1. 环境准备(我的虚拟机是新打开的IP都配置完毕work是克隆Master)1.1系统准备角色 主机名 IP 地址 操作系统 配置Master k8s-master 192.xxx.xxx.10 Rocky Linux 10.0 8C / 4GBWorker1 k8s-node1 192.xxx.xxx.11 Rocky Linux 10.0 8C / 4GBWorker2 k8s-node2 192.xxx.xxx.12 Rocky Linux 10.0 8C / 4GB自己根据IP设置即可1.2环境设置1.2.1 关闭SWAP每台虚拟机swapoff -a sed -i / swap / s/^/#/ /etc/fstab1.2.2关闭防火墙systemctl stop firewalld1.2.3关闭SElinuxsetenforce 01.2.4加载内核模块cat /etc/modules-load.d/k8s.conf EOF overlay br_netfilter EOF modprobe overlay || true modprobe br_netfilter || true1.2.5设置内核参数iptables 桥接转发 / IPv4 转发 cat /etc/sysctl.d/k8s.conf EOF net.bridge.bridge-nf-call-iptables 1 net.bridge.bridge-nf-call-ip6tables 1 net.ipv4.ip_forward 1 EOF sysctl --system /dev/null2.安装容器运行时containerd2.1安装containerd.ioyum install -y yum-utils yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo yum install -y containerd.io2.2生成默认配置mkdir -p /etc/containerd containerd config default /etc/containerd/config.toml2.3配置镜像加速该步骤比较关键2.3.1打开配置文件/etc/containerd/config.toml找到[plugins.io.containerd.cri.v1.images.registry]段落将config_path 改为config_path /etc/containerd/certs.d2.3.2配置host.toml因为版本较新mirrosr已经不太支持sudo bash -c cat /etc/containerd/certs.d/docker.io/hosts.toml EOF server https://docker.io [host.https://docker.1ms.run] capabilities [pull, resolve] [host.https://docker.m.daocloud.io] capabilities [pull, resolve] [host.https://docker.xuanyuan.me] capabilities [pull, resolve] EOF完整镜像源# 为 registry.k8s.io 配置加速 mkdir -p /etc/containerd/certs.d/registry.k8s.io cat /etc/containerd/certs.d/registry.k8s.io/hosts.toml EOF server https://registry.k8s.io [host.https://k8s.m.daocloud.io] capabilities [pull, resolve] [host.https://registry.cn-hangzhou.aliyuncs.com/google_containers] capabilities [pull, resolve] EOF # 为 docker.io 配置加速用于 Calico 等镜像 mkdir -p /etc/containerd/certs.d/docker.io cat /etc/containerd/certs.d/docker.io/hosts.toml EOF server https://docker.io [host.https://docker.m.daocloud.io] capabilities [pull, resolve] [host.https://registry.cn-hangzhou.aliyuncs.com] capabilities [pull, resolve] EOF2.4重启containerdsystemctl restart containerd systemctl enable containerd2.5手动测试加速即便配置了加速源也很可能无法拉成功我建议先将全部镜像手动测试拉取一遍。ctr -n k8s.io images pull registry.k8s.io/pause:3.10.2这里贴出一行可以全部拉取测试更直观查看。3.安装 Kubernetes 组件kubeadm、kubelet、kubectl3.1添加 Kubernetes 仓库cat /etc/yum.repos.d/kubernetes.repo EOF [kubernetes] nameKubernetes baseurlhttps://pkgs.k8s.io/core:/stable:/v1.36/rpm/ enabled1 gpgcheck1 gpgkeyhttps://pkgs.k8s.io/core:/stable:/v1.36/rpm/repodata/repomd.xml.key EOF3.2 安装指定版本yum install -y kubelet-1.36.3 kubeadm-1.36.3 kubectl-1.36.3 systemctl enable kubelet4.开始初始化4.1手动拉取ctr -n k8s.io images pull --hosts-dir /etc/containerd/certs.d registry.k8s.io/kube-apiserver:v1.36.3 ctr -n k8s.io images pull --hosts-dir /etc/containerd/certs.d registry.k8s.io/kube-controller-manager:v1.36.3 ctr -n k8s.io images pull --hosts-dir /etc/containerd/certs.d registry.k8s.io/kube-scheduler:v1.36.3 ctr -n k8s.io images pull --hosts-dir /etc/containerd/certs.d registry.k8s.io/kube-proxy:v1.36.3 ctr -n k8s.io images pull --hosts-dir /etc/containerd/certs.d registry.k8s.io/coredns/coredns:v1.14.2 ctr -n k8s.io images pull --hosts-dir /etc/containerd/certs.d registry.k8s.io/pause:3.10.2 ctr -n k8s.io images pull --hosts-dir /etc/containerd/certs.d registry.k8s.io/etcd:3.6.8-0这里是2.5的补充我希望大家可以在初始化之前手动拉取查看速度比较建议。出现拉取失败可以重新拉取尝试也可以从 DaoCloud 通用代理拉取后 tag 到官方路径ctr -n k8s.io images pull m.daocloud.io/registry.k8s.io/etcd:3.6.8-0 ctr -n k8s.io images tag m.daocloud.io/registry.k8s.io/etcd:3.6.8-0 registry.k8s.io/etcd:3.6.8-0本人未尝试过第二个方法只是重新拉取一般就好了4.2执行 kubeadm initsudo kubeadm init \ --apiserver-advertise-address192.168.179.10 \ --pod-network-cidr10.244.0.0/16 \ --kubernetes-versionv1.36.34.3配置 kubectlmkdir -p $HOME/.kube cp -i /etc/kubernetes/admin.conf $HOME/.kube/config chown $(id -u):$(id -g) $HOME/.kube/config4.4 安装网络插件Calicokubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.29.1/manifests/calico.yaml与上面同理如果 Calico 镜像拉取失败可以手动预拉取在已经配置 docker.io 加速的节点上ctr -n k8s.io images pull --hosts-dir /etc/containerd/certs.d docker.io/calico/node:v3.29.1 ctr -n k8s.io images pull --hosts-dir /etc/containerd/certs.d docker.io/calico/cni:v3.29.1 ctr -n k8s.io images pull --hosts-dir /etc/containerd/certs.d docker.io/calico/kube-controllers:v3.29.15. 加入 Worker 节点5.1 在 master 生成 join 命令kubeadm token create --print-join-command有输出记下来你的输出复制。5.2 在 worker 节点执行准备工作确保 containerd 加速配置完成如果之前没有在 worker 节点配置过 containerd 和镜像加速请按照第 2 节完整配置。然后手动预拉取所需镜像推荐避免 join 后卡在拉取镜像# 拉取 kube-proxy 和 pause ctr -n k8s.io images pull --hosts-dir /etc/containerd/certs.d registry.k8s.io/kube-proxy:v1.36.3 ctr -n k8s.io images pull --hosts-dir /etc/containerd/certs.d registry.k8s.io/pause:3.10.2 # 拉取 Calico 镜像如果尚未安装 Calico这一步可以等 join 后由 DaemonSet 自动拉取但建议提前拉取 ctr -n k8s.io images pull --hosts-dir /etc/containerd/certs.d docker.io/calico/node:v3.29.1 ctr -n k8s.io images pull --hosts-dir /etc/containerd/certs.d docker.io/calico/cni:v3.29.1 ctr -n k8s.io images pull --hosts-dir /etc/containerd/certs.d docker.io/calico/kube-controllers:v3.29.15.3 执行 join 命令将你5.1输出的内容粘贴即可。5.4 验证节点状态在 master 上kubectl get nodes这是我配置的全过程中间省去了很多错误环节希望有所帮助