ETCD_VER=v3.5.9

DOWNLOAD_URL=https://github.com/etcd-io/etcd/releases/download/${ETCD_VER}/etcd-${ETCD_VER}-linux-amd64.tar.gz

wget ${DOWNLOAD_URL} tar -xvf etcd-${ETCD_VER}-linux-amd64.tar.gz

sudo mv etcd-${ETCD_VER}-linux-amd64/etcd* /usr/local/bin/

[root@master ~]# etcd –version
etcd Version: 3.5.9
Git SHA: bdbbde998
Go Version: go1.19.9
Go OS/Arch: linux/amd64
[root@master ~]# etcdctl version
etcdctl version: 3.5.9
API version: 3.5

curl -L https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssl_1.6.1_linux_amd64 -o cfssl curl -L https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssljson_1.6.1_linux_amd64 -o cfssljson

chmod +x cfssl cfssljson

sudo mv cfssl cfssljson /usr/local/bin/

udo mkdir -p /etc/etcd /var/lib/etcd

etcd 配置文件
为每个节点创建独立的配置文件 /etc/etcd/etcd.conf

启动 etcd
创建 systemd 服务文件 /etc/systemd/system/etcd.service

[Unit] Description=etcd

Documentation=https://github.com/coreos/etcd

[Service] Type=notify

ExecStart=/usr/local/bin/etcd –config-file=/etc/etcd/etcd.conf

Restart=always RestartSec=10s LimitNOFILE=40000 [Install]

WantedBy=multi-user.target

sudo systemctl daemon-reload

sudo systemctl enable etcd

sudo systemctl start etcd

加载模块
cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
overlay
br_netfilter
EOF

sudo modprobe overlay
sudo modprobe br_netfilter

配置 sysctl 参数
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
EOF

sudo sysctl –system

安装 Containerd
sudo yum install -y yum-utils device-mapper-persistent-data lvm2
sudo yum-config-mannager –add-repo https://download.docker.com/linux/centos/docker-ce.repo
sudo yum install -y containerd.io

配置 Containerd，生成默认主配置文件：
sudo containerd config default | sudo tee /etc/containerd/config.toml
[plugins.”io.containerd.grpc.v1.cri”.containerd.runtimes.runc.options]
SystemdCgroup = true
sudo systemctl restart containerd
sudo systemctl enable containerd

cat <<EOF | sudo tee /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg
EOF

sudo yum install -y kubelet kubeadm kubectl –disableexcludes=kubernetes
缺少 tc 工具
sudo yum install -y iproute-tc

/etc/kubernetes/manifests/etcd.yaml 文件已经存在，说明之前可能尝试过初始化集群，但未完全清理。

或者使用 kubeadm reset 清理之前的集群配置后再重新初始化：

sudo kubeadm reset

查看端口占用进程
sudo lsof -i :6443
sudo lsof -i :10250
sudo lsof -i :10251
sudo lsof -i :10252
containerd 的 CRI 插件未启用或版本过低，导致 Kubernetes 无法通过 CRI 与容器运行时通信

containerd –version

启用 CRI 插件：

编辑 containerd 配置文件 /etc/containerd/config.toml，确保以下内容存在：

[plugins.”io.containerd.grpc.v1.cri”]
sandbox_image = “registry.k8s.io/pause:3.9”

sudo kubeadm reset -f
sudo rm -rf /etc/kubernetes/
sudo rm -rf ~/.kube/

sudo systemctl daemon-reload
sudo systemctl restart containerd
sudo systemctl restart kubelet

root@master containerd]# sudo kubeadm init –pod-network-cidr=10.244.0.0/16 –cri-socket=/run/containerd/containerd.sock
W0329 12:37:17.926025 1510436 initconfiguration.go:120] Usage of CRI endpoints without URL scheme is deprecated and can cause kubelet errors in the future. Automatically prepending scheme “unix” to the “criSocket” with value “/run/containerd/containerd.sock”. Please update your configuration!
I0329 12:37:18.487052 1510436 version.go:256] remote version is much newer: v1.32.3; falling back to: stable-1.28
[init] Using Kubernetes version: v1.28.15
[preflight] Running pre-flight checks
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
[preflight] You can also perform this action in beforehand using ‘kubeadm config images pull’

q^H^C
[root@master containerd]# sudo kubeadm init –pod-network-cidr=10.244.0.0/16 –cri-socket=/run/containerd/containerd.sock
W0329 12:38:06.429419 1510658 initconfiguration.go:120] Usage of CRI endpoints without URL scheme is deprecated and can cause kubelet errors in the future. Automatically prepending scheme “unix” to the “criSocket” with value “/run/containerd/containerd.sock”. Please update your configuration!
I0329 12:38:07.009412 1510658 version.go:256] remote version is much newer: v1.32.3; falling back to: stable-1.28
[init] Using Kubernetes version: v1.28.15
[preflight] Running pre-flight checks
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
[preflight] You can also perform this action in beforehand using ‘kubeadm config images pull’
[certs] Using certificateDir folder “/etc/kubernetes/pki”
[certs] Generating “ca” certificate and key
[certs] Generating “apiserver” certificate and key
[certs] apiserver serving cert is signed for DNS names [kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local master] and IPs [10.96.0.1 172.16.158.241]
[certs] Generating “apiserver-kubelet-client” certificate and key
[certs] Generating “front-proxy-ca” certificate and key
[certs] Generating “front-proxy-client” certificate and key
[certs] Generating “etcd/ca” certificate and key
[certs] Generating “etcd/server” certificate and key
[certs] etcd/server serving cert is signed for DNS names [localhost master] and IPs [172.16.158.241 127.0.0.1 ::1]
[certs] Generating “etcd/peer” certificate and key
[certs] etcd/peer serving cert is signed for DNS names [localhost master] and IPs [172.16.158.241 127.0.0.1 ::1]
[certs] Generating “etcd/healthcheck-client” certificate and key
[certs] Generating “apiserver-etcd-client” certificate and key
[certs] Generating “sa” key and public key
[kubeconfig] Using kubeconfig folder “/etc/kubernetes”
[kubeconfig] Writing “admin.conf” kubeconfig file
[kubeconfig] Writing “kubelet.conf” kubeconfig file
[kubeconfig] Writing “controller-manager.conf” kubeconfig file
[kubeconfig] Writing “scheduler.conf” kubeconfig file
[etcd] Creating static Pod manifest for local etcd in “/etc/kubernetes/manifests”
[control-plane] Using manifest folder “/etc/kubernetes/manifests”
[control-plane] Creating static Pod manifest for “kube-apiserver”
[control-plane] Creating static Pod manifest for “kube-controller-manager”
[control-plane] Creating static Pod manifest for “kube-scheduler”
[kubelet-start] Writing kubelet environment file with flags to file “/var/lib/kubelet/kubeadm-flags.env”
[kubelet-start] Writing kubelet configuration to file “/var/lib/kubelet/config.yaml”
[kubelet-start] Starting the kubelet
[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory “/etc/kubernetes/manifests”. This can take up to 4m0s
[apiclient] All control plane components are healthy after 7.009957 seconds
[upload-config] Storing the configuration used in ConfigMap “kubeadm-config” in the “kube-system” Namespace
[kubelet] Creating a ConfigMap “kubelet-config” in namespace kube-system with the configuration for the kubelets in the cluster
[upload-certs] Skipping phase. Please see –upload-certs
[mark-control-plane] Marking the node master as control-plane by adding the labels: [node-role.kubernetes.io/control-plane node.kubernetes.io/exclude-from-external-load-balancers]
[mark-control-plane] Marking the node master as control-plane by adding the taints [node-role.kubernetes.io/control-plane:NoSchedule]
[bootstrap-token] Using token: 6pov5t.6yun1dhadcwoxy7t
[bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles
[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to get nodes
[bootstrap-token] Configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
[bootstrap-token] Configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
[bootstrap-token] Configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
[bootstrap-token] Creating the “cluster-info” ConfigMap in the “kube-public” namespace
[kubelet-finalize] Updating “/etc/kubernetes/kubelet.conf” to point to a rotatable kubelet client certificate and key
[addons] Applied essential addon: CoreDNS
[addons] Applied essential addon: kube-proxy

Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

Alternatively, if you are the root user, you can run:

export KUBECONFIG=/etc/kubernetes/admin.conf

You should now deploy a pod network to the cluster.
Run “kubectl apply -f [podnetwork].yaml” with one of the options listed at:
https://kubernetes.io/docs/concepts/cluster-administration/addons/

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join 172.16.158.241:6443 –token 6pov5t.6yun1dhadcwoxy7t \
–discovery-token-ca-cert-hash sha256:291ee6b36c7299722ad7d4e52c213120c91db10ff2db33e460145ccef599e383

用户身份：

mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

root 用户：
export KUBECONFIG=/etc/kubernetes/admin.conf

永久配置：

echo “export KUBECONFIG=/etc/kubernetes/admin.conf” >> ~/.bashrc
source ~/.bashrc

为了使 Pod 能够跨节点通信，需要部署一个 Pod 网络插件

[root@master containerd]# kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
namespace/kube-flannel created
clusterrole.rbac.authorization.k8s.io/flannel created
clusterrolebinding.rbac.authorization.k8s.io/flannel created
serviceaccount/flannel created
configmap/kube-flannel-cfg created
daemonset.apps/kube-flannel-ds created

验证网络插件状态;
[root@master containerd]# kubectl get pods -n kube-system
NAME READY STATUS RESTARTS AGE
coredns-5dd5756b68-7vw7p 0/1 ContainerCreating 0 15m
coredns-5dd5756b68-wl457 0/1 ContainerCreating 0 15m
etcd-master 1/1 Running 0 15m
kube-apiserver-master 1/1 Running 0 15m
kube-controller-manager-master 1/1 Running 0 15m
kube-proxy-zxgs4 1/1 Running 0 15m
kube-scheduler-master 1/1 Running 0 15m

加入工作节点;其他服务器作为工作节点加入集群

[root@master containerd]# sudo kubeadm join 172.16.158.241:6443 \

–token 6pov5t.6yun1dhadcwoxy7t \
–discovery-token-ca-cert-hash sha256:291ee6b36c7299722ad7d4e52c213120c91db10ff2db33e460145ccef599e383
[preflight] Running pre-flight checks
error execution phase preflight: [preflight] Some fatal errors occurred:
[ERROR FileAvailable–etc-kubernetes-kubelet.conf]: /etc/kubernetes/kubelet.conf already exists
[ERROR Port-10250]: Port 10250 is in use
[ERROR FileAvailable–etc-kubernetes-pki-ca.crt]: /etc/kubernetes/pki/ca.crt already exists
[preflight] If you know what you are doing, you can make a check non-fatal with --ignore-preflight-errors=...
To see the stack trace of this error execute with –v=5 or higher

清理残留的 Kubernetes 配置文件
sudo rm -f /etc/kubernetes/kubelet.conf
sudo rm -f /etc/kubernetes/pki/ca.crt

强制终止占用 10250 端口的进程
sudo fuser -k 10250/tcp

sudo systemctl daemon-reload
sudo systemctl restart kubelet

[root@master containerd]# kubeadm join 172.16.158.241:6443 –token 6pov5t.6yun1dhadcwoxy7t \

–discovery-token-ca-cert-hash sha256:291ee6b36c7299722ad7d4e52c213120c91db10ff2db33e460145ccef599e383 \
–ignore-preflight-errors=FileAvailable–etc-kubernetes-kubelet.conf,FileAvailable–etc-kubernetes-pki-ca.crt
[preflight] Running pre-flight checks
[preflight] Reading configuration from the cluster…
[preflight] FYI: You can look at this config file with ‘kubectl -n kube-system get cm kubeadm-config -o yaml’
[kubelet-start] Writing kubelet configuration to file “/var/lib/kubelet/config.yaml”
[kubelet-start] Writing kubelet environment file with flags to file “/var/lib/kubelet/kubeadm-flags.env”
[kubelet-start] Starting the kubelet
[kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap…

This node has joined the cluster:

• Certificate signing request was sent to apiserver and a response was received.
• The Kubelet was informed of the new secure connection details.

Run ‘kubectl get nodes’ on the control-plane to see this node join the cluster.

验证节点状态：
kubectl get nodes

[root@master containerd]# kubectl run nginx-test –image=nginx
pod/nginx-test created
kubectl describe pod nginx-test

Token 和 CA Cert Hash 的有效期
Token 默认有效期为 24 小时。如果超过有效期，重新生成一个新的 Token：

kubeadm token create
openssl x509 -pubkey -in /etc/kubernetes/pki/ca.crt | openssl rsa -pubin -outform der 2>/dev/null | openssl dgst -sha256 -hex | sed ‘s/^.* //’

感谢您的来访，获取更多精彩文章请收藏本站。