ubuntu 24.04.4，下载（kubeadm 、kubelet、kubectl 、contanerd.io）的二进制离线包安装 k8s v1.34.3

集群规划（3 节点）：

master节点，主机名：k8s-master-01，内网ip：172.29.128.1

工作节点01：主机名：k8s-worker-01，内网ip：172.29.132.68 

工作节点02：主机名：k8s-worker-02，内网ip：172.29.132.69 

 

一，离线包准备

查看kubeadm-1.34.3需要哪些镜像：

kubeadm config images list --kubernetes-version v1.34.3

 

 离线部署需要的离线资源清单：

资源名称 离线包名称 下载链接
系统底层依赖包 
ubuntu-24.04-deps.tar.gz

 需要包含安装依赖：

socat, conntrack, ipvsadm, ipset, bridge-utils, iptables, ca-certificates, apparmor-utils
容器运行时全套

containerd-2.3.3-linux-amd64.tar.gz
runc.amd64
cni-plugins-linux-amd64-v1.6.0.tgz
containerd.service

https://github.com/containerd/containerd/releases/download/v2.3.3/containerd-2.3.3-linux-amd64.tar.gz
https://github.com/opencontainers/runc/releases/download/v1.2.4/runc.amd64
https://github.com/containernetworking/plugins/releases/download/v1.6.0/cni-plugins-linux-amd64-v1.6.0.tgz
https://raw.githubusercontent.com/containerd/containerd/main/containerd.service
K8s v1.34.3 控制平面二进制

kubeadm
kubectl
kubelet

https://dl.k8s.io/v1.34.3/bin/linux/amd64/kubectl
https://dl.k8s.io/v1.34.3/bin/linux/amd64/kubeadm
https://dl.k8s.io/v1.34.3/bin/linux/amd64/kubelet
 Calico 3.32.1完整离线资源

calicoctl-linux-amd64

calico-v3.32.1.yaml

  

https://github.com/projectcalico/calico/releases/download/v3.32.1/calicoctl-linux-amd64
https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico.yaml
 Calico 3.32.1镜像

quay.io/calico/cni:v3.32.1
quay.io/calico/kube-controllers:v3.32.1
quay.io/calico/node:v3.32.1

  

查看镜像： awk '/image:\s*/{print $2}' calico-v3.32.1.yaml | sort -u

7 个 K8s 核心控制平面镜像的导出包

k8s-1.34.3-offline-images.tar

registry.k8s.io/kube-apiserver:v1.34.3

registry.k8s.io/kube-controller-manager:v1.34.3

registry.k8s.io/kube-scheduler:v1.34.3

registry.k8s.io/kube-proxy:v1.34.3

registry.k8s.io/etcd:3.6.5-0

registry.k8s.io/coredns/coredns:v1.12.1

registry.k8s.io/pause:3.10.1

 
查看镜像：kubeadm config images list --kubernetes-version v1.34.3

nerdctl v.2.3.3离线安装包

 nerdctl-2.3.3-linux-amd64.tar.gz https://github.com/containerd/nerdctl/releases/download/v2.3.3/nerdctl-2.3.3-linux-amd64.tar.gz

 

 离线包汇总：

#系统依赖包
ubuntu-24.04-debs.tar.gz

#k8s-1.34.3镜像
k8s-1.34.3-offline-images.tar

#nerdctl离线安装包
nerdctl-2.3.3-linux-amd64.tar.gz

#kubeadm离线文件清单
containerd-2.3.3-linux-amd64.tar.gz
runc.amd64
cni-plugins-linux-amd64-v1.6.0.tgz
containerd.service
kubeadm
kubectl
kubelet
calicoctl-linux-amd64
calico-release-v3.32.1.tgz
calico-v3.32.1.yaml

#k8s-1.34.3镜像包 k8s-1.34.3-offline-images.tar，包含：
registry.k8s.io/kube-apiserver:v1.34.3
registry.k8s.io/kube-controller-manager:v1.34.3
registry.k8s.io/kube-scheduler:v1.34.3
registry.k8s.io/kube-proxy:v1.34.3
registry.k8s.io/etcd:3.6.5-0
registry.k8s.io/coredns/coredns:v1.12.1
registry.k8s.io/pause:3.10.1
#3个calico镜像
quay.io/calico/cni:v3.32.1
quay.io/calico/kube-controllers:v3.32.1
quay.io/calico/node:v3.32.1

 

2，制作 ubantu 24.04.4 系统依赖离线包

必备依赖列表：

socat, conntrack, ipvsadm, ipset, bridge-utils, iptables, ca-certificates, apparmor-utils

把下面的全部打包也可以：

curl, wget, openssl, ca-certificates, gnupg, lsb-release, openssh-server, sshpass, tar, unzip, ipset, ipvsadm, conntrack, socat, lvm2, bridge-utils, iptables，apparmor-utils

跳板机下载 deb（仅下载不安装），注意：这条命令要找一台没有安装过这些软件的跳板机，已安装过的软件会跳过下载。.

apt clean
apt update
apt install -y --download-only curl  wget  openssl  ca-certificates  gnupg  lsb-release  openssh-server  sshpass tar  unzip  ipset  ipvsadm  conntrack  socat  lvm2  bridge-utils  iptables  apparmor-utils
mkdir -p system-debs && cp /var/cache/apt/archives/*.deb system-debs/
tar -zcvf ubuntu-24.04-debs.tar.gz system-debs

 

如果已安装，可以加 --reinstall 参数强制重新安装

apt clean
apt update
apt install -y --reinstall --download-only curl  wget  openssl  ca-certificates  gnupg  lsb-release  openssh-server  sshpass tar  unzip  ipset  ipvsadm  conntrack  socat  lvm2  bridge-utils  iptables  apparmor-utils
mkdir -p system-debs && cp /var/cache/apt/archives/*.deb system-debs/
tar -zcvf ubuntu-24.04-debs.tar.gz system-debs

 

离线节点安装系统依赖

#保留当前本地修改过的配置文件，不覆盖
export DEBIAN_FRONTEND=noninteractive 
dpkg --force-confold -i *.deb
#安装系统依赖
cd /data
tar -zxvf ubuntu-24.04-debs.tar.gz
cd ubuntu-24.04-debs
dpkg -i *.deb
apt install -f -y --no-download

 

3，国内加速器下载k8s v1.34.3 + calico v3.32.1的镜像并导出镜像

#下载镜像
nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/kube-apiserver:v1.34.3
nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/kube-controller-manager:v1.34.3
nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/kube-scheduler:v1.34.3
nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/kube-proxy:v1.34.3
nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/etcd:3.6.5-0
nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/coredns/coredns:v1.12.1
nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/pause:3.10.1
nerdctl pull m.daocloud.io/quay.io/calico/cni:v3.32.1
nerdctl pull m.daocloud.io/quay.io/calico/kube-controllers:v3.32.1
nerdctl pull m.daocloud.io/quay.io/calico/node:v3.32.1

#镜像改名
nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/kube-apiserver:v1.34.3  registry.k8s.io/kube-apiserver:v1.34.3
nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/kube-controller-manager:v1.34.3  registry.k8s.io/kube-controller-manager:v1.34.3
nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/kube-scheduler:v1.34.3  registry.k8s.io/kube-scheduler:v1.34.3
nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/kube-proxy:v1.34.3  registry.k8s.io/kube-proxy:v1.34.3
nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/etcd:3.6.5-0  registry.k8s.io/etcd:3.6.5-0
nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/coredns/coredns:v1.12.1  registry.k8s.io/coredns/coredns:v1.12.1
nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/pause:3.10.1  registry.k8s.io/pause:3.10.1
nerdctl tag m.daocloud.io/quay.io/calico/cni:v3.32.1  quay.io/calico/cni:v3.32.1
nerdctl tag m.daocloud.io/quay.io/calico/kube-controllers:v3.32.1  quay.io/calico/kube-controllers:v3.32.1
nerdctl tag m.daocloud.io/quay.io/calico/node:v3.32.1  quay.io/calico/node:v3.32.1

#导出镜像
nerdctl save -o k8s-1.34.3-offline-images.tar \
registry.k8s.io/kube-apiserver:v1.34.3 \
registry.k8s.io/kube-controller-manager:v1.34.3 \
registry.k8s.io/kube-scheduler:v1.34.3 \
registry.k8s.io/kube-proxy:v1.34.3 \
registry.k8s.io/etcd:3.6.5-0 \
registry.k8s.io/coredns/coredns:v1.12.1 \
registry.k8s.io/pause:3.10.1 \
quay.io/calico/cni:v3.32.1 \
quay.io/calico/kube-controllers:v3.32.1 \
quay.io/calico/node:v3.32.1

 

二， 上传离线包

master节点：上传全部离线包。

工作节点：除了三个calico离线包（calicoctl-linux-amd64、 calico-release-v3.32.1.tgz、 calico-v3.32.1.yaml），其它全部上传。

离线包目录：/data/kubeadm-1.34.3-offline

 

三、前置统一操作（所有 3 节点执行）

1， 配置主机名与 hosts 解析

# Master节点执行
hostnamectl set-hostname k8s-master-01
# Worker01
hostnamectl set-hostname k8s-worker-01
# Worker02
hostnamectl set-hostname k8s-worker-02

# 全部节点写入/etc/hosts
cat >> /etc/hosts << EOF
172.29.128.1    k8s-master-01
172.29.132.68   k8s-worker-01
172.29.132.69   k8s-worker-02
EOF

 

2， 关闭防火墙、swap、selinux

# 关闭swap永久生效
swapoff -a
sed -i '/swap/s/^/#/' /etc/fstab

# 关闭ufw
systemctl stop ufw
systemctl disable ufw

# 加载内核模块ipvs/overlay
modprobe overlay
modprobe ip_tables
modprobe br_netfilter
modprobe ip_vs
modprobe ip_vs_rr
modprobe ip_vs_wrr
modprobe ip_vs_sh

# 内核参数优化k8s网络
cat >> /etc/sysctl.conf << EOF
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF
sysctl -p

 

3. 时间同步

apt install chrony -y
systemctl enable --now chronyd
timedatectl set-timezone Asia/Shanghai

 

四，部署containerd（所有节点）

1，执行安装

cd /data/kubeadm-.134.3-offline
# 解压containerd二进制
tar -zxvf containerd-2.3.3-linux-amd64.tar.gz
cp bin/* /usr/local/bin/
# 部署runc
cp runc.amd64 /usr/local/bin/runc
chmod +x /usr/local/bin/runc
# 部署cni插件
mkdir -p /opt/cni/bin
tar -zxvf cni-plugins-linux-amd64-v1.6.0.tgz -C /opt/cni/bin
chmod +x /opt/cni/bin/*
# 部署systemd服务
cp containerd.service /etc/systemd/system/
systemctl daemon-reload

 

2，生成并修改 containerd 核心配置（适配 K8s/K3s 必改）

# 生成默认配置
containerd config default > /etc/containerd/config.toml

# 修改配置：cgroup驱动systemd、sandbox镜像pause、关闭cni自动配置
sed -i 's/SystemdCgroup \= false/SystemdCgroup \= true/g' /etc/containerd/config.toml
sed -i 's#sandbox_image = "registry.k8s.io/pause:3.9"#sandbox_image = "registry.k8s.io/pause:3.10.1"#' /etc/containerd/config.toml
# 禁用内置cni，由calico接管
sed -i '/\[plugins."io.containerd.grpc.v1.cri".cni\]/,/}/d' /etc/containerd/config.toml
# 刷新缓存
systemctl daemon-reload
# 重启
systemctl restart containerd
systemctl enable --now containerd
systemctl status containerd
# 校验连接文件
ls -l /run/containerd/containerd.sock

 

3，安装nerdctl

tar -zxvf nerdctl-2.3.3-linux-amd64.tar.gz
cp nerdctl /usr/local/bin/
chmod +x /usr/local/bin/nerdctl

# 配置nerdctl默认命名空间
mkdir -p /etc/nerdctl
cat > /etc/nerdctl/nerdctl.toml <<EOF
namespace = "k8s.io"
address = "/run/containerd/containerd.sock"
cgroup_manager = "systemd"
EOF

 

4，离线导入 K8s 控制平面镜像（从 kubeadm-1.34.3-offline-images.tar 文件导入）

nerdctl -n k8s.io load -i /k8s-1.34.3-offline-images.tar

 

校验镜像清单：
  1. registry.k8s.io/kube-apiserver:v1.34.3
  2. registry.k8s.io/kube-controller-manager:v1.34.3
  3. registry.k8s.io/kube-scheduler:v1.34.3
  4. registry.k8s.io/kube-proxy:v1.34.3
  5. registry.k8s.io/etcd:3.5.16-0
  6. registry.k8s.io/coredns/coredns:v1.11.3
  7. registry.k8s.io/pause:3.10.1
  8. quay.io/calico/cni:v3.32.1
  9. quay.io/calico/kube-controllers:v3.32.1
  10. quay.io/calico/node:v3.32.1

 

 

五，部署 kubeadm / kubectl / kubelete

1, 所有节点执行部署

cp /data/kubeadm-1.34.3-offline/{kubeadm,kubectl,kubelet} /usr/local/bin/
chmod +x /usr/local/bin/{kubeadm,kubectl,kubelet}
# 重载systemd识别新服务
systemctl daemon-reload
systemctl enable --now kubelet
#验证版本
kubeadm version
kubectl version --client
kubelet --version

 

写入 kubelet systemd 服务

cat > /etc/systemd/system/kubelet.service <<EOF
[Unit]
Description=kubelet Kubernetes Agent
After=network.target containerd.service

[Service]
ExecStart=/usr/local/bin/kubelet \
  --config=/var/lib/kubelet/config.yaml \
  --kubeconfig=/var/lib/kubelet/kubelet.conf
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF
#启动 kubelet 并开机自启
systemctl daemon-reload
systemctl enable --now kubelet

 

六，kubeadm init 离线初始化控制平面

新建 kubeadm 配置文件 kubeadm-init.yaml

apiVersion: kubeadm.k8s.io/v1beta4
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: 172.29.128.1
  bindPort: 6443
nodeRegistration:
  criSocket: unix:///run/containerd/containerd.sock
  name: k8s-master-01
  imagePullPolicy: IfNotPresent
  taints: []
---
apiVersion: kubeadm.k8s.io/v1beta4
kind: ClusterConfiguration
kubernetesVersion: v1.34.3
imageRepository: registry.k8s.io
controlPlaneEndpoint: 172.29.128.1:6443
networking:
  dnsDomain: cluster.local
  serviceSubnet: 10.96.0.0/12
  podSubnet: 192.168.0.0/16
etcd:
  local: {}
dns: {}

 

执行离线初始化（无外网拉取）

kubeadm init --config /data/kubeadm-1.34.3-offline/kubeadm-init.yaml

 

查看初始化日志：

journalctl -u kubelet -f --no-pager

 

. 初始化成功后执行 kubectl 权限配置

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

# 记录输出的join命令（worker节点离线加入集群）
# 示例输出保存，后续worker用：
# kubeadm join 172.29.128.1:6443 --token xxx --discovery-token-ca-cert-hash sha256:xxx
# token有效期短，过期执行重新生成：kubeadm token create --print-join-command

 

七，部署 Calico 网络插件

# 应用calico网络yaml
kubectl apply -f calico-v3.32.1.yaml

# 校验网络就绪
kubectl get nodes # STATUS从NotReady变为Ready即成功
kubectl get pods -n kube-system

 

八，Worker 节点离线加入集群（两台 worker 完全相同操作）

执行 master 输出的 join 命令（离线不会拉取镜像）

kubeadm join 172.29.128.1:6443 --token xxx --discovery-token-ca-cert-hash sha256:xxx

 

token 过期重建（master 执行）

# 永久token，无过期
kubeadm token create --ttl 0 --print-join-command

 

全集群校验

# master执行
kubectl get nodes
# 三台节点全部Ready代表部署完成
kubectl get pods -n kube-system -o wide

 

posted @ 2026-07-30 19:04  民工黑猫  阅读(18)  评论(0)    收藏  举报