ubuntu 26.04，使用kubesas-3.7.0在线安装5节点高可用k8s-v1.36.3集群
ubuntu 26.04。
集群规划（5 节点）
master节点01，主机名：k8s-master-01，ip：172.21.64.36
master节点02，主机名：k8s-master-02，ip：172.21.64.37
master节点03，主机名：k8s-master-03，ip：172.21.64.38
工作节点01：主机名：k8s-worker-01，ip：172.21.64.39
工作节点02：主机名：k8s-worker-02，ip：172.21.64.40
| 机器名 | 内网 ip | 角色 |
| k8s-master-01 | 172.21.64.36 | master |
| k8s-master-02 | 172.21.64.37 | master |
| k8s-master-03 | 172.21.64.38 | master |
| k8s-worker-01 | 172.21.64.39 | worker |
| k8s-worker-02 | 172.21.64.40 | worker |
一，全节点卸载清理旧集群 containerd/k8s 所有残留
#!/usr/bin/env bash set -euo pipefail echo -e "===== 开始执行【全场景全覆盖】K8s 终极节点重置（适配kubeadm/sealos/kubekey/kubesray/kubeasz/二进制/deb混合残留）=====" # ====================== # 1. 通用集群重置（kubeadm体系） # ====================== if command -v kubeadm >/dev/null; then kubeadm reset -f || true fi # ====================== # 2. 停止所有可能存在的服务（全覆盖） # ====================== systemctl stop \ containerd kubelet \ kube-apiserver kube-controller-manager kube-scheduler kube-lb \ sealos kube-proxy etcd \ 2>/dev/null || true systemctl disable \ containerd kubelet \ kube-apiserver kube-controller-manager kube-scheduler kube-lb \ sealos kube-proxy etcd \ 2>/dev/null || true # ====================== # 3. 清理【二进制部署残留】控制面服务（你之前无限复活的元凶） # ====================== rm -f /etc/systemd/system/kube-apiserver.service rm -f /etc/systemd/system/kube-controller-manager.service rm -f /etc/systemd/system/kube-scheduler.service rm -f /etc/systemd/system/kube-lb.service rm -f /etc/systemd/system/etcd.service rm -f /etc/systemd/system/kube-proxy.service # ====================== # 4. 清理 Sealos / Kubekey / KubeSray / Kubeasz 专属服务 & 目录 # ====================== # sealos 残留 rm -rf /var/lib/sealos /etc/sealos /root/.sealos rm -f /etc/systemd/system/sealos.service # kubekey/kubesray 残留 rm -rf /var/lib/kubekey /etc/kubekey /opt/kubekey rm -rf /var/lib/kubesphere /etc/kubesphere # kubeasz 残留 rm -rf /etc/kubeasz /var/lib/kubeasz # ====================== # 5. 彻底purge卸载deb包（containerd.io、kubeadm、cri-tools全部purge，删除包+配置） # ====================== apt purge -y --allow-change-held-packages \ containerd.io containerd \ kubeadm kubectl kubelet \ cri-tools kubernetes-cni \ 2>/dev/null || true apt autoremove -y || true apt autoclean # 解除版本锁定，保证下次重装无冲突 apt-mark unhold \ kubeadm kubelet kubectl \ containerd.io cri-tools kubernetes-cni \ 2>/dev/null || true # ====================== # 6. 彻底清理所有路径 systemd 单元（解决二进制+deb双路径冲突） # ====================== rm -f /lib/systemd/system/kubelet.service rm -f /etc/systemd/system/kubelet.service rm -rf /etc/systemd/system/kubelet.service.d rm -f /lib/systemd/system/containerd.service rm -f /etc/systemd/system/containerd.service rm -rf /etc/systemd/system/containerd.service.d rm -f /usr/local/lib/systemd/system/containerd.service # ====================== # 7. 彻底清理所有路径 k8s/容器二进制 # 覆盖：apt/deb / 二进制解压 / kubekey / sealos # 新增 cni、crictl 二进制清理 # ====================== rm -f /usr/bin/containerd /usr/bin/ctr /usr/bin/crictl /usr/bin/kube* rm -f /usr/local/bin/containerd /usr/local/bin/ctr /usr/local/bin/crictl /usr/local/bin/kube* rm -f /opt/kube/bin/* 2>/dev/null || true # 清理二进制解压的cni插件二进制 rm -rf /opt/cni/bin/* 2>/dev/null || true # ====================== # 8. 重载 systemd、清除失效状态 # ====================== systemctl daemon-reload systemctl reset-failed # ====================== # 9. 绝杀所有残留进程（杜绝复活、端口占用） # ====================== pkill -9 -f "kube-apiserver|kube-scheduler|kube-controller-manager|kube-lb|kubelet|containerd|sealos|etcd|crictl" 2>/dev/null || true # ====================== # 10. 清空所有体系数据目录 # ====================== # 先卸载 Calico cgroup 挂载点（否则 rm 报 Operation not permitted） umount -R /var/run/calico/cgroup 2>/dev/null || true umount -R /run/calico/cgroup 2>/dev/null || true # /var/run 和 /run 是 tmpfs，重启自动清空，无需 rm rm -rf \ /var/lib/containerd \ /var/lib/cri \ /etc/cni \ /opt/cni \ /root/.kube \ /etc/containerd \ /etc/kubernetes \ /var/lib/kubelet \ /var/lib/etcd \ /var/lib/calico \ /var/lib/sealos \ /var/lib/nerdctl \ /var/lib/kubekey \ /var/lib/kubesphere \ /etc/kubeasz \ /etc/cni/net.d/* # ====================== # 11. 重置网络栈（解决多工具残留网卡、iptables错乱） # ====================== iptables -F && iptables -t nat -F && iptables -X && ipvsadm -C ip link del tunl0 2>/dev/null || true ip link del cni0 2>/dev/null || true ip link del flannel.1 2>/dev/null || true ip link del vxlan.calico 2>/dev/null || true echo -e "✅ 【k8s残留】清理完成！已purge卸载 containerd.io、cri-tools、kubernetes-cni"
二、前置环境配置，所有节点统一前置初始化脚本（所有机器执行）
1. 修改主机名
# master-01节点执行 hostnamectl set-hostname k8s-master-01 # master-02节点执行 hostnamectl set-hostname k8s-master-02 # master-03节点执行 hostnamectl set-hostname k8s-master-03 # worker-01节点执行 hostnamectl set-hostname k8s-worker-01 # worker-02节点执行 hostnamectl set-hostname k8s-worker-02
2. 配置 hosts 解析（所有节点统一写入 /etc/hosts）
cat >> /etc/hosts << EOF 172.21.64.36 k8s-master-01 172.21.64.37 k8s-master-02 172.21.64.38 k8s-master-03 172.21.64.39 k8s-worker-01 172.21.64.40 k8s-worker-02 EOF
3. 系统内核 & 资源优化
# 关闭永久swap swapoff -a sed -i '/swap/s/^/#/' /etc/fstab #关闭 ufw防火墙 systemctl stop ufw systemctl disable ufw # 内核转发、iptables桥接 cat >> /etc/sysctl.conf <<EOF net.bridge.bridge-nf-call-iptables = 1 net.bridge.bridge-nf-call-ip6tables = 1 net.ipv4.ip_forward = 1 # 允许绑定本机不存在的VIP（HA/kube-vip核心） net.ipv4.ip_nonlocal_bind = 1 # 反向路由过滤 全部宽松模式 net.ipv4.conf.all.rp_filter = 2 net.ipv4.conf.default.rp_filter = 2 net.ipv4.conf.eth0.rp_filter = 2 #eth0替换为真实的网卡名称（非必填） # ARP应答策略：仅匹配网卡IP才回复 net.ipv4.conf.all.arp_ignore = 1 net.ipv4.conf.default.arp_ignore = 1 net.ipv4.conf.eth0.arp_ignore = 1 #eth0替换为真实的网卡名称(非必填) # ARP宣告策略：严格匹配网卡网段 net.ipv4.conf.all.arp_announce = 2 net.ipv4.conf.default.arp_announce = 2 net.ipv4.conf.eth0.arp_announce = 2 #eth0替换为真实的网卡名称（非必填） EOF sysctl -p # 加载overlay/iptables内核模块 modprobe overlay modprobe br_netfilter #系统开机自动加载里面写的内核模块。 echo "overlay" >> /etc/modules-load.d/k8s.conf echo "br_netfilter" >> /etc/modules-load.d/k8s.conf # 开启root密码登录 sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config sed -i 's/#PasswordAuthentication no/PasswordAuthentication yes/' /etc/ssh/sshd_config sed -i 's/#PubkeyAuthentication no/PubkeyAuthentication yes/' /etc/ssh/sshd_config systemctl restart ssh systemctl enable ssh #时间同步 apt install chrony -y systemctl enable --now chronyd timedatectl set-timezone Asia/Shanghai
4. Master 节点单独执行 SSH 免密分发
# master节点生成密钥 ssh-keygen -t ed25519 -N "" -f /root/.ssh/id_ed25519 # 分发公钥 sshpass -p "root密码" ssh-copy-id root@172.21.64.36 sshpass -p "root密码" ssh-copy-id root@172.21.64.37 sshpass -p "root密码" ssh-copy-id root@172.21.64.38 sshpass -p "root密码" ssh-copy-id root@172.21.64.39 sshpass -p "root密码" ssh-copy-id root@172.21.64.40 # 验证免密连通 ssh root@172.21.64.36 hostname ssh root@172.21.64.37 hostname ssh root@172.21.64.38 hostname ssh root@172.21.64.39 hostname ssh root@172.21.64.40 hostname
5. 批量校验所有节点 SSH 连通性（最关键前置检查）
nodes=(172.21.64.36 172.21.64.37 172.21.64.38 172.21.64.39 172.21.64.40)
for ip in ${nodes[@]};
do
echo "=== 测试 $ip SSH ==="
sshpass -p "你的root密码" ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no root@$ip "hostname; echo 连接正常"
done
三，下载 ezdown 并在线拉取资源（k8s-master-01）
mkdir -p /data/kubeasz cd /data/kubeasz git clone https://gitee.com/easzlab/kubeasz.git kubeasz-src cd kubeasz-src # 查看当前分枝 git branch # 切换到3.7.0分枝 git checkout 3.7.0 chmod +x ezdown # 清理残留 rm -rf /etc/kubeasz # 在线下载所有资源（k8s 二进制、镜像、ansible 脚本等） # 默认下载 k8s v1.36.3；如需指定版本用./ezdown -k v1.33.x -D ./ezdown -D #下载依赖包，如果下载ubuntu 24依赖包，用 ./ezdown -P ubuntu_24 ./ezdown -P
四，在kubeasz容器内部署k8s
创建集群配置并编辑 hosts
#启动 kubeasz 容器（内含 ansible 运行环境） ./ezdown -S # 进入 kubeasz 容器 docker exec -it kubeasz bash # 创建新集群配置（生成 /etc/kubeasz/clusters/k8s-cluster/ 目录） ezctl new k8s-cluster
1. 编辑节点清单
查看默认清单：
cat /etc/kubeasz/clusters/k8s-cluster/hosts
# 'etcd' cluster should have odd member(s) (1,3,5,...) [etcd] 192.168.1.1 192.168.1.2 192.168.1.3 # master node(s), set unique 'k8s_nodename' for each node # CAUTION: 'k8s_nodename' must consist of lower case alphanumeric characters, '-' or '.', # and must start and end with an alphanumeric character [kube_master] 192.168.1.1 k8s_nodename='master-01' 192.168.1.2 k8s_nodename='master-02' 192.168.1.3 k8s_nodename='master-03' # work node(s), set unique 'k8s_nodename' for each node # CAUTION: 'k8s_nodename' must consist of lower case alphanumeric characters, '-' or '.', # and must start and end with an alphanumeric character [kube_node] 192.168.1.4 k8s_nodename='worker-01' 192.168.1.5 k8s_nodename='worker-02' # [optional] harbor server, a private docker registry # 'NEW_INSTALL': 'true' to install a harbor server; 'false' to integrate with existed one [harbor] #192.168.1.8 NEW_INSTALL=false # [optional] loadbalance for accessing k8s from outside [ex_lb] #192.168.1.6 LB_ROLE=backup EX_APISERVER_VIP=192.168.1.250 EX_APISERVER_PORT=8443 #192.168.1.7 LB_ROLE=master EX_APISERVER_VIP=192.168.1.250 EX_APISERVER_PORT=8443 # [optional] ntp server for the cluster [chrony] #192.168.1.1 [all:vars] # --------- Main Variables --------------- # Secure port for apiservers SECURE_PORT="6443" # Cluster container-runtime supported: docker, containerd # if k8s version >= 1.24, docker is not supported CONTAINER_RUNTIME="containerd" # Network plugins supported: calico, flannel, kube-router, cilium, kube-ovn CLUSTER_NETWORK="calico" # Service proxy mode of kube-proxy: 'iptables' or 'nftables' # Prerequisites: kernal >= 5.13 and nft >= 1.0.0 PROXY_MODE="nftables" # K8S Service CIDR, not overlap with node(host) networking SERVICE_CIDR="10.68.0.0/16" # Cluster CIDR (Pod CIDR), not overlap with node(host) networking CLUSTER_CIDR="172.20.0.0/16" # NodePort Range NODE_PORT_RANGE="30000-32767" # Cluster DNS Domain CLUSTER_DNS_DOMAIN="cluster.local" # -------- Additional Variables (don't change the default value right now) --- # Binaries Directory bin_dir="/opt/kube/bin" # Deploy Directory (kubeasz workspace) base_dir="/etc/kubeasz" # Directory for a specific cluster cluster_dir="{{ base_dir }}/clusters/k8s-cluster" # CA and other components cert/key Directory ca_dir="/etc/kubernetes/ssl" # Default 'k8s_nodename' is empty k8s_nodename='' # Default python interpreter ansible_python_interpreter=/usr/bin/python3 k8s-master-01:/# clear k8s-master-01:/# vi /etc/kubeasz/clusters/k8s-cluster/hosts k8s-master-01:/# cat /etc/kubeasz/clusters/k8s-cluster/hosts # 'etcd' cluster should have odd member(s) (1,3,5,...) [etcd] 192.168.1.1 192.168.1.2 192.168.1.3 # master node(s), set unique 'k8s_nodename' for each node # CAUTION: 'k8s_nodename' must consist of lower case alphanumeric characters, '-' or '.', # and must start and end with an alphanumeric character [kube_master] 192.168.1.1 k8s_nodename='master-01' 192.168.1.2 k8s_nodename='master-02' 192.168.1.3 k8s_nodename='master-03' # work node(s), set unique 'k8s_nodename' for each node # CAUTION: 'k8s_nodename' must consist of lower case alphanumeric characters, '-' or '.', # and must start and end with an alphanumeric character [kube_node] 192.168.1.4 k8s_nodename='worker-01' 192.168.1.5 k8s_nodename='worker-02' # [optional] harbor server, a private docker registry # 'NEW_INSTALL': 'true' to install a harbor server; 'false' to integrate with existed one [harbor] #192.168.1.8 NEW_INSTALL=false # [optional] loadbalance for accessing k8s from outside [ex_lb] #192.168.1.6 LB_ROLE=backup EX_APISERVER_VIP=192.168.1.250 EX_APISERVER_PORT=8443 #192.168.1.7 LB_ROLE=master EX_APISERVER_VIP=192.168.1.250 EX_APISERVER_PORT=8443 # [optional] ntp server for the cluster [chrony] #192.168.1.1 [all:vars] # --------- Main Variables --------------- # Secure port for apiservers SECURE_PORT="6443" # Cluster container-runtime supported: docker, containerd # if k8s version >= 1.24, docker is not supported CONTAINER_RUNTIME="containerd" # Network plugins supported: calico, flannel, kube-router, cilium, kube-ovn CLUSTER_NETWORK="calico" # Service proxy mode of kube-proxy: 'iptables' or 'nftables' # Prerequisites: kernal >= 5.13 and nft >= 1.0.0 PROXY_MODE="nftables" # K8S Service CIDR, not overlap with node(host) networking SERVICE_CIDR="10.68.0.0/16" # Cluster CIDR (Pod CIDR), not overlap with node(host) networking CLUSTER_CIDR="172.20.0.0/16" # NodePort Range NODE_PORT_RANGE="30000-32767" # Cluster DNS Domain CLUSTER_DNS_DOMAIN="cluster.local" # -------- Additional Variables (don't change the default value right now) --- # Binaries Directory bin_dir="/opt/kube/bin" # Deploy Directory (kubeasz workspace) base_dir="/etc/kubeasz" # Directory for a specific cluster cluster_dir="{{ base_dir }}/clusters/k8s-cluster" # CA and other components cert/key Directory ca_dir="/etc/kubernetes/ssl" # Default 'k8s_nodename' is empty k8s_nodename='' # Default python interpreter ansible_python_interpreter=/usr/bin/python3 k8s-master-01:/# lear bash: lear: command not found k8s-master-01:/# vi /etc/kubeasz/clusters/k8s-cluster/hosts k8s-master-01:/# cat /etc/kubeasz/clusters/k8s-cluster/hosts # 'etcd' cluster should have odd member(s) (1,3,5,...) [etcd] 192.168.1.1 192.168.1.2 192.168.1.3 # master node(s), set unique 'k8s_nodename' for each node # CAUTION: 'k8s_nodename' must consist of lower case alphanumeric characters, '-' or '.', # and must start and end with an alphanumeric character [kube_master] 192.168.1.1 k8s_nodename='master-01' 192.168.1.2 k8s_nodename='master-02' 192.168.1.3 k8s_nodename='master-03' # work node(s), set unique 'k8s_nodename' for each node # CAUTION: 'k8s_nodename' must consist of lower case alphanumeric characters, '-' or '.', # and must start and end with an alphanumeric character [kube_node] 192.168.1.4 k8s_nodename='worker-01' 192.168.1.5 k8s_nodename='worker-02' # [optional] harbor server, a private docker registry # 'NEW_INSTALL': 'true' to install a harbor server; 'false' to integrate with existed one [harbor] #192.168.1.8 NEW_INSTALL=false # [optional] loadbalance for accessing k8s from outside [ex_lb] #192.168.1.6 LB_ROLE=backup EX_APISERVER_VIP=192.168.1.250 EX_APISERVER_PORT=8443 #192.168.1.7 LB_ROLE=master EX_APISERVER_VIP=192.168.1.250 EX_APISERVER_PORT=8443 # [optional] ntp server for the cluster [chrony] #192.168.1.1 [all:vars] # --------- Main Variables --------------- # Secure port for apiservers SECURE_PORT="6443" # Cluster container-runtime supported: docker, containerd # if k8s version >= 1.24, docker is not supported CONTAINER_RUNTIME="containerd" # Network plugins supported: calico, flannel, kube-router, cilium, kube-ovn CLUSTER_NETWORK="calico" # Service proxy mode of kube-proxy: 'iptables' or 'nftables' # Prerequisites: kernal >= 5.13 and nft >= 1.0.0 PROXY_MODE="nftables" # K8S Service CIDR, not overlap with node(host) networking SERVICE_CIDR="10.68.0.0/16" # Cluster CIDR (Pod CIDR), not overlap with node(host) networking CLUSTER_CIDR="172.20.0.0/16" # NodePort Range NODE_PORT_RANGE="30000-32767" # Cluster DNS Domain CLUSTER_DNS_DOMAIN="cluster.local" # -------- Additional Variables (don't change the default value right now) --- # Binaries Directory bin_dir="/opt/kube/bin" # Deploy Directory (kubeasz workspace) base_dir="/etc/kubeasz" # Directory for a specific cluster cluster_dir="{{ base_dir }}/clusters/k8s-cluster" # CA and other components cert/key Directory ca_dir="/etc/kubernetes/ssl" # Default 'k8s_nodename' is empty k8s_nodename='' # Default python interpreter ansible_python_interpreter=/usr/bin/python3
2. 编辑 /etc/kubeasz/clusters/k8s-cluster/hosts,按照如下内容修改
cat > /etc/kubeasz/clusters/k8s-cluster/hosts << 'EOF' [etcd] 172.21.64.36 172.21.64.37 172.21.64.38 [kube_master] 172.21.64.36 k8s_nodename='k8s-master-01' 172.21.64.37 k8s_nodename='k8s-master-02' 172.21.64.38 k8s_nodename='k8s-master-03' [kube_node] 172.21.64.39 k8s_nodename='k8s-worker-01' 172.21.64.40 k8s_nodename='k8s-worker-02' [harbor] #172.21.64.36 NEW_INSTALL=false [ex_lb] #172.21.64.36 LB_ROLE=backup EX_APISERVER_VIP=172.21.64.250 EX_APISERVER_PORT=8443 #172.21.64.37 LB_ROLE=master EX_APISERVER_VIP=172.21.64.250 EX_APISERVER_PORT=8443 [chrony] #172.21.64.36 [deploy] 172.21.64.36 ansible_connection=local [all:vars] SECURE_PORT="6443" CONTAINER_RUNTIME="containerd" CLUSTER_NETWORK="calico" PROXY_MODE="nftables" SERVICE_CIDR="10.68.0.0/16" CLUSTER_CIDR="172.20.0.0/16" NODE_PORT_RANGE="30000-32767" CLUSTER_DNS_DOMAIN="cluster.local" bin_dir="/opt/kube/bin" base_dir="/etc/kubeasz" cluster_dir="{{ base_dir }}/clusters/k8s-cluster" ca_dir="/etc/kubernetes/ssl" k8s_nodename='' ansible_python_interpreter=/usr/bin/python3 EOF
3. 修改k8s版本（可选）
vi /etc/kubeasz/clusters/k8s-cluster/config.yml
修改 K8S_VER: "1.36.3" ，默认是1.36.3
4. 测试节点连通性
ansible -i /etc/kubeasz/clusters/k8s-cluster/hosts all -m ping
5. 一键部署
# 在 kubeasz 容器内执行
/etc/kubeasz/ezctl setup k8s-cluster all
6. 部署完成后验证：
kubectl get nodes -o wide kubectl get pods -A
浙公网安备 33010602011771号