1. Kubernetes 1.24部署方案概述Kubernetes作为当前容器编排领域的事实标准其部署方式一直是运维人员关注的焦点。kubeadm作为官方推荐的集群部署工具在1.24版本中引入了多项重要变更。本文将基于最新1.24版本详细解析使用kubeadm部署生产级Kubernetes集群的全过程包括关键组件配置、网络方案选型以及高可用实现方案。相比之前版本Kubernetes 1.24最显著的变化是彻底移除了dockershim这意味着默认不再支持Docker作为容器运行时。这个改动要求我们在部署前必须明确选择containerd、CRI-O等兼容的容器运行时环境。2. 环境准备与前置条件2.1 硬件资源配置建议对于生产环境建议至少准备以下规格的服务器控制平面节点4核CPU/8GB内存/50GB磁盘工作节点根据工作负载调整建议8核CPU/16GB内存/100GB磁盘起步测试环境可以使用更低配置但需要注意单个节点至少2核CPU/4GB内存磁盘空间不能少于20GB需要swap关闭状态执行swapoff -a并注释/etc/fstab中的swap行2.2 操作系统要求推荐使用以下Linux发行版Ubuntu 20.04/22.04 LTSCentOS 7/RHEL 7需注意1.24对旧版内核的限制Flatcar Container Linux关键系统配置# 加载br_netfilter模块 sudo modprobe br_netfilter # 设置内核参数 cat EOF | sudo tee /etc/modules-load.d/k8s.conf br_netfilter EOF cat EOF | sudo tee /etc/sysctl.d/k8s.conf net.bridge.bridge-nf-call-ip6tables 1 net.bridge.bridge-nf-call-iptables 1 net.ipv4.ip_forward 1 EOF sudo sysctl --system2.3 容器运行时安装以containerd为例的安装步骤# 安装依赖 sudo apt-get update sudo apt-get install -y apt-transport-https ca-certificates curl software-properties-common # 添加Docker仓库containerd由Docker提供 curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add - sudo add-apt-repository deb [archamd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable # 安装containerd sudo apt-get update sudo apt-get install -y containerd.io # 配置containerd sudo mkdir -p /etc/containerd containerd config default | sudo tee /etc/containerd/config.toml sudo systemctl restart containerd3. kubeadm集群部署详解3.1 安装kubeadm/kubelet/kubectl# 添加Kubernetes仓库 sudo curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg echo deb [signed-by/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main | sudo tee /etc/apt/sources.list.d/kubernetes.list # 安装组件注意指定版本 sudo apt-get update sudo apt-get install -y kubelet1.24.* kubeadm1.24.* kubectl1.24.* sudo apt-mark hold kubelet kubeadm kubectl3.2 初始化控制平面创建kubeadm配置文件kubeadm-config.yamlapiVersion: kubeadm.k8s.io/v1beta3 kind: InitConfiguration nodeRegistration: criSocket: unix:///var/run/containerd/containerd.sock kubeletExtraArgs: cgroup-driver: systemd --- apiVersion: kubeadm.k8s.io/v1beta3 kind: ClusterConfiguration kubernetesVersion: 1.24.0 controlPlaneEndpoint: LOAD_BALANCER_DNS:LOAD_BALANCER_PORT networking: podSubnet: 192.168.0.0/16 serviceSubnet: 10.96.0.0/12执行初始化sudo kubeadm init --configkubeadm-config.yaml --upload-certs初始化成功后按照提示配置kubectlmkdir -p $HOME/.kube sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config3.3 安装网络插件以Calico为例kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.24.1/manifests/tigera-operator.yaml kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.24.1/manifests/custom-resources.yaml验证网络插件kubectl get pods -n kube-system # 等待所有pod状态变为Running4. 高可用集群扩展4.1 添加控制平面节点在其他控制平面节点上执行sudo kubeadm join LOAD_BALANCER_DNS:LOAD_BALANCER_PORT --token token \ --discovery-token-ca-cert-hash sha256:hash \ --control-plane --certificate-key key4.2 添加工作节点在工作节点上执行sudo kubeadm join LOAD_BALANCER_DNS:LOAD_BALANCER_PORT --token token \ --discovery-token-ca-cert-hash sha256:hash验证节点状态kubectl get nodes # 所有节点状态应为Ready5. 关键配置与优化5.1 kubelet资源配置编辑/etc/default/kubeletKUBELET_EXTRA_ARGS--max-pods110 --kube-reservedcpu500m,memory1Gi --system-reservedcpu500m,memory1Gi5.2 控制平面组件参数修改/etc/kubernetes/manifests下的静态Pod定义文件例如为kube-apiserver添加- --default-not-ready-toleration-seconds30 - --default-unreachable-toleration-seconds305.3 集群自动扩缩容安装Cluster Autoscalerkubectl apply -f https://raw.githubusercontent.com/kubernetes/autoscaler/master/cluster-autoscaler/cloudprovider/aws/examples/cluster-autoscaler-autodiscover.yaml6. 常见问题排查6.1 节点NotReady状态排查流程检查kubelet状态systemctl status kubelet journalctl -xeu kubelet验证容器运行时crictl ps -a检查网络插件kubectl logs -n kube-system calico-pod6.2 证书过期问题查看证书有效期kubeadm certs check-expiration更新证书kubeadm certs renew all6.3 网络连通性问题诊断步骤# 检查CoreDNS kubectl get pods -n kube-system -l k8s-appkube-dns # 测试服务发现 kubectl run -it --rm --restartNever busybox --imagebusybox -- nslookup kubernetes.default7. 升级与维护7.1 版本升级策略先升级kubeadmsudo apt-get update sudo apt-get install -y kubeadm1.24.*升级控制平面sudo kubeadm upgrade apply v1.24.x升级节点sudo kubeadm upgrade node sudo apt-get update sudo apt-get install -y kubelet1.24.* kubectl1.24.* sudo systemctl restart kubelet7.2 日常维护命令集群状态检查kubectl get componentstatuses kubectl get events --sort-by.metadata.creationTimestamp资源清理kubectl get pods --all-namespaces -o jsonpath{range .items[*]}{.metadata.name}{\n}{end} | xargs -I{} kubectl describe pod {} -n {}