企业官网建设流程全解析

本文基于Rocky Linux 10.2，使用Kubeadm部署Kubernetes v1.36.3集群，
容器运行时选用Containerd，网络插件使用Calico v3.32.1。
全程包含详细命令、踩坑点与验证结果，适合生产环境参考。

rockLinux系统镜像下载链接：

一、环境准备

1.1 主机规划

1.2 基础系统配置（三台主机均需执行）

修改主机名（以 node1 为例）

hostnamectlhostnamenode1&&bash

配置静态 IP（以 node1 为例）

nmcli c m ens160 ipv4.method manual\ipv4.addresses192.168.194.16/24\ipv4.dns"223.5.5.5 8.8.8.8"\ipv4.gateway192.168.194.2\connection.autoconnectyesnmcli c up ens160

关闭防火墙与 SELinux

systemctl stop firewalld&&systemctl disable firewalld setenforce0sed-i's/^SELINUX=enforcing$/SELINUX=disabled/'/etc/selinux/config

配置主机映射

cat>/etc/hosts<<EOF 192.168.194.15 master 192.168.194.16 node1 192.168.194.17 node2 192.168.194.20 hb.reg.com harbor EOF

关闭交换分区

swapoff-ased-ri's/.*swap.*/#&/'/etc/fstab

调整系统资源限制

cat>>/etc/security/limits.conf<<EOF * soft nofile 655350 * hard nofile 655350 * soft nproc 655350 * hard nproc 655350 * soft memlock unlimited * hard memlock unlimited EOF

开启路由转发

echo'net.ipv4.ip_forward=1'>>/etc/sysctl.confsysctl-p

加载内核模块

modprobe br_netfilter modprobe overlaycat<<EOF|tee/etc/sysctl.d/k8s.confnet.bridge.bridge-nf-call-iptables = 1 net.bridge.bridge-nf-call-ip6tables = 1 net.ipv4.ip_forward = 1 EOFecho"br_netfilter"|tee/etc/modules-load.d/k8s.confsysctl--system

时间同步（Chrony）

dnfinstall-ychrony systemctlenable--nowchronydsed-i's/^pool.*/server ntp1.aliyun.com iburst/'/etc/chrony.conf systemctl restart chronyd chronyc tracking

重启生效

reboot

二、安装 Containerd 容器运行时

2.1 安装 Containerd

tar-xfcontainerd-2.0.5-linux-amd64.tar.gzmvbin/* /usr/local/bin/mkdir-p/usr/local/lib/systemd/systemwgethttps://raw.githubusercontent.com/containerd/containerd/main/containerd.service\-O/usr/local/lib/systemd/system/containerd.service systemctl daemon-reload

2.2 配置 Containerd

mkdir-p/etc/containerd containerd config default>/etc/containerd/config.toml

修改sandbox_image为阿里云镜像：

sed-i's|registry.k8s.io/pause:3.10|registry.aliyuncs.com/google_containers/pause:3.10.2|'/etc/containerd/config.toml

启用 SystemdCgroup：

sed-i'/\[plugins.*runtimes\.runc\.options\]/a\ SystemdCgroup = true'/etc/containerd/config.toml

2.3 安装 runc

编写脚本runc.sh：

#!/bin/bashcase"$(uname-m)"inx86_64)A=amd64;;aarch64)A=arm64;;*)echo"unsupported arch";exit1;;esacV=v1.2.6foruin\"https://github.com/opencontainers/runc/releases/download/${V}/runc.${A}"\"https://ghfast.top/https://github.com/opencontainers/runc/releases/download/${V}/runc.${A}"\"https://mirror.ghproxy.com/https://github.com/opencontainers/runc/releases/download/${V}/runc.${A}";docurl-fSL-o/usr/bin/runc"$u"&&[-s/usr/bin/runc]&&breakdonechmod+x /usr/bin/runc runc--version

执行：

sourcerunc.sh systemctl restart containerd

三、安装 Kubeadm / Kubelet / Kubectl

3.1 配置阿里云 YUM 源

cat>/etc/yum.repos.d/kubernetes.repo<<EOF [kubernetes] name=Kubernetes baseurl=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.36/rpm/ enabled=1 gpgcheck=1 gpgkey=https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.36/rpm/repodata/repomd.xml.key EOF

3.2 安装组件

dnf makecache dnfinstall-ykubelet-1.36.3 kubeadm-1.36.3 kubectl-1.36.3--disableexcludes=kubernetes systemctlenablekubelet

验证：

kubeadm version kubelet--versionkubectl version--client

四、初始化 Master 节点

4.1 执行初始化

kubeadm init\--apiserver-advertise-address=192.168.194.15\--image-repository=registry.aliyuncs.com/google_containers\--kubernetes-version=v1.36.3\--service-cidr=10.96.0.0/12\--pod-network-cidr=10.244.0.0/16\--cri-socket=unix:///run/containerd/containerd.sock

4.2 配置 kubectl

mkdir-p$HOME/.kubecp-i/etc/kubernetes/admin.conf$HOME/.kube/configchown$(id-u):$(id-g)$HOME/.kube/config

五、Worker 节点加入集群

在 node1 / node2 上执行（使用 init 输出的 join 命令）：

kubeadmjoin192.168.194.15:6443--tokenmgc5zo.v3jrhfvbklh1qc7r\--discovery-token-ca-cert-hash sha256:42dba2763ef41f8c76b79f851e2d8e593cd01eafff78825e94a439c461ee4989

💡 token 和 hash 以实际 init 输出为准，有效期 24h，过期后可重新生成。

六、安装 Calico 网络插件

6.1 下载并修改配置

curlhttps://raw.githubusercontent.com/projectcalico/calico/v3.32.1/manifests/calico-typha.yaml-ocalico.yaml

修改关键参数：

-name:CALICO_IPV4POOL_IPIPvalue:"Off"# 关闭 IPIP-name:CALICO_IPV4POOL_VXLANvalue:"Never"# 关闭 VXLAN-name:CALICO_IPV4POOL_CIDRvalue:"10.244.0.0/16"# 与 init 的 pod-network-cidr 一致

6.2 预拉取镜像（三台主机）

脚本pull-calico.sh：

#!/bin/bashMIRROR="docker.m.daocloud.io"NS="k8s.io"VER="v3.32.1"forimgincninodekube-controllers typha;doctr-n${NS}images pull${MIRROR}/calico/${img}:${VER}ctr-n${NS}images tag--force${MIRROR}/calico/${img}:${VER}docker.io/calico/${img}:${VER}ctr-n${NS}images tag--force${MIRROR}/calico/${img}:${VER}calico/${img}:${VER}ctr-n${NS}imagesrm${MIRROR}/calico/${img}:${VER}2>/dev/nulldonectr-n${NS}imagesls|grepcalico

执行：

sourcepull-calico.sh

6.3 部署 Calico

kubectl apply-fcalico.yaml

七、验证集群状态

查看所有 Pod

kubectl get pod-A

输出示例：

NAMESPACE NAME READY STATUS RESTARTS AGE kube-system calico-kube-controllers-58f68d56d9-qzvsw 1/1 Running 0 30s kube-system calico-node-2rl4b 1/1 Running 0 30s kube-system calico-node-9gb58 1/1 Running 0 30s kube-system calico-node-clkb6 1/1 Running 0 30s kube-system calico-typha-784fff7dd7-v55hn 1/1 Running 0 30s kube-system coredns-6b5f954497-rs6x4 1/1 Running 0 55m kube-system coredns-6b5f954497-x5ffm 1/1 Running 0 55m kube-system etcd-master 1/1 Running 0 55m kube-system kube-apiserver-master 1/1 Running 0 55m kube-system kube-controller-manager-master 1/1 Running 0 55m kube-system kube-proxy-fqwvh 1/1 Running 0 52m kube-system kube-proxy-vmtnl 1/1 Running 0 55m kube-system kube-proxy-w4s6l 1/1 Running 0 52m kube-system kube-scheduler-master 1/1 Running 0 55m

查看节点状态

kubectl getnode

输出示例：

NAME STATUS ROLES AGE VERSION master Ready control-plane 56m v1.36.3 node1 Ready <none> 53m v1.36.3 node2 Ready <none> 53m v1.36.3

✅ 所有节点均为Ready，集群部署成功！

八、常见踩坑与解决方案

九、附录：常用管理命令

# 查看所有资源kubectl get all-A# 查看节点详情kubectl describenodemaster# 查看 Pod 日志kubectl logs-nkube-system<pod-name># 重置集群（仅 Master）kubeadm reset-f--cri-socket=unix:///run/containerd/containerd.sockrm-rf/etc/kubernetes/* /var/lib/etcd /var/lib/kubelet$HOME/.kube