配置三台主机均需执行修改主机名以 node1 为例hostnamectlhostnamenode1bash配置静态 IP以 node1 为例nmcli c m ens160 ipv4.method manual\ipv4.addresses192.168.194.16/24\ipv4.dns223.5.5.5 8.8.8.8\ipv4.gateway192.168.194.2\connection.autoconnectyesnmcli c up ens160关闭防火墙与 SELinuxsystemctl stop firewalldsystemctl disable firewalld setenforce0sed-is/^SELINUXenforcing$/SELINUXdisabled//etc/selinux/config配置主机映射cat/etc/hostsEOF 192.168.194.15 master 192.168.194.16 node1 192.168.194.17 node2 192.168.194.20 hb.reg.com harbor EOF关闭交换分区swapoff-ased-ris/.*swap.*/#//etc/fstab调整系统资源限制cat/etc/security/limits.confEOF * soft nofile 655350 * hard nofile 655350 * soft nproc 655350 * hard nproc 655350 * soft memlock unlimited * hard memlock unlimited EOF开启路由转发echonet.ipv4.ip_forward1/etc/sysctl.confsysctl-p加载内核模块modprobe br_netfilter modprobe overlaycatEOF|tee/etc/sysctl.d/k8s.confnet.bridge.bridge-nf-call-iptables 1 net.bridge.bridge-nf-call-ip6tables 1 net.ipv4.ip_forward 1 EOFechobr_netfilter|tee/etc/modules-load.d/k8s.confsysctl--system时间同步Chronydnfinstall-ychrony systemctlenable--nowchronydsed-is/^pool.*/server ntp1.aliyun.com iburst//etc/chrony.conf systemctl restart chronyd chronyc tracking重启生效reboot二、安装 Containerd 容器运行时2.1 安装 Containerdtar-xfcontainerd-2.0.5-linux-amd64.tar.gzmvbin/* /usr/local/bin/mkdir-p/usr/local/lib/systemd/systemwgethttps://raw.githubusercontent.com/containerd/containerd/main/containerd.service\-O/usr/local/lib/systemd/system/containerd.service systemctl daemon-reload2.2 配置 Containerdmkdir-p/etc/containerd containerd config default/etc/containerd/config.toml修改sandbox_image为阿里云镜像sed-is|registry.k8s.io/pause:3.10|registry.aliyuncs.com/google_containers/pause:3.10.2|/etc/containerd/config.toml启用 SystemdCgroupsed-i/\[plugins.*runtimes\.runc\.options\]/a\ SystemdCgroup true/etc/containerd/config.toml2.3 安装 runc编写脚本runc.sh#!/bin/bashcase$(uname-m)inx86_64)Aamd64;;aarch64)Aarm64;;*)echounsupported arch;exit1;;esacVv1.2.6foruin\https://github.com/opencontainers/runc/releases/download/${V}/runc.${A}\https://ghfast.top/https://github.com/opencontainers/runc/releases/download/${V}/runc.${A}\https://mirror.ghproxy.com/https://github.com/opencontainers/runc/releases/download/${V}/runc.${A};docurl-fSL-o/usr/bin/runc$u[-s/usr/bin/runc]breakdonechmodx /usr/bin/runc runc--version执行sourcerunc.sh systemctl restart containerd三、安装 Kubeadm / Kubelet / Kubectl3.1 配置阿里云 YUM 源cat/etc/yum.repos.d/kubernetes.repoEOF [kubernetes] nameKubernetes baseurlhttps://mirrors.aliyun.com/kubernetes-new/core/stable/v1.36/rpm/ enabled1 gpgcheck1 gpgkeyhttps://mirrors.aliyun.com/kubernetes-new/core/stable/v1.36/rpm/repodata/repomd.xml.key EOF3.2 安装组件dnf makecache dnfinstall-ykubelet-1.36.3 kubeadm-1.36.3 kubectl-1.36.3--disableexcludeskubernetes systemctlenablekubelet验证kubeadm version kubelet--versionkubectl version--client四、初始化 Master 节点4.1 执行初始化kubeadm init\--apiserver-advertise-address192.168.194.15\--image-repositoryregistry.aliyuncs.com/google_containers\--kubernetes-versionv1.36.3\--service-cidr10.96.0.0/12\--pod-network-cidr10.244.0.0/16\--cri-socketunix:///run/containerd/containerd.sock4.2 配置 kubectlmkdir-p$HOME/.kubecp-i/etc/kubernetes/admin.conf$HOME/.kube/configchown$(id-u):$(id-g)$HOME/.kube/config五、Worker 节点加入集群在 node1 / node2 上执行使用 init 输出的 join 命令kubeadmjoin192.168.194.15:6443--tokenmgc5zo.v3jrhfvbklh1qc7r\--discovery-token-ca-cert-hash sha256:42dba2763ef41f8c76b79f851e2d8e593cd01eafff78825e94a439c461ee4989 token 和 hash 以实际 init 输出为准有效期 24h过期后可重新生成。六、安装 Calico 网络插件6.1 下载并修改配置curlhttps://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico-typha.yaml-ocalico.yaml修改关键参数-name:CALICO_IPV4POOL_IPIPvalue:Off# 关闭 IPIP-name:CALICO_IPV4POOL_VXLANvalue:Never# 关闭 VXLAN-name:CALICO_IPV4POOL_CIDRvalue:10.244.0.0/16# 与 init 的 pod-network-cidr 一致6.2 预拉取镜像三台主机脚本pull-calico.sh#!/bin/bashMIRRORdocker.m.daocloud.ioNSk8s.ioVERv3.32.1forimgincninodekube-controllers typha;doctr-n${NS}images pull${MIRROR}/calico/${img}:${VER}ctr-n${NS}images tag--force${MIRROR}/calico/${img}:${VER}docker.io/calico/${img}:${VER}ctr-n${NS}images tag--force${MIRROR}/calico/${img}:${VER}calico/${img}:${VER}ctr-n${NS}imagesrm${MIRROR}/calico/${img}:${VER}2/dev/nulldonectr-n${NS}imagesls|grepcalico执行sourcepull-calico.sh6.3 部署 Calicokubectl apply-fcalico.yaml七、验证集群状态查看所有 Podkubectl get pod-A输出示例NAMESPACE NAME READY STATUS RESTARTS AGE kube-system calico-kube-controllers-58f68d56d9-qzvsw 1/1 Running 0 30s kube-system calico-node-2rl4b 1/1 Running 0 30s kube-system calico-node-9gb58 1/1 Running 0 30s kube-system calico-node-clkb6 1/1 Running 0 30s kube-system calico-typha-784fff7dd7-v55hn 1/1 Running 0 30s kube-system coredns-6b5f954497-rs6x4 1/1 Running 0 55m kube-system coredns-6b5f954497-x5ffm 1/1 Running 0 55m kube-system etcd-master 1/1 Running 0 55m kube-system kube-apiserver-master 1/1 Running 0 55m kube-system kube-controller-manager-master 1/1 Running 0 55m kube-system kube-proxy-fqwvh 1/1 Running 0 52m kube-system kube-proxy-vmtnl 1/1 Running 0 55m kube-system kube-proxy-w4s6l 1/1 Running 0 52m kube-system kube-scheduler-master 1/1 Running 0 55m查看节点状态kubectl getnode输出示例NAME STATUS ROLES AGE VERSION master Ready control-plane 56m v1.36.3 node1 Ready none 53m v1.36.3 node2 Ready none 53m v1.36.3✅ 所有节点均为Ready集群部署成功八、常见踩坑与解决方案问题解决方案runc未安装或版本不对使用提供的脚本安装确保/usr/bin/runc存在pause镜像拉取失败修改sandbox_image为阿里云镜像Calico Pod 一直CrashLoopBackOff检查CALICO_IPV4POOL_CIDR是否与pod-network-cidr一致kubeadm init超时检查 containerd 是否正常运行cri-socket路径是否正确Worker 节点 token 过期在 Master 执行kubeadm token create --print-join-command重新生成九、附录常用管理命令# 查看所有资源kubectl get all-A# 查看节点详情kubectl describenodemaster# 查看 Pod 日志kubectl logs-nkube-systempod-name# 重置集群仅 Masterkubeadm reset-f--cri-socketunix:///run/containerd/containerd.sockrm-rf/etc/kubernetes/* /var/lib/etcd /var/lib/kubelet$HOME/.kube