1. 离线安装Kubernetes的核心挑战与解决方案在基础设施受限或安全合规要求严格的场景中离线安装Kubernetes集群是许多运维团队必须面对的硬需求。我曾为某金融机构实施过完全离线的K8s部署整个过程涉及超过200个组件的依赖管理。与在线安装相比离线环境最大的痛点在于组件版本依赖关系复杂如kubelet与kubeadm的版本匹配系统基础依赖缺失如CNI插件、容器运行时后续维护升级困难典型解决方案是构建本地镜像仓库和软件包仓库。以下是经过生产验证的组件获取路径官方二进制包从https://github.com/kubernetes/kubernetes/releases 下载对应版本的server binaries容器镜像使用kubeadm config images list列出所需镜像通过中转机pull后导出系统依赖包根据OS类型准备containerd/docker、socat、conntrack等rpm/deb包关键经验建议同时下载相邻三个小版本的组件包当出现依赖冲突时可快速回退。我们在v1.23.5的部署中就曾因kube-proxy镜像版本不匹配导致网络异常。2. 组件下载的完整操作流程2.1 准备下载环境需要至少一台能访问外网的跳板机建议Ubuntu 20.04配置代理环境变量如有需要export HTTPS_PROXYhttp://proxy.example.com:8080 export NO_PROXYlocalhost,127.0.0.1,.internal安装必备工具sudo apt-get update sudo apt-get install -y \ curl \ jq \ docker.io \ apt-transport-https2.2 下载Kubernetes核心组件使用官方脚本获取最新稳定版示例为v1.27.3RELEASEv1.27.3 ARCHamd64 cd /tmp curl -L https://dl.k8s.io/release/${RELEASE}/bin/linux/${ARCH}/ \ | grep -oP kube(adm|ctl|let|proxy)-[^] \ | xargs -I{} curl -LO https://dl.k8s.io/release/${RELEASE}/bin/linux/${ARCH}/{}验证文件完整性curl -LO https://dl.k8s.io/${RELEASE}/bin/linux/${ARCH}/kubernetes-client-linux-${ARCH}.sha256 sha256sum -c kubernetes-client-linux-${ARCH}.sha2562.3 获取容器镜像使用kubeadm生成镜像清单kubeadm config images list --kubernetes-version ${RELEASE} images.list通过docker批量拉取while read img; do docker pull $img docker save $img -o $(echo $img | sed s/[^a-zA-Z0-9._-]/_/g).tar done images.list3. 离线安装的完整实施步骤3.1 环境预配置在所有节点执行# 关闭swap swapoff -a sed -i / swap / s/^/#/ /etc/fstab # 加载内核模块 cat EOF | sudo tee /etc/modules-load.d/k8s.conf overlay br_netfilter EOF modprobe overlay modprobe br_netfilter # 设置sysctl cat EOF | sudo tee /etc/sysctl.d/k8s.conf net.bridge.bridge-nf-call-iptables 1 net.bridge.bridge-nf-call-ip6tables 1 net.ipv4.ip_forward 1 EOF sysctl --system3.2 部署容器运行时传输containerd安装包并安装sudo tar Cxzvf /usr/local containerd-1.6.21-linux-${ARCH}.tar.gz sudo systemctl enable --now containerd配置cgroup驱动cat EOF | sudo tee /etc/containerd/config.toml version 2 [plugins.io.containerd.grpc.v1.cri.containerd.runtimes.runc] [plugins.io.containerd.grpc.v1.cri.containerd.runtimes.runc.options] SystemdCgroup true EOF sudo systemctl restart containerd3.3 安装Kubernetes组件将下载的二进制文件部署到所有节点sudo install -o root -g root -m 0755 \ kubeadm kubelet kubectl \ /usr/local/bin/配置kubelet服务cat EOF | sudo tee /etc/systemd/system/kubelet.service.d/10-kubeadm.conf [Service] EnvironmentKUBELET_KUBECONFIG_ARGS--bootstrap-kubeconfig/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig/etc/kubernetes/kubelet.conf EnvironmentKUBELET_CONFIG_ARGS--config/var/lib/kubelet/config.yaml EnvironmentFile-/var/lib/kubelet/kubeadm-flags.env ExecStart ExecStart/usr/local/bin/kubelet \$KUBELET_KUBECONFIG_ARGS \$KUBELET_CONFIG_ARGS \$KUBELET_KUBEADM_ARGS \$KUBELET_EXTRA_ARGS EOF sudo systemctl enable --now kubelet4. 集群初始化与验证4.1 使用离线镜像初始化控制平面先加载所有必需镜像for img in *.tar; do docker load -i $img done生成定制化kubeadm配置cat EOF kubeadm-config.yaml apiVersion: kubeadm.k8s.io/v1beta3 kind: InitConfiguration nodeRegistration: criSocket: unix:///var/run/containerd/containerd.sock imagePullPolicy: IfNotPresent --- apiVersion: kubeadm.k8s.io/v1beta3 kind: ClusterConfiguration kubernetesVersion: ${RELEASE} imageRepository: networking: podSubnet: 192.168.0.0/16 EOF执行初始化sudo kubeadm init \ --configkubeadm-config.yaml \ --upload-certs \ --ignore-preflight-errorsall4.2 网络插件安装以Calico为例离线安装步骤下载清单文件curl -LO https://docs.projectcalico.org/manifests/calico.yaml修改image字段指向本地仓库应用配置kubectl apply -f calico.yaml4.3 集群健康检查验证核心组件状态kubectl get pods -n kube-system kubectl get nodes kubectl cluster-info测试工作负载kubectl create deployment nginx --imagenginx kubectl expose deployment nginx --port80 curl $(kubectl get svc nginx -o jsonpath{.spec.clusterIP})5. 长期维护策略5.1 本地镜像仓库搭建建议部署Harbor作为长期镜像仓库# 下载离线安装包 curl -LO https://github.com/goharbor/harbor/releases/download/v2.7.1/harbor-offline-installer-v2.7.1.tgz # 解压配置 tar xzvf harbor-offline-installer-*.tgz cd harbor cp harbor.yml.tmpl harbor.yml配置关键参数hostname: registry.local http: port: 8080 harbor_admin_password: YourStrongPassword data_volume: /data/harbor执行安装sudo ./install.sh --with-notary --with-trivy5.2 版本升级方案在新环境中下载目标版本组件逐个节点执行kubeadm upgrade node systemctl restart kubelet最后升级控制平面kubeadm upgrade apply v1.27.45.3 常见故障处理镜像拉取失败检查containerd配置的registry.mirrorskubelet启动报错确认cgroup driver与容器运行时一致网络插件异常查看CNI二进制文件是否在/opt/cni/bin证书过期使用kubeadm certs renew命令更新我在某次升级中曾遇到kube-proxy的DaemonSet无法自动更新的问题最终发现是旧版本的finalizer阻塞了更新。解决方案是kubectl patch ds -n kube-system kube-proxy \ -p {metadata:{finalizers:null}} \ --typemerge
