K8s 1.29 集群部署文档

K8s 1.29 集群部署文档

环境信息

节点	IP	角色	主机名
Node01	192.168.80.91	Master (control-plane)	node01
Node02	192.168.80.92	Worker	node02
Node03	192.168.80.93	Worker	node03

• 系统: Rocky Linux 9.8 (Blue Onyx)
• K8s 版本: v1.29.15
• 容器运行时: containerd 2.2.6
• CNI 插件: Flannel
• Pod 网段: 10.244.0.0/16

---

一、前置配置（三台节点都执行）

1.1 关闭 swap

swapoff -a
sed -i '/ swap / s/^/#/' /etc/fstab

1.2 加载内核模块

cat > /etc/modules-load.d/k8s.conf <<EOF
overlay
br_netfilter
EOF
modprobe overlay
modprobe br_netfilter

1.3 设置 sysctl

cat > /etc/sysctl.d/k8s.conf <<EOF
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF
sysctl --system

1.4 关闭防火墙（重要）

systemctl stop firewalld
systemctl disable firewalld
iptables -F

1.5 关闭 SELinux

setenforce 0
sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config

1.6 配置 hosts 解析

cat >> /etc/hosts <<EOF
192.168.80.91 node01
192.168.80.92 node02
192.168.80.93 node03
EOF

---

二、安装 containerd

2.1 安装依赖 & containerd

dnf install -y yum-utils device-mapper-persistent-data lvm2
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
dnf install -y containerd.io

2.2 配置 systemd cgroup driver

mkdir -p /etc/containerd
containerd config default > /etc/containerd/config.toml
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
systemctl enable --now containerd

---

三、安装 kubeadm / kubelet / kubectl（三台节点都执行）

3.1 添加 K8s 仓库

cat > /etc/yum.repos.d/kubernetes.repo <<EOF
[kubernetes]
name=Kubernetes
baseurl=https://pkgs.k8s.io/core:/stable:/v1.29/rpm/
enabled=1
gpgcheck=1
gpgkey=https://pkgs.k8s.io/core:/stable:/v1.29/rpm/repodata/repomd.xml.key
EOF

3.2 安装

dnf install -y kubelet kubeadm kubectl --disableexcludes=kubernetes
systemctl enable --now kubelet

3.3 配置 crictl

cat > /etc/crictl.yaml <<EOF
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 10
EOF

---

四、初始化 Master 节点（仅在 91 执行）

4.1 kubeadm init

kubeadm init \
  --apiserver-advertise-address=192.168.80.91 \
  --pod-network-cidr=10.244.0.0/16 \
  --kubernetes-version=1.29.0

输出中包含 join 命令，形如：

kubeadm join 192.168.80.91:6443 --token <token> \
        --discovery-token-ca-cert-hash sha256:<hash>

4.2 配置 kubectl

mkdir -p $HOME/.kube
cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config

4.3 安装 Flannel CNI

kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml

---

五、Worker 节点加入集群

5.1 获取 join 命令（在 Master 上执行）

kubeadm token create --print-join-command

输出示例：

kubeadm join 192.168.80.91:6443 --token abcdef...123456 \
        --discovery-token-ca-cert-hash sha256:xxxx...

5.2 在 Worker 节点上执行 join

kubeadm join 192.168.80.91:6443 --token <token> \
        --discovery-token-ca-cert-hash sha256:<hash>

---

六、验证集群

6.1 查看节点

kubectl get nodes -o wide

6.2 查看系统 Pod

kubectl get pods -n kube-system -o wide

6.3 部署测试应用

kubectl create deployment nginx --image=nginx --replicas=3
kubectl expose deployment nginx --port=80 --type=NodePort
kubectl get svc nginx

---

七、常见问题

7.1 Worker 节点 NotReady

• 检查防火墙是否关闭：systemctl status firewalld
• 检查 Flannel 是否正常运行：kubectl get pods -n kube-flannel
• 检查 kubelet 日志：journalctl -u kubelet -n 50

7.2 join 失败：no route to host

通常是防火墙导致的。在 Master 上放行端口或直接关闭 firewalld：

systemctl stop firewalld
systemctl disable firewalld

7.3 kubelet 不停重启：config.yaml: no such file or directory

这是正常现象------kubelet 在 kubeadm join 或 kubeadm init 之前没有配置文件。执行对应操作后会自动生成。

7.4 Token 过期

Token 默认有效期 24 小时。过期后重新生成：

kubeadm token create --print-join-command

---

八、附录：一键安装脚本

部署完成后将以下脚本保存为 /root/k8s-prepare.sh，可用于后续克隆的虚拟机快速部署：

#!/bin/bash
set -euo pipefail

# 关闭 swap
swapoff -a
sed -i '/ swap / s/^/#/' /etc/fstab

# 内核模块
cat > /etc/modules-load.d/k8s.conf <<EOF
overlay
br_netfilter
EOF
modprobe overlay; modprobe br_netfilter

# sysctl
cat > /etc/sysctl.d/k8s.conf <<EOF
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF
sysctl --system > /dev/null

# SELinux + 防火墙
setenforce 0 || true
sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config
systemctl stop firewalld 2>/dev/null || true
systemctl disable firewalld 2>/dev/null || true
iptables -F 2>/dev/null || true

# containerd
dnf install -y -q yum-utils device-mapper-persistent-data lvm2
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
dnf install -y -q containerd.io
mkdir -p /etc/containerd
containerd config default > /etc/containerd/config.toml
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
systemctl enable --now containerd

# K8s 1.29 组件
cat > /etc/yum.repos.d/kubernetes.repo <<EOF
[kubernetes]
name=Kubernetes
baseurl=https://pkgs.k8s.io/core:/stable:/v1.29/rpm/
enabled=1
gpgcheck=1
gpgkey=https://pkgs.k8s.io/core:/stable:/v1.29/rpm/repodata/repomd.xml.key
EOF
dnf install -y -q kubelet kubeadm kubectl --disableexcludes=kubernetes
systemctl enable --now kubelet

cat > /etc/crictl.yaml <<EOF
runtime-endpoint: unix:///run/containerd/containerd.sock
timeout: 10
EOF

# hosts
cat >> /etc/hosts <<HOSTSEOF
192.168.80.91 node01
192.168.80.92 node02
192.168.80.93 node03
HOSTSEOF

echo "K8s 1.29 节点准备完成！"