保姆级 Kubernetes 部署教程｜从原理到三节点集群落地

2401_834636992026-08-07 23:17

Kubernetes 介绍

应用部署发展过程

  • 传统部署时代：企业直接在物理服务器上运行应用程序，无法为单台物理机内的应用划分资源边界，极易引发资源争抢问题。例如单台物理机部署多套应用时，某一个应用会抢占绝大多数硬件资源，导致其余应用运行性能严重下降。虽可通过单台服务器仅部署一套应用的方式规避问题，但该方案硬件资源利用率极低，横向扩展能力受限，同时企业维护大量物理服务器的综合成本居高不下。

  • 虚拟化部署时代 ：虚拟化技术作为优化方案应运而生，支持在单台物理服务器的 CPU 硬件上同时运行多台独立虚拟机（VM）。虚拟化机制可实现虚拟机之间的资源与数据隔离，具备基础安全防护能力，不同应用的数据无法跨虚拟机随意访问。依托虚拟化技术，硬件资源利用率得到显著提升，应用新增、迭代更新流程更简便，硬件投入成本降低，整体业务伸缩性更强。每一台虚拟机都是完整独立的计算单元，需要在虚拟硬件层之上完整运行整套操作系统及配套组件。

  • 容器部署时代：容器的设计思路与虚拟机相似，但轻量化隔离特性更突出，多个容器可共享宿主机操作系统内核，因此容器被定义为轻量化运行单元。容器同样拥有独立文件系统、CPU、内存、进程命名空间等资源，且与底层硬件基础设施解耦，能够跨云平台、跨操作系统分发部署。

    容器凭借多重核心优势快速普及，核心优势整理如下：

    • 应用快速构建与交付：对比虚拟机镜像，容器镜像的制作流程更简洁、构建效率大幅提升。
    • 持续集成与持续部署：依托镜像不可变特性，支持快速、可靠的高频构建与发布，故障回滚操作简单高效。
    • 开发运维职责解耦：应用容器镜像在构建、发布阶段完成打包，实现业务程序与底层基础设施完全分离。
    • 多环境一致性：开发、测试、生产环境运行逻辑完全统一，本地笔记本与云端集群运行效果无差异。
    • 跨平台可移植：可兼容 Ubuntu、RHEL、CoreOS 等各类 Linux 发行版，同时支持本地机房、Google Kubernetes Engine 等公有云环境部署。
    • 以应用为核心的管理模式：提升资源抽象层级，管理对象从 "虚拟硬件 + 操作系统" 转变为 "操作系统上独立运行的业务应用"。
    • 适配微服务架构：天然支持松耦合、分布式、弹性扩缩的微服务体系，业务拆分为独立子模块后可动态调度、独立运维，无需整体打包部署。
    • 资源强隔离：资源配额管控精准，保障应用运行性能稳定可预期。
    • 硬件高利用率：资源调度密度更高，硬件成本消耗更低。

Kubernetes 前世今生

Kubernetes 一词源自希腊语，本义为 "舵手" 或 "领航员"。行业缩写 K8s 的由来是省略中间 8 个字母 "ubernete"，以数字 8 替代简写。

谷歌数据中心常年承载超 20 亿容器实例，容器技术落地已有十余年历史。谷歌内部最早自研 Borg 调度系统（后迭代更名为 Omega），用于大规模容器与业务负载调度。在沉淀多年生产实践经验后，谷歌重构这套容器管理平台并开源，向全行业共享技术能力，该开源项目即为 Kubernetes（K8s）。简单概括，Kubernetes 是谷歌内部 Omega 系统的开源实现版本。

2014 年 6 月，谷歌云计算专家埃里克・布鲁尔（Eric Brewer）于旧金山发布会正式发布这款开源容器编排工具。

2015 年 5 月，Kubernetes 全网搜索热度超越 Mesos、Docker Swarm，此后热度持续大幅领先其余容器编排方案。

2015 年 7 月 22 日，K8s 迭代至 v1.0 版本并正式对外商用发布。

2017 年 9 月，Mesosphere 官方宣布全面兼容 Kubernetes；同年 10 月，Docker 新版本原生内置 Kubernetes 支持。至此容器编排领域三足鼎立的竞争格局终结，Kubernetes 成为行业主流标准。

当前 AWS、Azure、谷歌云、阿里云、腾讯云等主流公有云，均提供基于 Kubernetes 的容器托管服务；Rancher、CoreOS、IBM、Mirantis、Oracle、Red Hat、VMWare 等厂商，也深度研发、推广基于 Kubernetes 的容器 CaaS、PaaS 产品。Kubernetes 已成为容器生态领域最核心、应用最广泛的技术体系。

Kubernetes 是什么

官方介绍

Kubernetes，简称 K8s，是一款开源系统，用于容器化应用的自动化部署、弹性扩缩容与全生命周期管理。

它可将构成整套业务的多个容器整合为逻辑管理单元，简化运维操作，同时提供内置服务发现能力。

Kubernetes 特性

  • 自动化上线和回滚：Kubernetes 分批次灰度发布应用或配置变更，同步持续监测业务运行健康状态，避免业务实例一次性全部下线；若发布过程出现故障，平台自动执行变更回滚。配套丰富的部署扩展工具生态可充分落地各类发布策略。
  • 服务发现与负载均衡：应用无需适配额外第三方服务发现组件即可原生使用该能力。平台为每个 Pod 分配独立 IP，为一组同类 Pod 绑定统一 DNS 域名，同时内置流量负载均衡机制。
  • 存储编排：支持自动挂载各类存储介质，涵盖本地服务器磁盘、公有云厂商托管存储、iSCSI、NFS 等网络分布式存储。
  • Secret 和配置管理：应用配置、敏感密钥可独立更新部署，无需重新构建容器镜像，同时避免账号、密钥等敏感信息硬编码暴露。
  • 自动装箱：依据容器资源申请配额、调度约束自动分配节点，保障业务可用性；可混合部署核心业务与低优先级任务，提升服务器资源整体利用率，降低硬件投入。
  • 批量执行：除长期运行的在线服务外，平台同时支持批处理任务、CI 流水线作业，可自动替换运行异常的容器实例。
  • 自我修复：自动重启运行崩溃的容器；故障严重时直接替换异常 Pod；存储故障场景自动重新挂载存储卷；配合节点自动扩缩组件，实现集群节点层级故障自愈。
  • 水平扩缩：支持命令行、可视化面板手动扩容缩容，也可基于 CPU 使用率等监控指标自动调整应用实例数量。
  • IPv4/IPv6 双协议栈：可为 Pod、Service 同时分配 IPv4 与 IPv6 双栈网络地址。
  • 扩展性设计：无需修改 Kubernetes 上游源代码，即可基于扩展接口自定义集群能力。

Kubernetes 不是什么？

Kubernetes 不属于传统意义上的 PaaS（平台即服务）产品。

  • Kubernetes 不限制应用类型、开发框架，兼容 Java、Python、Ruby 等各类编程语言运行时，完全适配 12 要素应用规范，不区分普通应用与微服务。支持全类型业务负载，包含无状态服务、有状态应用、大数据批处理任务，只要业务能够打包为容器镜像，即可在 Kubernetes 集群正常运行。
  • Kubernetes 未内置消息中间件（消息队列）、大数据计算框架（Spark）、数据库（MySQL）、分布式存储（Ceph）等组件，但上述中间件均可以容器形式部署于 Kubernetes 之上。
  • Kubernetes 不提供源代码编译、应用构建能力。持续集成（CI）流水线属于用户自定义场景，不同团队存在差异化需求，因此 Kubernetes 仅提供分层 CI 对接能力，不强制规范流水线实现方式。
  • Kubernetes 允许用户自主选择日志采集、监控告警系统，无强制绑定组件。
  • Kubernetes 不内置、不强制统一的应用配置语法或配置管理工具（例如 jsonnet）。
  • Kubernetes 不提供物理服务器初始化、运维、底层硬件自愈相关能力。

PaaS 是（Platform as a Service）的缩写，即平台即服务。云计算体系中，将服务器运行平台、开发环境封装为对外交付的服务形态，即为 PaaS。典型 PaaS 产品提供标准化开发框架，开发人员基于框架快速搭建、自定义云原生应用，类似 Excel 内置宏工具，封装了可复用业务组件，内置弹性扩容、高可用、多租户等云原生能力，大幅减少重复代码开发工作量。

Kubernetes 架构

一套 Kubernetes 集群由多台名为 node 的服务器节点组成，集群内所有容器化业务均运行在节点之上。集群最低部署标准为 1 台master 控制节点搭配 1 台worker工作节点。

控制平面的组件

控制平面组件（Control Plane Components） 负责集群全局决策（如 Pod 调度），同时持续监测、响应集群各类事件（例如部署副本数不达标时自动新建 Pod）。

控制平面组件可部署在集群任意节点；常规部署脚本会将全部控制平面组件部署至同一台服务器，且该服务器默认不运行用户业务容器。

  • kube-apiserver：部署于 master 节点，对外提供标准化 Kubernetes API 接口，是控制平面统一入口。各类客户端工具（命令行、可视化界面）与集群内部其余组件，均通过该组件完成集群资源的增删改查操作。
  • kube-scheduler：部署于 master 节点，依据预设调度策略，将待创建 Pod 分配至匹配条件的工作节点。
  • kube-controller-manager：部署于 master 节点，持续维护集群预期状态，包含故障检测、应用自动扩缩、滚动更新等核心管控能力。
  • etcd：具备强一致性、高可用特性的键值数据库，集群全部配置、资源数据均持久化存储于此，是集群底层数据存储核心。

Worker组件

Worker组件在每个节点上运行（包括master节点），维护运行的 Pod 并提供 Kubernetes 运行环境。

  • kubelet ，集群中每个节点上都需要运行的代理，负责维护容器的生命周期，同时也负责Volume（CVI）和网络（CNI）的管理。kubelet 接收一组通过各类机制提供给它的 PodSpecs，确保这些 PodSpecs 中描述的容器处于运行状态且健康。
  • kube-proxy，集群中每个节点上运行的网络代理，负责为Service提供cluster内部的服务发现和负载均衡。kube-proxy 维护节点上的网络规则。这些网络规则允许从集群内部或外部的网络会话与 Pod 进行网络通信。
  • 容器运行环境(Container Runtime)，容器运行环境，负责镜像管理以及Pod和容器的真正运行（CRI）。Kubernetes 支持多个容器运行环境: Dkubectlker、 containerd、cri-o、 rktlet 以及任何实现 Kubernetes CRI (容器运行环境接口)。

插件(Addons)

插件(Addons)使用 Kubernetes 资源 (DaemonSet , Deployment 等) 实现集群功能，插件资源属于 kube-system 命名空间。包涵如下插件：

  • kubedns，一个 DNS 服务器，为 Kubernetes 服务提供 DNS 记录。
  • 用户界面(Dashboard)，为Kubernetes 集群提供Web UI。它使用户可以管理集群中运行的应用程序以及集群本身并进行故障排除。
  • 容器资源监控，将关于容器的一些常见的时间序列度量值保存到一个集中的数据库中，并提供用于浏览这些数据的界面。例如Heapster。
  • 集群层面日志，负责将容器的日志数据保存到一个集中的日志存储中，该存储能够提供搜索和浏览接口。例如，Fluentd-elasticsearch。
  • 网络插件 ，是实现容器网络接口（CNI）规范的软件组件。它们负责为 Pod 分配 IP 地址，并使这些 Pod 能在集群内部相互通信。

为什么master上也有kubelet和kube-proxy呢？

因为Master同时也是一个worker。

Master上也可以运行应用，几乎所有的Kubernetes组件本身都运行在Pod里 。例如etcd，kube-apiserver，kube-controller-manager等。

kubelet是唯一没有以容器形式运行的Kubernetes组件。

Kubernetes 安装

生产环境说明

安装方式

安装方式 核心特点 难度 适用场景 优点 缺点 推荐指数
kubeadm 官方标准、无魔改 中等 生产自建、CKA/CKAD考试、标准集群 兼容性强、易升级、生态完善、文档全 步骤较多，需手动配置运行时/网络 ⭐⭐⭐⭐⭐
二进制手工部署 全手动、底层可控 极高 原理研究、深度定制、教学演示 掌控所有组件、无任何封装 极易出错、升级繁琐、维护成本高 ⭐⭐
Sealos / KubeKey 一键部署、高可用 低 快速搭建生产/测试环境 命令简单、自动装依赖、自带插件 轻度封装，不如 kubeadm 透明 ⭐⭐⭐⭐
k3s / k0s 轻量、单二进制 低 边缘节点、低配机器、开发测试 占用小、启动快、自带 containerd/ingress 裁剪版，部分高级特性有差异 ⭐⭐⭐⭐
minikube / kind / k3d 单机实验环境 极低 本地开发、快速验证、学习调试 一键启动、环境干净 不能模拟真实多节点生产集群 ⭐⭐⭐
云厂商托管（ACK/EKS等） Master 托管、免运维 低 云上生产业务 高可用、自动升级、无需维护控制面 成本高、受厂商限制 ⭐⭐⭐⭐
RKE / OpenShift 企业发行版 中高 大型企业、有商业化支持需求 生态成熟、技术支持完善 重、学习成本高、商用成本高 ⭐⭐⭐

选择建议：

  • 学习 + 未来上生产：优先 kubeadm
  • 快速搭建、不想折腾：Sealos
  • 本地测试/开发：k3s 或 minikube
  • 边缘/低配机器：k3s

环境说明

软件清单

  • vmware workstation 17

  • ubuntu-24.04-live-server-amd64

  • kubeadm 1.30.2

  • kubernetes 1.30.2

  • containerd.io=1.7.20-1

  • nerdctl-1.7.7-linux-amd64

  • cni-plugins-linux-amd64-v1.6.0

虚拟机硬件配置

  • 2 核 CPU
  • 4G 内存
  • 1 块 NAT 模式网卡
  • 1 块 100G 容量硬盘

节点规划

节点 IP 角色
master30.liu.cloud 10.1.8.30 master
worker31.liu.cloud 10.1.8.31 work
worker32.liu.cloud 10.1.8.32 work

准备模板

系统准备

安装系统

采用 Ubuntu 2404 最小化系统安装，无需划分 swap 交换分区，磁盘分区规范如下：

  • /boot 分区 2G
  • / 根分区 90G
配置仓库源

将操作系统软件源替换为华为云镜像源，提升软件下载速度。

bash 复制代码 
root@ubuntu2404 ~ 10:32:38# cat > /etc/apt/sources.list.d/ubuntu.sources <<'EOF'
Types: deb
URIs: http://mirrors.huaweicloud.com/ubuntu/
Suites: noble noble-updates noble-backports
Components: main restricted universe multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
#Types: deb
#URIs: http://security.ubuntu.com/ubuntu/
#Suites: noble-security
#Components: main restricted universe multiverse
#Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
EOF

containerd 软件源配置

bash 复制代码 
# 导入 containerd 仓库公钥
root@ubuntu2404 ~ 10:33:57# curl -fsSL https://mirrors.huaweicloud.com/docker-ce/linux/ubuntu/gpg | gpg --dearmour -o /etc/apt/trusted.gpg.d/containerd.gpg
# 添加 containerd 软件源
root@ubuntu2404 ~ 10:34:07# cat << 'EOF' > /etc/apt/sources.list.d/docker-ce.list
deb [arch=amd64] https://mirrors.huaweicloud.com/docker-ce/linux/ubuntu noble stable
EOF

Kubernetes 官方调整了软件仓库存储路径与配置规范，1.28 及以上版本必须采用新版配置方式。

本文示例基于 1.30 版本配置，如需切换其他版本，仅需将配置内 v1.30 字符串替换为对应版本号。例如安装 1.29 版本，全局替换 v1.30 为 v1.29 即可。

当前镜像源支持 v1.24 至 v1.35 全系列版本，后续新版本会持续同步更新。

bash 复制代码 
# 导入 kubernetes 仓库公钥
root@ubuntu2404 ~ 10:35:57# curl -fsSL https://mirrors.huaweicloud.com/docker-ce/linux/ubuntu/gpg | gpg --dearmour -o /etc/apt/trusted.gpg.d/containerd.gpg
# 配置 kubernetes 软件源
root@ubuntu2404 ~ 10:37:38# echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.30/deb/ /" > /etc/apt/sources.list.d/kubernetes.list
安装基础软件包
bash 复制代码 
root@ubuntu2404 ~ 10:37:48# apt update && apt install -y vim lrzsz bash-completion open-vm-tools apt-transport-https sshpass
# vim：功能完备的终端文本编辑器，用于修改各类系统、业务配置文件、代码编辑。
# lrzsz：适配Xshell工具，支持本地与服务器文件快速上传、下载。
# bash-completion：命令行自动补全工具，按下Tab键可自动补全命令、参数、文件路径。
# open-vm-tools：VMware虚拟机配套工具，实现宿主机虚拟机时间同步、文件拖拽、窗口分辨率自适应等能力。
# apt-transport-https：扩展apt工具支持HTTPS协议拉取软件包，用于访问加密镜像源。
# sshpass：无交互SSH登录工具，命令行可直接携带密码登录远程服务器，多用于自动化脚本编写。
设置 IP
bash 复制代码 
root@ubuntu2404 ~ 10:37:50# mkdir /etc/netplan/origin
root@ubuntu2404 ~ 10:38:01# mv /etc/netplan/*yaml /etc/netplan/origin
root@ubuntu2404 ~ 10:38:20# cat > /etc/netplan/00-static.yaml <<EOF
network:
  ethernets:
    ens33:
      dhcp4: no
      addresses:
        - 10.1.8.30/24
      routes:
        - to: default
          via: 10.1.8.2
      nameservers:
        addresses:
          - 10.1.8.2
          - 223.5.5.5
  version: 2
EOF
root@ubuntu2404 ~ 10:38:25# chmod 600 /etc/netplan/00-static.yaml
root@ubuntu2404 ~ 10:38:48# netplan apply
设置 /etc/hosts
bash 复制代码 
root@ubuntu2404 ~ 10:39:24# vim /etc/hosts
###### kubernetes 集群节点解析 #####
10.1.8.30 master30.liu.cloud master30
10.1.8.31 worker31.liu.cloud worker31
10.1.8.32 worker32.liu.cloud worker32
关闭 swap

集群运行不允许启用 swap 交换分区，若系统存在 swap 分区需完全关闭。

bash 复制代码 
root@ubuntu2404 ~ 10:40:56#  swapoff -a && sed -i '/^.*swap/d' /etc/fstab
root@ubuntu2404 ~ 10:41:32# rm -f /swap.img
配置对时服务
bash 复制代码 
root@ubuntu2404 ~ 10:41:39# apt-get install -y chrony
# 以下步骤可按需执行
root@ubuntu2404 ~ 10:41:58# systemctl enable chrony --now
Synchronizing state of chrony.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable chrony
设置 ssh
bash 复制代码 
# 关闭SSH服务端反向DNS解析，消除客户端连接等待延迟
root@ubuntu2404 ~ 10:42:12#  echo 'UseDNS no' >> /etc/ssh/sshd_config
# 关闭SSH客户端服务器公钥校验，避免首次连接手动输入确认指令
root@ubuntu2404 ~ 10:42:24# echo 'StrictHostKeyChecking no' >> /etc/ssh/ssh_config
# 生成SSH免密登录密钥对
root@ubuntu2404 ~ 10:42:40# ssh-keygen -N '' -f ~/.ssh/id_rsa -t rsa
Generating public/private rsa key pair.
/root/.ssh/id_rsa already exists.
Overwrite (y/n)? y
Your identification has been saved in /root/.ssh/id_rsa
Your public key has been saved in /root/.ssh/id_rsa.pub
The key's fingerprint is:
SHA256:ULs0jdtm3WpBt0f6agt47ciiTYD9fZGhg2MWlt8FTr0 root@ubuntu2404.liu.cloud
The key's randomart image is:
+---[RSA 3072]----+
|        .     o. |
|       . + . o ..|
|      . = = . + +|
|       = * * = E |
|      . S O * B .|
|         B + = + |
|          + * o .|
|         o.+ =.. |
|        ....o.+. |
+----[SHA256]-----+
# 配置本机免密登录，将password替换为服务器实际密码
root@ubuntu2404 ~ 10:42:50# sshpass -p 123 ssh-copy-id root@localhost
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Number of key(s) added: 1
Now try logging into the machine, with:   "ssh 'root@localhost'"
and check to make sure that only the key(s) you wanted were added.
配置 IPVS
bash 复制代码 
# 1. 安装 IPVS 依赖工具包
root@ubuntu2404 ~ 10:43:21# apt install -y iptables ipvsadm ipset conntrack
# 2-1. 临时加载基础网络内核模块，即时生效
root@ubuntu2404 ~ 10:44:07# modprobe overlay
root@ubuntu2404 ~ 10:44:19# modprobe br_netfilter
# 模块功能说明：
# br_netfilter：允许Linux网桥设备通过iptables进行流量过滤，是Kubernetes网络互通的必要组件。
# overlay：Overlay分层文件系统内核模块，containerd、Docker等容器运行时镜像分层存储依赖该模块。
# 2-2. 临时加载IPVS全套内核模块，即时生效
root@ubuntu2404 ~ 10:44:30# modprobe ip_vs
root@ubuntu2404 ~ 10:44:40# modprobe ip_vs_rr
root@ubuntu2404 ~ 10:44:45# modprobe ip_vs_wrr
root@ubuntu2404 ~ 10:44:48# modprobe ip_vs_lc
root@ubuntu2404 ~ 10:44:55# modprobe ip_vs_sh
root@ubuntu2404 ~ 10:44:58# modprobe nf_conntrack
# 模块功能说明：
# ip_vs：IPVS四层负载均衡核心模块，kube-proxy使用ipvs模式的底层依赖。
# ip_vs_rr：IPVS轮询调度算法，请求按顺序依次分发至后端服务实例。
# ip_vs_wrr：加权轮询调度，依据后端节点权重分配流量，适配性能不均的节点集群。
# ip_vs_lc：最少连接调度，优先将请求转发至当前连接数最少的后端实例。
# ip_vs_sh：源地址哈希调度，保证同一客户端IP持续访问同一后端实例，适配会话保持场景。
# nf_conntrack：网络连接跟踪模块，记录全量网络连接状态，保障数据包正常转发。
# 3 配置永久加载内核模块，服务器重启后自动生效
# systemd-modules-load.service 开机自动读取该配置文件加载模块
root@ubuntu2404 ~ 10:45:22# cat > /etc/modules-load.d/k8s-net.conf 
<< EOF
# K8s 基础网络依赖模块
br_netfilter
overlay
# IPVS 负载均衡所需模块
ip_vs
ip_vs_rr
ip_vs_wrr
ip_vs_lc
ip_vs_sh
nf_conntrack
EOF
配置其他内核参数
bash 复制代码 
# 配置内核网络参数，开启网桥IPv4流量转发至iptables链
root@ubuntu2404 ~ 10:46:24# cat > /etc/sysctl.d/k8s.conf << 'EOF'
net.bridge.bridge-nf-call-iptables=1  
net.bridge.bridge-nf-call-ip6tables=1
net.ipv4.ip_forward=1
vm.swappiness=0
EOF
# 内核参数说明：
# net.bridge.bridge-nf-call-iptables=1：开启网桥流量iptables过滤能力
# net.bridge.bridge-nf-call-ip6tables=1：开启IPv6网桥流量ip6tables过滤能力
# net.ipv4.ip_forward=1：开启服务器IPv4数据包路由转发功能
# vm.swappiness=0：完全禁用swap交换分区使用
# 加载内核参数，配置立即生效
root@ubuntu2404 ~ 10:47:19# sysctl -p /etc/sysctl.d/k8s.conf 
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
vm.swappiness = 0

k8s 环境预配置

配置 containerd
bash 复制代码 
root@ubuntu2404 ~ 10:53:59# apt-get install -y containerd.io=1.7.20-1 cri-tools
# 指定crictl工具默认对接的容器运行时地址
root@ubuntu2404 ~ 10:54:20# crictl config runtime-endpoint unix:///var/run/containerd/containerd.sock
root@ubuntu2404 ~ 10:54:26# containerd config default > /etc/containerd/config.toml
# 修改配置：开启systemd cgroup驱动、指定pause基础镜像
root@ubuntu2404 ~ 10:54:34# sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
root@ubuntu2404 ~ 10:54:45# sed -i 's|sandbox_image = ".*"|sandbox_image = "registry.k8s.io/pause:3.9"|' /etc/containerd/config.toml
# 配置容器镜像仓库加速源
root@ubuntu2404 ~ 11:11:36# vim /etc/containerd/config.toml
bash 复制代码 
# 定位configs配置段落
      [plugins."io.containerd.grpc.v1.cri".registry.configs]
        # 新增私有仓库证书配置，注意缩进层级匹配
        [plugins."io.containerd.grpc.v1.cri".registry.configs."hub.laoma.cloud".tls]
          insecure_skip_verify = true
......
# 定位mirrors镜像加速段落
      [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
        # 为docker.io配置多组国内加速节点，缩进严格对齐
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
          endpoint = ["https://docker.m.daocloud.io","https://09def58152000fc00ff0c00057bad7e0.mirror.swr.myhuaweicloud.com"]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."registry.k8s.io"]
          endpoint = ["https://k8s.m.daocloud.io","https://09def58152000fc00ff0c00057bad7e0.mirror.swr.myhuaweicloud.com"]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."hub.laoma.cloud"]
          endpoint = ["http://hub.laoma.cloud"]
bash 复制代码 
# 重启containerd服务加载新配置
root@ubuntu2404 ~ 11:23:59# systemctl restart containerd.service
# containerd服务默认设置开机自启，安装完成后自动运行

crictl 工具基于 containerd CRI 接口 交互，读取 /etc/containerd/config.toml 内 registry.mirrors 镜像加速配置。

镜像拉取测试：

bash 复制代码 
oot@ubuntu2404 ~ 11:24:44# crictl pull busybox
Image is up to date for sha256:c6348fa86ba0fb2108c9334f5fe913ddc6d853313e655891f133a0127c30099f
root@ubuntu2404 ~ 11:25:11# crictl pull registry.k8s.io/pause:3.9
Image is up to date for sha256:e6f1816883972d4be47bd48879a08919b96afcd344132622e4d444987919323c
root@ubuntu2404 ~ 11:25:20# crictl pull hub.laoma.cloud/library/busybox
Image is up to date for sha256:c6348fa86ba0fb2108c9334f5fe913ddc6d853313e655891f133a0127c30099f
安装 nerdctl 和 cni plugin

nerdctl 开源项目地址：https://github.com/containerd/nerdctl/releases

cni 插件开源项目地址：https://github.com/containernetworking/plugins/releases

bash 复制代码 
# 下载并解压安装nerdctl工具
root@ubuntu2404 ~ 11:25:24# wget http://192.168.46.200/class/course-materials/softwares/stage03/nerdctl-1.7.7-linux-amd64.tar.gz
root@ubuntu2404 ~ 11:25:34# tar -xf nerdctl-1.7.7-linux-amd64.tar.gz -C /usr/bin/
# 下载nerdctl依赖的CNI网络插件
root@ubuntu2404 ~ 11:25:41# wget http://192.168.46.200/class/course-materials/softwares/stage03/cni-plugins-linux-amd64-v1.6.0.tgz
root@ubuntu2404 ~ 11:25:49# mkdir -p /opt/cni/bin
root@ubuntu2404 ~ 11:26:05# tar -xf cni-plugins-linux-amd64-v1.6.0.tgz -C /opt/cni/bin

nerdctl 直接调用 containerd 原生 API，不会复用 CRI 专属镜像加速配置，需要独立配置镜像源规则。

nerdctl 拥有专属配置目录，需单独配置 Docker Hub 镜像加速。

bash 复制代码 
# 配置docker.io镜像仓库加速规则
mkdir -p /etc/containerd/certs.d/docker.io
cat > /etc/containerd/certs.d/docker.io/hosts.toml << EOF
server = "https://registry-1.docker.io"
[host."https://docker.m.daocloud.io"]
  capabilities = ["pull", "resolve"]
[host."https://09def58152000fc00ff0c00057bad7e0.mirror.swr.myhuaweicloud.com"]
  capabilities = ["pull", "resolve"]
EOF
# 配置registry.k8s.io镜像仓库加速规则
mkdir -p /etc/containerd/certs.d/registry.k8s.io
cat > /etc/containerd/certs.d/registry.k8s.io/hosts.toml << EOF
server = "https://registry.k8s.io"
[host."https://k8s.m.daocloud.io"]
  capabilities = ["pull", "resolve"]
[host."https://registry.cn-hangzhou.aliyuncs.com/google_containers"]
  capabilities = ["pull", "resolve"]
  override_path = true
EOF
# 配置私有仓库hub.laoma.cloud访问规则
mkdir -p /etc/containerd/certs.d/hub.laoma.cloud
cat > /etc/containerd/certs.d/hub.laoma.cloud/hosts.toml << EOF
server = "http://hub.laoma.cloud"
[host."http://hub.laoma.cloud"]
  capabilities = ["pull", "resolve"]
EOF

镜像拉取验证：

bash 复制代码 
root@ubuntu2404 ~ 11:27:03# nerdctl pull busybox
docker.io/library/busybox:latest: resolving      |--------------------------------------| 
elapsed: 0.1 s                    total:   0.0 B (0.0 B/s)                                         
docker.io/library/busybox:latest: resolving      |--------------------------------------| 
elapsed: 0.2 s                    total:   0.0 B (0.0 B/s)                                         
+++++++++++++++++++++++++++++++++++++| 
index-sha256:dc2d74b28e4cf8984fa52af1f39bc7c3d9c73760b41a74d629f5d11b1ab28616:    done           |++++++++++++++++++++++++++++++++++++++| 
manifest-sha256:1cfa4e2b09e127b9c4ed43578d3f3c18e7d44ea47b9ea98475c0cbe9086525f8: done           |++++++++++++++++++++++++++++++++++++++| 
config-sha256:c6348fa86ba0fb2108c9334f5fe913ddc6d853313e655891f133a0127c30099f:   done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:b05093807bb0294152bb9cf86d64da722732dddaf7f8882fa1f120477dbc4db3:    done           |++++++++++++++++++++++++++++++++++++++| 
elapsed: 0.3 s                                                                    total:   0.0 B (0.0 B/s)                                         
root@ubuntu2404 ~ 11:27:20# nerdctl pull registry.k8s.io/pause:3.9
registry.k8s.io/pause:3.9: resolving      |--------------------------------------| 
elapsed: 0.1 s             total:   0.0 B (0.0 B/s)                                         
registry.k8s.io/pause:3.9: resolving      |--------------------------------------| 
elapsed: 0.2 s             total:   0.0 B (0.0 B/s)                                         
registry.k8s.io/pause:3.9: resolving      |--------------------------------------| 
elapsed: 0.3 s             total:   0.0 B (0.0 B/s)                                         
registry.k8s.io/pause:3.9: resolving      |--------------------------------------| 
elapsed: 0.4 s             total:   0.0 B (0.0 B/s)                                         
registry.k8s.io/pause:3.9: resolving      |--------------------------------------| 
elapsed: 0.5 s             total:   0.0 B (0.0 B/s)                                         
registry.k8s.io/pause:3.9: resolving      |--------------------------------------| 
elapsed: 0.6 s             total:   0.0 B (0.0 B/s)                                         
registry.k8s.io/pause:3.9: resolving      |--------------------------------------| 
elapsed: 0.7 s             total:   0.0 B (0.0 B/s)                                         
registry.k8s.io/pause:3.9: resolving      |--------------------------------------| 
elapsed: 0.8 s             total:   0.0 B (0.0 B/s)                                         
registry.k8s.io/pause:3.9: resolving      |--------------------------------------| 
elapsed: 0.9 s             total:   0.0 B (0.0 B/s)                                         
registry.k8s.io/pause:3.9: resolving      |--------------------------------------| 
elapsed: 1.0 s             total:   0.0 B (0.0 B/s)                                         
registry.k8s.io/pause:3.9: resolving      |--------------------------------------| 
elapsed: 1.1 s             total:   0.0 B (0.0 B/s)                                         
registry.k8s.io/pause:3.9: resolving      |--------------------------------------| 
elapsed: 1.2 s             total:   0.0 B (0.0 B/s)                                         
registry.k8s.io/pause:3.9: resolving      |--------------------------------------| 
elapsed: 1.3 s             total:   0.0 B (0.0 B/s)                                         
registry.k8s.io/pause:3.9: resolving      |--------------------------------------| 
elapsed: 1.4 s             total:   0.0 B (0.0 B/s)                                         
+++++++++++++++++++++++++++++++++++++| 
index-sha256:7031c1b283388d2c2e09b57badb803c05ebed362dc88d84b480cc47f72a21097:    done           |++++++++++++++++++++++++++++++++++++++| 
manifest-sha256:8d4106c88ec0bd28001e34c975d65175d994072d65341f62a8ab0754b0fafe10: done           |++++++++++++++++++++++++++++++++++++++| 
config-sha256:e6f1816883972d4be47bd48879a08919b96afcd344132622e4d444987919323c:   done           |++++++++++++++++++++++++++++++++++++++| 
elapsed: 1.5 s                                                                    total:  3.8 Ki (2.5 KiB/s)                                       
+++++++++++++++++++++++++++++++++++++| 
index-sha256:7031c1b283388d2c2e09b57badb803c05ebed362dc88d84b480cc47f72a21097:    done           |++++++++++++++++++++++++++++++++++++++| 
manifest-sha256:8d4106c88ec0bd28001e34c975d65175d994072d65341f62a8ab0754b0fafe10: done           |++++++++++++++++++++++++++++++++++++++| 
config-sha256:e6f1816883972d4be47bd48879a08919b96afcd344132622e4d444987919323c:   done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:61fec91190a0bab34406027bbec43d562218df6e80d22d4735029756f23c7007:    done           |++++++++++++++++++++++++++++++++++++++| 
elapsed: 1.6 s                                                                    total:  3.8 Ki (2.4 KiB/s)                                       
root@ubuntu2404 ~ 11:27:35# nerdctl pull hub.laoma.cloud/library/busybox
hub.laoma.cloud/library/busybox:latest:                                           resolved       |++++++++++++++++++++++++++++++++++++++| 
manifest-sha256:92b1d1cae5f235812184415e63d9b24464116c58d3ba3c460b1eb0247f0f46e3: done           |++++++++++++++++++++++++++++++++++++++| 
config-sha256:c6348fa86ba0fb2108c9334f5fe913ddc6d853313e655891f133a0127c30099f:   done           |++++++++++++++++++++++++++++++++++++++| 
elapsed: 0.1 s                                                                    total:   0.0 B (0.0 B/s)
安装 kubernetes 软件包
bash 复制代码 
# 查看仓库内kubeadm全版本列表
root@ubuntu2404 ~ 11:27:46# apt list kubeadm -a|head
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.
Listing...
kubeadm/unknown 1.30.14-1.1 amd64
kubeadm/unknown 1.30.13-1.1 amd64
kubeadm/unknown 1.30.12-1.1 amd64
kubeadm/unknown 1.30.11-1.1 amd64
kubeadm/unknown 1.30.10-1.1 amd64
kubeadm/unknown 1.30.9-1.1 amd64
kubeadm/unknown 1.30.8-1.1 amd64
kubeadm/unknown 1.30.7-1.1 amd64
kubeadm/unknown 1.30.6-1.1 amd64
root@ubuntu2404 ~ 11:28:06# apt install -y kubeadm=1.30.2-1.1 kubelet=1.30.2-1.1 kubectl=1.30.2-1.1
# 设置kubelet开机自启并立即启动服务
root@ubuntu2404 ~ 11:29:48# systemctl enable kubelet --now

安装完成后 kubelet 初始状态为 activating，集群完整部署完成后会切换至 active 运行状态。

配置相关命令补全
bash 复制代码 
# 配置 crictl 命令Tab自动补全
root@ubuntu2404 ~ 11:29:54# mkdir /etc/bash_completion.d
root@ubuntu2404 ~ 11:30:12# crictl completion bash > /etc/bash_completion.d/crictl
root@ubuntu2404 ~ 11:30:40# source /etc/bash_completion.d/crictl 
# 配置 nerdctl 命令Tab自动补全
root@ubuntu2404 ~ 11:30:56# nerdctl completion bash > /etc/bash_completion.d/nerdctl
root@ubuntu2404 ~ 11:31:28# echo 'export CONTAINERD_NAMESPACE=k8s.io' >> /etc/bash_completion.d/nerdctl
root@ubuntu2404 ~ 11:31:52# source /etc/bash_completion.d/nerdctl

== 重要注意事项 == ：必须配置环境变量 CONTAINERD_NAMESPACE，否则 nerdctl 默认将镜像存入default命名空间，Kubernetes 无法读取使用；Kubernetes 固定从k8s.io命名空间加载镜像。

bash 复制代码 
# 配置 kubectl 命令Tab自动补全
root@ubuntu2404 ~ 11:32:08# kubectl completion bash > /etc/bash_completion.d/kubectl
root@ubuntu2404 ~ 11:32:18# source /etc/bash_completion.d/kubectl
# 配置 kubeadm 命令Tab自动补全
root@ubuntu2404 ~ 11:32:43# kubeadm completion bash > /etc/bash_completion.d/kubeadm
root@ubuntu2404 ~ 11:32:57# source /etc/bash_completion.d/kubeadm
关闭虚拟机
bash 复制代码 
root@ubuntu2404 ~ 11:37:02# init 0

准备节点

bash 复制代码 
### 虚拟机克隆操作
# 采用完整克隆方式复制出另外两台虚拟机。
# 三台克隆虚拟机分别修改主机名与静态网络配置。
# master30 节点配置
root@ubuntu2404 ~ 11:41:53# hostnamectl set-hostname master30.liu.cloud
root@ubuntu2404 ~ 11:43:01# cat > /etc/netplan/00-installer-config.yaml 
<<EOF
network:
  ethernets:
    ens32:
      dhcp4: no
      addresses:
        - 10.1.8.30/24
      routes:
        - to: default
          via: 10.1.8.2
      nameservers:
        addresses:
          - 10.1.8.2
          - 223.5.5.5
  version: 2
EOF
root@ubuntu2404 ~ 11:43:31# netplan apply
# worker31 节点配置
root@ubuntu2404 ~ 11:44:08# hostnamectl set-hostname worker31.liu.cloud
root@ubuntu2404 ~ 11:44:19# cat > /etc/netplan/00-installer-config.yaml <<EOF
network:
  ethernets:
    ens32:
      dhcp4: no
      addresses:
        - 10.1.8.31/24
      routes:
        - to: default
          via: 10.1.8.2
      nameservers:
        addresses:
          - 10.1.8.2
          - 223.5.5.5
  version: 2
EOF
root@ubuntu2404 ~ 11:44:44# netplan apply
# worker32 节点配置
root@ubuntu2404 ~ 11:45:17# hostnamectl set-hostname worker32.liu.cloud
root@ubuntu2404 ~ 11:45:25# cat > /etc/netplan/00-installer-config.yaml 
<<EOF
network:
  ethernets:
    ens32:
      dhcp4: no
      addresses:
        - 10.1.8.32/24
      routes:
        - to: default
          via: 10.1.8.2
      nameservers:
        addresses:
          - 10.1.8.2
          - 223.5.5.5
  version: 2
EOF
root@ubuntu2404 ~ 11:45:52# netplan apply

创建集群

预拉取组件镜像

master 节点执行集群初始化时会自动下载所需组件镜像，推荐提前手动拉取避免初始化耗时过长。

bash 复制代码 
root@master30:~# kubeadm config images pull --kubernetes-version=v1.30.2
[config/images] Pulled registry.k8s.io/kube-apiserver:v1.30.2
[config/images] Pulled registry.k8s.io/kube-controller-manager:v1.30.2
[config/images] Pulled registry.k8s.io/kube-scheduler:v1.30.2
[config/images] Pulled registry.k8s.io/kube-proxy:v1.30.2
[config/images] Pulled registry.k8s.io/coredns/coredns:v1.11.1
[config/images] Pulled registry.k8s.io/pause:3.9
[config/images] Pulled registry.k8s.io/etcd:3.5.12-0

备选方案 - 阿里云镜像仓库拉取：

bash 复制代码 
root@master30:~# kubeadm config images pull --kubernetes-version=v1.30.2 --image-repository registry.aliyuncs.com/google_containers
[config/images] Pulled registry.k8s.io/kube-apiserver:v1.30.2
[config/images] Pulled registry.k8s.io/kube-controller-manager:v1.30.2
[config/images] Pulled registry.k8s.io/kube-scheduler:v1.30.2
[config/images] Pulled registry.k8s.io/kube-proxy:v1.30.2
[config/images] Pulled registry.k8s.io/coredns/coredns:v1.11.1
[config/images] Pulled registry.k8s.io/pause:3.9
[config/images] Pulled registry.k8s.io/etcd:3.5.12-0

备选方案 - 私有仓库拉取：

bash 复制代码 
root@master30 ~ 13:33:47# kubeadm config images pull --kubernetes-version=v1.30.2 --image-repository hub.laoma.cloud/kubernetes
[config/images] Pulled hub.laoma.cloud/kubernetes/kube-apiserver:v1.30.2
[config/images] Pulled hub.laoma.cloud/kubernetes/kube-controller-manager:v1.30.2
[config/images] Pulled hub.laoma.cloud/kubernetes/kube-scheduler:v1.30.2
[config/images] Pulled hub.laoma.cloud/kubernetes/kube-proxy:v1.30.2
[config/images] Pulled hub.laoma.cloud/kubernetes/coredns:v1.11.1
[config/images] Pulled hub.laoma.cloud/kubernetes/pause:3.9
[config/images] Pulled hub.laoma.cloud/kubernetes/etcd:3.5.12-0

worker 节点通过私有仓库预拉取基础镜像：

bash 复制代码 
root@worker31 ~ 13:45:50# nerdctl pull hub.laoma.cloud/kubernetes/kube-proxy:v1.30.2
hub.laoma.cloud/kubernetes/kube-proxy:v1.30.2:                                    resolved       |++++++++++++++++++++++++++++++++++++++| 
manifest-sha256:854b9a1bb27a6b3ee8e7345f459aaed19944febdaef0a3dfda783896ee8ed961: done           |++++++++++++++++++++++++++++++++++++++| 
config-sha256:53c535741fb446f6b34d720fdc5748db368ef96771111f3892682e6eab8f3772:   done           |++++++++++++++++++++++++++++++++++++++| 
elapsed: 0.1 s                                                                    total:   0.0 B (0.0 B/s)                                         
root@worker31 ~ 13:46:02# nerdctl pull hub.laoma.cloud/kubernetes/pause:3.9
hub.laoma.cloud/kubernetes/pause:3.9:                                             resolved       |++++++++++++++++++++++++++++++++++++++| 
manifest-sha256:0fc1f3b764be56f7c881a69cbd553ae25a2b5523c6901fbacb8270307c29d0c4: done           |++++++++++++++++++++++++++++++++++++++| 
config-sha256:e6f1816883972d4be47bd48879a08919b96afcd344132622e4d444987919323c:   done           |++++++++++++++++++++++++++++++++++++++| 
elapsed: 0.1 s                                                                    total:   0.0 B (0.0 B/s)                                         
root@worker32 ~ 13:34:00# nerdctl pull hub.laoma.cloud/kubernetes/kube-proxy:v1.30.2
hub.laoma.cloud/kubernetes/kube-proxy:v1.30.2:                                    resolved       |++++++++++++++++++++++++++++++++++++++| 
manifest-sha256:854b9a1bb27a6b3ee8e7345f459aaed19944febdaef0a3dfda783896ee8ed961: done           |++++++++++++++++++++++++++++++++++++++| 
config-sha256:53c535741fb446f6b34d720fdc5748db368ef96771111f3892682e6eab8f3772:   done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:ca0bf8d30b46cb686b3b63f434b900f2aa17084d77d84d606a8fe8638a305c36:    done           |++++++++++++++++++++++++++++++++++++++| 
layer-sha256:529cf6e0a17387061836a737b20c5c53be64036bd05ef123b1bad79ffa5898ff:    done           |++++++++++++++++++++++++++++++++++++++| 
elapsed: 1.2 s                                                                    total:  27.7 M (23.1 MiB/s)                                      
root@worker32 ~ 13:46:31# nerdctl pull hub.laoma.cloud/kubernetes/pause:3.9
hub.laoma.cloud/kubernetes/pause:3.9:                                             resolved       |++++++++++++++++++++++++++++++++++++++| 
manifest-sha256:0fc1f3b764be56f7c881a69cbd553ae25a2b5523c6901fbacb8270307c29d0c4: done           |++++++++++++++++++++++++++++++++++++++| 
config-sha256:e6f1816883972d4be47bd48879a08919b96afcd344132622e4d444987919323c:   done           |++++++++++++++++++++++++++++++++++++++| 
elapsed: 0.2 s

初始化控制平面集群

bash 复制代码 
root@master30:~# kubeadm init --kubernetes-version=v1.30.2 --pod-network-cidr=10.224.0.0/16

指定私有镜像仓库初始化：

bash 复制代码 
root@master30 ~ 13:45:28# kubeadm init --kubernetes-version=v1.30.2 --pod-network-cidr=10.224.0.0/16 --image-repository hub.laoma.cloud/kubernetes

指定阿里云镜像仓库初始化：

bash 复制代码 
root@master30:~# kubeadm init --kubernetes-version=v1.30.2 --pod-network-cidr=10.224.0.0/16 --image-repository registry.aliyuncs.com/google_containers

完整初始化输出流程如下：

bash 复制代码 
[init] Using Kubernetes version: v1.30.2
[preflight] Running pre-flight checks
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
[preflight] You can also perform this action in beforehand using 'kubeadm config images pull'
W0805 13:47:35.863598    2022 checks.go:844] detected that the sandbox image "registry.k8s.io/pause:3.9" of the container runtime is inconsistent with that used by kubeadm.It is recommended to use "hub.laoma.cloud/kubernetes/pause:3.9" as the CRI sandbox image.
[certs] Using certificateDir folder "/etc/kubernetes/pki"
[certs] Generating "ca" certificate and key
[certs] Generating "apiserver" certificate and key
[certs] apiserver serving cert is signed for DNS names [kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local master30.liu.cloud] and IPs [10.96.0.1 10.1.8.30]
[certs] Generating "apiserver-kubelet-client" certificate and key
[certs] Generating "front-proxy-ca" certificate and key
[certs] Generating "front-proxy-client" certificate and key
[certs] Generating "etcd/ca" certificate and key
[certs] Generating "etcd/server" certificate and key
[certs] etcd/server serving cert is signed for DNS names [localhost master30.liu.cloud] and IPs [10.1.8.30 127.0.0.1 ::1]
[certs] Generating "etcd/peer" certificate and key
[certs] etcd/peer serving cert is signed for DNS names [localhost master30.liu.cloud] and IPs [10.1.8.30 127.0.0.1 ::1]
[certs] Generating "etcd/healthcheck-client" certificate and key
[certs] Generating "apiserver-etcd-client" certificate and key
[certs] Generating "sa" key and public key
[kubeconfig] Using kubeconfig folder "/etc/kubernetes"
[kubeconfig] Writing "admin.conf" kubeconfig file
[kubeconfig] Writing "super-admin.conf" kubeconfig file
[kubeconfig] Writing "kubelet.conf" kubeconfig file
[kubeconfig] Writing "controller-manager.conf" kubeconfig file
[kubeconfig] Writing "scheduler.conf" kubeconfig file
[etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests"
[control-plane] Using manifest folder "/etc/kubernetes/manifests"
[control-plane] Creating static Pod manifest for "kube-apiserver"
[control-plane] Creating static Pod manifest for "kube-controller-manager"
[control-plane] Creating static Pod manifest for "kube-scheduler"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Starting the kubelet
[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests"
[kubelet-check] Waiting for a healthy kubelet. This can take up to 4m0s
[kubelet-check] The kubelet is healthy after 504.089154ms
[api-check] Waiting for a healthy API server. This can take up to 4m0s
[api-check] The API server is healthy after 3.502432522s
[upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
[kubelet] Creating a ConfigMap "kubelet-config" in namespace kube-system with the configuration for the kubelets in the cluster
[upload-certs] Skipping phase. Please see --upload-certs
[mark-control-plane] Marking the node master30.liu.cloud as control-plane by adding the labels: [node-role.kubernetes.io/control-plane node.kubernetes.io/exclude-from-external-load-balancers]
[mark-control-plane] Marking the node master30.liu.cloud as control-plane by adding the taints [node-role.kubernetes.io/control-plane:NoSchedule]
[bootstrap-token] Using token: zvo1vd.a6mlqxy93dtc8vcr
[bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles
[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to get nodes
[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
[bootstrap-token] Configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
[bootstrap-token] Configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
[bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace
[kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key
[addons] Applied essential addon: CoreDNS
[addons] Applied essential addon: kube-proxy
Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config
Alternatively, if you are the root user, you can run:
  export KUBECONFIG=/etc/kubernetes/admin.conf
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 10.1.8.30:6443 --token zvo1vd.a6mlqxy93dtc8vcr \
	--discovery-token-ca-cert-hash sha256:33448a90d717bb68082b8a37e4389a8932e87eed9188b9511560d98b75fb8aa6

参数说明：

--image-repository registry.aliyuncs.com/google_containers：自定义组件镜像拉取仓库地址

--kubernetes-version=v1.30.2：指定集群 Kubernetes 版本

--pod-network-cidr=10.224.0.0/16：定义集群 Pod 网段。Kubernetes 兼容多种网络插件，不同插件对该网段存在专属要求。

--apiserver-advertise-address：指定 apiserver 对外通信网卡 IP。若 master 节点配置多块网卡，建议显式声明；未指定时 kubeadm 自动选用配置默认网关的网卡。

初始化完整流程拆解：

  1. kubeadm 执行集群部署前置校验。
  2. 下载控制平面所需组件镜像，耗时取决于网络传输速度。
  3. 生成集群通信 Token 与全套安全证书。
  4. 生成 kubeconfig 配置文件，kubelet 依靠该文件与 master 节点建立安全通信。
  5. 部署 master 控制平面核心组件。
  6. 安装集群基础插件 kube-proxy、CoreDNS。
  7. 输出提示，代表 master 控制平面初始化完成。
  8. 告知普通用户配置 kubectl 访问权限的操作步骤。
  9. 提示必须部署 Pod 网络插件集群才可正常调度业务。
  10. 输出 worker 节点加入集群的完整执行命令。

配置集群

配置凭据

  • kubectl 默认读取 ~/.kube/config 文件内的凭证信息，以此完成 Kubernetes 集群的管理权限认证。
bash 复制代码 
root@master30 ~ 13:47:42# mkdir -p $HOME/.kube
root@master30 ~ 14:01:40# sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
root@master30 ~ 14:04:19# sudo chown $(id -u):$(id -g) $HOME/.kube/config
root@master30 ~ 14:04:51# kubectl cluster-info 
Kubernetes control plane is running at https://10.1.8.30:6443
CoreDNS is running at https://10.1.8.30:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
root@master30 ~ 14:04:51# kubectl get pods -A
NAMESPACE     NAME                                         READY   STATUS    RESTARTS   AGE
kube-system   coredns-5485cd7479-df85k                     0/1     Pending   0          17m
kube-system   coredns-5485cd7479-vcm2h                     0/1     Pending   0          17m
kube-system   etcd-master30.liu.cloud                      1/1     Running   0          17m
kube-system   kube-apiserver-master30.liu.cloud            1/1     Running   0          17m
kube-system   kube-controller-manager-master30.liu.cloud   1/1     Running   0          17m
kube-system   kube-proxy-f58ks                             1/1     Running   0          17m
kube-system   kube-scheduler-master30.liu.cloud            1/1     Running   0          17m
  • 若系统存在 KUBECONFIG 环境变量，kubectl 会优先使用该变量指定的凭证文件路径。
bash 复制代码 
root@master30 ~ 14:05:07# mv $HOME/.kube/config /tmp
root@master30 ~ 14:10:04# export KUBECONFIG=/tmp/config 
root@master30 ~ 14:10:29# kubectl get pods -A 
NAMESPACE     NAME                                         READY   STATUS    RESTARTS   AGE
kube-system   coredns-5485cd7479-df85k                     0/1     Pending   0          22m
kube-system   coredns-5485cd7479-vcm2h                     0/1     Pending   0          22m
kube-system   etcd-master30.liu.cloud                      1/1     Running   0          22m
kube-system   kube-apiserver-master30.liu.cloud            1/1     Running   0          22m
kube-system   kube-controller-manager-master30.liu.cloud   1/1     Running   0          22m
kube-system   kube-proxy-f58ks                             1/1     Running   0          22m
kube-system   kube-scheduler-master30.liu.cloud            1/1     Running   0          22m
  • 也可通过命令行参数 --kubeconfig='' 手动明确指定凭证文件的存放路径。
bash 复制代码 
root@master30 ~ 14:05:07# mv $HOME/.kube/config /tmp
root@master30 ~ 14:09:43# kubectl get pods -A --kubeconfig /tmp/config 
NAMESPACE     NAME                                         READY   STATUS    RESTARTS   AGE
kube-system   coredns-5485cd7479-df85k                     0/1     Pending   0          22m
kube-system   coredns-5485cd7479-vcm2h                     0/1     Pending   0          22m
kube-system   etcd-master30.liu.cloud                      1/1     Running   0          22m
kube-system   kube-apiserver-master30.liu.cloud            1/1     Running   0          22m
kube-system   kube-controller-manager-master30.liu.cloud   1/1     Running   0          22m
kube-system   kube-proxy-f58ks                             1/1     Running   0          22m
kube-system   kube-scheduler-master30.liu.cloud            1/1     Running   0          22m
  • 恢复默认凭证文件路径 ~/.kube/config 的使用方式
bash 复制代码 
root@master30 ~ 14:10:37# unset KUBECONFIG
root@master30 ~ 14:10:49# mv /tmp/config .kube/
root@master30 ~ 14:11:00# kubectl get pods -A
NAMESPACE     NAME                                         READY   STATUS    RESTARTS   AGE
kube-system   coredns-5485cd7479-df85k                     0/1     Pending   0          32m
kube-system   coredns-5485cd7479-vcm2h                     0/1     Pending   0          32m
kube-system   etcd-master30.liu.cloud                      1/1     Running   0          32m
kube-system   kube-apiserver-master30.liu.cloud            1/1     Running   0          32m
kube-system   kube-controller-manager-master30.liu.cloud   1/1     Running   0          32m
kube-system   kube-proxy-f58ks                             1/1     Running   0          32m
kube-system   kube-scheduler-master30.liu.cloud            1/1     Running   0          32m

部署网络

本文档选用 Calico 作为集群网络插件。

官方站点：http://projectcalico.org 与 https://www.tigera.io/project-calico/

产品文档地址：https://projectcalico.docs.tigera.io/about/about-calico

开源项目仓库：https://github.com/projectcalico/calico（配套容器镜像存放于此）

下载 calico 配置
bash 复制代码 
root@master30:~# wget --no-check-certificate https://raw.githubusercontent.com/projectcalico/calico/v3.30.7/manifests/calico.yaml
# 内网环境下载方式
root@master30 ~ 14:22:21#  wget http://192.168.46.200/class/course-materials/softwares/stage03/calico-3.30.7.yaml -O calico.yaml
--2026-08-05 14:41:16--  http://192.168.46.200/class/course-materials/softwares/stage03/calico-3.30.7.yaml
Connecting to 192.168.46.200:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 541790 (529K) [text/plain]
Saving to: 'calico.yaml'
calico.yaml                   100%[==============================================>] 529.09K  --.-KB/s    in 0.01s   
2026-08-05 14:41:16 (37.4 MB/s) - 'calico.yaml' saved [541790/541790]
修改 pod 网络网段
bash 复制代码 
# 查询集群初始化时配置的 Pod 网络网段
root@master30 ~ 14:41:16# kubectl get cm -n kube-system kubeadm-config -o yaml |grep podSubnet
      podSubnet: 10.224.0.0/16
# 修改 calico.yaml 文件，保证 CALICO_IPV4POOL_CIDR 参数与集群初始化定义的 Pod 网段保持一致
root@master30 ~ 14:42:43# sed -i "s|# - name: CALICO_IPV4POOL_CIDR|- name: CALICO_IPV4POOL_CIDR|g" calico.yaml
root@master30 ~ 14:42:56# sed -i "s|#   value: \"192.*|  value: \"10.224.0.0/16\"|g" calico.yaml
修改镜像仓库地址
bash 复制代码 
# 替换配置文件内的镜像源地址
root@master30 ~ 14:43:10# sed -i 's/docker.io/hub.laoma.cloud/g' calico.yaml
root@master30 ~ 14:43:17# grep image: calico.yaml | sort | uniq
          image: hub.laoma.cloud/calico/cni:v3.30.7
          image: hub.laoma.cloud/calico/kube-controllers:v3.30.7
          image: hub.laoma.cloud/calico/node:v3.30.7
部署 calico 网络组件
bash 复制代码 
root@master30 ~ 14:43:28# kubectl apply -f calico.yaml 
poddisruptionbudget.policy/calico-kube-controllers created
serviceaccount/calico-kube-controllers created
serviceaccount/calico-node created
serviceaccount/calico-cni-plugin created
configmap/calico-config created
customresourcedefinition.apiextensions.k8s.io/bgpconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/bgpfilters.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/bgppeers.crd.projectcalico.org created
...
验证网络部署状态
bash 复制代码 
root@master30 ~ 14:43:43# kubectl get pods --all-namespaces
NAMESPACE     NAME                                         READY   STATUS    RESTARTS   AGE
kube-system   calico-kube-controllers-5b778fd8ff-cn6g2     1/1     Running   0          68s
kube-system   calico-node-pdfgq                            1/1     Running   0          68s
kube-system   coredns-5485cd7479-df85k                     1/1     Running   0          56m
kube-system   coredns-5485cd7479-vcm2h                     1/1     Running   0          56m
kube-system   etcd-master30.liu.cloud                      1/1     Running   0          57m
kube-system   kube-apiserver-master30.liu.cloud            1/1     Running   0          57m
kube-system   kube-controller-manager-master30.liu.cloud   1/1     Running   0          57m
kube-system   kube-proxy-f58ks                             1/1     Running   0          56m
kube-system   kube-scheduler-master30.liu.cloud            1/1     Running   0          57m

节点接入集群

bash 复制代码 
# 将 worker31 工作节点加入集群
root@worker31 ~ 13:46:16# kubeadm join 10.1.8.30:6443 --token zvo1vd.a6mlqxy93dtc8vcr \
        --discovery-token-ca-cert-hash sha256:33448a90d717bb68082b8a37e4389a8932e87eed9188b9511560d98b75fb8aa6 
[preflight] Running pre-flight checks
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-check] Waiting for a healthy kubelet. This can take up to 4m0s
[kubelet-check] The kubelet is healthy after 502.299593ms
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.
# 将 worker32 工作节点加入集群
root@worker32 ~ 13:46:37# kubeadm join 10.1.8.30:6443 --token zvo1vd.a6mlqxy93dtc8vcr \
        --discovery-token-ca-cert-hash sha256:33448a90d717bb68082b8a37e4389a8932e87eed9188b9511560d98b75fb8aa6 
[preflight] Running pre-flight checks
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-check] Waiting for a healthy kubelet. This can take up to 4m0s
[kubelet-check] The kubelet is healthy after 501.555237ms
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.

若未保存集群初始化输出的节点接入命令，可在控制平面节点执行以下命令重新生成接入指令：

bash 复制代码 
root@master30:~# kubeadm token create --print-join-command
kubeadm join 10.1.8.30:6443 --token dzpuca.8lqxqqydwskroabx --discovery-token-ca-cert-hash sha256:5606e09618330aee8859abe3ea4cd8734f9b540630048a6e1c3aaf6c54d486fd

集群部署结果校验

bash 复制代码 
root@master30 ~ 14:50:29# kubectl get node;echo;kubectl get pods -A
NAME                 STATUS   ROLES           AGE     VERSION
master30.liu.cloud   Ready    control-plane   63m     v1.30.2
worker31.liu.cloud   Ready    <none>          2m45s   v1.30.2
worker32.liu.cloud   Ready    <none>          2m37s   v1.30.2
NAMESPACE     NAME                                         READY   STATUS    RESTARTS   AGE
kube-system   calico-kube-controllers-5b778fd8ff-cn6g2     1/1     Running   0          7m52s
kube-system   calico-node-pdfgq                            1/1     Running   0          7m52s
kube-system   calico-node-tlcpd                            1/1     Running   0          2m37s
kube-system   calico-node-w8xd6                            1/1     Running   0          2m45s
kube-system   coredns-5485cd7479-df85k                     1/1     Running   0          63m
kube-system   coredns-5485cd7479-vcm2h                     1/1     Running   0          63m
kube-system   etcd-master30.liu.cloud                      1/1     Running   0          63m
kube-system   kube-apiserver-master30.liu.cloud            1/1     Running   0          63m
kube-system   kube-controller-manager-master30.liu.cloud   1/1     Running   0          63m
kube-system   kube-proxy-bnsvk                             1/1     Running   0          2m45s
kube-system   kube-proxy-f58ks                             1/1     Running   0          63m
kube-system   kube-proxy-q6zt6                             1/1     Running   0          2m37s
kube-system   kube-scheduler-master30.liu.cloud            1/1     Running   0          63m

Node and Cluster

学习参考文档：Node

查看节点信息

bash 复制代码 
# 查看集群全部节点列表
root@master30:~# kubectl get nodes
NAME                  STATUS   ROLES           AGE   VERSION
master30.liu.cloud   Ready    control-plane   37h   v1.30.2
worker31.liu.cloud   Ready    <none>          36h   v1.30.2
worker32.liu.cloud   Ready    <none>          36h   v1.30.2
# 查看指定节点的完整详情
root@master30:~# kubectl describe node worker31.liu.cloud

删除节点

以 worker31 工作节点为例演示操作流程。

bash 复制代码 
# 将节点设置为维护调度隔离状态
root@master30 ~ 15:02:55# kubectl drain worker31.liu.cloud --ignore-daemonsets
node/worker31.liu.cloud cordoned
Warning: ignoring DaemonSet-managed Pods: kube-system/calico-node-w8xd6, kube-system/kube-proxy-bnsvk
node/worker31.liu.cloud drained
root@master30 ~ 15:20:51# kubectl get nodes 
NAME                 STATUS                     ROLES           AGE   VERSION
master30.liu.cloud   Ready                      control-plane   93m   v1.30.2
worker31.liu.cloud   Ready,SchedulingDisabled   <none>          32m   v1.30.2
worker32.liu.cloud   Ready                      <none>          32m   v1.30.2
# 从集群中移除 worker31 节点记录
root@master30 ~ 15:21:04# kubectl delete nodes worker31.liu.cloud 
node "worker31.liu.cloud" deleted
root@master30 ~ 15:21:21# kubectl get nodes 
NAME                 STATUS   ROLES           AGE   VERSION
master30.liu.cloud   Ready    control-plane   93m   v1.30.2
worker32.liu.cloud   Ready    <none>          32m   v1.30.2
# 在被移除的节点本地执行集群重置操作
root@worker31 ~ 15:20:26# kubeadm reset -f
[preflight] Running pre-flight checks
W0805 15:21:40.110284   10013 removeetcdmember.go:106] [reset] No kubeadm config, using etcd pod spec to get data directory
[reset] Deleted contents of the etcd data directory: /var/lib/etcd
[reset] Stopping the kubelet service
[reset] Unmounting mounted directories in "/var/lib/kubelet"
[reset] Deleting contents of directories: [/etc/kubernetes/manifests /var/lib/kubelet /etc/kubernetes/pki]
[reset] Deleting files: [/etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf /etc/kubernetes/kubelet.conf /etc/kubernetes/bootstrap-kubelet.conf /etc/kubernetes/controller-manager.conf /etc/kubernetes/scheduler.conf]
The reset process does not clean CNI configuration. To do so, you must remove /etc/cni/net.d
The reset process does not reset or clean up iptables rules or IPVS tables.
If you wish to reset iptables, you must do so manually by using the "iptables" command.
If your cluster was setup to utilize IPVS, run ipvsadm --clear (or similar)
to reset your system's IPVS tables.
The reset process does not clean your kubeconfig files and you must remove them manually.
Please, check the contents of the $HOME/.kube/config file.

删除集群

集群完整销毁流程：

  1. 移除所有工作节点
  2. 销毁控制平面节点
  3. 移除全部工作节点
bash 复制代码 
root@master30 ~ 15:47:01# kubectl drain worker31.liu.cloud --ignore-daemonsets --force 
node/worker31.liu.cloud cordoned
Warning: ignoring DaemonSet-managed Pods: kube-system/calico-node-w8xd6, kube-system/kube-proxy-bnsvk
node/worker31.liu.cloud drained
root@master30 ~ 15:47:41# kubectl drain worker32.liu.cloud --ignore-daemonsets --force 
node/worker32.liu.cloud cordoned
Warning: ignoring DaemonSet-managed Pods: kube-system/calico-node-tlcpd, kube-system/kube-proxy-q6zt6
node/worker32.liu.cloud drained
root@master30 ~ 15:47:47# kubectl delete nodes worker31.liu.cloud worker32.liu.cloud 
node "worker31.liu.cloud" deleted
node "worker32.liu.cloud" deleted
# 在对应节点本地执行重置命令，注意执行主机区分
root@worker31 ~ 15:21:55# kubeadm reset -f
[preflight] Running pre-flight checks
W0805 15:48:15.919000   19048 removeetcdmember.go:106] [reset] No kubeadm config, using etcd pod spec to get data directory
[reset] Deleted contents of the etcd data directory: /var/lib/etcd
[reset] Stopping the kubelet service
[reset] Unmounting mounted directories in "/var/lib/kubelet"
[reset] Deleting contents of directories: [/etc/kubernetes/manifests /var/lib/kubelet /etc/kubernetes/pki]
[reset] Deleting files: [/etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf /etc/kubernetes/kubelet.conf /etc/kubernetes/bootstrap-kubelet.conf /etc/kubernetes/controller-manager.conf /etc/kubernetes/scheduler.conf]
The reset process does not clean CNI configuration. To do so, you must remove /etc/cni/net.d
The reset process does not reset or clean up iptables rules or IPVS tables.
If you wish to reset iptables, you must do so manually by using the "iptables" command.
If your cluster was setup to utilize IPVS, run ipvsadm --clear (or similar)
to reset your system's IPVS tables.
The reset process does not clean your kubeconfig files and you must remove them manually.
Please, check the contents of the $HOME/.kube/config file.
root@worker32 ~ 15:00:46# kubeadm reset -f 
[preflight] Running pre-flight checks
W0805 15:48:24.754966   18008 removeetcdmember.go:106] [reset] No kubeadm config, using etcd pod spec to get data directory
[reset] Deleted contents of the etcd data directory: /var/lib/etcd
[reset] Stopping the kubelet service
[reset] Unmounting mounted directories in "/var/lib/kubelet"
[reset] Deleting contents of directories: [/etc/kubernetes/manifests /var/lib/kubelet /etc/kubernetes/pki]
[reset] Deleting files: [/etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf /etc/kubernetes/kubelet.conf /etc/kubernetes/bootstrap-kubelet.conf /etc/kubernetes/controller-manager.conf /etc/kubernetes/scheduler.conf]
The reset process does not clean CNI configuration. To do so, you must remove /etc/cni/net.d
The reset process does not reset or clean up iptables rules or IPVS tables.
If you wish to reset iptables, you must do so manually by using the "iptables" command.
If your cluster was setup to utilize IPVS, run ipvsadm --clear (or similar)
to reset your system's IPVS tables.
The reset process does not clean your kubeconfig files and you must remove them manually.
Please, check the contents of the $HOME/.kube/config file.
bash 复制代码 
# 销毁集群前导出集群初始化配置
root@master30 ~ 15:48:04# kubectl get cm kubeadm-config -n kube-system -o yaml > kubeadm.yml
# 编辑 kubeadm.yml 文件，修改内容如下
root@master30 ~ 15:49:20# vim kubeadm.yml 
# 删除配置文件第1-3行、22-28行，修改后内容如下
apiServer:
  timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta3
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns: {}
etcd:
  local:
    dataDir: /var/lib/etcd
imageRepository: registry.k8s.io
kind: ClusterConfiguration
kubernetesVersion: v1.30.2
networking:
  dnsDomain: cluster.local
  podSubnet: 10.224.0.0/16
  serviceSubnet: 10.96.0.0/12
scheduler: {}
root@master30 ~ 15:49:53# kubectl delete node master30.liu.cloud 
node "master30.liu.cloud" deleted
root@master30 ~ 15:50:10# kubeadm reset -f
[reset] Reading configuration from the cluster...
[reset] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
...
root@master30 ~ 15:50:23# rm -rf .kube/

重建集群

bash 复制代码 
# 基于配置文件初始化集群
root@master30 ~ 15:52:57# kubeadm init --config kubeadm.yml
...
You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 10.1.8.30:6443 --token imi0so.50dyeyrk4tr8xw2n \
	--discovery-token-ca-cert-hash sha256:220ccf9f803a1a17d25659ece82213786b82caca0c932111eb1d62f58307dd0f
	
	
# 也可直接使用完整参数执行初始化命令
root@master30 ~ 15:52:57# root@master30 ~ 15:53:12# kubeadm init --kubernetes-version=v1.30.2 --pod-network-cidr=10.224.0.0/16 --image-repository hub.laoma.cloud/kubernetes
# 配置本地 kubectl 访问凭证
root@master30 ~ 15:53:33# mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config
# 部署 Calico 网络插件
root@master30 ~ 15:53:53#  kubectl apply -f calico.yaml
# 工作节点接入集群操作
root@worker31 ~ 15:48:16# kubeadm join 10.1.8.30:6443 --token imi0so.50dyeyrk4tr8xw2n \
        --discovery-token-ca-cert-hash sha256:220ccf9f803a1a17d25659ece82213786b82caca0c932111eb1d62f58307dd0f 
[preflight] Running pre-flight checks
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-check] Waiting for a healthy kubelet. This can take up to 4m0s
[kubelet-check] The kubelet is healthy after 500.791463ms
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.
root@worker31 ~ 15:48:16# kubeadm join 10.1.8.30:6443 --token imi0so.50dyeyrk4tr8xw2n \
        --discovery-token-ca-cert-hash sha256:220ccf9f803a1a17d25659ece82213786b82caca0c932111eb1d62f58307dd0f 
[preflight] Running pre-flight checks
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-check] Waiting for a healthy kubelet. This can take up to 4m0s
[kubelet-check] The kubelet is healthy after 500.791463ms
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap
This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.
Run 'kubectl get nodes' on the control-plane to see this node join the cluster.
root@master30 ~ 15:54:03# kubectl get pods -A
NAMESPACE     NAME                                         READY   STATUS    RESTARTS   AGE
kube-system   calico-kube-controllers-585df69d45-p5fsp     1/1     Running   0          48s
kube-system   calico-node-7plmg                            1/1     Running   0          48s
kube-system   calico-node-k5hk6                            1/1     Running   0          28s
kube-system   calico-node-ql64b                            1/1     Running   0          22s
kube-system   coredns-7db6d8ff4d-4l7rh                     1/1     Running   0          64s
kube-system   coredns-7db6d8ff4d-b4pn5                     1/1     Running   0          64s
kube-system   etcd-master30.liu.cloud                      1/1     Running   0          79s
kube-system   kube-apiserver-master30.liu.cloud            1/1     Running   0          79s
kube-system   kube-controller-manager-master30.liu.cloud   1/1     Running   0          80s
kube-system   kube-proxy-dnl6s                             1/1     Running   0          22s
kube-system   kube-proxy-glbf6                             1/1     Running   0          64s
kube-system   kube-proxy-s7bpm                             1/1     Running   0          28s
kube-system   kube-scheduler-master30.liu.cloud            1/1     Running   0          79s

Namespace and Contexts

学习参考文档：Namespace

Namespace 介绍

**业务场景问题：**多名开发人员共用同一套 Kubernetes 集群时，如何对各自创建的业务资源做逻辑隔离？

解决方案：Namespace，简写为 ns，也可称作项目隔离域，本质是一组资源的集合，用于对集群内资源做分组管理。借助 Namespace，可将单套物理集群从逻辑上切分为多组独立资源池，每个资源池对应一个 Namespace。不同 Namespace 内的各类资源相互隔离，互不干扰。

Kubernetes 集群初始化时会自动创建四类内置命名空间：

  • default：创建资源时若未手动指定命名空间，资源会默认存放于此命名空间。
  • kube-system：集群自身组件、系统核心资源全部部署在该命名空间内。
  • kube-public：该命名空间内所有资源对象支持全量用户读取，包含未完成身份认证的匿名访问用户。
  • **kube-node-lease：**存放与每台节点绑定的 Lease 租约资源。节点租约机制可供 kubelet 持续上报节点心跳，控制平面依靠心跳检测节点运行状态、判断节点故障。

Namespace 管理操作

bash 复制代码 
# 查询集群内全部命名空间列表
root@master30 ~ 15:54:51# kubectl get ns
NAME              STATUS   AGE
default           Active   56m
kube-node-lease   Active   56m
kube-public       Active   56m
kube-system       Active   56m
# 导出指定命名空间的完整 YAML 定义
root@master30 ~ 16:49:53# kubectl get ns default -o yaml
apiVersion: v1
kind: Namespace
metadata:
  creationTimestamp: "2026-08-05T07:53:30Z"
  labels:
    kubernetes.io/metadata.name: default
  name: default
  resourceVersion: "42"
  uid: 2087a5ee-1aa8-4122-a2dd-3800309b2e26
spec:
  finalizers:
  - kubernetes
status:
  phase: Active
# 创建全新命名空间
root@master30 ~ 16:50:24# kubectl create ns liu
namespace/liu created
# 命名空间命名规范：仅支持小写字母、数字与中横线，匹配正则表达式[a-z0-9]([-a-z0-9]*[a-z0-9])?，名称最大长度限制63字符
# 直接在线编辑命名空间配置
root@master30 ~ 16:50:41# kubectl edit ns liu
# 查看命名空间完整详情
root@master30 ~ 16:51:16# kubectl describe ns liu
Name:         liu
Labels:       kubernetes.io/metadata.name=liu
Annotations:  <none>
Status:       Active
No resource quota.
No LimitRange resource.
# 删除指定命名空间
root@master30 ~ 16:51:22# kubectl delete ns liu
namespace "liu" deleted
# 重要注意事项：
# 删除命名空间会同步清理该命名空间下全部业务资源。
# default 与 kube-system 系统内置命名空间不允许执行删除操作。

也可通过 YAML 配置文件声明式创建命名空间。

yaml 复制代码 
root@master30 ~ 16:53:09# touch  ns-liu.yaml
root@master30 ~ 16:53:50# vim ns-liu.yaml 
# ns-liu.yaml 文件内容
apiVersion: v1
kind: Namespace
metadata:
  name: liu
bash 复制代码 
root@master30 ~ 16:56:41# kubectl apply -f ns-liu.yaml 
namespace/liu created

操作指定命名空间内的资源对象时，需通过 -n 参数声明目标命名空间，示例如下：

bash 复制代码 
root@master30 ~ 16:57:03# kubectl run web --image=nginx -n liu
pod/web created
root@master30 ~ 16:58:53# kubectl get pod -n liu -o wide
NAME   READY   STATUS    RESTARTS   AGE     IP              NODE                 NOMINATED NODE   READINESS GATES
web    1/1     Running   0          3m15s   10.224.133.65   worker31.liu.cloud   <none>           <none>
root@master30 ~ 17:00:44# curl -s 10.224.133.65 | grep nginx
<title>Welcome to nginx!</title>
<h1>Welcome to nginx!</h1>
<p>If you see this page, nginx is successfully installed and working.
<a href="https://nginx.org/">nginx.org</a>.<br />
<a href="https://community.nginx.org/">community.nginx.org</a>.<br />
<a href="https://f5.com/nginx">f5.com/nginx</a>.</p>
<p><em>Thank you for using nginx.</em></p>
相关推荐
陌路201 小时前
Docker教程从入门到精通（0基础）
运维·docker·容器
初级炼丹师(爱说实话版)2 小时前
Ubuntu24.04 Docker+vLLM+qianwen2.5-coder-32B部署文档
docker·容器·vllm
2301_780789662 小时前
DDoS 攻击溯源：DNS 水印标记 + 区块链存证的双保险
运维·服务器·网络·云原生·ddos
ᥬ 小月亮8 小时前
SonarQube使用教程（Docker安装）
运维·docker·容器
驾驭人生11 小时前
IIS微服务5分钟自动预热守护服务
微服务·云原生·架构
空谷有来人11 小时前
docker安装redis
redis·docker·容器
运维大师12 小时前
【K8S 运维实战】39-etcd脑裂故障复盘
运维·kubernetes·etcd
Ai拆代码的曹操12 小时前
K8s 实战：CrashLoopBackOff 状态下 kubectl logs 拿不到日志的三层排查方案
linux·docker·kubernetes
热门推荐
01如何新建文件夹？ 电脑新建文件夹的4种方法02GitHub 镜像站点03国内可直接用、免费额度/永久免费的大模型API清单（含 SiliconFlow、火山、阿里、智谱、百度、Kimi、DeepSeek、DMXAPI 等）04AI 编程 IDE 全景解析 2026：Agent 全面接管开发链路052026 国产 AI 大模型横评：DeepSeek、通义千问、Kimi、文心一言、星火、豆包谁更能打？06微信历史版本含下载地址（ Windows PC | 安卓 | MAC ）及设置微信不更新07Agnes AI 免费 API 接入指南：文本、生图、生视频，一套接口全免费082026年7月AI圈大地震：GPT-5.6被政府限制、Claude入驻Slack、Anthropic自研芯片09历年考研数学一、数学二、数学三真题试卷及答案PDF1000 Debian字符界面如何支持中文