ubuntu 26.04，使用kubesas-3.7.0离线安装5节点高可用k8s-v1.36.3集群

ubuntu 26.04。

集群规划（5 节点）

master节点01，主机名：k8s-master-01，ip：172.21.64.36

master节点02，主机名：k8s-master-02，ip：172.21.64.37

master节点03，主机名：k8s-master-03，ip：172.21.64.38

工作节点01：主机名：k8s-worker-01，ip：172.21.64.39

工作节点02：主机名：k8s-worker-02，ip：172.21.64.40

 

机器名	内网 ip	角色
k8s-master-01	172.21.64.36	master
k8s-master-02	172.21.64.37	master
k8s-master-03	172.21.64.38	master
k8s-worker-01	172.21.64.39	worker
k8s-worker-02	172.21.64.40	worker

 一，安装ansible

apt update && apt install -y python3-pip
pip3 install ansible
ansible --version

 

二，下载kubeasz及离线资源

mkdir -p /data/kubeasz-3.6.7
cd /data/kubeasz-3.6.7
git clone https://gitee.com/easzlab/kubeasz.git kubeasz-src
cd kubeasz-src  
# 查看当前分枝
git branch
# 切换到3.6.7分枝
git checkout 3.6.7
chmod +x ezdown
# 清理残留
rm -rf /etc/kubeasz
# 在线下载所有资源（k8s 二进制、镜像、ansible 脚本等）
# 默认下载 k8s v1.36.3；如需指定版本用./ezdown  -k v1.36.3  -D
./ezdown -k v1.33.0 -D
#下载依赖包，如果下载ubuntu 24依赖包，用 ./ezdown -P ubuntu_24
./ezdown -P ubuntu_24

# 打包完整离线资源包 

tar -zcvf kubeasz_3.6.7_k8s1.33.0_offline.tar.gz /etc/kubeasz

 把 kubeasz_3.6.7_k8s1.33.0_offline.tar.gz用scp 传到 5 台节点统一路径。

上传到5台节点之后，离线包解压到独立版本目录

#备份，命名为上一个版本
cp -r /etc/kubeasz /etc/kubeasx-3.6.0.bak
rm -rf /etc/kubeasz
tar -zxvf kubeasz_3.6.7_k8s1.33.0_offline.tar.gz -C /etc/ 
chmod +x /etc/kubeasz/ezctl 
chmod +x /etc/kubeasz/ezctl
chmod +x /etc/kubeasz/ezdown

 

三，全节点卸载清理旧集群 containerd/k8s 所有残留

#!/usr/bin/env bash
set -euo pipefail

echo -e "===== 开始执行【全场景全覆盖】K8s 终极节点重置（适配kubeadm/sealos/kubekey/kubesray/kubeasz/二进制/deb混合残留）====="

# ======================
# 1. 通用集群重置（kubeadm体系）
# ======================
if command -v kubeadm >/dev/null; then
    kubeadm reset -f || true
fi

# ======================
# 2. 停止所有可能存在的服务（全覆盖）
# ======================
systemctl stop \
containerd kubelet \
kube-apiserver kube-controller-manager kube-scheduler kube-lb \
sealos kube-proxy etcd \
2>/dev/null || true

systemctl disable \
containerd kubelet \
kube-apiserver kube-controller-manager kube-scheduler kube-lb \
sealos kube-proxy etcd \
2>/dev/null || true

# ======================
# 3. 清理【二进制部署残留】控制面服务（你之前无限复活的元凶）
# ======================
rm -f /etc/systemd/system/kube-apiserver.service
rm -f /etc/systemd/system/kube-controller-manager.service
rm -f /etc/systemd/system/kube-scheduler.service
rm -f /etc/systemd/system/kube-lb.service
rm -f /etc/systemd/system/etcd.service
rm -f /etc/systemd/system/kube-proxy.service

# ======================
# 4. 清理 Sealos / Kubekey / KubeSray / Kubeasz 专属服务 & 目录
# ======================
# sealos 残留
rm -rf /var/lib/sealos /etc/sealos /root/.sealos
rm -f /etc/systemd/system/sealos.service

# kubekey/kubesray 残留
rm -rf /var/lib/kubekey /etc/kubekey /opt/kubekey
rm -rf /var/lib/kubesphere /etc/kubesphere

# kubeasz 残留
rm -rf /etc/kubeasz /var/lib/kubeasz

# ======================
# 5. 彻底purge卸载deb包（containerd.io、kubeadm、cri-tools全部purge，删除包+配置）
# ======================
apt purge -y --allow-change-held-packages \
    containerd.io containerd \
    kubeadm kubectl kubelet \
    cri-tools kubernetes-cni \
2>/dev/null || true

apt autoremove -y || true
apt autoclean

# 解除版本锁定，保证下次重装无冲突
apt-mark unhold \
    kubeadm kubelet kubectl \
    containerd.io cri-tools kubernetes-cni \
2>/dev/null || true

# ======================
# 6. 彻底清理所有路径 systemd 单元（解决二进制+deb双路径冲突）
# ======================
rm -f /lib/systemd/system/kubelet.service
rm -f /etc/systemd/system/kubelet.service
rm -rf /etc/systemd/system/kubelet.service.d

rm -f /lib/systemd/system/containerd.service
rm -f /etc/systemd/system/containerd.service
rm -rf /etc/systemd/system/containerd.service.d
rm -f /usr/local/lib/systemd/system/containerd.service

# ======================
# 7. 彻底清理所有路径 k8s/容器二进制
# 覆盖：apt/deb / 二进制解压 / kubekey / sealos
# 新增 cni、crictl 二进制清理
# ======================
rm -f /usr/bin/containerd /usr/bin/ctr /usr/bin/crictl /usr/bin/kube*
rm -f /usr/local/bin/containerd /usr/local/bin/ctr /usr/local/bin/crictl /usr/local/bin/kube*
rm -f /opt/kube/bin/* 2>/dev/null || true

# 清理二进制解压的cni插件二进制
rm -rf /opt/cni/bin/* 2>/dev/null || true

# ======================
# 8. 重载 systemd、清除失效状态
# ======================
systemctl daemon-reload
systemctl reset-failed

# ======================
# 9. 绝杀所有残留进程（杜绝复活、端口占用）
# ======================
pkill -9 -f "kube-apiserver|kube-scheduler|kube-controller-manager|kube-lb|kubelet|containerd|sealos|etcd|crictl" 2>/dev/null || true

# ======================
# 10. 清空所有体系数据目录
# ======================

# 先卸载 Calico cgroup 挂载点（否则 rm 报 Operation not permitted）
umount -R /var/run/calico/cgroup 2>/dev/null || true
umount -R /run/calico/cgroup 2>/dev/null || true

# /var/run 和 /run 是 tmpfs，重启自动清空，无需 rm
rm -rf \
/var/lib/containerd \
/var/lib/cri \
/etc/cni \
/opt/cni \
/root/.kube \
/etc/containerd \
/etc/kubernetes \
/var/lib/kubelet \
/var/lib/etcd \
/var/lib/calico \
/var/lib/sealos \
/var/lib/nerdctl \
/var/lib/kubekey \
/var/lib/kubesphere \
/etc/kubeasz \
/etc/cni/net.d/*

# ======================
# 11. 重置网络栈（解决多工具残留网卡、iptables错乱）
# ======================
iptables -F && iptables -t nat -F && iptables -X && ipvsadm -C
ip link del tunl0 2>/dev/null || true
ip link del cni0 2>/dev/null || true
ip link del flannel.1 2>/dev/null || true
ip link del vxlan.calico 2>/dev/null || true

echo -e "✅ 【k8s残留】清理完成！已purge卸载 containerd.io、cri-tools、kubernetes-cni"

 

四、前置环境配置，所有节点统一前置初始化脚本（所有机器执行）

1. 修改主机名

# master-01节点执行
hostnamectl set-hostname k8s-master-01
# master-02节点执行
hostnamectl set-hostname k8s-master-02
# master-03节点执行
hostnamectl set-hostname k8s-master-03
# worker-01节点执行
hostnamectl set-hostname k8s-worker-01
# worker-02节点执行
hostnamectl set-hostname k8s-worker-02

 

2. 配置 hosts 解析（所有节点统一写入 /etc/hosts）

cat >> /etc/hosts << EOF
172.21.64.36   k8s-master-01
172.21.64.37   k8s-master-02
172.21.64.38   k8s-master-03
172.21.64.39   k8s-worker-01
172.21.64.40   k8s-worker-02
EOF

 

3. 系统内核 & 资源优化

# 关闭永久swap
swapoff -a
sed -i '/swap/s/^/#/' /etc/fstab

#关闭 ufw防火墙
systemctl stop ufw
systemctl disable ufw

# 内核转发、iptables桥接
cat >> /etc/sysctl.conf <<EOF
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1

# 允许绑定本机不存在的VIP（HA/kube-vip核心）
net.ipv4.ip_nonlocal_bind = 1

# 反向路由过滤 全部宽松模式
net.ipv4.conf.all.rp_filter = 2
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.eth0.rp_filter = 2  #eth0替换为真实的网卡名称（非必填）

# ARP应答策略：仅匹配网卡IP才回复
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.default.arp_ignore = 1
net.ipv4.conf.eth0.arp_ignore = 1  #eth0替换为真实的网卡名称(非必填)

# ARP宣告策略：严格匹配网卡网段
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.default.arp_announce = 2
net.ipv4.conf.eth0.arp_announce = 2  #eth0替换为真实的网卡名称（非必填）

EOF
sysctl -p

# 加载overlay/iptables内核模块
modprobe overlay
modprobe br_netfilter


#系统开机自动加载里面写的内核模块。
echo "overlay" >> /etc/modules-load.d/k8s.conf
echo "br_netfilter" >> /etc/modules-load.d/k8s.conf
# 开启root密码登录
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config
sed -i 's/#PasswordAuthentication no/PasswordAuthentication yes/' /etc/ssh/sshd_config
sed -i 's/#PubkeyAuthentication no/PubkeyAuthentication yes/' /etc/ssh/sshd_config
systemctl restart ssh systemctl enable ssh

#时间同步
apt install chrony -y
systemctl enable --now chronyd
timedatectl set-timezone Asia/Shanghai

 

4. Master 节点单独执行 SSH 免密分发

# master节点生成密钥
ssh-keygen -t ed25519 -N "" -f /root/.ssh/id_ed25519
# 分发公钥
sshpass -p "root密码" ssh-copy-id root@172.21.64.36
sshpass -p "root密码" ssh-copy-id root@172.21.64.37
sshpass -p "root密码" ssh-copy-id root@172.21.64.38
sshpass -p "root密码" ssh-copy-id root@172.21.64.39
sshpass -p "root密码" ssh-copy-id root@172.21.64.40

# 验证免密连通
ssh root@172.21.64.36 hostname
ssh root@172.21.64.37 hostname
ssh root@172.21.64.38 hostname
ssh root@172.21.64.39 hostname
ssh root@172.21.64.40 hostname

 

5. 批量校验所有节点 SSH 连通性（最关键前置检查）

nodes=(172.21.64.36 172.21.64.37 172.21.64.38 172.21.64.39 172.21.64.40)
for ip in ${nodes[@]};
do
  echo "=== 测试 $ip SSH ==="
  sshpass -p "你的root密码" ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no root@$ip "hostname; echo 连接正常"
done

 

五，在k8s-master-01上部署实例

 

1. 在 k8s-master-01（ansible 执行机）创建集群实例

 

cd /etc/kubeasz
./ezctl new k8s-cluster

 

2. 编辑节点清单

vi /etc/kubeasz/clusters/k8s-cluster/hosts

按照如下内容编辑

[etcd]
172.21.64.36
172.21.64.37
172.21.64.38

[kube_master]
172.21.64.36 k8s_nodename='k8s-master-01'
172.21.64.37 k8s_nodename='k8s-master-02'
172.21.64.38 k8s_nodename='k8s-master-03'

[kube_node]
172.21.64.39 k8s_nodename='k8s-worker-01'
172.21.64.40 k8s_nodename='k8s-worker-02'

[harbor]
#172.21.64.36 NEW_INSTALL=false

[ex_lb]
#172.21.64.36 LB_ROLE=backup EX_APISERVER_VIP=172.21.64.250 EX_APISERVER_PORT=8443
#172.21.64.37 LB_ROLE=master EX_APISERVER_VIP=172.21.64.250 EX_APISERVER_PORT=8443

[chrony]
#172.21.64.36

[deploy]
172.21.64.36 ansible_connection=local

[all:vars]
SECURE_PORT="6443"
CONTAINER_RUNTIME="containerd"
CLUSTER_NETWORK="calico"
PROXY_MODE="nftables"
SERVICE_CIDR="10.68.0.0/16"
CLUSTER_CIDR="172.20.0.0/16"
NODE_PORT_RANGE="30000-32767"
CLUSTER_DNS_DOMAIN="cluster.local"
bin_dir="/opt/kube/bin"
base_dir="/etc/kubeasz"
cluster_dir="{{ base_dir }}/clusters/k8s-cluster"
ca_dir="/etc/kubernetes/ssl"
k8s_nodename=''
ansible_python_interpreter=/usr/bin/python3

 

3. 测试节点连通性

ansible -i /etc/kubeasz/clusters/k8s-cluster/hosts all -m ping

 

4. 预检

/etc/kubeasz/ezctl precheck k8s-cluster

 

4. 部署

# 在 kubeasz 容器内执行
/etc/kubeasz/ezctl setup k8s-cluster all