ubuntu26.04，使用kubeadm在线安装k8s-v1.34.11（NLB + 3 master + 2 worker节点）
ubuntu 26.04。
集群规划（5 节点）
master节点01，主机名：k8s-master-01，ip：172.21.64.36
master节点02，主机名：k8s-master-02，ip：172.21.64.37
master节点03，主机名：k8s-master-03，ip：172.21.64.38
工作节点01：主机名：k8s-worker-01，ip：172.21.64.39
工作节点02：主机名：k8s-worker-02，ip：172.21.64.40
| 机器名 | 内网 ip | 角色 |
| k8s-master-01 | 172.21.64.36 | master |
| k8s-master-02 | 172.21.64.37 | master |
| k8s-master-03 | 172.21.64.38 | master |
| k8s-worker-01 | 172.21.64.39 | worker |
| k8s-worker-02 | 172.21.64.40 | worker |
一，清理kubeadm、containerd残留（所有节点执行）
清理旧版k8s残留
#!/usr/bin/env bash set -euo pipefail echo -e "===== 开始执行【全场景全覆盖】K8s 终极节点重置（适配kubeadm/sealos/kubekey/kubesray/kubeasz/二进制/deb混合残留）=====" # ====================== # 1. 通用集群重置（kubeadm体系） # ====================== if command -v kubeadm >/dev/null; then kubeadm reset -f || true fi # ====================== # 2. 停止所有可能存在的服务（全覆盖） # ====================== systemctl stop \ containerd kubelet \ kube-apiserver kube-controller-manager kube-scheduler kube-lb \ sealos kube-proxy etcd \ 2>/dev/null || true systemctl disable \ containerd kubelet \ kube-apiserver kube-controller-manager kube-scheduler kube-lb \ sealos kube-proxy etcd \ 2>/dev/null || true # ====================== # 3. 清理【二进制部署残留】控制面服务（你之前无限复活的元凶） # ====================== rm -f /etc/systemd/system/kube-apiserver.service rm -f /etc/systemd/system/kube-controller-manager.service rm -f /etc/systemd/system/kube-scheduler.service rm -f /etc/systemd/system/kube-lb.service rm -f /etc/systemd/system/etcd.service rm -f /etc/systemd/system/kube-proxy.service # ====================== # 4. 清理 Sealos / Kubekey / KubeSray / Kubeasz 专属服务 & 目录 # ====================== # sealos 残留 rm -rf /var/lib/sealos /etc/sealos /root/.sealos rm -f /etc/systemd/system/sealos.service # kubekey/kubesray 残留 rm -rf /var/lib/kubekey /etc/kubekey /opt/kubekey rm -rf /var/lib/kubesphere /etc/kubesphere # kubeasz 残留 rm -rf /etc/kubeasz /var/lib/kubeasz # ====================== # 5. 彻底purge卸载deb包（containerd.io、kubeadm、cri-tools全部purge，删除包+配置） # ====================== apt purge -y --allow-change-held-packages \ containerd.io containerd \ kubeadm kubectl kubelet \ cri-tools kubernetes-cni \ 2>/dev/null || true apt autoremove -y || true apt autoclean # 解除版本锁定，保证下次重装无冲突 apt-mark unhold \ kubeadm kubelet kubectl \ containerd.io cri-tools kubernetes-cni \ 2>/dev/null || true # ====================== # 6. 彻底清理所有路径 systemd 单元（解决二进制+deb双路径冲突） # ====================== rm -f /lib/systemd/system/kubelet.service rm -f /etc/systemd/system/kubelet.service rm -rf /etc/systemd/system/kubelet.service.d rm -f /lib/systemd/system/containerd.service rm -f /etc/systemd/system/containerd.service rm -rf /etc/systemd/system/containerd.service.d rm -f /usr/local/lib/systemd/system/containerd.service # ====================== # 7. 彻底清理所有路径 k8s/容器二进制 # 覆盖：apt/deb / 二进制解压 / kubekey / sealos # 新增 cni、crictl 二进制清理 # ====================== rm -f /usr/bin/containerd /usr/bin/ctr /usr/bin/crictl /usr/bin/kube* rm -f /usr/local/bin/containerd /usr/local/bin/ctr /usr/local/bin/crictl /usr/local/bin/kube* rm -f /opt/kube/bin/* 2>/dev/null || true # 清理二进制解压的cni插件二进制 rm -rf /opt/cni/bin/* 2>/dev/null || true # ====================== # 8. 重载 systemd、清除失效状态 # ====================== systemctl daemon-reload systemctl reset-failed # ====================== # 9. 绝杀所有残留进程（杜绝复活、端口占用） # ====================== pkill -9 -f "kube-apiserver|kube-scheduler|kube-controller-manager|kube-lb|kubelet|containerd|sealos|etcd|crictl" 2>/dev/null || true # ====================== # 10. 清空所有体系数据目录 # ====================== # 先卸载 Calico cgroup 挂载点（否则 rm 报 Operation not permitted） umount -R /var/run/calico/cgroup 2>/dev/null || true umount -R /run/calico/cgroup 2>/dev/null || true # /var/run 和 /run 是 tmpfs，重启自动清空，无需 rm rm -rf \ /var/lib/containerd \ /var/lib/cri \ /etc/cni \ /opt/cni \ /root/.kube \ /etc/containerd \ /etc/kubernetes \ /var/lib/kubelet \ /var/lib/etcd \ /var/lib/calico \ /var/lib/sealos \ /var/lib/nerdctl \ /var/lib/kubekey \ /var/lib/kubesphere \ /etc/kubeasz \ /etc/cni/net.d/* # ====================== # 11. 重置网络栈（解决多工具残留网卡、iptables错乱） # ====================== iptables -F && iptables -t nat -F && iptables -X && ipvsadm -C ip link del tunl0 2>/dev/null || true ip link del cni0 2>/dev/null || true ip link del flannel.1 2>/dev/null || true ip link del vxlan.calico 2>/dev/null || true echo -e "✅ 【k8s残留】清理完成！已purge卸载 containerd.io、cri-tools、kubernetes-cni"
二. 前置系统环境配置（所有节点执行）
1. 修改主机名
# master-01节点执行 hostnamectl set-hostname k8s-master-01 # master-02节点执行 hostnamectl set-hostname k8s-master-02 # master-03节点执行 hostnamectl set-hostname k8s-master-03 # worker-01节点执行 hostnamectl set-hostname k8s-worker-01 # worker-02节点执行 hostnamectl set-hostname k8s-worker-02
2. 配置 hosts 解析（所有节点统一写入 /etc/hosts）
cat >> /etc/hosts << EOF 172.21.64.36 k8s-master-01 172.21.64.37 k8s-master-02 172.21.64.38 k8s-master-03 172.21.64.39 k8s-worker-01 172.21.64.40 k8s-worker-02 EOF
3. 系统内核 & 资源优化
# 关闭永久swap swapoff -a sed -i '/swap/s/^/#/' /etc/fstab #关闭 ufw防火墙 systemctl stop ufw systemctl disable ufw # 内核转发、iptables桥接 cat >> /etc/sysctl.conf <<EOF net.bridge.bridge-nf-call-iptables = 1 net.bridge.bridge-nf-call-ip6tables = 1 net.ipv4.ip_forward = 1 # 允许绑定本机不存在的VIP（HA/kube-vip核心） net.ipv4.ip_nonlocal_bind = 1 # 反向路由过滤 全部宽松模式 net.ipv4.conf.all.rp_filter = 2 net.ipv4.conf.default.rp_filter = 2 net.ipv4.conf.eth0.rp_filter = 2 #eth0替换为真实的网卡名称（非必填） # ARP应答策略：仅匹配网卡IP才回复 net.ipv4.conf.all.arp_ignore = 1 net.ipv4.conf.default.arp_ignore = 1 net.ipv4.conf.eth0.arp_ignore = 1 #eth0替换为真实的网卡名称（非必填） # ARP宣告策略：严格匹配网卡网段 net.ipv4.conf.all.arp_announce = 2 net.ipv4.conf.default.arp_announce = 2 net.ipv4.conf.eth0.arp_announce = 2 #eth0替换为真实的网卡名称（非必填） EOF sysctl -p # 加载overlay/iptables内核模块 modprobe overlay modprobe br_netfilter #系统开机自动加载里面写的内核模块。 echo "overlay" >> /etc/modules-load.d/k8s.conf echo "br_netfilter" >> /etc/modules-load.d/k8s.conf # 开启root密码登录 sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config sed -i 's/#PasswordAuthentication no/PasswordAuthentication yes/' /etc/ssh/sshd_config sed -i 's/#PubkeyAuthentication no/PubkeyAuthentication yes/' /etc/ssh/sshd_config systemctl restart ssh systemctl enable ssh #时间同步 apt install chrony -y systemctl enable --now chronyd timedatectl set-timezone Asia/Shanghai
4 安装所有软件包
apt update && apt upgrade -y apt install -y curl wget openssl ca-certificates gnupg lsb-release openssh-server sshpass tar unzip ipset ipvsadm conntrack socat lvm2
5. Master 节点单独执行 SSH 免密分发
# master节点生成密钥 ssh-keygen -t ed25519 -N "" -f /root/.ssh/id_ed25519 # 分发公钥 sshpass -p "root密码" ssh-copy-id root@172.21.64.36 sshpass -p "root密码" ssh-copy-id root@172.21.64.37 sshpass -p "root密码" ssh-copy-id root@172.21.64.38 sshpass -p "root密码" ssh-copy-id root@172.21.64.39 sshpass -p "root密码" ssh-copy-id root@172.21.64.40 # 验证免密连通 ssh root@172.21.64.36 hostname ssh root@172.21.64.37 hostname ssh root@172.21.64.38 hostname ssh root@172.21.64.39 hostname ssh root@172.21.64.40 hostname
6. 批量校验所有节点 SSH 连通性（最关键前置检查）
nodes=(172.21.64.36 172.21.64.37 172.21.64.38 172.21.64.39 172.21.64.40)
for ip in ${nodes[@]};
do
echo "=== 测试 $ip SSH ==="
sshpass -p "你的root密码" ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no root@$ip "hostname; echo 连接正常"
done
三，安装nerdctl（所有节点）
由于阿里云ecs服务器不能访问外问，所以通过nerdctl从国内镜像仓库预先拉取镜像。
nerdctl下载地址：https://github.com/containerd/nerdctl/releases/download/v2.3.4/nerdctl-2.3.4-linux-amd64.tar.gz
安装部署nerdctl
curl https://github.com/containerd/nerdctl/releases/download/v2.3.4/nerdctl-2.3.4-linux-amd64.tar.gz
tar -zxvf nerdctl-2.3.4-linux-amd64.tar.gz
mv nerdctl /usr/local/bin/
chmod +x /usr/local/bin/nerdctl
# 同样配置默认命名空间
mkdir -p /etc/nerdctl
cat > /etc/nerdctl/nerdctl.toml <<EOF
namespace = "k8s.io"
address = "/run/containerd/containerd.sock"
cgroup_manager = "systemd"
EOF
四，配置apt源（所有节点执行）
1. 配置containerd.io apt安装源，因为apt自带的 containerd apt源的版本太旧
#!/bin/bash
# 探测信息赋值本地副本变量
local_arch=$(dpkg --print-architecture)
local_ubuntu_codename=$(lsb_release -cs)
# 清理旧docker源
rm -f /etc/apt/sources.list.d/docker.list
rm -f /etc/apt/trusted.gpg.d/docker*.gpg
# 阿里云docker-ce公钥
curl -fsSL https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/trusted.gpg.d/docker.gpg
# 添加阿里云docker-ce源（包含 containerd.io）
echo "deb [arch=${local_arch} signed-by=/etc/apt/trusted.gpg.d/docker.gpg] https://mirrors.aliyun.com/docker-ce/linux/ubuntu ${local_ubuntu_codename} stable" | tee /etc/apt/sources.list.d/docker.list
apt update
echo -e "\n=== 当前架构：${local_arch}，系统代号：${local_ubuntu_codename} ==="
echo -e "\n=== 查看当前源可用 containerd.io 版本 ==="
apt-cache madison containerd.io
2. 配置kuberetes v1.34 apt安装源
#!/bin/bash set -euo pipefail # ========== 配置项：k8s源分支只写小版本 v1.32 / v1.33 / v1.34 / v1.35 / v1.36 ========== k8s_apt_branch="v1.34" # 定义本地变量 local_arch=$(dpkg --print-architecture) local_ubuntu_codename=$(lsb_release -cs) local_k8s_apt_branch="${k8s_apt_branch}" ########################### # 1. 配置 K8s pkgs.k8s.io 源 ########################### rm -f /etc/apt/sources.list.d/kubernetes.list rm -f /etc/apt/trusted.gpg.d/kubernetes-*.gpg curl -fsSL "https://pkgs.k8s.io/core:/stable:/${local_k8s_apt_branch}/deb/Release.key" | gpg --dearmor -o "/etc/apt/trusted.gpg.d/kubernetes-${local_k8s_apt_branch}.gpg" echo "deb [signed-by=/etc/apt/trusted.gpg.d/kubernetes-${local_k8s_apt_branch}.gpg] https://pkgs.k8s.io/core:/stable:/${local_k8s_apt_branch}/deb/ /" | tee /etc/apt/sources.list.d/kubernetes.list apt update echo -e "\n========== 可用 kubeadm 版本列表 ==========" apt-cache madison kubeadm
五，安装基础组件（所有节点执行）
1. 安装containerd
#!/usr/bin/env bash set -euo pipefail # ====================== # 版本变量区 # k8s v1.34 配套pause固定版本:3.10.1，不是kubelet版本 # ====================== local_pause_version="3.10.1" # ====================== # 前提：已经配置好 docker‑ce apt源(阿里云docker镜像源) # 卸载系统自带旧 containerd，避免包冲突 # ====================== apt-get update # 卸载ubuntu系统源的 containerd，防止混淆 apt purge -y containerd containerd.io 2>/dev/null || true # 1. 安装 docker‑ce源 containerd.io apt-get install -y containerd.io # 2. 停止服务，修改配置前必须停止 systemctl stop containerd || true # 3. 生成标准配置 mkdir -p /etc/containerd containerd config default > /etc/containerd/config.toml # 4. SystemdCgroup = true sed -i -e 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml # 5. pause镜像域名保持registry.k8s.io，直接用版本变量拼接tag sed -i -E "s#^(\s*)sandbox = 'registry\.k8s\.io/pause:[0-9.]+'#\1sandbox = 'registry.k8s.io/pause:${local_pause_version}'#" /etc/containerd/config.toml # 6. systemd重载，启动 systemctl daemon-reload systemctl enable --now containerd # 7. 验证服务 sleep 3 systemctl status containerd --no-pager | head -15 ls -la /run/containerd/containerd.sock containerd --version # 校验输出 echo "pause配置版本: ${local_pause_version}" echo "=== config.toml sandbox行 ===" grep -n "sandbox =" /etc/containerd/config.toml
2. 安装kubeadm / kubelet / kubectl / cri-tools / kuberntes-cni (安装当前k8s源的最新版本)
#!/bin/bash set -euo pipefail # ========= 安装当前k8s源的最新版本 ========= apt-get -y install \ kubeadm \ kubelet \ kubectl \ cri-tools \ kubernetes-cni # 锁定版本防止apt自动升级 apt-mark hold kubeadm kubelet kubectl cri-tools kubernetes-cni containerd.io # 生成crictl配置文件 cat > /etc/crictl.yaml <<'INNER' runtime-endpoint: unix:///run/containerd/containerd.sock image-endpoint: unix:///run/containerd/containerd.sock timeout: 10 debug: false INNER systemctl enable --now kubelet echo -e "\n===== 版本校验 =====" kubelet --version
3. 仅在master-01节点拉取kubeadm的7个镜像并导出镜像
kubeadm用的7个镜像需要离线下载，由于不同版本的containerd的国内代理配置方法不一样，而且就算配置了国内代理也未必好用，所以先通过国内镜像仓库预下载所需要的镜像。
#!/bin/bash set -euo pipefail # 从kubeadm里自动获取k8s版本（v1.34.11） k8s_version=$(kubeadm version -o short) # 定义文件名变量 img_list_file="k8s-images-${k8s_version}.list" img_tar="k8s-images-${k8s_version}.tar" # 基础目录 mkdir -p /data/k8s/k8s-${k8s_version} cd /data/k8s/k8s-${k8s_version} # 获取kubeadm需要全部镜像列表 kubeadm config images list --kubernetes-version "${k8s_version}" > "${img_list_file}" cat "${img_list_file}" # DaoCloud镜像加速预下载镜像：m.daocloud.io/ while read -r img; do ctr -n k8s.io images pull --platform linux/amd64 "m.daocloud.io/${img}" done < "${img_list_file}" # 重标签为原生镜像，删除daocloud前缀镜像 while read -r img; do ctr -n k8s.io images tag "m.daocloud.io/${img}" "${img}" ctr -n k8s.io images rm "m.daocloud.io/${img}" done < "${img_list_file}" # ctr export输出裸tar磁盘文件，不做gzip压缩 ctr -n k8s.io images export "${img_tar}" $(grep -v '^$' "${img_list_file}") ls -lh "${img_tar}"
4. 把镜像批量上传到其它四个节点，并且导入镜像
#!/bin/bash set -euo pipefail # 从kubeadm里自动获取k8s版本（v1.34.11） k8s_version=$(kubeadm version -o short) img_tar="/data/k8s/k8s-${k8s_version}/k8s-images-${k8s_version}.tar" remote_dir="/data/k8s/k8s-${k8s_version}" remote_tar="${remote_dir}/k8s-images-${k8s_version}.tar" # 节点IP列表 node_list=( 172.21.64.37 172.21.64.38 172.21.64.39 172.21.64.40 ) # 循环分发+远程导入镜像 for node_ip in "${node_list[@]}"; do echo -e "\n===== 处理节点 ${node_ip} =====" # 创建目录，删除旧tar包，避免残留损坏文件 ssh "root@${node_ip}" "mkdir -p ${remote_dir} && rm -f ${remote_tar}" # scp拷贝镜像包到远程节点指定目录 scp "${img_tar}" "root@${node_ip}:${remote_tar}" # ssh远程使用ctr导入到k8s.io命名空间 ssh "root@${node_ip}" "ctr -n k8s.io image import ${remote_tar}" echo "节点 ${node_ip} 镜像导入完成，tar包保留：${remote_tar}" done echo -e "\n全部节点镜像分发导入完毕"
四. 下载适配 k8s-v1.34.11的calico.yaml / ingress-nginx.yaml部署文件及镜像（仅在master-01节点执行）
calico-v1.32.1, ingress-nginx-v1.15.1适配 k8s-v1.34.x / v1.35.x / v1.36.x
calico-v3.32.1：https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico.yaml
ingress-nginx-controler-v1.15.1：https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.15.1/deploy/static/provider/cloud/deploy.yaml
1. 下载yaml文件（如果下载失败，手动下载到本地，再上传）
cd /data/k8s/k8s_$(kubeadm version -o short)
calico_version="v1.32.1" ingress-nginx_version="v1.15.1" calico_yaml="calico-${calico_version}.yaml" ingress_yaml="ingress-nginx-${ingress-nginx_version}.yaml" curl -fSL -o "${calico_yaml}" \ https://mirror.ghproxy.com/https://raw.githubusercontent.com/projectcalico/calico/${calico_version}/manifests/calico.yaml curl -fSL -o "${ingress_yaml}" \ https://mirror.ghproxy.com/https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-${ingress-nginx_version}/deploy/static/provider/cloud/deploy.yaml
2. 安装方式（两种方案）
2.1. 方案一，修改calico.yaml与ingress-nginx镜像源为国内镜像源的方式安装
# 替换镜像前缀为DaoCloud源 sed -i 's|docker.io/calico|m.daocloud.io/docker.io/calico|g' calico-v3.32.1.yaml sed -i 's|quay.io/calico|m.daocloud.io/quay.io/calico|g' calico-v3.32.1.yaml # 替换ingress-nginx原镜像为daocloud镜像 sed -i 's|registry.k8s.io/ingress-nginx|m.daocloud.io/registry.k8s.io/ingress-nginx|g' ingress-nginx-v1.15.1.yaml # 删除 sha256 digest sed -i 's/@sha256:[0-9a-f]*//g' ingress-nginx-v1.15.1.yaml
2.2 方案二，预先下载镜像，然后导入境像到其它节点的方式安装
查看 calico.yaml与ingress-nginx.yaml有哪些镜像
# 一条命令从yaml里提取镜像并去重 grep -hoP 'image:\s*\K[^@]+' calico-v3.32.1.yaml ingress-nginx-v1.15.1.yaml | sort -u
输出：
quay.io/calico/cni:v3.32.1 quay.io/calico/kube-controllers:v3.32.1 quay.io/calico/node:v3.32.1 registry.k8s.io/ingress-nginx/controller:v1.15.1 registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9
从国内代理（daocloud）拉取镜像
k8_version="v1.34.11" work_dir="/data/k8s/k8s-${k8_version}" img_name="calico-ingress-images" img_tar="${work_dir}/${img_name}-${k8_version}.tar" mkdir -p "${work_dir}" images=( "quay.io/calico/cni:v3.32.1" "quay.io/calico/kube-controllers:v3.32.1" "quay.io/calico/node:v3.32.1" "registry.k8s.io/ingress-nginx/controller:v1.15.1" "registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9" ) for img in "${images[@]}"; do proxy_img="m.daocloud.io/${img}" ctr -n k8s.io images pull --platform linux/amd64 "${proxy_img}" ctr -n k8s.io images tag "${proxy_img}" "${img}" ctr -n k8s.io images rm "${proxy_img}" done # 输出裸tar，不gzip ctr -n k8s.io images export "${img_tar}" "${images[@]}" ls -lh "${img_tar}"
2.3 上传镜像到其它四个节点并导入镜像
#!/bin/bash set -euo pipefail k8s_version="v1.34.11" work_dir="/data/k8s/k8s-${k8s_version}" img_name="calico-ingress-images" # 本地源文件、远端完整路径统一变量管理 local_img_tar="${work_dir}/${img_name}-${k8s_version}.tar" remote_img_tar="${work_dir}/${img_name}-${k8s_version}.tar" mkdir -p "${work_dir}" node_list=( 172.21.64.37 172.21.64.38 172.21.64.39 172.21.64.40 ) for node in "${node_list[@]}"; do echo -e "\n===== 分发处理节点 ${node} =====" ssh "root@${node}" "mkdir -p ${work_dir} && rm -f ${remote_img_tar}" scp "${local_img_tar}" "root@${node}:${remote_img_tar}" ssh "root@${node}" "ctr -n k8s.io images import ${remote_img_tar}" done echo -e "\n===== 验证各节点导入结果 =====" for node in "${node_list[@]}"; do echo "=== ${node} ===" ssh "root@${node}" "ctr -n k8s.io images ls -q | grep -E 'calico|ingress-nginx'" done
五，初始化集群
注意，如果使用 NLB / CLB 做控制面板端点，需要关闭NLB / CLB 的客户端地址保持，不然其它master节点未join进来，或故障，会导致kubectl命令卡住。
1.初始化master节点
kubeadm init \ --kubernetes-version v1.34.11 \ --control-plane-endpoint "nlb-8uzzik99a4ylb0f1fq.cn-shanghai.nlb.aliyuncsslb.com:6443" \ --apiserver-advertise-address=172.21.64.36 \ --pod-network-cidr=192.168.0.0/16 \ --service-cidr=10.96.0.0/12 \ --upload-certs # 拷贝kubeconfig mkdir -p $HOME/.kube cp -i /etc/kubernetes/admin.conf $HOME/.kube/config chown $(id -u):$(id -g) $HOME/.kube/config # 查看节点状态 kubectl get nodes
输出：
Your Kubernetes control-plane has initialized successfully! To start using your cluster, you need to run the following as a regular user: mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config Alternatively, if you are the root user, you can run: export KUBECONFIG=/etc/kubernetes/admin.conf You should now deploy a pod network to the cluster. Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at: https://kubernetes.io/docs/concepts/cluster-administration/addons/ You can now join any number of control-plane nodes running the following command on each as root: kubeadm join nlb-8uzzik99a4ylb0f1fq.cn-shanghai.nlb.aliyuncsslb.com:6443 --token n6k5gy.m3182dic1snyr2jh \ --discovery-token-ca-cert-hash sha256:a438a568a2ab0251ae01c19734f0620f297d8b225cc09b052f2971d4b0b73182 \ --control-plane --certificate-key 0bc74678770f9abdb248dac7a89239a83632589ea9afee043a10b38d5016008c Please note that the certificate-key gives access to cluster sensitive data, keep it secret! As a safeguard, uploaded-certs will be deleted in two hours; If necessary, you can use "kubeadm init phase upload-certs --upload-certs" to reload certs afterward. Then you can join any number of worker nodes by running the following on each as root: kubeadm join nlb-8uzzik99a4ylb0f1fq.cn-shanghai.nlb.aliyuncsslb.com:6443 --token n6k5gy.m3182dic1snyr2jh \ --discovery-token-ca-cert-hash sha256:a438a568a2ab0251ae01c19734f0620f297d8b225cc09b052f2971d4b0b73182
3. 安装calico（必须）
cd /data/k8s/k8s-v1.34.11 kubectl apply -f calico-v3.32.1.yaml
3. 加入其它工作节点
kubeadm join nlb-8uzzik99a4ylb0f1fq.cn-shanghai.nlb.aliyuncsslb.com:6443 --token n6k5gy.m3182dic1snyr2jh \ --discovery-token-ca-cert-hash sha256:a438a568a2ab0251ae01c19734f0620f297d8b225cc09b052f2971d4b0b73182 \ --control-plane --certificate-key 0bc74678770f9abdb248dac7a89239a83632589ea9afee043a10b38d5016008c
拷贝kube.config
mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config
如果没有记录join命令，重新生成加入master节点的命令：
out=$(kubeadm init phase upload-certs --upload-certs 2>/dev/null) cert_key=$(echo "$out" | sed -n '/Using certificate key:/{n;p;}') echo "【Master控制平面节点加入命令】" kubeadm token create --print-join-command --ttl 0 --certificate-key "${cert_key}"
4.加入工作节点
kubeadm join nlb-8uzzik99a4ylb0f1fq.cn-shanghai.nlb.aliyuncsslb.com:6443 --token n6k5gy.m3182dic1snyr2jh \ --discovery-token-ca-cert-hash sha256:a438a568a2ab0251ae01c19734f0620f297d8b225cc09b052f2971d4b0b73182
如果没有记录join命令，重新生成加入工作节点的命令：
kubeadm token create --print-join-command --ttl 0
5. 查看集群状态
kubectl get nodes kubectl get pod -A
输出以下信息表示k8s集群安装成功：
root@k8s-master-01:/data/k8s/k8s-v1.34.11# kubectl get nodes NAME STATUS ROLES AGE VERSION k8s-master-01 Ready control-plane 51m v1.34.11 k8s-master-02 Ready control-plane 24m v1.34.11 k8s-master-03 Ready control-plane 21m v1.34.11 k8s-worker-01 Ready <none> 20m v1.34.11 k8s-worker-02 Ready <none> 19m v1.34.11 root@k8s-master-01:/data/k8s/k8s-v1.34.11# kubectl get pod -A NAMESPACE NAME READY STATUS RESTARTS AGE kube-system calico-kube-controllers-688bf7649b-2zmq9 1/1 Running 0 5m40s kube-system calico-node-56dsn 1/1 Running 0 5m9s kube-system calico-node-b9mff 1/1 Running 0 4m34s kube-system calico-node-f4qr8 1/1 Running 0 4m52s kube-system calico-node-rfbl8 1/1 Running 0 5m40s kube-system calico-node-sz689 1/1 Running 0 4m17s kube-system coredns-66bc5c9577-gpwbj 1/1 Running 0 51m kube-system coredns-66bc5c9577-xchlg 1/1 Running 0 51m kube-system etcd-k8s-master-01 1/1 Running 1 51m kube-system etcd-k8s-master-02 1/1 Running 0 24m kube-system etcd-k8s-master-03 1/1 Running 0 21m kube-system kube-apiserver-k8s-master-01 1/1 Running 1 51m kube-system kube-apiserver-k8s-master-02 1/1 Running 0 24m kube-system kube-apiserver-k8s-master-03 1/1 Running 0 21m kube-system kube-controller-manager-k8s-master-01 1/1 Running 1 51m kube-system kube-controller-manager-k8s-master-02 1/1 Running 0 24m kube-system kube-controller-manager-k8s-master-03 1/1 Running 0 21m kube-system kube-proxy-2fssw 1/1 Running 0 21m kube-system kube-proxy-5dt8j 1/1 Running 0 20m kube-system kube-proxy-696f2 1/1 Running 0 51m kube-system kube-proxy-d6kd7 1/1 Running 0 24m kube-system kube-proxy-d6sg8 1/1 Running 0 20m kube-system kube-scheduler-k8s-master-01 1/1 Running 1 51m kube-system kube-scheduler-k8s-master-02 1/1 Running 0 24m kube-system kube-scheduler-k8s-master-03 1/1 Running 0 21m root@k8s-master-01:/data/k8s/k8s-v1.34.11#
浙公网安备 33010602011771号