1. 项目概述在当今云原生技术蓬勃发展的背景下Kubernetes作为容器编排的事实标准已经成为企业级应用部署的必备技能。本文将详细介绍在Ubuntu 22.04 LTS系统上部署Kubernetes 1.23版本的完整流程这是一套经过生产环境验证的可靠方案。我曾在多个实际项目中采用这套部署方案包括金融行业的微服务架构和电商平台的高可用集群。相比直接使用云服务商提供的托管Kubernetes自主部署能带来更深入的技术掌控和成本优化空间特别适合需要定制化配置的中大型项目。2. 环境准备2.1 系统要求推荐使用Ubuntu 22.04 LTS作为基础系统这是目前最稳定的长期支持版本。硬件配置建议至少2核CPU生产环境建议4核以上4GB内存生产环境建议16GB以上20GB磁盘空间稳定的网络连接注意所有节点包括master和worker的系统时间必须同步建议安装chrony进行时间同步sudo apt install -y chrony sudo systemctl enable --now chronyd2.2 基础环境配置首先在所有节点上执行以下通用配置禁用swap空间sudo swapoff -a sudo sed -i / swap / s/^\(.*\)$/#\1/g /etc/fstab加载内核模块sudo modprobe overlay sudo modprobe br_netfilter设置系统参数cat EOF | sudo tee /etc/sysctl.d/k8s.conf net.bridge.bridge-nf-call-ip6tables 1 net.bridge.bridge-nf-call-iptables 1 net.ipv4.ip_forward 1 EOF sudo sysctl --system3. 容器运行时安装3.1 Docker安装与配置虽然Kubernetes 1.23支持多种容器运行时但Docker仍是最成熟稳定的选择sudo apt update sudo apt install -y apt-transport-https ca-certificates curl software-properties-common curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg echo deb [archamd64 signed-by/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable | sudo tee /etc/apt/sources.list.d/docker.list /dev/null sudo apt update sudo apt install -y docker-ce docker-ce-cli containerd.io配置Docker使用systemd作为cgroup驱动sudo mkdir -p /etc/docker cat EOF | sudo tee /etc/docker/daemon.json { exec-opts: [native.cgroupdriversystemd], log-driver: json-file, log-opts: { max-size: 100m }, storage-driver: overlay2 } EOF sudo systemctl enable --now docker3.2 containerd配置Kubernetes 1.23默认使用containerd作为容器运行时接口(CRI)需要额外配置sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml /dev/null sudo sed -i s/SystemdCgroup false/SystemdCgroup true/ /etc/containerd/config.toml sudo systemctl restart containerd4. Kubernetes组件安装4.1 安装kubeadm、kubelet和kubectl添加Kubernetes官方仓库并安装必要组件sudo apt update sudo apt install -y apt-transport-https curl curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add - cat EOF | sudo tee /etc/apt/sources.list.d/kubernetes.list deb https://apt.kubernetes.io/ kubernetes-xenial main EOF sudo apt update sudo apt install -y kubelet1.23.17-00 kubeadm1.23.17-00 kubectl1.23.17-00 sudo apt-mark hold kubelet kubeadm kubectl提示这里我们选择1.23.17这个经过充分验证的补丁版本避免使用初始版本可能存在的稳定性问题。4.2 初始化控制平面在master节点执行初始化sudo kubeadm init \ --kubernetes-versionv1.23.17 \ --pod-network-cidr10.244.0.0/16 \ --service-cidr10.96.0.0/12 \ --apiserver-advertise-addressmaster节点IP初始化完成后按照提示配置kubectlmkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config记录下输出的join命令后续worker节点加入集群时需要用到。5. 网络插件部署5.1 安装Flannel网络插件Kubernetes需要CNI插件实现Pod间通信这里选择最稳定的Flannelkubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/v0.20.2/Documentation/kube-flannel.yml验证网络插件状态kubectl get pods -n kube-system -l appflannel5.2 网络策略配置生产环境建议启用NetworkPolicykubectl apply -f https://raw.githubusercontent.com/kubernetes/website/main/content/en/examples/policy/network-policy.yaml6. Worker节点加入集群在每个worker节点上执行之前记录的join命令格式如下sudo kubeadm join master节点IP:6443 \ --token token \ --discovery-token-ca-cert-hash sha256:hash加入完成后在master节点验证节点状态kubectl get nodes7. 集群验证与优化7.1 基础功能验证部署测试应用验证集群功能kubectl create deployment nginx --imagenginx kubectl expose deployment nginx --port80 --typeNodePort kubectl get svc nginx访问NodePort端口验证Nginx服务是否正常。7.2 集群优化配置设置kubelet最大Pod数量sudo sed -i s/^KUBELET_EXTRA_ARGS.*/KUBELET_EXTRA_ARGS--max-pods100/ /etc/default/kubelet sudo systemctl restart kubelet调整API服务器参数sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml添加以下参数- --service-node-port-range30000-32767 - --max-requests-inflight1500 - --max-mutating-requests-inflight5008. 常见问题排查8.1 节点NotReady状态可能原因及解决方案网络插件未正常运行kubectl describe pod -n kube-system flannel-pod-name容器运行时故障sudo systemctl status containerd journalctl -xeu containerd8.2 Pod卡在Pending状态检查资源配额和调度约束kubectl describe pod pod-name kubectl get events --sort-by.metadata.creationTimestamp8.3 网络连接问题检查Calico网络策略kubectl get networkpolicy --all-namespaces kubectl describe networkpolicy policy-name9. 生产环境建议高可用部署建议至少3个master节点组成高可用控制平面监控方案部署Prometheus-Operator监控集群状态日志收集使用EFK(ElasticsearchFluentdKibana)栈备份策略定期备份etcd数据安全加固启用RBAC、PodSecurityPolicy等安全机制10. 版本升级路径从1.23升级到更高版本的推荐路径先升级到1.23的最新补丁版本然后逐步升级到1.24、1.25等后续版本每次升级前务必检查版本变更说明和废弃API升级命令示例sudo apt update sudo apt install -y kubeadm1.24.x-00 sudo kubeadm upgrade plan sudo kubeadm upgrade apply v1.24.x sudo apt install -y kubelet1.24.x-00 kubectl1.24.x-00 sudo systemctl restart kubelet11. 性能调优技巧调整kubelet资源预留sudo vi /var/lib/kubelet/config.yaml添加systemReserved: cpu: 500m memory: 500Mi kubeReserved: cpu: 500m memory: 500Mi优化etcd性能sudo vi /etc/kubernetes/manifests/etcd.yaml添加- --auto-compaction-retention1h - --quota-backend-bytes8589934592 # 8GBAPI服务器缓存优化sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml添加- --watch-cachetrue - --watch-cache-sizessecrets#500,configmaps#50012. 安全加固措施启用Pod安全准入sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml添加- --enable-admission-pluginsPodSecurity限制容器权限apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: restricted spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: - ALL volumes: - configMap - emptyDir - projected - secret - downwardAPI - persistentVolumeClaim hostNetwork: false hostIPC: false hostPID: false runAsUser: rule: MustRunAsNonRoot seLinux: rule: RunAsAny supplementalGroups: rule: MustRunAs ranges: - min: 1 max: 65535 fsGroup: rule: MustRunAs ranges: - min: 1 max: 65535 readOnlyRootFilesystem: false定期轮换证书sudo kubeadm certs renew all sudo systemctl restart kubelet