Rocky Linux 9.2 Kubernetes 部署完整指南 环境信息操作系统Rocky Linux 9.2 (Minimal)网络模式NAT访问外网 仅主机集群内部通信节点规划Master192.168.80.100主机名 k8s-masterWorker1192.168.80.110主机名 k8s-worker1Worker2192.168.80.120主机名 k8s-worker2Kubernetes版本v1.28.2容器运行时containerd (v2.3.3)网络插件Calico v3.28.0Dashboard版本v2.7.0一、系统初始化所有节点执行1.1 设置主机名# Masterhostnamectl set-hostname k8s-masterbash# Worker1hostnamectl set-hostname k8s-worker1bash# Worker2hostnamectl set-hostname k8s-worker2bash1.2 配置 hosts 解析cat/etc/hostsEOF 192.168.80.100 k8s-master 192.168.80.110 k8s-worker1 192.168.80.120 k8s-worker2 EOF1.3 设置免密登录Master操作ssh-ssh-keygen#一路回车ssh-copy-id k8s-master ssh-copy-id k8s-worker1 ssh-copy-id k8s-worker21.4 更换国内 YUM 源阿里云sed-es|^mirrorlist|#mirrorlist|g\-es|^#baseurlhttp://dl.rockylinux.org/$contentdir|baseurlhttps://mirrors.aliyun.com/rockylinux|g\-i.bak/etc/yum.repos.d/[Rr]ocky*.repo dnf makecache1.5 关闭防火墙与 SELinuxsystemctl disable--nowfirewalld setenforce0sed-is/^SELINUXenforcing$/SELINUXdisabled//etc/selinux/config1.6 关闭 Swapswapoff-ased-ris/.*swap.*/#//etc/fstab1.7 加载内核模块catEOF|tee/etc/modules-load.d/k8s.confoverlay br_netfilter EOFmodprobe overlay modprobe br_netfilter1.8 配置内核参数catEOF|tee/etc/sysctl.d/k8s.confnet.bridge.bridge-nf-call-iptables 1 net.bridge.bridge-nf-call-ip6tables 1 net.ipv4.ip_forward 1 EOFsysctl--system1.9 配置时间同步Chronydnfinstall-ychronysed-is/^pool.*/#//etc/chrony.confechopool ntp1.aliyun.com iburst/etc/chrony.conf systemctl restart chronyd systemctlenablechronyd timedatectl set-timezone Asia/Shanghai二、安装容器运行时containerd所有节点执行2.1 添加 Docker CE 源containerd 源自此dnfinstall-yyum-utils yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo2.2 安装 containerddnfinstall-ycontainerd.io2.3 配置 containerd关键步骤# 生成默认配置containerd config default/etc/containerd/config.toml# 修改 pause 镜像为阿里云镜像注意新版配置位置是 pinned_images.sandboxsed-is|sandbox registry.k8s.io/pause:3.*|sandbox registry.aliyuncs.com/google_containers/pause:3.10|g/etc/containerd/config.toml# 启用 SystemdCgroupsed-is/SystemdCgroup false/SystemdCgroup true//etc/containerd/config.toml# 重启 containerdsystemctl restart containerd systemctlenablecontainerd验证配置containerd config dump|grep-A2pinned_images# 应显示 sandbox registry.aliyuncs.com/google_containers/pause:3.10三、安装 Kubernetes 组件所有节点3.1 添加阿里云 Kubernetes YUM 源catEOF|tee/etc/yum.repos.d/kubernetes.repo[kubernetes] nameKubernetes baseurlhttps://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/ enabled1 gpgcheck1 gpgkeyhttps://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg EOF3.2 安装 kubeadm、kubelet、kubectldnfinstall-ykubelet kubeadm kubectl--disableexcludeskubernetes systemctlenablekubelet四、初始化集群仅在 Master 节点4.1 预拉取镜像可选加速初始化kubeadm config images pull --image-repositoryregistry.aliyuncs.com/google_containers4.2 初始化集群kubeadm init\--apiserver-advertise-address192.168.80.100\--image-repositoryregistry.aliyuncs.com/google_containers\--pod-network-cidr192.168.0.0/16\--service-cidr10.96.0.0/12保存输出中的 join 命令稍后用于 Worker 节点加入。4.3 配置 kubectlmkdir-p$HOME/.kubesudocp/etc/kubernetes/admin.conf$HOME/.kube/configsudochown$(id-u):$(id-g)$HOME/.kube/config五、安装 Calico 网络插件Master 节点5.1 安装 Tigera Operatorkubectl create-fhttps://raw.githubusercontent.com/projectcalico/calico/v3.28.0/manifests/tigera-operator.yaml5.2 创建 Installation 自定义资源指定镜像仓库catEOF|kubectl apply-f-apiVersion: operator.tigera.io/v1 kind: Installation metadata: name: default spec: registry: quay.io calicoNetwork: ipPools: - blockSize: 26 cidr: 192.168.0.0/16 encapsulation: VXLANCrossSubnet natOutgoing: Enabled nodeSelector: all() --- apiVersion: operator.tigera.io/v1 kind: APIServer metadata: name: default spec: {} EOF5.3 如果 quay.io 拉取慢改为 DaoCloud 加速kubectl patch installation default--typejson-p[{op: replace, path: /spec/registry, value: docker.m.daocloud.io}]5.4 验证 Calico Pod 运行kubectl get pods-ncalico-system-w# 等待所有 Pod 变为 Running六、加入 Worker 节点在 Worker 节点执行之前保存的 join 命令例如kubeadmjoin192.168.80.100:6443--tokentoken--discovery-token-ca-cert-hash sha256:hash如果 token 过期在 Master 上重新生成kubeadm token create --print-join-command七、验证集群kubectl get nodes-owide kubectl get pods-A所有节点状态应为Ready。八、部署 Kubernetes DashboardMaster 节点8.1 安装 Dashboard官方 YAMLkubectl apply-fhttps://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yaml8.2 修改镜像为国内源如果 Pod 出现 ImagePullBackOffkubectlsetimage deployment/kubernetes-dashboard-nkubernetes-dashboard\kubernetes-dashboarddocker.m.daocloud.io/kubernetesui/dashboard:v2.7.0 kubectlsetimage deployment/dashboard-metrics-scraper-nkubernetes-dashboard\dashboard-metrics-scraperdocker.m.daocloud.io/kubernetesui/metrics-scraper:v1.0.88.3 创建管理员用户并获取 TokencatEOF|kubectl apply-f-apiVersion: v1 kind: ServiceAccount metadata: name: dashboard-admin namespace: kubernetes-dashboard --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: dashboard-admin roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: dashboard-admin namespace: kubernetes-dashboard EOF#执行以下命令生成一个永不过期或长期有效的 Token--duration87600h 表示 10 年有效期按需调整kubectl create token-nkubernetes-dashboard dashboard-admin--duration87600h8.4 访问 Dashboard方式一临时端口转发仅限本机kubectl-nkubernetes-dashboard port-forward svc/kubernetes-dashboard8443:443# 浏览器访问 https://localhost:8443方式二NodePort允许外部访问kubectl patch svc kubernetes-dashboard-nkubernetes-dashboard-p{spec: {type: NodePort}}kubectl get svc-nkubernetes-dashboard kubernetes-dashboard# 获取 NodePort 端口如 3xxxx访问 https://任意节点IP:3xxxx登录时选择 Token粘贴上一步生成的 Token。九、常见问题及解决方案9.1 containerd 拉取 pause 镜像失败原因新版 containerd 配置中 pause 镜像定义在pinned_images.sandbox而非sandbox_image。解决使用sed -i s|sandbox registry.k8s.io/pause:3.*|sandbox registry.aliyuncs.com/google_containers/pause:3.10|g /etc/containerd/config.toml修改并重启 containerd。9.2 Calico 镜像拉取失败解决使用kubectl patch installation default --typejson -p[{op: replace, path: /spec/registry, value: docker.m.daocloud.io}]切换到 DaoCloud 镜像仓库。9.3 Dashboard Pod ImagePullBackOff解决使用kubectl set image指定国内镜像如 DaoCloud 或阿里云镜像。9.4 端口 6443 被占用导致初始化失败解决kill -9 进程PID杀掉占用进程然后kubeadm reset -f清理后重新初始化。9.5 Worker 节点 NotReady原因Calico 网络插件未成功部署或镜像拉取慢。解决检查calico-nodePod 状态如果镜像拉取失败按 9.2 处理如果卡在 Init可删除 Pod 重建。 Rocky Linux 9.2 Kubernetes 部署完整指南
Rocky Linux 9.2 Kubernetes 部署完整指南 环境信息操作系统Rocky Linux 9.2 (Minimal)网络模式NAT访问外网 仅主机集群内部通信节点规划Master192.168.80.100主机名 k8s-masterWorker1192.168.80.110主机名 k8s-worker1Worker2192.168.80.120主机名 k8s-worker2Kubernetes版本v1.28.2容器运行时containerd (v2.3.3)网络插件Calico v3.28.0Dashboard版本v2.7.0一、系统初始化所有节点执行1.1 设置主机名# Masterhostnamectl set-hostname k8s-masterbash# Worker1hostnamectl set-hostname k8s-worker1bash# Worker2hostnamectl set-hostname k8s-worker2bash1.2 配置 hosts 解析cat/etc/hostsEOF 192.168.80.100 k8s-master 192.168.80.110 k8s-worker1 192.168.80.120 k8s-worker2 EOF1.3 设置免密登录Master操作ssh-ssh-keygen#一路回车ssh-copy-id k8s-master ssh-copy-id k8s-worker1 ssh-copy-id k8s-worker21.4 更换国内 YUM 源阿里云sed-es|^mirrorlist|#mirrorlist|g\-es|^#baseurlhttp://dl.rockylinux.org/$contentdir|baseurlhttps://mirrors.aliyun.com/rockylinux|g\-i.bak/etc/yum.repos.d/[Rr]ocky*.repo dnf makecache1.5 关闭防火墙与 SELinuxsystemctl disable--nowfirewalld setenforce0sed-is/^SELINUXenforcing$/SELINUXdisabled//etc/selinux/config1.6 关闭 Swapswapoff-ased-ris/.*swap.*/#//etc/fstab1.7 加载内核模块catEOF|tee/etc/modules-load.d/k8s.confoverlay br_netfilter EOFmodprobe overlay modprobe br_netfilter1.8 配置内核参数catEOF|tee/etc/sysctl.d/k8s.confnet.bridge.bridge-nf-call-iptables 1 net.bridge.bridge-nf-call-ip6tables 1 net.ipv4.ip_forward 1 EOFsysctl--system1.9 配置时间同步Chronydnfinstall-ychronysed-is/^pool.*/#//etc/chrony.confechopool ntp1.aliyun.com iburst/etc/chrony.conf systemctl restart chronyd systemctlenablechronyd timedatectl set-timezone Asia/Shanghai二、安装容器运行时containerd所有节点执行2.1 添加 Docker CE 源containerd 源自此dnfinstall-yyum-utils yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo2.2 安装 containerddnfinstall-ycontainerd.io2.3 配置 containerd关键步骤# 生成默认配置containerd config default/etc/containerd/config.toml# 修改 pause 镜像为阿里云镜像注意新版配置位置是 pinned_images.sandboxsed-is|sandbox registry.k8s.io/pause:3.*|sandbox registry.aliyuncs.com/google_containers/pause:3.10|g/etc/containerd/config.toml# 启用 SystemdCgroupsed-is/SystemdCgroup false/SystemdCgroup true//etc/containerd/config.toml# 重启 containerdsystemctl restart containerd systemctlenablecontainerd验证配置containerd config dump|grep-A2pinned_images# 应显示 sandbox registry.aliyuncs.com/google_containers/pause:3.10三、安装 Kubernetes 组件所有节点3.1 添加阿里云 Kubernetes YUM 源catEOF|tee/etc/yum.repos.d/kubernetes.repo[kubernetes] nameKubernetes baseurlhttps://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/ enabled1 gpgcheck1 gpgkeyhttps://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg EOF3.2 安装 kubeadm、kubelet、kubectldnfinstall-ykubelet kubeadm kubectl--disableexcludeskubernetes systemctlenablekubelet四、初始化集群仅在 Master 节点4.1 预拉取镜像可选加速初始化kubeadm config images pull --image-repositoryregistry.aliyuncs.com/google_containers4.2 初始化集群kubeadm init\--apiserver-advertise-address192.168.80.100\--image-repositoryregistry.aliyuncs.com/google_containers\--pod-network-cidr192.168.0.0/16\--service-cidr10.96.0.0/12保存输出中的 join 命令稍后用于 Worker 节点加入。4.3 配置 kubectlmkdir-p$HOME/.kubesudocp/etc/kubernetes/admin.conf$HOME/.kube/configsudochown$(id-u):$(id-g)$HOME/.kube/config五、安装 Calico 网络插件Master 节点5.1 安装 Tigera Operatorkubectl create-fhttps://raw.githubusercontent.com/projectcalico/calico/v3.28.0/manifests/tigera-operator.yaml5.2 创建 Installation 自定义资源指定镜像仓库catEOF|kubectl apply-f-apiVersion: operator.tigera.io/v1 kind: Installation metadata: name: default spec: registry: quay.io calicoNetwork: ipPools: - blockSize: 26 cidr: 192.168.0.0/16 encapsulation: VXLANCrossSubnet natOutgoing: Enabled nodeSelector: all() --- apiVersion: operator.tigera.io/v1 kind: APIServer metadata: name: default spec: {} EOF5.3 如果 quay.io 拉取慢改为 DaoCloud 加速kubectl patch installation default--typejson-p[{op: replace, path: /spec/registry, value: docker.m.daocloud.io}]5.4 验证 Calico Pod 运行kubectl get pods-ncalico-system-w# 等待所有 Pod 变为 Running六、加入 Worker 节点在 Worker 节点执行之前保存的 join 命令例如kubeadmjoin192.168.80.100:6443--tokentoken--discovery-token-ca-cert-hash sha256:hash如果 token 过期在 Master 上重新生成kubeadm token create --print-join-command七、验证集群kubectl get nodes-owide kubectl get pods-A所有节点状态应为Ready。八、部署 Kubernetes DashboardMaster 节点8.1 安装 Dashboard官方 YAMLkubectl apply-fhttps://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yaml8.2 修改镜像为国内源如果 Pod 出现 ImagePullBackOffkubectlsetimage deployment/kubernetes-dashboard-nkubernetes-dashboard\kubernetes-dashboarddocker.m.daocloud.io/kubernetesui/dashboard:v2.7.0 kubectlsetimage deployment/dashboard-metrics-scraper-nkubernetes-dashboard\dashboard-metrics-scraperdocker.m.daocloud.io/kubernetesui/metrics-scraper:v1.0.88.3 创建管理员用户并获取 TokencatEOF|kubectl apply-f-apiVersion: v1 kind: ServiceAccount metadata: name: dashboard-admin namespace: kubernetes-dashboard --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: dashboard-admin roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: dashboard-admin namespace: kubernetes-dashboard EOF#执行以下命令生成一个永不过期或长期有效的 Token--duration87600h 表示 10 年有效期按需调整kubectl create token-nkubernetes-dashboard dashboard-admin--duration87600h8.4 访问 Dashboard方式一临时端口转发仅限本机kubectl-nkubernetes-dashboard port-forward svc/kubernetes-dashboard8443:443# 浏览器访问 https://localhost:8443方式二NodePort允许外部访问kubectl patch svc kubernetes-dashboard-nkubernetes-dashboard-p{spec: {type: NodePort}}kubectl get svc-nkubernetes-dashboard kubernetes-dashboard# 获取 NodePort 端口如 3xxxx访问 https://任意节点IP:3xxxx登录时选择 Token粘贴上一步生成的 Token。九、常见问题及解决方案9.1 containerd 拉取 pause 镜像失败原因新版 containerd 配置中 pause 镜像定义在pinned_images.sandbox而非sandbox_image。解决使用sed -i s|sandbox registry.k8s.io/pause:3.*|sandbox registry.aliyuncs.com/google_containers/pause:3.10|g /etc/containerd/config.toml修改并重启 containerd。9.2 Calico 镜像拉取失败解决使用kubectl patch installation default --typejson -p[{op: replace, path: /spec/registry, value: docker.m.daocloud.io}]切换到 DaoCloud 镜像仓库。9.3 Dashboard Pod ImagePullBackOff解决使用kubectl set image指定国内镜像如 DaoCloud 或阿里云镜像。9.4 端口 6443 被占用导致初始化失败解决kill -9 进程PID杀掉占用进程然后kubeadm reset -f清理后重新初始化。9.5 Worker 节点 NotReady原因Calico 网络插件未成功部署或镜像拉取慢。解决检查calico-nodePod 状态如果镜像拉取失败按 9.2 处理如果卡在 Init可删除 Pod 重建。