K8s集群离线环境Kubeadm安装部署管理实操技术栈kubeadm v1.32.13 Kubernetes v1.32.13 Rocky Linux 8.6 Containerd 1.7.x Calico操作环境 / 对接原理 / 详细步骤 / 完整命令 / 配置文件 / 验证流程 / 排错方案K8s集群离线环境Kubeadm安装部署管理实操操作环境K8s 集群版本 v1.32.13kubeadm 初始化操作系统 Rocky Linux 8.6内核 4.18.x容器运行时 Containerd 1.7.13已配置 systemd cgroup3 Master 3 Worker高可用架构网络插件 Calico v3.27.xPod CIDR 10.244.0.0/16离线镜像仓库 Harbor已预加载 K8s 组件镜像root 权限主机名解析正常时间同步对接原理kubeadm 是官方推荐的 K8s 集群部署工具通过 init/join/upgrade/reset 等子命令管理集群生命周期。kubeadm init 在 Master 节点生成证书CA/apiserver/etcd/front-proxy、静态 Pod 清单apiserver/controller-manager/scheduler/etcd、kubeconfig 文件admin/controller-manager/scheduler/kubelet、ConfigMapkubeadm-config/kubelet-config并启动控制平面。kubeadm join 通过 bootstrap token 向 apiserver 认证获取集群信息配置 kubelet 并加入集群。高可用部署需外部 etcd 或堆叠 etcd 负载均衡HAProxy/Keepalivedapiserver 指向 VIP。证书默认有效期1年可用 kubeadm certs renew 续期CA 证书10年。升级流程kubeadm upgrade plan 检查 - kubeadm upgrade applyMaster- kubeadm upgrade nodeWorker- 升级 kubelet/kubectl。详细步骤1. 系统初始化# 关闭防火墙 systemctl stop firewalld systemctl disable firewalld # 关闭SELinux setenforce 0 sed -i s/^SELINUXenforcing$/SELINUXpermissive/ /etc/selinux/config # 关闭Swap swapoff -a sed -i /swap/d /etc/fstab # 内核参数 cat /etc/sysctl.d/k8s.conf EOF net.bridge.bridge-nf-call-ip6tables 1 net.bridge.bridge-nf-call-iptables 1 net.ipv4.ip_forward 1 EOF sysctl --system # 加载ipvs模块 cat /etc/sysconfig/modules/ipvs.modules EOF #!/bin/bash modprobe -- ip_vs modprobe -- ip_vs_rr modprobe -- ip_vs_wrr modprobe -- ip_vs_sh modprobe -- nf_conntrack EOF chmod 755 /etc/sysconfig/modules/ipvs.modules bash /etc/sysconfig/modules/ipvs.modules # 时间同步 yum install -y chrony systemctl enable --now chronyd2. 安装Containerd和kubeadm# 安装Containerd yum install -y yum-utils yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo yum install -y containerd.io containerd config default /etc/containerd/config.toml sed -i s/SystemdCgroup false/SystemdCgroup true/ /etc/containerd/config.toml sed -i s#registry.k8s.io#harbor.example.com/k8s# /etc/containerd/config.toml systemctl enable --now containerd # 安装kubeadm/kubelet/kubectl cat /etc/yum.repos.d/kubernetes.repo EOF [kubernetes] nameKubernetes baseurlhttps://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/ enabled1 gpgcheck0 repo_gpgcheck0 EOF yum install -y kubelet-1.32.13 kubeadm-1.32.13 kubectl-1.32.13 systemctl enable kubelet # 配置crictl crictl config runtime-endpoint unix:///run/containerd/containerd.sock3. kubeadm init初始化集群# 预拉取镜像 kubeadm config images pull --image-repository harbor.example.com/k8s --kubernetes-version v1.32.13 # 初始化集群 kubeadm init \ --kubernetes-version v1.32.13 \ --apiserver-advertise-address10.0.0.10 \ --control-plane-endpoint10.0.0.100:6443 \ --pod-network-cidr10.244.0.0/16 \ --service-cidr10.96.0.0/12 \ --image-repository harbor.example.com/k8s \ --cri-socketunix:///run/containerd/containerd.sock \ --upload-certs # 配置kubectl mkdir -p $HOME/.kube cp -i /etc/kubernetes/admin.conf $HOME/.kube/config chown $(id -u):$(id -g) $HOME/.kube/config # 安装Calico kubectl apply -f https://docs.projectcalico.org/v3.27/manifests/calico.yaml # 查看节点 kubectl get nodes验证流程# 1. 验证节点状态 kubectl get nodes # 所有节点Ready # 2. 验证系统Pod kubectl get pods -n kube-system # 核心组件Running # 3. 验证网络 kubectl get pods -n kube-system | grep calico # 4. 验证DNS kubectl run dns-test --imagebusybox --restartNever -- nslookup kubernetes # 5. 验证证书 kubeadm certs check-expiration # 6. 验证版本 kubectl version --short kubeadm version排错方案kubeadm init失败检查端口6443/10250/2379是否被占用镜像是否可拉取--image-repositorycgroup驱动是否一致systemdswap是否关闭内核参数是否配置节点join失败检查token是否有效kubeadm token listCA hash是否正确网络是否可达Master VIP防火墙是否放行cri-socket是否正确证书过期kubeadm certs check-expiration查看kubeadm certs renew all续期重启控制平面静态Pod更新admin.conf注意CA证书10年有效期升级失败先kubeadm upgrade plan检查兼容性逐个节点升级Worker升级前cordondrainkubeadm和kubelet版本匹配升级后重启kubeletetcd故障检查etcd静态Pod是否Runningetcd数据目录/var/lib/etcdetcdctl endpoint health磁盘空间是否充足多Master时etcd集群是否健康apiserver不启动检查证书是否有效etcd是否可达--advertise-address是否正确端口是否被占用查看apiserver日志高可用VIP不漂移检查Keepalived配置state/priority/virtual_router_idHAProxy后端健康检查防火墙放行VRRP协议节点间网络连通重置不干净kubeadm reset后清理iptables/ipvs/CNI/kubelet数据容器运行时数据必要时重启节点重新join前确保完全清理