1. Kubernetes集群搭建概述Kubernetes作为当前最流行的容器编排系统已经成为云原生应用部署的事实标准。对于刚接触Kubernetes的开发者来说搭建一个可用的生产级集群往往面临诸多挑战。本指南将使用kubeadm工具带你从零开始构建一个符合最佳实践的Kubernetes集群。kubeadm是Kubernetes官方推荐的集群引导工具它能够快速初始化符合一致性测试标准的控制平面简化节点加入流程支持集群生命周期管理如升级、证书续期等作为其他自动化工具的基础组件2. 环境准备2.1 硬件要求至少需要2台Linux主机物理机或虚拟机控制平面节点2核CPU/2GB内存/30GB磁盘工作节点1核CPU/1GB内存/20GB磁盘生产环境建议控制平面节点配置4核CPU/8GB内存以上2.2 系统要求所有节点需要禁用swapswapoff -a并注释/etc/fstab中的swap行确保唯一主机名hostnamectl set-hostname name时间同步安装并启用chrony或ntpd加载内核模块cat EOF | sudo tee /etc/modules-load.d/k8s.conf overlay br_netfilter EOF sudo modprobe overlay sudo modprobe br_netfilter2.3 网络配置确保节点间网络互通开放6443API Server、2379-2380etcd等端口为Pod和Service分配独立CIDR不与主机网络重叠3. 安装基础组件3.1 容器运行时安装以containerd为例# 安装依赖 apt-get update apt-get install -y apt-transport-https ca-certificates curl # 添加Docker仓库 curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg echo deb [archamd64 signed-by/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable | sudo tee /etc/apt/sources.list.d/docker.list /dev/null # 安装containerd apt-get update apt-get install -y containerd.io # 配置containerd mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml systemctl restart containerd3.2 安装kubeadm/kubelet/kubectl# 添加Kubernetes仓库 curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add - cat EOF | sudo tee /etc/apt/sources.list.d/kubernetes.list deb https://apt.kubernetes.io/ kubernetes-xenial main EOF # 安装指定版本示例为1.26.0 apt-get update apt-get install -y kubelet1.26.0-00 kubeadm1.26.0-00 kubectl1.26.0-00 apt-mark hold kubelet kubeadm kubectl4. 初始化控制平面4.1 初始化命令kubeadm init \ --apiserver-advertise-address192.168.1.100 \ --pod-network-cidr10.244.0.0/16 \ --upload-certs \ --control-plane-endpointcluster.example.com:6443关键参数说明--pod-network-cidr必须与后续安装的CNI插件匹配--control-plane-endpoint高可用集群的负载均衡地址--upload-certs自动分发证书到其他控制平面节点4.2 初始化后配置mkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config4.3 安装网络插件以Calico为例kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.25.0/manifests/calico.yaml验证网络插件watch kubectl get pods -n kube-system # 等待所有Pod变为Running状态5. 添加工作节点在控制平面初始化输出的join命令基础上添加参数kubeadm join cluster.example.com:6443 \ --token token \ --discovery-token-ca-cert-hash sha256:hash \ --node-labelsnode-role.kubernetes.io/workerworker验证节点加入kubectl get nodes # 应看到新节点状态为Ready6. 集群验证6.1 基础检查kubectl get componentstatus kubectl cluster-info kubectl get all -A6.2 部署测试应用kubectl create deployment nginx --imagenginx kubectl expose deployment nginx --port80 --typeNodePort kubectl get svc nginx访问测试curl http://node-ip:node-port7. 生产级配置建议7.1 证书管理自动续期配置# /etc/kubernetes/kubelet.conf rotateCertificates: true serverTLSBootstrap: true手动续期检查kubeadm certs check-expiration kubeadm certs renew all7.2 高可用方案推荐架构3个控制平面节点外部etcd集群非堆叠式负载均衡器如HAProxyKeepalived7.3 监控与日志基础监控栈# 安装Metrics Server kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml # 推荐Prometheus Operator helm repo add prometheus-community https://prometheus-community.github.io/helm-charts helm install prometheus prometheus-community/kube-prometheus-stack8. 常见问题排查8.1 节点NotReady检查步骤查看kubelet状态systemctl status kubelet检查容器运行时crictl ps -a查看节点详情kubectl describe node node-name8.2 网络问题诊断方法# 检查CNI插件日志 kubectl logs -n kube-system -l k8s-appcalico-node # 测试Pod间通信 kubectl run test-nginx --imagenginx kubectl exec test-nginx -- curl other-pod-ip8.3 证书过期应急处理# 备份原有证书 cp -r /etc/kubernetes/pki /etc/kubernetes/pki.bak # 更新证书 kubeadm certs renew all # 重启控制平面组件 docker ps | grep kube-apiserver | awk {print $1} | xargs docker restart9. 维护与升级9.1 版本升级流程升级kubeadmapt-get update apt-get install -y kubeadm1.27.0-00检查升级计划kubeadm upgrade plan升级控制平面kubeadm upgrade apply v1.27.0升级节点kubeadm upgrade node apt-get install -y kubelet1.27.0-00 kubectl1.27.0-00 systemctl restart kubelet9.2 日常维护命令# 查看集群事件 kubectl get events -A --sort-by.metadata.creationTimestamp # 检查资源使用 kubectl top nodes kubectl top pods -A # 清理终止状态的Pod kubectl delete pods -A --field-selectorstatus.phaseFailed10. 安全加固建议启用Pod安全准入kubectl apply -f https://raw.githubusercontent.com/kubernetes/website/main/content/en/examples/security/podsecurity-psa.yaml限制kubelet权限# /var/lib/kubelet/config.yaml authorization: mode: Webhook authentication: x509: clientCAFile: /etc/kubernetes/pki/ca.crt网络策略示例apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny spec: podSelector: {} policyTypes: - Ingress - Egress通过以上步骤你应该已经成功搭建了一个生产可用的Kubernetes集群。实际环境中还需要根据具体需求调整存储配置、网络策略、资源配额等参数。