一、集群节点规划注意Kubernetes 1.36 已经彻底移除 docker shim只能使用 containerd/crun不再支持 docker 直接作为 runtime。软件环境操作系统Ubuntu 24.04.4 LTS 内核6.8.0-138-genericContainerdv2.2.1k8sv1.36.4kubeadmv1.36节点配置主机角色IPCPU内存node1控制平面192.168.5.1016C40Gnode2工作节点192.168.5.1116C40Gnode3工作节点192.168.5.1216C40G注意控制平面至少 2 核、4 GB 内存工作节点至少 2 核、4 GB 内存所有节点使用固定 IP节点之间可以互相访问不要使用公网 IP 作为集群节点通信地址主机名不能重复普通用户 sudo官方推荐方式安装二、设置主机名和 hosts分别在每个节点设置对应主机名例如sudo hostnamectl set-hostname node1所有节点配置/etc/hostssudo tee -a /etc/hosts /dev/null EOF 192.168.5.10 node1 192.168.5.11 node2 192.168.5.12 node3 EOF验证rootnode1:~# hostname node1三、更新系统并安装基础工具sudo apt update sudo apt upgrade -y sudo apt install -y \ apt-transport-https \ ca-certificates \ curl \ gpg \ chrony \ socat \ conntrack \ ipset \ ebtables \ ethtool \ lsof四、保持时间同步sudo systemctl enable --now chrony timedatectl status设置时区# 设置时区为上海 sudo timedatectl set-timezone Asia/Shanghai # 验证 timedatectl五、关闭 SwapKubernetes 默认检测到 Swap 时会导致 kubelet 无法正常启动。官方建议关闭 Swap或者额外配置 kubelet 允许 Swap。生产环境建议直接关闭。临时关闭sudo swapoff -a永久关闭sudo sed -i.bak /[[:space:]]swap[[:space:]]/ s/^/#/ /etc/fstab检查free -h swapon --show六、配置内核模块和网络参数加载内核模块sudo tee /etc/modules-load.d/k8s.conf /dev/null EOF overlay br_netfilter EOF sudo modprobe overlay sudo modprobe br_netfilter配置网络参数sudo tee /etc/sysctl.d/k8s.conf /dev/null EOF net.bridge.bridge-nf-call-iptables 1 net.bridge.bridge-nf-call-ip6tables 1 net.ipv4.ip_forward 1 EOF sudo sysctl --system检查sysctl net.ipv4.ip_forward lsmod | grep br_netfilter预期net.ipv4.ip_forward 1七、安装并配置 containerdsudo apt install -y containerd检查pannode1:~$ sudo ctr version Client: Version: 2.2.1 Revision: Go version: go1.24.4 Server: Version: 2.2.1 Revision: UUID: 9844b409-4c1c-4f55-b0d4-164c16ea759e生成默认配置sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml /dev/null启用 systemd cgroupsudo sed -i \ s/SystemdCgroup false/SystemdCgroup true/ \ /etc/containerd/config.toml确认 CRI 插件没有被禁用sudo grep -n disabled_plugins\|SystemdCgroup /etc/containerd/config.toml预期disabled_plugins [cri]重启并设置开机启动sudo systemctl restart containerd sudo systemctl enable containerd sudo systemctl status containerd --no-pager八、安装 kubeadm、kubelet、kubectl生产环境建议所有节点使用完全相同的 Kubernetes 版本本文主要介绍Kubernetesv1.36的安装。注意Kubernetes 官方已弃用旧的apt.kubernetes.io仓库应使用新的pkgs.k8s.io仓库。sudo mkdir -p -m 755 /etc/apt/keyrings curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.36/deb/Release.key \ | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg echo deb [signed-by/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.36/deb/ / \ | sudo tee /etc/apt/sources.list.d/kubernetes.list安装组件sudo apt update sudo apt install -y kubelet kubeadm kubectl检查版本kubeadm version kubelet --version kubectl version --client锁定版本避免系统升级时自动升级 Kubernetessudo apt-mark hold kubelet kubeadm kubectl启用 kubeletsudo systemctl enable kubelet九、关闭防火墙Ubuntu 默认防火墙工具是ufw底层是 iptables/nftables。k8s 测试环境可以关闭生产环境建议不要完全关闭而是放行集群端口。sudo ufw disable sudo systemctl stop ufw sudo systemctl disable ufw十、禁用IPV6sudo tee /etc/sysctl.d/99-disable-ipv6.conf /dev/null EOF net.ipv6.conf.all.disable_ipv6 1 net.ipv6.conf.default.disable_ipv6 1 EOF sudo sysctl --system验证cat /proc/sys/net/ipv6/conf/all/disable_ipv6输出1表示已禁用。重启相关服务sudo systemctl restart containerd sudo systemctl restart kubelet十一、使用配置文件进行初始化控制平面相比长命令配置文件更容易保存和后续复用。创建配置文件sudo mkdir -p /etc/kubernetes sudo vim /etc/kubernetes/kubeadm-config.yaml写入apiVersion: kubeadm.k8s.io/v1beta4 kind: InitConfiguration localAPIEndpoint: advertiseAddress: 192.168.5.10 bindPort: 6443 nodeRegistration: criSocket: unix:///run/containerd/containerd.sock kubeletExtraArgs: node-ip: 192.168.5.10 --- apiVersion: kubeadm.k8s.io/v1beta4 kind: ClusterConfiguration kubernetesVersion: v1.36.4 imageRepository: registry.aliyuncs.com/google_containers controlPlaneEndpoint: 192.168.5.10:6443 networking: podSubnet: 10.244.0.0/16 serviceSubnet: 10.96.0.0/12 dnsDomain: cluster.local注意advertiseAddress填控制平面节点 IPnode-ip填本机实际用于集群通信的 IPcontrolPlaneEndpoint是其他节点访问 API Server 的地址podSubnet必须与后续 CNI 网络插件配置一致如果未来计划做高可用controlPlaneEndpoint应填写负载均衡器或稳定 DNS而不是单个节点 IP查看需要拉取的镜像pannode1:~$ sudo kubeadm config images list \ --config/etc/kubernetes/kubeadm-config.yaml registry.aliyuncs.com/google_containers/kube-apiserver:v1.36.4 registry.aliyuncs.com/google_containers/kube-controller-manager:v1.36.4 registry.aliyuncs.com/google_containers/kube-scheduler:v1.36.4 registry.aliyuncs.com/google_containers/kube-proxy:v1.36.4 registry.aliyuncs.com/google_containers/coredns:v1.14.2 registry.aliyuncs.com/google_containers/pause:3.10.2 registry.aliyuncs.com/google_containers/etcd:3.6.8-0先执行预检查:sudo kubeadm init \ --config/etc/kubernetes/kubeadm-config.yaml \ --dry-run执行初始化sudo kubeadm init \ --config/etc/kubernetes/kubeadm-config.yaml如果初始化失败查看日志journalctl -u kubelet -n 100 --no-pager我第一次安装失败查找日志找到了报错信息failed to pull image registry.k8s.io/pause:3.10.1先测试一下是否可拉取镜像sudo crictl pull registry.k8s.io/pause:3.10.1 ctr: failed to resolve image: failed to do request: Head https://europe-west3-docker.pkg.dev/v2/k8s-artifacts-prod/images/pause/manifests/3.10.1?rid0f7a60629231ae3195f59506e39f5118: dial tcp 74.125.142.82:443: i/o timeout说明网络有问题无法下载可以修改为国内镜像地址sudo sed -i s#registry.k8s.io/pause:3.10.1#registry.aliyuncs.com/google_containers/pause:3.10.1# /etc/containerd/config.toml重启 containerdsudo systemctl restart containerd测试拉取apt install -y cri-tools crictl pull registry.aliyuncs.com/google_containers/pause:3.10.1 crictl images | grep pause执行清理后重新初始化sudo kubeadm reset -f sudo rm -rf /etc/cni/net.d sudo rm -rf /var/lib/cni sudo systemctl restart containerd sudo systemctl restart kubelet初始化成功后终端会输出类似下面的 Worker 加入命令kubeadm join 192.168.5.10:6443 \ --token token \ --discovery-token-ca-cert-hash sha256:hash需要保存下命令。十二、配置 kubectl普通用户mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/configroot用户export KUBECONFIG/etc/kubernetes/admin.conf十三、Worker 节点加入集群sudo kubeadm join 192.168.5.10:6443 --token xxx \ --discovery-token-ca-cert-hash xxx十四、安装 Calico 网络插件建议安装 Calico Open Sourcev3.32.1。Calico 官方已测试支持 Kubernetes 1.36。安装 Tigera Operator 和 CRDkubectl create -f \ https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/v1_crd_projectcalico_org.yaml kubectl create -f \ https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/tigera-operator.yaml检查 Operatorkubectl get pods -n tigera-operator下载并修改 Calico 配置curl -LO \ https://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/custom-resources.yaml查看配置中的 Pod 网段grep -n cidr: custom-resources.yaml修改为sed -i s#192.168.0.0/16#10.244.0.0/16#g \ custom-resources.yaml创建 Calico 资源kubectl create -f custom-resources.yaml查看集群状态kubectl get tigerastatus验证节点状态kubectl get nodes -o wide移除控制平面污点kubectl taint nodes node1 node-role.kubernetes.io/control-plane:NoSchedule-如果遇到calico node event报错calico/node is not ready: BIRD is not ready: BGP not established with 192.168.5.11,192.168.5.12修改Tigera calico网络配置spec: # Configures Calico networking. calicoNetwork: nodeAddressAutodetectionV4: firstFound: false interface: enp1s0应用并重启 calico‑node 使变更生效kubectl apply -f custom-resources.yaml kubectl rollout restart daemonset/calico-node -n calico-system验证kubectl get pods -A -w|grep calico-node十五、测试集群创建测试 Deploymentkubectl create deployment nginx --imagedocker.m.daocloud.io/library/nginx:1.25 kubectl expose deployment nginx --port80 --typeNodePort查看服务kubectl get pods -o wide kubectl get svc nginx访问服务http://192.168.5.10:nodeport