前置说明镜像拉取需要使用美国源/镜像仓库如1.Ubuntu APT / Ubuntu24.04美国源 Index of /Index of /ubuntu2.containerd.io Docker密钥 / Docker 美国源 Index of /https://download.docker.com/linux/ubuntu/gpg3. kubeadmkubeletkubectl k8s密钥 / K8s 美国源 pkgs.k8s.iov1.36https://pkgs.k8s.io/core:/stable:/v1.36/deb/Release.key4.网络插件Calio / Calico美国源 raw.githubusercontenthttps://raw.githubusercontent.com/projectcalico/calico/v3.29.4/manifests/calico.yaml环境信息集群服务器1台美国CN2大带宽弹性IP通过curl cip.cn显示为香港, 做master节点1台美国CN2大带宽弹性IP通过curl cip.cn显示为香港做worker/node节点操作系统Ubuntu 24.04Master IP149.88.88.183Worker / Node IP154.201.92.72K8s 版本v1.36.2容器运行时containerd镜像 / 软件源美国源K8s、docker、apt 、containerd.io免 sudo 配置操作前提前给当前用户赋予无密码 sudo 权限全文命令不带 sudo 可选两台节点全部步骤同步执行仅初始化、加入集群步骤区分 Master / Worker (Node)一、两台节点统一前置配置Master Worker / Node 都执行配置免密码 sudo实现全程不加 sudo操作bash运行usermod -aG sudoUSERechoUSER echo USERechoUSER ALL(ALL) NOPASSWD: ALL | tee -a /etc/sudoers.d/k8s-nopasswdchmod 440 /etc/sudoers.d/k8s-nopasswd重新登录终端生效新开一个ssh窗口校验bash运行sudo ls /root成功标准无需输入密码直接列出 root 目录文件无密码提示2. 关闭 SwapK8s 强制要求操作bash运行临时关闭swapoff -a永久注释fstab交换分区sed -i ‘/swap/s/^/#/’ /etc/fstab校验bash运行cat /proc/swaps成功标准输出为空无 swap 挂载行3. 加载内核模块、开启 IP 转发容器网络必备操作bash运行加载overlay、br_netfiltermodprobe overlaymodprobe br_netfiltersysctl持久配置tee /etc/sysctl.d/k8s.conf EOFnet.bridge.bridge-nf-call-iptables 1net.bridge.bridge-nf-call-ip6tables 1net.ipv4.ip_forward 1EOFsysctl --system校验bash运行sysctl net.bridge.bridge-nf-call-iptables net.ipv4.ip_forward成功标准两个参数输出值均为 14. 主机名与 hosts 解析避免节点域名解析失败Master 执行bash运行hostnamectl set-hostname k8s-mastertee -a /etc/hosts EOF149.88.88.183 k8s-master154.201.92.72 k8s-node01EOFNode 执行bash运行hostnamectl set-hostname k8s-node01tee -a /etc/hosts EOF149.88.88.183 k8s-master154.201.92.72 k8s-node01EOF校验两台都执行bash运行cat /etc/hosts | grep k8shostname成功标准hosts 包含两条 IP 映射hostname 输出对应主机名5. 替换 APT 为美国源Ubuntu24.04镜像仓库 Index of /操作bash运行备份原有源cp /etc/apt/sources.list /etc/apt/sources.list.bak写入美国Ubuntu源tee /etc/apt/sources.list EOFdeb Index of /ubuntu noble main restricted universe multiversedeb Index of /ubuntu noble-security main restricted universe multiversedeb Index of /ubuntu noble-updates main restricted universe multiversedeb Index of /ubuntu noble-backports main restricted universe multiverseEOF更新软件缓存apt update apt upgrade -y校验bash运行apt update成功标准无国内镜像域名全部拉取us.archive.ubuntu.com源无报错二、两台节点安装 containerd.io美国源安装依赖bash运行apt update apt install -y ca-certificates curl gnupg lsb-release校验bash运行dpkg -l ca-certificates curl gnupg lsb-release成功标准有版本输出导入 Docker 密钥bash运行curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg校验bash运行ls -l /usr/share/keyrings/docker-archive-keyring.gpgfile /usr/share/keyrings/docker-archive-keyring.gpg 或者gpg --show-keys /usr/share/keyrings/docker-archive-keyring.gpg 或者成功标准文件存在不会提示 No such file or directory正常打印 Docker 官方公钥信息包含发行方、指纹、有效期不提示损坏、无效密钥。添加 Docker 仓库含 containerd.iobash运行echo “deb [arch$(dpkg --print-architecture) signed-by/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable” | tee /etc/apt/sources.list.d/docker.list /dev/null检验bash运行cat /etc/apt/sources.list.d/docker.list成功标准文件存在且不为空架构、系统代号与本机匹配源地址为官方 Index of /更新并安装新版 containerd.iobash运行apt updateapt install -y containerd.io校验bash运行containerd --versionsystemctl status containerd成功标准输出版本号服务状态 active (running)生成 containerd 默认配置、配置 cgroup 驱动bash运行containerd config default | tee /etc/containerd/config.toml修改cgroup驱动为systemdK8s标准sed -i ‘s/SystemdCgroup false/SystemdCgroup true/g’ /etc/containerd/config.toml重启服务生效systemctl restart containerdsystemctl enable containerd校验bash运行grep SystemdCgroup /etc/containerd/config.toml成功标准输出 SystemdCgroup true三、两台节点安装 K8s 1.36.2 组件kubeadm,kubelet,kubectl美国源1、配置 Docker 美国源/镜像仓库 Index of /bash运行apt install -y apt-transport-https ca-certificates curl gnupg lsb-release导入GPG密钥curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg写入美国docker源echo “deb [arch$(dpkg --print-architecture) signed-by/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable” | tee /etc/apt/sources.list.d/docker.list /dev/null校验bash运行cat /etc/apt/sources.list.d/docker.list成功标准输出内容包含 https://download.docker.com/linux/ubuntu无国内镜像地址、无报错乱码。ls -l /usr/share/keyrings/docker-archive-keyring.gpg成功标准文件存在、文件大小不为 0无No such file or directory报错。2、配置 K8s 美国源/镜像仓库 pkgs.k8s.iov1.36bash运行mkdir -p /etc/apt/keyrings密钥curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.36/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpgK8s源echo “deb [signed-by/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.36/deb/ /” /etc/apt/sources.list.d/kubernetes.list校验bash运行cat /etc/apt/sources.list.d/kubernetes.listapt update成功标准源地址为https://pkgs.k8s.io/core:/stable:/v1.36/deb/ apt update 无密钥报错3、更新并安装bash运行apt update指定1.36.2K8S_VER1.36.2apt install -y kubeadmK8SVER−∗kubelet{K8S_VER}-* kubeletK8SV​ER−∗kubelet{K8S_VER}-* kubectl${K8S_VER}-*锁定版本apt-mark hold kubelet kubeadm kubectl containerd.io校验bash运行kubeadm versionkubectl version --clientkubelet --versionapt-mark showhold成功标准三者版本均输出 v1.36.2锁定列表包含三个组件四、仅 Master 节点执行初始化 K8s 控制平面kubeadm init 初始化命令参数说明apiserver-advertise-addressMaster 公网 IPpod-network-cidrCalico 标准网段 192.168.0.0/16kubernetes-version指定 1.36.2image-repositoryregistry.k8s.io美国镜像仓库国内源替换项这里用美国源bash运行kubeadm init \–apiserver-advertise-address149.88.88.183 \–kubernetes-versionv1.36.2 \–pod-network-cidr192.168.0.0/16 \–image-repositoryregistry.k8s.io初始化输出重点保存后续 Worker / Node 加入用输出末尾类似plaintextkubeadm join 149.88.88.183:6443 --token abcdef.0123456789abcdef \–discovery-token-ca-cert-hash sha256:xxxxxxxxxxxxxxxxxxxxtoken 有效期 24h过期执行 kubeadm token create --print-join-command 重新生成配置 kubectl 管理员凭证免 root 操作集群bash运行mkdir -p $HOME/.kubecp /etc/kubernetes/admin.conf $HOME/.kube/configchown(id−u):(id -u):(id−u):(id -g) $HOME/.kube/config校验 Master 集群状态bash运行kubectl get nodeskubectl get cs成功标准Master 节点状态 NotReady未装网络插件正常控制平面组件 scheduler、controller-manager 健康master 推送配置到 workerscp /etc/kubernetes/admin.conf rootk8s-node01:/root/sshpass -p “123456” scp /etc/kubernetes/admin.conf rootk8s-node01:/root/ 或者带登录密码执行示列密码为123456拷贝配置文件到node01成功标准每次提示错误直接显示第二个命令行部署 Calico 网络插件美国镜像仓库 raw.githubusercontent bash运行kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.29.4/manifests/calico.yaml校验网络 Pod 启动状态bash运行kubectl get pods -n kube-system -w成功标准所有 calico-node、calico-kube-controllers Pod 状态 Running按 CtrlC 退出再次校验 Master 节点就绪bash运行kubectl get nodes成功标准k8s-master 状态变为 Ready五、仅 Worker / Node 节点执行加入 Master 集群执行 Master 初始化输出的 kubeadm join 命令示例替换成你 Master 实际输出的 token 与 hashbash运行kubeadm join 149.88.88.183:6443 --token abcdef.0123456789abcdef \–discovery-token-ca-cert-hash sha256:xxxxxxxxxxxxxxxxxxxx校验 Node 加入结果Worker / Node 节点执行bash运行systemctl status kubelet成功标准kubelet 服务 running无认证 / 连接报错Worker / Node节点配置 kubectl 凭证mkdir -p $HOME/.kubemv /root/admin.conf $HOME/.kube/configchown(id−u):(id -u):(id−u):(id -g) $HOME/.kube/config校验 在Worker / Node节点校验集群状态bash运行kubectl get nodeskubectl get cs成功标准Master 节点状态 NotReady未装网络插件正常控制平面组件 scheduler、controller-manager 健康六、Master 节点全局集群最终验证全部节点就绪校验查看所有节点bash运行kubectl get nodes -o wide成功标准plaintextNAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIMEk8s-master Ready control-plane 15m v1.36.2 149.88.88.183 Ubuntu 24.04 LTS 6.8.0-XX-generic containerd://X.X.Xk8s-node01 Ready 3m v1.36.2 154.201.92.72 Ubuntu 24.04 LTS 6.8.0-XX-generic containerd://X.X.X两个节点全部 Ready版本统一 v1.36.2校验全部系统 Pod 正常运行bash运行kubectl get pods -n kube-system成功标准所有 Pod Running无 CrashLoopBackOff、Error 状态测试集群调度验证节点可正常负载 Podbash运行新建测试nginx deploymentkubectl create deploy test-nginx --imagenginx扩容2副本验证调度到node节点kubectl scale deploy test-nginx --replicas2查看Pod分布kubectl get pods -o wide成功标准两个 nginx Pod 分别调度到 master、node 节点全部 Running七、附录-补充排错命令节点加入失败时使用1.Master 重新生成 join 命令bash运行kubeadm token create --print-join-command2.Node 重置集群重新加入加入失败执行bash运行kubeadm reset -frm -rf $HOME/.kube3.查看 kubelet 详细日志bash运行journalctl -u kubelet -f