centos8 安装k8s-1.23(单控制节点)

Aug 5, 2026 // 大蚊子

1、准备工作 1.1、三台机器并配置hosts， vim /etc/hosts 192.168.2.134 k8s-node-02 192.168.2.135 k8s-node-01 192.168.2.136 k8s-master 1.2、在所有节点增加yum源： /etc/yum.repos.d/kubernetes.repo 注意：没有找到 kubernetes-el8的 [kubernetes] name=Kubernetes baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/ enabled=1 gpgcheck=1 repo_gpgcheck=1 gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg 粘贴上面的或者使用下面的脚本

配置源

cat «EOF > /etc/yum.repos.d/kubernetes.repo [kubernetes] name=Kubernetes baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64 enabled=1 gpgcheck=0 repo_gpgcheck=0 gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg EOF

说明: enabled=1 ：开启 gpgcheck=0 ：是否开启gpg签名，1开启，0关闭 repo_gpgcheck=0 ：是否检查元数据信息文件的签名信息与完整性，1开启，0关闭 1.3、在所有节点修改环境

关闭防火墙

systemctl disable firewalld systemctl stop firewalld

关闭selinux

临时禁用selinux

setenforce 0

永久关闭修改/etc/sysconfig/selinux文件设置

sed -i ’s/SELINUX=permissive/SELINUX=disabled/’ /etc/sysconfig/selinux sed -i “s/SELINUX=enforcing/SELINUX=disabled/g” /etc/selinux/config

禁用交换分区

swapoff -a

永久禁用，打开/etc/fstab注释掉swap那一行。

sed -i ’s/.swap./#&/’ /etc/fstab

修改内核参数

cat «EOF > /etc/sysctl.d/k8s.conf net.bridge.bridge-nf-call-ip6tables = 1 net.bridge.bridge-nf-call-iptables = 1 EOF sysctl –system 设置主机名： $ hostnamectl set-hostname 将桥接的IPv4流量传递到iptables的链： $ cat > /etc/sysctl.d/k8s.conf « EOF net.bridge.bridge-nf-call-ip6tables = 1 net.bridge.bridge-nf-call-iptables = 1 EOF $ sysctl –system # 生效

时间同步：（猜想在多个物理机不在同一个时区下才需要用到） $ yum install ntpdate -y $ ntpdate time.windows.com #或者使用 yum install chrony chronyc -a makestep #解决 [WARNING FileExisting-tc]: tc not found in system path wget https://mirrors.aliyun.com/centos/8-stream/BaseOS/x86_64/os/Packages/iproute-tc- 5.12.0-4.el8.x86_64.rpm rpm -ivh iproute-tc-5.12.0-4.el8.x86_64.rpm 1.4、在所有节点安装docker Kubernetes默认CRI（容器运行时）为Docker，因此先安装Docker 清华大学源 sudo yum-config-manager
–add-repo
https://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/centos/docker-ce.repo #centos stream8 sudo dnf config-manager
–add-repo
https://mirrors.tuna.tsinghua.edu.cn/docker-ce/linux/centos/docker-ce.repo sudo yum install docker-ce docker-ce-cli containerd.io

启动docker

systemctl enable docker.service systemctl enable docker systemctl start docker 修改文件 vi /etc/docker/daemon.json { “registry-mirrors”: [“https://q2hy3fzi.mirror.aliyuncs.com”], “exec-opts”: [“native.cgroupdriver=systemd”],

“insecure-registries”:[“harbor.dym.com”] } #查看docker的cgroup docker info | grep -i cgroup #重新加载daemon systemctl daemon-reload #重启docker systemctl restart docker 2、开始安装 2.1、在所有节点安装kubeadm,kubelet和kubectl #安装k8s(注意版本号，后面的版本需要对应) #yum install -y kubelet-1.23.5 kubeadm-1.23.5 kubectl-1.23.5 yum install -y kubelet kubeadm kubectl systemctl enable kubelet systemctl start kubelet #查看K8S版本kubeadm version kubectl version –client kubelet –version 2.2、在master节点执行kubeadm初始化 $ kubeadm reset $ kubeadm init
–bind-address=0.0.0.0
–apiserver-advertise-address=192.168.2.136
–image-repository registry.aliyuncs.com/google_containers
–kubernetes-version v1.23.5
–service-cidr=10.96.0.0/12 \

–pod-network-cidr=10.244.0.0/16
–ignore-preflight-errors=all #-–apiserver-advertise-address 集群通告地址（master内网） #–-image-repository 由于默认拉取镜像地址k8s.gcr.io国内无法访问，这里指定阿里云镜像仓库地址 #–-kubernetes-version K8s版本，与上面安装的一致 #–-service-cidr 集群内部虚拟网络，Pod统一访问入口 #-–pod-network-cidr Pod网络，与下面部署的CNI网络组件yaml中保持一致或者使用配置文件引导初始化： $ vi kubeadm.conf apiVersion: kubeadm.k8s.io/v1beta2 kind: ClusterConfiguration kubernetesVersion: v1.21.1 imageRepository: registry.aliyuncs.com/google_containers networking: podSubnet: 10.244.0.0/16 serviceSubnet: 10.96.0.0/12 $ kubeadm init –config kubeadm.conf –ignore-preflight-errors=all 执行日志 [init] Using Kubernetes version: v1.23.5 [preflight] Running pre-flight checks [WARNING Mem]: the system RAM (987 MB) is less than the minimum 1700 MB [preflight] Pulling images required for setting up a Kubernetes cluster [preflight] This might take a minute or two, depending on the speed of your internet connection [preflight] You can also perform this action in beforehand using ‘kubeadm config images pull’ [certs] Using certificateDir folder “/etc/kubernetes/pki” [certs] Generating “ca” certificate and key [certs] Generating “apiserver” certificate and key [certs] apiserver serving cert is signed for DNS names [k8s-master kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [10.96.0.1 192.168.2.136]

[certs] Generating “apiserver-kubelet-client” certificate and key [certs] Generating “front-proxy-ca” certificate and key [certs] Generating “front-proxy-client” certificate and key [certs] Generating “etcd/ca” certificate and key [certs] Generating “etcd/server” certificate and key [certs] etcd/server serving cert is signed for DNS names [k8s-master localhost] and IPs [192.168.2.136 127.0.0.1 ::1] [certs] Generating “etcd/peer” certificate and key [certs] etcd/peer serving cert is signed for DNS names [k8s-master localhost] and IPs [192.168.2.136 127.0.0.1 ::1] [certs] Generating “etcd/healthcheck-client” certificate and key [certs] Generating “apiserver-etcd-client” certificate and key [certs] Generating “sa” key and public key [kubeconfig] Using kubeconfig folder “/etc/kubernetes” [kubeconfig] Writing “admin.conf” kubeconfig file [kubeconfig] Writing “kubelet.conf” kubeconfig file [kubeconfig] Writing “controller-manager.conf” kubeconfig file [kubeconfig] Writing “scheduler.conf” kubeconfig file [kubelet-start] Writing kubelet environment file with flags to file “/var/lib/kubelet/kubeadm-flags.env” [kubelet-start] Writing kubelet configuration to file “/var/lib/kubelet/config.yaml” [kubelet-start] Starting the kubelet [control-plane] Using manifest folder “/etc/kubernetes/manifests” [control-plane] Creating static Pod manifest for “kube-apiserver” [control-plane] Creating static Pod manifest for “kube-controller-manager” [control-plane] Creating static Pod manifest for “kube-scheduler” [etcd] Creating static Pod manifest for local etcd in “/etc/kubernetes/manifests” [wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory “/etc/kubernetes/manifests”. This can take up to 4m0s [apiclient] All control plane components are healthy after 25.527204 seconds [upload-config] Storing the configuration used in ConfigMap “kubeadm-config” in the “kube-system” Namespace [kubelet] Creating a ConfigMap “kubelet-config-1.23” in namespace kube-system with the configuration for the kubelets in the cluster NOTE: The “kubelet-config-1.23” naming of the kubelet ConfigMap is deprecated. Once the UnversionedKubeletConfigMap feature gate graduates to Beta the default name will become just “kubelet-config”. Kubeadm upgrade will handle this transition transparently. [upload-certs] Skipping phase. Please see –upload-certs [mark-control-plane] Marking the node k8s-master as control-plane by adding the labels: [node-role.kubernetes.io/master(deprecated) node-role.kubernetes.io/control-plane node.kubernetes.io/exclude-from-external-load-balancers] [mark-control-plane] Marking the node k8s-master as control-plane by adding the taints [node-role.kubernetes.io/master:NoSchedule] [bootstrap-token] Using token: x12s1y.pwaot2zd0hw1tbsr [bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles

[bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to get nodes [bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials [bootstrap-token] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token [bootstrap-token] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster [bootstrap-token] Creating the “cluster-info” ConfigMap in the “kube-public” namespace [kubelet-finalize] Updating “/etc/kubernetes/kubelet.conf” to point to a rotatable kubelet client certificate and key [addons] Applied essential addon: CoreDNS [addons] Applied essential addon: kube-proxy Your Kubernetes control-plane has initialized successfully! To start using your cluster, you need to run the following as a regular user: mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config Alternatively, if you are the root user, you can run: export KUBECONFIG=/etc/kubernetes/admin.conf You should now deploy a pod network to the cluster. Run “kubectl apply -f [podnetwork].yaml” with one of the options listed at: https://kubernetes.io/docs/concepts/cluster-administration/addons/ Then you can join any number of worker nodes by running the following on each as root: kubeadm join 192.168.2.136:6443 –token x12s1y.pwaot2zd0hw1tbsr
–discovery-token-ca-cert-hash sha256:6b1e36c6ce96c501ccfcd0a64f0accd115a0c10628bcb1fd5131dd86587e186a 配置 kubectl ： $ mkdir -p $HOME/.kube $ sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config

$ sudo chown $(id -u):$(id -g) $HOME/.kube/config $ kubectl get nodes NAME STATUS ROLES AGE VERSION k8s-master NotReady control-plane,master 2m25s v1.21.0 k8s-node1 NotReady 112s v1.21.0 k8s-node2 NotReady 112s v1.21.0 以上，安装master节点完毕。可以使用kubectl get nodes查看一下，此时master处于NotReady状态，暂时不用管。 2.3、node节点加入k8s集群 #可以使用上面kubeadm init输出的kubeadm join命令： kubeadm join 192.168.2.136:6443 –token x12s1y.pwaot2zd0hw1tbsr
–discovery-token-ca-cert-hash sha256:6b1e36c6ce96c501ccfcd0a64f0accd115a0c10628bcb1fd5131dd86587e186a 如果上面的日志丢失了可以使用kubeadm token create –print-join-command来获取。获取后执行如下。

加入集群，如果这里不知道加入集群的命令，可以登录master节点，使用kubeadm token create –

print-join-command 来获取 kubeadm join 192.168.99.104:6443 –token ncfrid.7ap0xiseuf97gikl
–discovery-token-ca-cert-hash sha256:47783e9851a1a517647f1986225f104e81dbfd8fb256ae55ef6d68ce9334c6a2 token有效期为24小时，如果过期，需要重新创建token： $ kubeadm token create –print-join-command #快捷生成方式

查看token状态

TTL值就是token生于时间

[root@k8s-master ~]# kubeadm token list TOKEN TTL EXPIRES USAGES DESCRIPTION EXTRA GROUPS

5ti5kd.o32bm9lofv6zej94 21h 2019-05-22T11:16:31+08:00 authentication,signing The default bootstrap token generated by ‘kubeadm init’. system:bootstrappers:kubeadm:default-node- token

重新生产token

[root@k8s-master ~]# kubeadm token create W0511 05:25:48.747429 31569 configset.go:202] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io] lb2hib.5kf3zjrzkp8e632w

获取–discovery-token-ca-cert-hash值

[root@k8s-master ~]# openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa - pubin -outform der 2>/dev/null |
openssl dgst -sha256 -hex | sed ’s/^.* //’ 4fcac7c487209d7c354351ba6f93110253df4d0440fc68cb23fc4ac0baed4e0c

加入集群命令–在node节点执行

[root@k8s-master ~]# kubeadm join 192.168.1.106:6443 –token hb0mhv.5kf3zjrzkp8e632w
–discovery-token-ca-cert-hash sha256:cd778ad01bdbc656eaff7d3b1273691f0070ebbadd2f1b8a3189a6dc1e88f39f 注意: 需要替换两个位置的值第一个位置替换:lb2hib.5kf3zjrzkp8e632w第二个位置替换:4fcac7c487209d7c354351ba6f93110253df4d0440fc68cb23fc4ac0baed4e0c 验证： $ kubectl get nodes The connection to the server localhost:8080 was refused - did you specify the right host or port? 3、安装网络插件flannel（master机器）以上步骤安装完后，机器搭建起来了，但状态还是NotReady状态，如下图，master机器需要安装flanneld。

下载官方fannel配置文件

wget https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube- flannel.yml kube-flannel.yml kube-flannel.yml.quay.io 2. 安装fannel kubectl apply -f kube-flannel.yml 3.验证结果 #先获取pods [root@localhost home]# kubectl get pods –all-namespaces NAMESPACE NAME READY STATUS RESTARTS AGE kube-system coredns-6d8c4cb4d-fr69c 1/1 Running 0 59m kube-system coredns-6d8c4cb4d-zkv4l 1/1 Running 0 59m kube-system etcd-k8s-master 1/1 Running 1 59m kube-system kube-apiserver-k8s-master 1/1 Running 1 60m kube-system kube-controller-manager-k8s-master 1/1 Running 1 59m kube-system kube-flannel-ds-fpxq9 1/1 Running 0 21m kube-system kube-flannel-ds-mhjvw 1/1 Running 0 21m kube-system kube-flannel-ds-vc2x4 1/1 Running 0 21m kube-system kube-proxy-77rxc 1/1 Running 1 55m kube-system kube-proxy-hdg28 1/1 Running 0 59m kube-system kube-proxy-t9sq4 1/1 Running 0 54m kube-system kube-scheduler-k8s-master 1/1 Running 1 60m #查看一个pod的日志即可看到网络信息 [root@localhost home]# kubectl logs -n kube-system kube-proxy-77rxc I0415 09:52:42.383370 1 node.go:163] Successfully retrieved node IP: 192.168.2.134

I0415 09:52:42.383420 1 server_others.go:138] “Detected node IP” address=“192.168.2.134” I0415 09:52:42.383437 1 server_others.go:561] “Unknown proxy mode, assuming iptables proxy” proxyMode="" I0415 09:52:42.675853 1 server_others.go:206] “Using iptables Proxier” I0415 09:52:42.675893 1 server_others.go:213] “kube-proxy running in dual-stack mode” ipFamily=IPv4 I0415 09:52:42.675900 1 server_others.go:214] “Creating dualStackProxier for iptables” I0415 09:52:42.675908 1 server_others.go:491] “Detect-local-mode set to ClusterCIDR, but no IPv6 cluster CIDR defined, , defaulting to no-op detect-local for IPv6” I0415 09:52:42.676124 1 server.go:656] “Version info” version=“v1.23.5” I0415 09:52:42.676847 1 conntrack.go:52] “Setting nf_conntrack_max” nf_conntrack_max=131072 I0415 09:52:42.677179 1 config.go:317] “Starting service config controller” I0415 09:52:42.677207 1 shared_informer.go:240] Waiting for caches to sync for service config I0415 09:52:42.677220 1 config.go:226] “Starting endpoint slice config controller” I0415 09:52:42.677224 1 shared_informer.go:240] Waiting for caches to sync for endpoint slice config I0415 09:52:42.778170 1 shared_informer.go:247] Caches are synced for endpoint slice config I0415 09:52:42.778170 1 shared_informer.go:247] Caches are synced for service config 也将fannel可以换成calico curl https://docs.projectcalico.org/v3.18/manifests/calico.yaml -O kubectl apply -f calico.yaml 4、安装ui界面 Kuboard v3 4.1、执行 Kuboard v3 在 K8S 中的安装官网：https://kuboard.cn/

kubectl apply -f https://addons.kuboard.cn/kuboard/kuboard-v3.yaml

您也可以使用下面的指令，唯一的区别是，该指令使用华为云的镜像仓库替代 docker hub 分发 Kuboard

所需要的镜像

kubectl apply -f https://addons.kuboard.cn/kuboard/kuboard-v3-swr.yaml

定制参数如果您想要定制 Kuboard 的启动参数，请将该 YAML 文件下载到本地，并修改其中的 ConfigMap 4.2、等待 Kuboard v3 就绪执行指令 [root@node1 ~]# kubectl get pods -n kuboard NAME READY STATUS RESTARTS AGE kuboard-agent-2-65bc84c86c-r7tc4 1/1 Running 2 28s kuboard-agent-78d594567-cgfp4 1/1 Running 2 28s kuboard-etcd-fh9rp 1/1 Running 0 67s kuboard-etcd-nrtkr 1/1 Running 0 67s kuboard-etcd-ader3 1/1 Running 0 67s kuboard-v3-645bdffbf6-sbdxb 1/1 Running 0 67s 4.3、访问 Kuboard 在浏览器中打开链接输入初始用户名和密码，并登录用户名：

密码：添加新的集群 Kuboard v3 是支持 Kubernetes 多集群管理的，在 Kuboard v3 的首页里，点击添加集群按钮，在向导的引导下可以完成集群的添加；向 Kuboard v3 添加新的 Kubernetes 集群时，请确保：您新添加集群可以访问到当前集群 Master 节点的、、端口；如果您打算新添加到 Kuboard 中的集群与当前集群不在同一个局域网，请咨询 Kuboard 团队，帮助您解决问题。 4.4、卸载执行 Kuboard v3 的卸载 kubectl delete -f https://addons.kuboard.cn/kuboard/kuboard-v3.yaml 清理遗留数据在 master 节点以及带有k8s.kuboard.cn/role=etcd标签的节点上执行 rm -rf /usr/share/kuboard 5、常用命令卸载旧版本 yum remove -y kubelet kubeadm kubectl 安装kubelet、kubeadm、kubectl yum install -y kubelet kubeadm kubectl 重启 docker，并启动 kubelet systemctl enable kubelet && systemctl start kubelet 之后便可给Master节点打上快照，然后worker节点便可用这个快照进行构建。