ubuntu 24.04.4，下载（kubeadm 、kubelet、kubectl 、contanerd.io）的deb离线包安装 k8s-v1.34.3（kubeadm离线安装k8s行业标准）
集群规划（3 节点）：
master节点，主机名：k8s-master-01，内网ip：172.29.128.1
工作节点01：主机名：k8s-worker-01，内网ip：172.29.132.68
工作节点02：主机名：k8s-worker-02，内网ip：172.29.132.69
一，离线资源清单
| 资源名称 | 包名称 | 下载链接 |
| utuntu24.04依赖deb包 | ubuntu-24.04-debs.tar.gz | |
| k8s-1.34.3离线deb包 | k8s-1.34.3-debs.tar.gz | |
|
镜像包 + ingress-nginx-v1.15.1
|
k8s-1.34.3-offline-images.tar |
镜像清单： registry.k8s.io/kube-apiserver:v1.34.3 |
| calicao-v1.32.1配置文件 | calico-v1.32.1.yaml | https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico.yaml |
| ingress-nginx-v1.15.1配置文件 | ingress-nginx-v1.15.1.yaml | https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.15.1/deploy/static/provider/baremetal/deploy.yaml |
| nerdctl离线安装包 | nerdctl-2.3.3-linux-amd64.tar.gz | https://github.com/containerd/nerdctl/releases/download/v2.3.3/nerdctl-2.3.3-linux-amd64.tar.gz |
二，【有外网机器】批量下载全部离线 deb 包
1,安装依赖
apt update && apt install -y ca-certificates curl wget gnupg lsb-release
2，配置 kubernetes apt 源（在线下载机执行）
# 查询本机 deb 架构标识 local_arch=$(dpkg --print-architecture) # 查询 Ubuntu 系统发行代号 local_ubuntu_codename=$(lsb_release -cs) # 清理旧docker源 rm -f /etc/apt/sources.list.d/docker.list rm -f /etc/apt/trusted.gpg.d/docker*.gpg # 阿里云docker-ce公钥 curl -fsSL https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/trusted.gpg.d/docker.gpg # 添加阿里云docker-ce源 echo "deb [arch=${local_arch} signed-by=/etc/apt/trusted.gpg.d/docker.gpg] https://mirrors.aliyun.com/docker-ce/linux/ubuntu ${local_ubuntu_codename} stable" | tee /etc/apt/sources.list.d/docker.list apt update echo -e "\n=== 当前系统代号：${local_ubuntu_codename}，查看可用 containerd.io 版本 ===" apt-cache madison containerd.io
重要避坑：
K8s 源是分支锁定
1) /v1.34/deb/ = 只能装 1.34.x；想要 1.35 必须改源地址为 /v1.35/deb/，不能一个源同时看到多个大版本。
2) containerd.io 版本 和 K8s 版本没有强制绑定，但有兼容矩阵，kubeadm 1.34 推荐 containerd ≥1.7；生产建议 2.0+，推荐 2.3.x。
2，查看源里有哪些包版本
查看k8s可用包版本：
# 查询kubeadm所有可用版本 apt-cache madison kubeadm # kubectl apt-cache madison kubectl # kubelet apt-cache madison kubelet
apt-cache madison kubeadm 命令输出：
kubeadm | 1.34.10-1.1 | https://pkgs.k8s.io/core:/stable:/v1.34/deb Packages kubeadm | 1.34.9-1.1 | https://pkgs.k8s.io/core:/stable:/v1.34/deb Packages kubeadm | 1.34.8-1.1 | https://pkgs.k8s.io/core:/stable:/v1.34/deb Packages kubeadm | 1.34.7-1.1 | https://pkgs.k8s.io/core:/stable:/v1.34/deb Packages kubeadm | 1.34.6-1.1 | https://pkgs.k8s.io/core:/stable:/v1.34/deb Packages kubeadm | 1.34.5-1.1 | https://pkgs.k8s.io/core:/stable:/v1.34/deb Packages kubeadm | 1.34.4-1.1 | https://pkgs.k8s.io/core:/stable:/v1.34/deb Packages kubeadm | 1.34.3-1.1 | https://pkgs.k8s.io/core:/stable:/v1.34/deb Packages kubeadm | 1.34.2-1.1 | https://pkgs.k8s.io/core:/stable:/v1.34/deb Packages kubeadm | 1.34.1-1.1 | https://pkgs.k8s.io/core:/stable:/v1.34/deb Packages kubeadm | 1.34.0-1.1 | https://pkgs.k8s.io/core:/stable:/v1.34/deb Packages
查看 containerd.io 可用版本
apt-cache madison containerd.io
输出：
containerd.io | 2.2.6-1~ubuntu.24.04~noble | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 2.2.5-1~ubuntu.24.04~noble | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 2.2.4-1~ubuntu.24.04~noble | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 2.2.3-1~ubuntu.24.04~noble | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 2.2.2-1~ubuntu.24.04~noble | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 2.2.1-1~ubuntu.24.04~noble | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 2.2.0-2~ubuntu.24.04~noble | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 2.1.5-1~ubuntu.24.04~noble | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.7.29-1~ubuntu.24.04~noble | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.7.28-2~ubuntu.24.04~noble | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.7.28-1~ubuntu.24.04~noble | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.7.28-0~ubuntu.24.04~noble | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.7.27-1 | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.7.26-1 | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.7.25-1 | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.7.24-1 | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.7.23-1 | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.7.22-1 | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.7.21-1 | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.7.20-1 | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.7.19-1 | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.7.18-1 | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.6.33-1 | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.6.32-1 | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.6.31-1 | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages containerd.io | 1.6.28-2 | https://mirrors.aliyun.com/docker-ce/linux/ubuntu noble/stable amd64 Packages
3, 下载所有 deb 包（保存到 /data/k8s-1.34.3/debs）
# 清理apt缓存 apt clean # 下载指定版本离线包 apt-get download \ kubeadm=1.34.3-1.1 \ kubelet=1.34.3-1.1 \ kubectl=1.34.3-1.1 \ containerd.io=2.2.6-1~ubuntu.24.04~noble # 复制deb包到介质目录 mkdir -p /data/k8s-1.34.3-debs cp /var/cache/apt/archives/* /data/k8s-1.34.3-debs/ tar -zcvf k8s-1.34.3-debs.tar.gz /data/k8s-1.34.3-debs
debs清单：
ls -lh /var/cache/apt/archives/*
4，制作 ubuntu 24.04.4 系统依赖离线包
apt clean
apt update
apt install -y --reinstall --download-only curl wget openssl ca-certificates gnupg lsb-release openssh-server sshpass tar unzip ipset ipvsadm conntrack socat lvm2 bridge-utils iptables apparmor-utils
mkdir -p system-debs && cp /var/cache/apt/archives/*.deb system-debs/
tar -zcvf ubuntu-24.04-debs.tar.gz system-debs
5，国内加速器下载k8s-v1.34.3 + calico-v3.32.1 + ingress-nginx-v1.15.1的配置文件并导出镜像
calico-v1.32.1配置文件：https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico.yaml
ingress-nginx-v1.15.1配置文件：https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.15.1/deploy/static/provider/baremetal/deploy.yaml
下载镜载：
#下载镜像 nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/kube-apiserver:v1.34.3 nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/kube-controller-manager:v1.34.3 nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/kube-scheduler:v1.34.3 nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/kube-proxy:v1.34.3 nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/etcd:3.6.5-0 nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/coredns/coredns:v1.12.1 nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/pause:3.10.1 nerdctl pull m.daocloud.io/quay.io/calico/cni:v3.32.1 nerdctl pull m.daocloud.io/quay.io/calico/kube-controllers:v3.32.1 nerdctl pull m.daocloud.io/quay.io/calico/node:v3.32.1 nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/ingress-nginx/controller:v1.15.1 nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9 #镜像改名 nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/kube-apiserver:v1.34.3 registry.k8s.io/kube-apiserver:v1.34.3 nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/kube-controller-manager:v1.34.3 registry.k8s.io/kube-controller-manager:v1.34.3 nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/kube-scheduler:v1.34.3 registry.k8s.io/kube-scheduler:v1.34.3 nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/kube-proxy:v1.34.3 registry.k8s.io/kube-proxy:v1.34.3 nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/etcd:3.6.5-0 registry.k8s.io/etcd:3.6.5-0 nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/coredns/coredns:v1.12.1 registry.k8s.io/coredns/coredns:v1.12.1 nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/pause:3.10.1 registry.k8s.io/pause:3.10.1 nerdctl tag m.daocloud.io/quay.io/calico/cni:v3.32.1 quay.io/calico/cni:v3.32.1 nerdctl tag m.daocloud.io/quay.io/calico/kube-controllers:v3.32.1 quay.io/calico/kube-controllers:v3.32.1 nerdctl tag m.daocloud.io/quay.io/calico/node:v3.32.1 quay.io/calico/node:v3.32.1 nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/ingress-nginx/controller:v1.15.1 registry.k8s.io/ingress-nginx/controller:v1.15.1 nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9 registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9 #导出镜像 nerdctl save -o kubeadm-1.34.3-offline-images.tar \ registry.k8s.io/kube-apiserver:v1.34.3 \ registry.k8s.io/kube-controller-manager:v1.34.3 \ registry.k8s.io/kube-scheduler:v1.34.3 \ registry.k8s.io/kube-proxy:v1.34.3 \ registry.k8s.io/etcd:3.6.5-0 \ registry.k8s.io/coredns/coredns:v1.12.1 \ registry.k8s.io/pause:3.10.1 \ quay.io/calico/cni:v3.32.1 \ quay.io/calico/kube-controllers:v3.32.1 \ quay.io/calico/node:v3.32.1 \ registry.k8s.io/ingress-nginx/controller:v1.15.1 \ registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9
6，上传到离线机
上传清单：
ubuntu-24.04.debs.tar.gz
k8s-1.34.3-debs.targz
k8s-1-34.3-offline-images.tar.gz
三、前置统一操作（所有 3 节点执行）
1， 配置主机名与 hosts 解析
# Master节点执行
hostnamectl set-hostname k8s-master-01
# Worker01
hostnamectl set-hostname k8s-worker-01
# Worker02
hostnamectl set-hostname k8s-worker-02
# 全部节点写入/etc/hosts
cat >> /etc/hosts << EOF
172.29.128.1 k8s-master-01
172.29.132.68 k8s-worker-01
172.29.132.69 k8s-worker-02
EOF
2， 关闭防火墙、swap、selinux
# 关闭swap永久生效 swapoff -a sed -i '/swap/s/^/#/' /etc/fstab # 关闭ufw防火墙 systemctl stop ufw systemctl disable ufw # 加载内核模块ipvs/overlay modprobe overlay modprobe ip_tables
modprobe br_netfilter modprobe ip_vs modprobe ip_vs_rr modprobe ip_vs_wrr modprobe ip_vs_sh # 内核参数优化k8s网络 cat >> /etc/sysctl.conf << EOF net.bridge.bridge-nf-call-iptables = 1 net.bridge.bridge-nf-call-ip6tables = 1 net.ipv4.ip_forward = 1 EOF sysctl -p
# 校验输出全部为1
sysctl net.bridge.bridge-nf-call-iptables net.ipv4.ip_forward
如果不关闭防火墙，要放行端口
1） Master 节点放行端口：
ufw allow 6443/tcp
ufw allow 2379:2380/tcp
ufw allow 10250/tcp
ufw allow 10259/tcp
ufw allow 10257/tcp
ufw allow 30000:32767/tcp
ufw reload
2） Worker 节点放行端口：
ufw allow 10250/tcp
ufw allow 30000:32767/tcp
ufw reload
3. 时间同步
apt install chrony -y systemctl enable --now chronyd timedatectl set-timezone Asia/Shanghai
四，离线节点安装k8s
1，安装utuntu依赖（所有节点执行）
#保留当前本地修改过的配置文件，不覆盖 export DEBIAN_FRONTEND=noninteractive dpkg --force-confold -i *.deb #安装系统依赖 cd /data tar -zxvf ubuntu-24.04-debs.tar.gz cd ubuntu-24.04-debs dpkg -i *.deb apt install -f -y --no-download
2,所有节点安装containerd、kubeadm、kubelet、kubectl
#保留当前本地修改过的配置文件，不覆盖 export DEBIAN_FRONTEND=noninteractive dpkg --force-confold -i *.deb #安装k8s cd /opt/k8s-offline/debs # 优先安装容器运行时 apt install -y --no-download ./containerd.io_*.deb apt install -y --no-download ./cri-tools_*.deb apt install -y --no-download ./kubernetes-cni_*.deb # 然后k8s组件 apt install -y --no-download ./kubelet_*.deb apt install -y --no-download ./kubeadm_*.deb apt install -y --no-download ./kubectl_*.deb # 锁定版本 apt-mark hold kubeadm kubelet kubectl containerd.io cri-tools kubernetes-cni
如果版本不兼容会安装失败，用下面方式替代
#保留当前本地修改过的配置文件，不覆盖 export DEBIAN_FRONTEND=noninteractive dpkg --force-confold -i *.deb #安装k8s cd /opt/k8s-offline/debs # 优先安装容器运行时 dpkg -i ./containerd.io_*.deb dpkg -i ./cri-tools_*.deb dpkg -i ./kubernetes-cni_*.deb # 然后k8s组件 dpkg -i ./kubelet_*.deb dpkg -i ./kubeadm_*.deb dpkg -i ./kubectl_*.deb # 安装依赖 apt-get install -y -f --no-download systemctl enable --now kubelet # 锁定版本 apt-mark hold kubeadm kubelet kubectl containerd.io cri-tools kubernetes-cni
3，所有节点配置 containerd（关键！适配 k8s v1.34.3）
#!/bin/bash # 根据K8s版本修改此处pause版本 PAUSE_VERSION="3.10" #生成默认配置 containerd config default | tee /etc/containerd/config.toml # 修改cgroup驱动为systemd sed -i 's/SystemdCgroup \= false/SystemdCgroup \= true/g' /etc/containerd/config.toml # 正则替换pause版本，直接内嵌变量 sed -i "s#sandbox_image = \".*pause:[0-9.]*\"#sandbox_image = \"registry.k8s.io/pause:${PAUSE_VERSION}\"#g" /etc/containerd/config.toml
4，重启 containerd（所有节点执行）
systemctl daemon-reload systemctl restart containerd systemctl enable --now containerd systemctl status containerd # 校验连接文件 ls -l /run/containerd/containerd.sock
5，安装nerdctl
tar -zxvf nerdctl-2.3.3-linux-amd64.tar.gz
cp nerdctl /usr/local/bin/
chmod +x /usr/local/bin/nerdctl
# 配置nerdctl默认命名空间
mkdir -p /etc/nerdctl
cat > /etc/nerdctl/nerdctl.toml <<EOF
namespace = "k8s.io"
address = "/run/containerd/containerd.sock"
cgroup_manager = "systemd"
EOF
6，导入离线镜像（所有节点执行）
nerdctl -n k8s.io load -i k8s-1.34.3-offline-images.tar
7，Master 节点 kubeadm init 初始化集群
kubeadm init \ --apiserver-advertise-address=172.29.128.1 \ --kubernetes-version=v1.34.3 \ --service-cidr=10.96.0.0/12 \ --pod-network-cidr=192.168.0.0/16 \ --cri-socket=/run/containerd/containerd.sock
配置 KUBECONFIG 环境变量（master节点执行）
mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config
这段一定要执行，不然k8s集群会无权限启动。
查看节点状态
kubectl get nodes
8, master节点加入集成
out=$(kubeadm init phase upload-certs --upload-certs 2>/dev/null) cert_key=$(echo "$out" | sed -n '/Using certificate key:/{n;p;}') echo "【Master控制平面节点加入命令】" kubeadm token create --print-join-command --ttl 0 --certificate-key "${cert_key}"
输出加入master的命令：
kubeadm join 172.29.128.1:6443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:xxxxxxxxxxxxxxxxxxxxxxxxxxx \
--control-plane --certificate-key xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
9，工作节点加入集群
查看加入集群的命令：
echo "【worker节点加入命令】" kubeadm token create --print-join-command --ttl 0
执行命令后输出：
kubeadm join 172.29.128.1:6443 --token rs8kek.dsxsezvq0sc1r96a --discovery-token-ca-cert-hash sha256:7a90a9732a6ef02581f958bb972243cf1294d0cfe51224b6e1542eb8b8c1c417
token 有效期 24h，过期重建。保存，然后在所有工作节点执行输出命令加入集群。
查看节点状态 （还未安装calico，节点是NotReady状态）
五，master节点安装calico
1，如果没下载calico-v3.32.1.yaml文件及镜像，在线机器下载 calico.yaml + 导出镜像
wget -O calico-v3.32.1.yaml https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico.yaml
其他配套清单（按需下载）
# 带Typha（50节点以上集群）
curl -O calico-typha-v3.32.1.yaml https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico-typha.yaml
# canal（calico网络策略+flannel底层）
curl -O canal-v3.32.1.yaml https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/canal.yaml
2,，查看calico-v.3.32.1.yaml需要哪些镜像：
grep "image:" calico-v3.32.1.yaml #只显示镜像名 awk '/image:\s*/{print $2}' calico-v3.32.1.yaml | sort -u
输出：
quay.io/calico/cni:v3.32.1 quay.io/calico/kube-controllers:v3.32.1 quay.io/calico/node:v3.32.1
3，下载calico-v3.32.1镜像：
nerdctl pull quay.io/calico/cni:v3.32.1 nerdctl pull quay.io/calico/node:v3.32.1 nerdctl pull quay.io/calico/kube-controllers:v3.32.1 #把镜像导出成tar文件 nerdctl save -o calico-v3.32.1.tar \ quay.io/calico/cni:v3.32.1 \ quay.io/calico/node:v3.32.1 \ quay.io/calico/kube-controllers:v3.32.1
4，将 calico-v3.32.1.tar 和 calico-v3.32.1.yaml 传到 master 节点。
5，Master 节点离线导入 calico 镜像
nerdctl load -i calico-v3.32.1.tar
6，应用 calico 网络
kubectl apply -f calico-v3.32.1.yaml # 等待所有calico-node就绪 kubectl get pods -n kube-system -w
等待30秒左右就会安装成功。
查看pod状态：
kubectl get pod -A
查看节点状态：
kubectl get nodes
节点全部Ready，表示节点就绪，k8s集群安装成功。
六，master节点安装ingress-nginx-v1.15.1
1，下载，另存为 ingress-nginx-v1.15.1.yaml，上传到master节点
2，查看ingress-nginx-v1.15.1.yaml需要哪些镜像
grep 'image:' ingress-nginx-v1.15.1.yaml | awk '{print $2}' | sort -u
输出：
registry.k8s.io/ingress-nginx/controller:v1.15.1@sha256:594ceea76b01c592858f803f9ff4d2cb40542cae2060410b2c95f75907d659e1 registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9@sha256:01038e7de14b78d702d2849c3aad72fd25903c4765af63cf16aa3398f5d5f2dd
去掉@及后面的字符串就是镜像名称。
4，批量删除 ingress-nginx-v1.15.1.yaml 里所有镜像后的 sha256 摘要
sed -i 's/@sha256:[0-9a-fA-Z]*//g' ingress-nginx-v1.15.1.yaml
kubelet 识别逻辑：镜像地址带 @sha256 时，必须本地存在完全一致哈希的镜像，否则无视本地同名 tag，强制拉取外网，离线环境直接超时。
3，下载镜像，上传到master节点
nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/ingress-nginx/controller:v1.15.1 nerdctl pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9 #改标签 nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/ingress-nginx/controller:v1.15.1 registry.k8s.io/ingress-nginx/controller:v1.15.1 nerdctl tag swr.cn-north-4.myhuaweicloud.com/ddn-k8s/registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9 registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9 # 导出离线镜像包 nerdctl save -o ingress-nginx-images-v1.15.1.tar \ registry.k8s.io/ingress-nginx/controller:v1.15.1 \ registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9
3，部署ingress-nginx
#导入镜像 nerdctl -n k8s.io load -i ingress-nginx-images-v1.15.1.tar #应用 kubectl apply -f ingress-nginx-v1.15.1.yaml
4，验证部署状态
# 查看命名空间 kubectl get ns ingress-nginx # 查看pod，全部running即成功 kubectl get pods -n ingress-nginx -w # 查看ingress控制器class kubectl get ingressclasses
输出如下，表示ingress-nginx安装成功：
5，删除weebhook勾子才能创建ingress规则：
kubectl delete ValidatingWebhookConfiguration ingress-nginx-admission --ignore-not-found
不删除webhook验证，会输出错误：
Error from server (BadRequest): error when creating "dotnet-demo-v1-ingress.yaml": admission webhook "validate.nginx.ingress.kubernetes.io" denied the request: nginx.ingress.kubernetes.io/server-snippet annotation cannot be used. Snippet directives are disabled by the Ingress administrator
6，更改ingress对外访问的端口为 30080 / 30443
kubectl edit svc ingress-nginx-controller -n ingress-nginx
找到 spec.ports 区域，示例默认配置：
spec:
clusterIP: 10.96.3.243
clusterIPs:
- 10.96.3.243
externalTrafficPolicy: Cluster
internalTrafficPolicy: Cluster
ipFamilies:
- IPv4
ipFamilyPolicy: SingleStack
ports:
- appProtocol: http
name: http
nodePort: 30080 #修改为你要对外的端口
port: 80 #service内部端口
protocol: TCP
targetPort: http
- appProtocol: https
name: https
nodePort: 30443 #修改为你要对外的端口
port: 443 #service内部端口
七，运维命令
1. Master 节点允许调度 Pod（单 master 无多余机器时）
#移除某一台节点的污点
kubectl taint nodes --all node-role.kubernetes.io/control-plane-
kubectl taint nodes --all node-role.kubernetes.io/master-
#一次性清除全部控制平面污点（无需写节点名，适配任意多 master）
kubectl taint nodes --all node-role.kubernetes.io/control-plane-
2. 批量恢复隔离污点（全部 master 重新加 NoSchedule 限制）
kubectl taint nodes --all node-role.kubernetes.io/control-plane=:NoSchedule
3. 配置 kubectl 命令自动补全
apt install bash-completion -y
echo 'source <(kubectl completion bash)' >> ~/.bashrc
echo 'alias k=kubectl' >> ~/.bashrc
echo 'complete -F __start_kubectl k' >> ~/.bashrc
source ~/.bashrc
4. 常见故障排查命令
# kubelet日志
journalctl -u kubelet -f
# containerd日志
journalctl -u containerd
# 查看集群事件
kubectl get events -w
# 重置集群（重装场景）
kubeadm reset -f
rm -rf /var/lib/kubelet /etc/kubernetes
浙公网安备 33010602011771号