1. 项目概述在容器编排领域Kubernetes简称K8S已成为事实上的行业标准。对于中小型企业或刚接触K8S的团队来说从单master节点架构入手是最稳妥的选择。kubeadm作为官方推荐的集群部署工具能够以最精简的步骤搭建符合生产要求的K8S环境。我曾在多个实际生产项目中采用这种架构它的优势在于部署复杂度远低于多master高可用方案资源消耗更可控通常2核4G配置即可运行维护成本低且能满足中小规模业务需求后续可平滑扩展为多master集群重要提示单master架构适合测试环境和中小规模生产环境对于核心业务系统建议至少部署3个master节点实现高可用。2. 环境准备与系统配置2.1 硬件资源规划生产环境的最低配置建议Master节点2核CPU/4GB内存/40GB磁盘Worker节点根据业务负载调整建议至少2核/4GB操作系统Ubuntu 20.04 LTS或CentOS 7.9实际项目中我曾遇到内存不足导致apiserver频繁崩溃的情况因此特别强调/var分区至少预留20GB存放etcd数据swap必须彻底禁用否则kubelet无法正常运行2.2 系统基础配置在所有节点执行以下操作# 关闭防火墙生产环境应配置安全组规则替代 systemctl stop firewalld systemctl disable firewalld # 禁用SELinux setenforce 0 sed -i s/^SELINUXenforcing/SELINUXdisabled/ /etc/selinux/config # 关闭swap swapoff -a sed -i / swap / s/^\(.*\)$/#\1/g /etc/fstab # 加载内核模块 cat EOF | sudo tee /etc/modules-load.d/k8s.conf br_netfilter ip_vs ip_vs_rr ip_vs_wrr ip_vs_sh nf_conntrack EOF # 配置sysctl cat EOF | sudo tee /etc/sysctl.d/k8s.conf net.bridge.bridge-nf-call-ip6tables 1 net.bridge.bridge-nf-call-iptables 1 net.ipv4.ip_forward 1 EOF sysctl --system3. 容器运行时与kubeadm安装3.1 Docker安装与配置虽然containerd已成为默认运行时但在实际生产中发现Docker的日志管理和调试更方便# 安装Docker CE yum install -y yum-utils yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo yum install -y docker-ce docker-ce-cli containerd.io # 配置cgroup驱动为systemd mkdir -p /etc/docker cat /etc/docker/daemon.json EOF { exec-opts: [native.cgroupdriversystemd], log-driver: json-file, log-opts: { max-size: 100m }, storage-driver: overlay2 } EOF systemctl enable --now docker3.2 安装kubeadm三件套配置阿里云镜像源加速安装cat EOF /etc/yum.repos.d/kubernetes.repo [kubernetes] nameKubernetes baseurlhttps://mirrors.aliyun.com/kubernetes/yum/repos/kubernetes-el7-x86_64/ enabled1 gpgcheck1 repo_gpgcheck1 gpgkeyhttps://mirrors.aliyun.com/kubernetes/yum/doc/yum-key.gpg https://mirrors.aliyun.com/kubernetes/yum/doc/rpm-package-key.gpg EOF # 安装指定版本建议选择较新的稳定版 yum install -y kubelet-1.23.8 kubeadm-1.23.8 kubectl-1.23.8 systemctl enable kubelet4. 集群初始化实战4.1 Master节点初始化关键参数说明--pod-network-cidr必须与后续安装的网络插件匹配--apiserver-advertise-address建议显式指定内网IP--image-repository使用国内镜像源加速kubeadm init \ --apiserver-advertise-address192.168.1.100 \ --image-repository registry.aliyuncs.com/google_containers \ --kubernetes-version v1.23.8 \ --service-cidr10.96.0.0/12 \ --pod-network-cidr10.244.0.0/16 # 初始化成功后配置kubectl mkdir -p $HOME/.kube cp -i /etc/kubernetes/admin.conf $HOME/.kube/config chown $(id -u):$(id -g) $HOME/.kube/config4.2 网络插件安装推荐使用flannel配置简单且资源占用低kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml验证网络状态kubectl get pods -n kube-system -l appflannel kubectl get nodes -o wide5. Worker节点加入集群在Master节点上获取join命令kubeadm token create --print-join-command在Worker节点执行输出的join命令类似如下kubeadm join 192.168.1.100:6443 --token abcdef.0123456789abcdef \ --discovery-token-ca-cert-hash sha256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx6. 生产环境关键配置6.1 证书自动续期配置修改kubeadm配置实现证书自动续期# 查看当前证书有效期 kubeadm certs check-expiration # 配置自动续期 cat /etc/kubernetes/kubeadm-config.yaml EOF apiVersion: kubeadm.k8s.io/v1beta3 kind: ClusterConfiguration controllerManager: extraArgs: experimental-cluster-signing-duration: 87600h feature-gates: RotateKubeletServerCertificatetrue scheduler: extraArgs: feature-gates: RotateKubeletServerCertificatetrue EOF kubeadm init phase upload-config kubeadm --config /etc/kubernetes/kubeadm-config.yaml6.2 关键组件监控配置部署metrics-server监控资源使用kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml # 验证监控数据 kubectl top nodes7. 常见问题排查指南7.1 节点NotReady问题排查流程检查kubelet状态journalctl -u kubelet -n 50验证网络插件kubectl logs -n kube-system flannel-pod检查CNI配置ls /etc/cni/net.d/测试Pod间通信kubectl run test --imagebusybox -- sleep 36007.2 证书过期处理方案# 手动更新证书 kubeadm certs renew all systemctl restart kubelet # 更新kubeconfig mv $HOME/.kube/config $HOME/.kube/config.bak cp -i /etc/kubernetes/admin.conf $HOME/.kube/config8. 生产环境优化建议8.1 关键参数调优# 调整kubelet最大Pod数量 cat /etc/default/kubelet EOF KUBELET_EXTRA_ARGS--max-pods150 --image-gc-high-threshold85 --image-gc-low-threshold80 EOF systemctl daemon-reload systemctl restart kubelet8.2 备份etcd数据# 手动备份 ETCDCTL_API3 etcdctl \ --endpointshttps://127.0.0.1:2379 \ --cacert/etc/kubernetes/pki/etcd/ca.crt \ --cert/etc/kubernetes/pki/etcd/server.crt \ --key/etc/kubernetes/pki/etcd/server.key \ snapshot save /opt/etcd-backup-$(date %Y%m%d).db # 配置定时任务每天凌晨2点备份 0 2 * * * root /usr/local/bin/etcd-backup.sh经过多个生产环境项目的验证这套方案能稳定支撑200Pod的运行。对于刚开始使用K8S的团队建议先熟悉单master架构的运行机制等业务规模扩大后再考虑升级为多master高可用架构。实际运维中发现90%的异常问题都与网络配置或证书过期相关因此务必做好这两方面的监控和维护。