CentOS7.9安装部署K8S-1.26版本

最新推荐文章于 2026-08-09 21:32:13 发布

原创最新推荐文章于 2026-08-09 21:32:13 发布 · 1.2k 阅读

13 ·

本内容遵循CC 4.0 BY-SA版权协议

GEO检测

CentOS 运维避坑实战

CentOS7.9 安装 Python3.8.16 后 yum 报错，快速修复方案

一键订阅

kubeadm搭建安装k8s集群v1.26版本完整教程
四台服务器搭建K8S两主两从
192.168.88.21 k8s-master1
192.168.88.22 k8s-master2
192.168.88.23 k8s-node1
192.168.88.24 k8s-node2

一.升级系统内核：

Centos7.9默认的系统内核为3.10，使用ipvs需要内核版本高于4.1
#安装ELRepo仓库的yum源
yum install -y https://www.elrepo.org/elrepo-release-7.el7.elrepo.noarch.rpm

#更新yum源仓库
yum -y update && yum clean all && yum makecache fast

#查看可用的系统内核包
yum --disablerepo="*" --enablerepo="elrepo-kernel" list available
# 长期维护版本为lt，最新主线稳定版为ml

#选择的是长期维护版本kernel-lt，如需更新最新稳定版选择kernel-ml，建议选择长期维护版，目前为5.4版本，内核版本过高也不好
yum --enablerepo=elrepo-kernel install -y kernel-lt

#查看可用内核版本及启动顺序
awk -F\' '$1=="menuentry " {print i++ " : " $2}' /boot/grub2/grub.cfg

0 : CentOS Linux (5.4.108-1.el7.elrepo.x86_64) 7 (Core)
1 : CentOS Linux (3.10.0-1160.11.1.el7.x86_64) 7 (Core)
2 : CentOS Linux (3.10.0-1160.el7.x86_64) 7 (Core)
3 : CentOS Linux (0-rescue-20210128140208453518997635111697) 7 (Core)

#安装辅助工具
yum install -y grub2-pc

#设置内核默认启动顺序
grub2-set-default 0

#编辑/etc/default/grub文件
vim /etc/default/grub

#设置GRUB_DEFAULT=0 #只需要修改这里即可
sed -i 's/GRUB_DEFAULT=saved/GRUB_DEFAULT=0/g' /etc/default/grub

#生成grub 配置文件
# 运行grub2-mkconfig命令来重新创建内核配置
grub2-mkconfig -o /boot/grub2/grub.cfg

#重启系统
reboot
# 或者
shutdown -r now

#重启完成后，查看内核版本是否正确
uname -r

二.必要配置
1.修改hosts文件，配置主机名：
cat >> /etc/hosts << EOF
192.168.88.20 k8s-master1
192.168.88.21 k8s-master2
192.168.88.22 k8s-node1
192.168.88.23 k8s-node2
EOF

2.每台机器都设置转发IPv4并让iptables看到桥接流量
cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
overlay
br_netfilter
EOF

]# sudo modprobe overlay && sudo modprobe br_netfilter

# 设置所需的 sysctl 参数，参数在重新启动后保持不变
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
EOF

# 应用 sysctl 参数而不重新启动
sudo sysctl --system

三.每台机器设置时间同步
yum install chrony -y && systemctl enable chronyd --now && chronyc sources
关闭防火墙及swap：
]# systemctl stop firewalld && systemctl disable firewalld && sed -i 's/^SELINUX=enforcing$/SELINUX=disabled/' /etc/selinux/config && sed -ri 's/.*swap.*/#&/' /etc/fstab
关闭SElinux及swap
# 永久禁用
sed -i 's/^SELINUX=enforcing$/SELINUX=disabled/' /etc/selinux/config
# 永久关闭
sed -ri 's/.*swap.*/#&/' /etc/fstab
# 可以通过这个命令查看swap是否关闭了
free -h

四.安装CRI

自 Kubernetes 1.20 版本开始，官方不再支持使用 Docker 作为默认的容器运行时。
每台机器安装containerd

# 添加docker源
curl -L -o /etc/yum.repos.d/docker-ce.repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
# 安装containerd
yum install -y containerd.io
# 创建默认配置文件
containerd config default > /etc/containerd/config.toml
# 设置aliyun地址，不设置会连接不上, 如果无法下载镜像检查一下配置是否替换 cat /etc/containerd/config.toml |grep sandbox_image
# 将pause:3.6替换为pause:3.9，如果有关版本发生变化需要修改
sed -i "s#registry.k8s.io/pause:3.6#registry.aliyuncs.com/google_containers/pause:3.9#g" /etc/containerd/config.toml
# 设置驱动为systemd，Kubernetes官网推荐设置
sed -i 's/SystemdCgroup = false/SystemdCgroup = true/g' /etc/containerd/config.toml
# 设置docker地址为aliyun镜像地址
sudo sed -i '/\[plugins\."io\.containerd\.grpc\.v1\.cri"\.registry\.mirrors\]/a\
[plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]\
endpoint = [\
    "https://8aj710su.mirror.aliyuncs.com",\
    "https://registry-1.docker.io",\
    "https://docker-0.unsee.tech",\
    "https://docker-cf.registry.cyou",\
    "https://docker.1panel.live",\
    "http://hub-mirror.c.163.com",\
    "https://docker.mirrors.ustc.edu.cn",\
    "https://registry.docker-cn.com",\
    "https://dockerhub.azk8s.cn",\
    "https://mirror.ccs.tencentyun.com",\
    "https://registry.cn-hangzhou.aliyuncs.com",\
    "https://docker.m.daocloud.io",\
    "https://mirror.baidubce.com",\
    "https://docker.nju.edu.cn",\
    "https://docker.mirrors.sjtug.sjtu.edu.cn",\
    "https://mirror.iscas.ac.cn"\
]' /etc/containerd/config.toml

# 重启服务
]# systemctl daemon-reload && systemctl enable --now containerd && systemctl restart containerd && systemctl status containerd

# 查看是否安装成功

~]# containerd -version
containerd containerd.io 1.6.31 e377cd56a71523140ca6ae87e30244719194a521

每台机器安装crictl工具用来调度Containerd
# 安装crictl工具
wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.24.0/crictl-v1.24.0-linux-amd64.tar.gz
tar -zxvf crictl-v1.24.0-linux-amd64.tar.gz -C /usr/local/bin
# 生成配置文件
crictl config runtime-endpoint
# 编辑配置文件
cat << EOF | tee /etc/crictl.yaml
runtime-endpoint: "unix:///run/containerd/containerd.sock"
image-endpoint: "unix:///run/containerd/containerd.sock"
timeout: 10
debug: false
pull-image-on-create: false
disable-pull-on-run: false
EOF

# 查看是否安装成功
~]# crictl version
Version: 0.1.0
RuntimeName: containerd
RuntimeVersion: 1.6.31
RuntimeApiVersion: v1

#crictl使用（与Docker基本一致）

crictl ps
crictl images ps
crictl pull nginx:1.18.0
crictl pods --name etcd
crictl exec -it 1f73f2d81bf98 ls

五. 安装kubelet kubeadm kubectl 三大件

cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
exclude=kubelet kubeadm kubectl
EOF

yum clean all && yum makecache && yum repolist
# 安装指定版本
sudo yum install -y kubelet-1.26.5 kubeadm-1.26.5 kubectl-1.26.5 --disableexcludes=kubernetes

#启动kubelet
systemctl enable kubelet --now && systemctl status kubelet

Master执行集群初始化,192.168.88.21替换为你的master节点IP
kubeadm init \
--apiserver-advertise-address=192.168.88.50 \
--control-plane-endpoint=k8s-master1 \
--image-repository registry.aliyuncs.com/google_containers \
--kubernetes-version v1.26.5 \
--service-cidr=172.16.0.0/16 \
--pod-network-cidr=10.244.0.0/16 \
--ignore-preflight-errors=all

看到如下信息，说明初始化成功！
Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

Alternatively, if you are the root user, you can run:

export KUBECONFIG=/etc/kubernetes/admin.conf

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/

You can now join any number of control-plane nodes by copying certificate authorities
and service account keys on each node and then running the following as root:

kubeadm join k8s-master1:6443 --token vpqk0f.4bu4mrmcistw1stg \
--discovery-token-ca-cert-hash sha256:d530ebf2f1c260aa63b014e47ccf23d6a85355f1b4f7bcda772c204686dd3130 \
--control-plane

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join k8s-master1:6443 --token vpqk0f.4bu4mrmcistw1stg \
--discovery-token-ca-cert-hash sha256:d530ebf2f1c260aa63b014e47ccf23d6a85355f1b4f7bcda772c204686dd3130

利用上述Token,将其他worker节点加入集群
~]# kubeadm join 192.168.88.21:6443 --token libh4p.td06g7kq2n0eudn7 \
>         --discovery-token-ca-cert-hash sha256:17c57c4168d2199dba5511c8cbbb053fc96c0fbc52aae0a3cc2b4eb05c5775c9
[preflight] Running pre-flight checks
        [WARNING Hostname]: hostname "k8s-node1" could not be reached
        [WARNING Hostname]: hostname "k8s-node1": lookup k8s-node1 on 8.8.8.8:53: no such host
[preflight] Reading configuration from the cluster...
[preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...

This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.

Run 'kubectl get nodes' on the control-plane to see this node join the cluster.

高可用Master2节点加入：
在其他Master节点操作
]# mkdir -p /etc/kubernetes/pki/etcd
主Master拷贝证书到Master2：
]# scp /etc/kubernetes/admin.conf k8s-master2:/etc/kubernetes/ && scp /etc/kubernetes/pki/front-proxy-ca* k8s-master2:/etc/kubernetes/pki/ && scp /etc/kubernetes/pki/ca.* k8s-master2:/etc/kubernetes/pki/ && scp /etc/kubernetes/pki/etcd/ca.* k8s-master2:/etc/kubernetes/pki/etcd/ && scp /etc/kubernetes/pki/sa.* k8s-master2:/etc/kubernetes/pki/
然后执行上一条Master节点加入的Token指定，即可把新的Master2节点加入集群！
再执行下创建对应文件权限目录：
]# mkdir -p $HOME/.kube && cp -i /etc/kubernetes/admin.conf $HOME/.kube/config && chown $(id -u):$(id -g) $HOME/.kube/config

安装Calico网络插件
当前企业级环境使用的最多的CNI插件是Calico，其优点是转发效率好，支持网络策略，容易查错
Master1节点安装Calico插件
# 创建一个yaml文件存放目录
mkdir /root/cni && cd /root/cni

# 下载operator & custom-resources

wget https://raw.githubusercontent.com/projectcalico/calico/v3.25.1/manifests/tigera-operator.yaml && wget https://raw.githubusercontent.com/projectcalico/calico/v3.25.1/manifests/custom-resources.yaml

# 修改custom-resources.yaml匹配容器网络 --pod-network-cidr=10.244.0.0/16

vim +13 custom-resources.yaml #cidr: 192.168.0.0/16 -> cidr: 10.244.0.0/16

# 器群启动calico网络
kubectl create -f tigera-operator.yaml && kubectl create -f custom-resources.yaml
注意，主节点如果出现如下报错：
cni]# kubectl create -f tigera-operator.yaml
The connection to the server localhost:8080 was refused - did you specify the right host or port?
则可执行如下命令：
echo "export KUBECONFIG=/etc/kubernetes/admin.conf" >> ~/.bash_profile && source ~/.bash_profile
然后再执行：
kubectl create -f tigera-operator.yaml
kubectl create -f custom-resources.yaml

顺利解决，输出如下：
]# kubectl create -f tigera-operator.yaml
namespace/tigera-operator created
customresourcedefinition.apiextensions.k8s.io/bgpconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/bgppeers.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/blockaffinities.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/caliconodestatuses.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/clusterinformations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/felixconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/globalnetworkpolicies.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/globalnetworksets.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/hostendpoints.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamblocks.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamconfigs.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamhandles.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ippools.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipreservations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/kubecontrollersconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/networkpolicies.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/networksets.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/apiservers.operator.tigera.io created
customresourcedefinition.apiextensions.k8s.io/imagesets.operator.tigera.io created
customresourcedefinition.apiextensions.k8s.io/installations.operator.tigera.io created
customresourcedefinition.apiextensions.k8s.io/tigerastatuses.operator.tigera.io created
serviceaccount/tigera-operator created
clusterrole.rbac.authorization.k8s.io/tigera-operator created
clusterrolebinding.rbac.authorization.k8s.io/tigera-operator created
deployment.apps/tigera-operator created

]# kubectl create -f custom-resources.yaml
installation.operator.tigera.io/default created
apiserver.operator.tigera.io/default created

六. 切换ipvs,所有机器执行准备步骤
# 所有机器执行，为kube-proxy开启ipvs的前提需要加载以下的内核模块
cat > /etc/sysconfig/modules/ipvs.modules <<EOF
#!/bin/bash
modprobe -- ip_vs
modprobe -- ip_vs_rr
modprobe -- ip_vs_wrr
modprobe -- ip_vs_sh
modprobe -- nf_conntrack
EOF

# 执行加载命令，检查是否完成加载
chmod 755 /etc/sysconfig/modules/ipvs.modules && bash /etc/sysconfig/modules/ipvs.modules && lsmod | grep -e ip_vs -e nf_conntrack

# 所有机器ipset软件包
yum install -y ipset ipvsadm

** Master机器修改kube-proxy configmap
#修改kube-proxy configmap为ipvs模式
kubectl edit configmap kube-proxy -n kube-system ##48行左右

...
    kind: KubeProxyConfiguration
    metricsBindAddress: ""
    mode: "ipvs" # "" 改成 ipvs
    nodePortAddresses: null
    oomScoreAdj: null
...

configmap/kube-proxy edited

# 重启kube-proxy容器
kubectl delete pods -n kube-system -l k8s-app=kube-proxy

# 成功验证
kubectl -n kube-system logs kube-proxy-qmdhp|grep ipvs

I0415 10:48:49.984477 1 server_others.go:259] Using ipvs Proxier.
# 在 kube-proxy pod 看到如上信息后说明是启用ipvs的

此时查看所有节点状态：是否准备完毕！
~]# kubectl get nodes -owide
NAME          STATUS   ROLES           AGE   VERSION   INTERNAL-IP     EXTERNAL-IP   OS-IMAGE                KERNEL-VERSION                CONTAINER-RUNTIME
k8s-master1   Ready    control-plane   54m   v1.26.4   192.168.88.21   <none>        CentOS Linux 7 (Core)   5.4.274-1.el7.elrepo.x86_64   containerd://1.6.31
k8s-master2   Ready    <none>          16m   v1.26.4   192.168.88.22   <none>        CentOS Linux 7 (Core)   5.4.274-1.el7.elrepo.x86_64   containerd://1.6.31
k8s-node1     Ready    <none>          52m   v1.26.4   192.168.88.23   <none>        CentOS Linux 7 (Core)   5.4.274-1.el7.elrepo.x86_64   containerd://1.6.31
k8s-node2     Ready    <none>          52m   v1.26.4   192.168.88.24   <none>        CentOS Linux 7 (Core)   5.4.274-1.el7.elrepo.x86_64   containerd://1.6.31

状态为Ready，说明已经成功启用！

后续操作：可选
# 创建名称空间，并使用 deployment创建一次部署，镜像为Nginx,副本数为3份。
]# kubectl create ns myproject
]# kubectl create deployment nginx-demo --image=nginx --replicas=3 -n myproject
deployment.apps/nginx-demo created
]# kubectl get pods -owide -n myproject
即可查看pod创建及分配到的节点信息：
~]# kubectl get pods -owide -n myproject
NAME                         READY   STATUS    RESTARTS   AGE    IP               NODE          NOMINATED NODE   READINESS GATES
nginx-demo-98c8d48ff-njlhj   1/1     Running   0          2m5s   10.244.224.4     k8s-node3     <none>           <none>
nginx-demo-98c8d48ff-rn88k   1/1     Running   0          2m5s   10.244.169.131   k8s-node2     <none>           <none>
nginx-demo-98c8d48ff-xwxbg   1/1     Running   0          2m5s   10.244.36.68     k8s-node1     <none>           <none>

# 创建service暴露方式为NodePort
kubectl expose deployment nginx-demo --port=80 --target-port=80 --type=NodePort -n myproject
service/nginx-demo exposed

# 访问Nginx资源
]# kubectl get svc -A
NAME         TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)        AGE
kubernetes   ClusterIP   172.16.0.1      <none>        443/TCP        5h59m
nginx-demo   NodePort    172.16.17.244   <none>        80:30394/TCP   11s

副本数的扩容与缩容：
~]# kubectl scale --replicas=5 deploy/nginx-demo -n myproject
deployment.apps/nginx-demo scaled

采用滚动更新的方式更新镜像，并查看状态
watch -n 1 kubectl get pods -owide -n myproject

使用服务器IP+NodePort端口验证：
~]# curl http://192.168.88.21:30094
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
html { color-scheme: light dark; }
body { width: 35em; margin: 0 auto;
font-family: Tahoma, Verdana, Arial, sans-serif; }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

看到以上信息，说明部署成功！

Master机器设置kubectl简写，实际操作中非常实用！！
cat >> ~/.bashrc << EOF
alias kg='kubectl get'
alias k='kubectl'
alias kd='kubectl describe pods'
alias ke='kubectl explain'
alias ka='kubectl apply'
alias kl='kubectl logs'
EOF

source ~/.bashrc

---
apiVersion: v1
kind: deployment
metadata:
name: test-web
spec:
containers:
- name: nginx
    image: nginx:1.24.0
    imagePullPolicy: IfNotPresent
    ports:
    - containerPort: 80
    volumeMounts:
    - name: html
      mountPath: /usr/share/nginx/html
volumes:
- name: html
    persistentVolumeClaim:
      claimName: nginx-deploy-pvc
[root@k8s-master01 ~]# kubectl create -f test-web.yaml