ubuntu 26.04，使用sealos v5.1.1在线安装5节点高可用k8s-v1.33.6集群
ubuntu 26.04。
集群规划（5 节点）
master节点01，主机名：k8s-master-01，ip：172.21.64.36
master节点02，主机名：k8s-master-02，ip：172.21.64.37
master节点03，主机名：k8s-master-03，ip：172.21.64.38
工作节点01：主机名：k8s-worker-01，ip：172.21.64.39
工作节点02：主机名：k8s-worker-02，ip：172.21.64.40
| 机器名 | 内网 ip | 角色 |
| k8s-master-01 | 172.21.64.36 | master |
| k8s-master-02 | 172.21.64.37 | master |
| k8s-master-03 | 172.21.64.38 | master |
| k8s-worker-01 | 172.21.64.39 | worker |
| k8s-worker-02 | 172.21.64.40 | worker |
一，全节点卸载清理旧集群 containerd/k8s 所有残留
#!/usr/bin/env bash set -euo pipefail echo -e "===== 开始执行【全场景全覆盖】K8s 终极节点重置（适配kubeadm/sealos/kubekey/kubesray/kubeasz/二进制/deb混合残留）=====" # ====================== # 1. 通用集群重置（kubeadm体系） # ====================== if command -v kubeadm >/dev/null; then kubeadm reset -f || true fi # ====================== # 2. 停止所有可能存在的服务（全覆盖） # ====================== systemctl stop \ containerd kubelet \ kube-apiserver kube-controller-manager kube-scheduler kube-lb \ sealos kube-proxy etcd \ 2>/dev/null || true systemctl disable \ containerd kubelet \ kube-apiserver kube-controller-manager kube-scheduler kube-lb \ sealos kube-proxy etcd \ 2>/dev/null || true # ====================== # 3. 清理【二进制部署残留】控制面服务（你之前无限复活的元凶） # ====================== rm -f /etc/systemd/system/kube-apiserver.service rm -f /etc/systemd/system/kube-controller-manager.service rm -f /etc/systemd/system/kube-scheduler.service rm -f /etc/systemd/system/kube-lb.service rm -f /etc/systemd/system/etcd.service rm -f /etc/systemd/system/kube-proxy.service # ====================== # 4. 清理 Sealos / Kubekey / KubeSray / Kubeasz 专属服务 & 目录 # ====================== # sealos 残留 rm -rf /var/lib/sealos /etc/sealos /root/.sealos rm -f /etc/systemd/system/sealos.service # kubekey/kubesray 残留 rm -rf /var/lib/kubekey /etc/kubekey /opt/kubekey rm -rf /var/lib/kubesphere /etc/kubesphere # kubeasz 残留 rm -rf /etc/kubeasz /var/lib/kubeasz # ====================== # 5. 彻底purge卸载deb包（containerd.io、kubeadm、cri-tools全部purge，删除包+配置） # ====================== apt purge -y --allow-change-held-packages \ containerd.io containerd \ kubeadm kubectl kubelet \ cri-tools kubernetes-cni \ 2>/dev/null || true apt autoremove -y || true apt autoclean # 解除版本锁定，保证下次重装无冲突 apt-mark unhold \ kubeadm kubelet kubectl \ containerd.io cri-tools kubernetes-cni \ 2>/dev/null || true # ====================== # 6. 彻底清理所有路径 systemd 单元（解决二进制+deb双路径冲突） # ====================== rm -f /lib/systemd/system/kubelet.service rm -f /etc/systemd/system/kubelet.service rm -rf /etc/systemd/system/kubelet.service.d rm -f /lib/systemd/system/containerd.service rm -f /etc/systemd/system/containerd.service rm -rf /etc/systemd/system/containerd.service.d rm -f /usr/local/lib/systemd/system/containerd.service # ====================== # 7. 彻底清理所有路径 k8s/容器二进制 # 覆盖：apt/deb / 二进制解压 / kubekey / sealos # 新增 cni、crictl 二进制清理 # ====================== rm -f /usr/bin/containerd /usr/bin/ctr /usr/bin/crictl /usr/bin/kube* rm -f /usr/local/bin/containerd /usr/local/bin/ctr /usr/local/bin/crictl /usr/local/bin/kube* rm -f /opt/kube/bin/* 2>/dev/null || true # 清理二进制解压的cni插件二进制 rm -rf /opt/cni/bin/* 2>/dev/null || true # ====================== # 8. 重载 systemd、清除失效状态 # ====================== systemctl daemon-reload systemctl reset-failed # ====================== # 9. 绝杀所有残留进程（杜绝复活、端口占用） # ====================== pkill -9 -f "kube-apiserver|kube-scheduler|kube-controller-manager|kube-lb|kubelet|containerd|sealos|etcd|crictl" 2>/dev/null || true # ====================== # 10. 清空所有体系数据目录 # ====================== # 先卸载 Calico cgroup 挂载点（否则 rm 报 Operation not permitted） umount -R /var/run/calico/cgroup 2>/dev/null || true umount -R /run/calico/cgroup 2>/dev/null || true # /var/run 和 /run 是 tmpfs，重启自动清空，无需 rm rm -rf \ /var/lib/containerd \ /var/lib/cri \ /etc/cni \ /opt/cni \ /root/.kube \ /etc/containerd \ /etc/kubernetes \ /var/lib/kubelet \ /var/lib/etcd \ /var/lib/calico \ /var/lib/sealos \ /var/lib/nerdctl \ /var/lib/kubekey \ /var/lib/kubesphere \ /etc/kubeasz \ /etc/cni/net.d/* # ====================== # 11. 重置网络栈（解决多工具残留网卡、iptables错乱） # ====================== iptables -F && iptables -t nat -F && iptables -X && ipvsadm -C ip link del tunl0 2>/dev/null || true ip link del cni0 2>/dev/null || true ip link del flannel.1 2>/dev/null || true ip link del vxlan.calico 2>/dev/null || true echo -e "✅ 【k8s残留】清理完成！已purge卸载 containerd.io、cri-tools、kubernetes-cni"
二、前置环境配置，所有节点统一前置初始化脚本（所有机器执行）
1. 修改主机名
# master-01节点执行 hostnamectl set-hostname k8s-master-01 # master-02节点执行 hostnamectl set-hostname k8s-master-02 # master-03节点执行 hostnamectl set-hostname k8s-master-03 # worker-01节点执行 hostnamectl set-hostname k8s-worker-01 # worker-02节点执行 hostnamectl set-hostname k8s-worker-02
2. 配置 hosts 解析（所有节点统一写入 /etc/hosts）
cat >> /etc/hosts << EOF 172.21.64.36 k8s-master-01 172.21.64.37 k8s-master-02 172.21.64.38 k8s-master-03 172.21.64.39 k8s-worker-01 172.21.64.40 k8s-worker-02 EOF
3. 系统内核 & 资源优化
# 关闭永久swap swapoff -a sed -i '/swap/s/^/#/' /etc/fstab #关闭 ufw防火墙 systemctl stop ufw systemctl disable ufw # 内核转发、iptables桥接 cat >> /etc/sysctl.conf <<EOF net.bridge.bridge-nf-call-iptables = 1 net.bridge.bridge-nf-call-ip6tables = 1 net.ipv4.ip_forward = 1 # 允许绑定本机不存在的VIP（HA/kube-vip核心） net.ipv4.ip_nonlocal_bind = 1 # 反向路由过滤 全部宽松模式 net.ipv4.conf.all.rp_filter = 2 net.ipv4.conf.default.rp_filter = 2 net.ipv4.conf.eth0.rp_filter = 2 #eth0替换为真实的网卡名称（非必填） # ARP应答策略：仅匹配网卡IP才回复 net.ipv4.conf.all.arp_ignore = 1 net.ipv4.conf.default.arp_ignore = 1 net.ipv4.conf.eth0.arp_ignore = 1 #eth0替换为真实的网卡名称（非必填） # ARP宣告策略：严格匹配网卡网段 net.ipv4.conf.all.arp_announce = 2 net.ipv4.conf.default.arp_announce = 2 net.ipv4.conf.eth0.arp_announce = 2 #eth0替换为真实的网卡名称（非必填） EOF sysctl -p # 加载overlay/iptables内核模块 modprobe overlay modprobe br_netfilter #系统开机自动加载里面写的内核模块。 echo "overlay" >> /etc/modules-load.d/k8s.conf echo "br_netfilter" >> /etc/modules-load.d/k8s.conf # 开启root密码登录 sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config sed -i 's/#PasswordAuthentication no/PasswordAuthentication yes/' /etc/ssh/sshd_config sed -i 's/#PubkeyAuthentication no/PubkeyAuthentication yes/' /etc/ssh/sshd_config systemctl restart ssh systemctl enable ssh #时间同步 apt install chrony -y systemctl enable --now chronyd timedatectl set-timezone Asia/Shanghai
4 安装所有软件包
apt update && apt upgrade -y
apt install -y curl wget openssl ca-certificates gnupg lsb-release openssh-server sshpass tar unzip ipset ipvsadm conntrack socat lvm2
5. Master 节点单独执行 SSH 免密分发
# master节点生成密钥 ssh-keygen -t ed25519 -N "" -f /root/.ssh/id_ed25519 # 分发公钥 sshpass -p "root密码" ssh-copy-id root@172.21.64.36 sshpass -p "root密码" ssh-copy-id root@172.21.64.37 sshpass -p "root密码" ssh-copy-id root@172.21.64.38 sshpass -p "root密码" ssh-copy-id root@172.21.64.39 sshpass -p "root密码" ssh-copy-id root@172.21.64.40 # 验证免密连通 ssh root@172.21.64.36 hostname ssh root@172.21.64.37 hostname ssh root@172.21.64.38 hostname ssh root@172.21.64.39 hostname ssh root@172.21.64.40 hostname
6. 批量校验所有节点 SSH 连通性（最关键前置检查）
nodes=(172.21.64.36 172.21.64.37 172.21.64.38 172.21.64.39 172.21.64.40) for ip in ${nodes[@]}; do echo "=== 测试 $ip SSH ===" sshpass -p "你的root密码" ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no root@$ip "hostname; echo 连接正常" done
三、Master 节点安装 Sealos v5.1.1
试过用二进制方式安装不了，改换下载离线包到本机，然后人本机copy到远程服务器。
下载地址：https://github.com/labring/sealos/releases/download/v5.1.1/sealos_5.1.1_linux_amd64.tar.gz
在本机打开 powershell 窗口，用scp命令拷贝到远程服务器，然后在服务器上执行安装：
#上传到服务器
scp D:/softs/k8s/sealos_5.1.1_linux_amd64.tar.gz root@121.40.63.235:/data/sealos-5 cd /data/sealos-5 # 解压 tar -zxvf sealos_5.1.1_linux_amd64.tar.gz # 赋予执行权限并全局放置 chmod +x sealos # 验证版本 ./sealos version
四，安装k8s
1. 从渡渡鸟预拉取镜像，加快安装速度
搜索渡渡鸟有哪个版本的labring/kubernetes镜像，渡渡鸟地址： https://docker.aityp.com
搜索三个镜像：
docker.io/labring/kubernetes docker.io/labring/helm docker.io/labring/calico docker.io/labring/cert-manager docker.io/labring/openebs
2，在第一台master节点预拉取镜像（拉取渡渡鸟上存在的labring镜像）
渡渡鸟镜像需要加前缀 swr.cn-north-4.myhuaweicloud.com/ddn-k8s/
./sealos pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/kubernetes:v1.33.6 ./sealos pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/helm:v4.0.1 ./sealos pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/calico:v3.28.1 ./sealos pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/cert-manager:v1.14.6 ./sealos pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/openebs:v3.10.0
3，安装k8s，两种安装方式
1) 纯命令行安装
./sealos run \ swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/kubesphere:v1.33.6 \ swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/helm:v4.0.1 \ swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/calico:v3.28.1 \ swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/cert-manager:v1.14.6 \ swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/openebs:v3.10.0 \ --masters 172.21.64.36,172.21.64.37,172.21.64.38 \ --nodes 172.21.64.39,172.21.64.40 \ --user root \ --passwd 你的密码
2) 生成配置文件安装
/sealos gen \ swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/kubernetes:v1.33.6 \ swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/helm:v4.0.1 \ swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/calico:v3.28.1 \ swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/cert-manager:v1.14.6 \ swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/openebs:v3.10.0 \ swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/kubesphere:v3.4.0 \ --masters 172.21.64.36,172.21.64.37,172.21.64.38 \ --nodes 172.21.64.39,172.21.64.40 \ --user root \ --passwd yihan@123 > k8s-v1.33.6-install2.yaml
查看配置文件
ls README.md image-cri-shim k8s-v1.33.6-install.yaml lvscare sealctl sealos sealos_5.1.1_linux_amd64.tar.gz yaml
可以根据需要修改安装配置文件
vi k8s-v1.33.6-install.yaml
用配置文件安装k8s
./sealos apply -f k8s-v1.33.6-install.yaml
4，验证集群状态
查看节点：
kubectl get nodes
输出：
NAME STATUS ROLES AGE VERSION k8s-master-01 Ready control-plane 34m v1.33.6 k8s-master-02 Ready control-plane 33m v1.33.6 k8s-master-03 Ready control-plane 33m v1.33.6 k8s-worker-01 Ready <none> 33m v1.33.6 k8s-worker-02 Ready <none> 33m v1.33.6
查看pod：
kubectl get pod -A
输出：
NAMESPACE NAME READY STATUS RESTARTS AGE kube-system calico-kube-controllers-74cc9b7b47-lxqcb 1/1 Running 0 26m kube-system calico-node-8kzkm 1/1 Running 0 26m kube-system calico-node-8lwkd 1/1 Running 0 26m kube-system calico-node-8x7gx 1/1 Running 0 26m kube-system calico-node-ffgt7 1/1 Running 0 26m kube-system calico-node-zk26m 1/1 Running 0 26m kube-system coredns-674b8bbfcf-9bd5g 1/1 Running 0 35m kube-system coredns-674b8bbfcf-qwmxh 1/1 Running 0 35m kube-system etcd-k8s-master-01 1/1 Running 0 35m kube-system etcd-k8s-master-02 1/1 Running 0 35m kube-system etcd-k8s-master-03 1/1 Running 0 34m kube-system kube-apiserver-k8s-master-01 1/1 Running 0 35m kube-system kube-apiserver-k8s-master-02 1/1 Running 0 35m kube-system kube-apiserver-k8s-master-03 1/1 Running 0 34m kube-system kube-controller-manager-k8s-master-01 1/1 Running 0 35m kube-system kube-controller-manager-k8s-master-02 1/1 Running 0 35m kube-system kube-controller-manager-k8s-master-03 1/1 Running 0 34m kube-system kube-proxy-4l5wb 1/1 Running 0 35m kube-system kube-proxy-87552 1/1 Running 0 34m kube-system kube-proxy-9mhwd 1/1 Running 0 35m kube-system kube-proxy-fcj62 1/1 Running 0 34m kube-system kube-proxy-nwjvg 1/1 Running 0 34m kube-system kube-scheduler-k8s-master-01 1/1 Running 0 35m kube-system kube-scheduler-k8s-master-02 1/1 Running 0 35m kube-system kube-scheduler-k8s-master-03 1/1 Running 0 34m kube-system kube-sealos-lvscare-k8s-worker-01 1/1 Running 0 34m kube-system kube-sealos-lvscare-k8s-worker-02 1/1 Running 0 34m
关掉k8s-master-01节点，验证其它master是否可以使用kubectl命令
master-02验证：
root@iZuf64za30h8pviw3ljcqsZ:~# hostname k8s-master-02 root@iZuf64za30h8pviw3ljcqsZ:~# kubectl get nodes NAME STATUS ROLES AGE VERSION k8s-master-01 Ready control-plane 38m v1.33.6 k8s-master-02 Ready control-plane 37m v1.33.6 k8s-master-03 Ready control-plane 37m v1.33.6 k8s-worker-01 Ready <none> 36m v1.33.6 k8s-worker-02 Ready <none> 37m v1.33.6
master-03验证：
root@iZuf69r5difqrzqopjsqi5Z:~# hostname k8s-master-03 root@iZuf69r5difqrzqopjsqi5Z:~# kubectl get nodes NAME STATUS ROLES AGE VERSION k8s-master-01 Ready control-plane 39m v1.33.6 k8s-master-02 Ready control-plane 38m v1.33.6 k8s-master-03 Ready control-plane 38m v1.33.6 k8s-worker-01 Ready <none> 38m v1.33.6 k8s-worker-02 Ready <none> 38m v1.33.6
关掉master-01节点后，其它全部master节点可以使用kubectl命令，表示集群高可用部署成功。
安装K8s v1.33.6版（ingress v1.13.16）
curl -o ingress-1.14.5.yaml https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.14.5/deploy/static/provider/baremetal/deploy.yaml
sed -i 's|registry.k8s.io|k8s.m.daocloud.io|g' ingress-1.14.5.yaml
kubectl apply -f ingress-1.14.5.yaml
先删除校验勾子，不删除创建不了ingress
kubectl delete ValidatingWebhookConfiguration ingress-nginx-admission --ignore-not-found
如果不删除校验勾子，部署ingress规则会报如下错误：
Error from server (InternalError): error when creating "dotnet-demo-v1-ingress.yaml": Internal error occurred: failed calling webhook "validate.nginx.ingress.kubernetes.io": failed to call webhook: Post "https://ingress-nginx-controller-admission.ingress-nginx.svc:443/networking/v1/ingresses?timeout=10s": no endpoints available for service "ingress-nginx-controller-admission"
【修改ingress控制器对外端口】
1，先切换编辑器避免报错
export KUBE_EDITOR="nano" kubectl edit svc ingress-nginx-controller -n ingress-nginx
2，找到 spec.ports 区域，示例默认配置：
spec:
clusterIP: 10.96.3.243
clusterIPs:
- 10.96.3.243
externalTrafficPolicy: Cluster
internalTrafficPolicy: Cluster
ipFamilies:
- IPv4
ipFamilyPolicy: SingleStack
ports:
- appProtocol: http
name: http
nodePort: 30080 #修改为你要对外的端口
port: 80 #service内部端口
protocol: TCP
targetPort: http
- appProtocol: https
name: https
nodePort: 30443 #修改为你要对外的端口
port: 443 #service内部端口
直接修改 nodePort 数值（范围 30000-32767），保存退出即可，控制器自动滚动更新。
浙公网安备 33010602011771号