K8s 集群：一组受 Kubernetes 统一管理的服务器（物理机 / 虚拟机），用来批量运行、调度容器化应用。

控制平面（Master 节点，管理大脑）

负责整个集群的决策，不跑业务应用，主要组件：

kube‑apiserver：集群唯一入口，所有操作都走它，鉴权、接收指令

etcd：集群数据库，保存集群所有配置、状态数据

kube‑controller‑manager：控制器，维持资源期望状态

kube‑scheduler：调度器，决定把 Pod 分配到哪个 Node 机器上

Node 工作节点（干活的机器）

真正跑业务容器的服务器，每个 Node 都有：

• kubelet：本机代理，接收 apiserver 指令，管理本机 Pod 容器
• kube‑proxy：网络代理，处理 Service 服务访问、负载均衡
• 容器运行时：如 containerd /docker，真正启动容器

172.25.254.100     master
172.25.254.10      node1
172.25.254.20      node2
172.25.254.100     reg.timinglee.org
172.25.254.254     kubernetes
关闭防火墙加载内核模块

[root@master ~]# mv cri-dockerd /usr/local/bin/
mv：是否覆盖'/usr/local/bin/cri-dockerd'？ y
mv: 无法以目录'cri-dockerd' 来覆盖非目录'/usr/local/bin/cri-dockerd'
[root@master ~]# cd /usr/local/bin/
[root@master bin]# ls
cri-dockerd
[root@master bin]# ll cri-dockerd 
-rwxr-xr-x 1 1001 1001 51638434  6月 30 16:49 cri-dockerd
[root@master bin]# cat > /etc/systemd/system/cri-docker.service <<EOF
[Unit]
Description=CRI Docker daemon for Kubernetes
After=docker.service
Requires=docker.service

[Service]
ExecStart=/usr/local/bin/cri-dockerd --container-runtime-endpoint=unix:///var /run/cri-dockerd.sock
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF
[root@master bin]# cat > /etc/systemd/system/cri-docker.socket <<EOF
[Unit]
Description=CRI Docker Socket for Kubernetes
PartOf=cri-docker.service

[Socket]
ListenStream=/var/run/cri-dockerd.sock
SocketMode=0660
SocketUser=root
SocketGroup=docker

[Install]
WantedBy=sockets.target
EOF
[root@master bin]# systemctl daemon-reload3
Unknown command verb daemon-reload3.
[root@master bin]# cd 
[root@master ~]# cd cri-dockerd/
[root@master cri-dockerd]# ls
cri-dockerd
[root@master cri-dockerd]# systemctl daemon-reload
[root@master cri-dockerd]# systemctl enable cri-docker --now
[root@master cri-dockerd]# mv cri-dockerd /usr/local/bin/
mv：是否覆盖'/usr/local/bin/cri-dockerd'？ y
[root@master cri-dockerd]# chmod +x /usr/local/bin/cri-dockerd
[root@master cri-dockerd]# cri-dockerd --version
cri-dockerd 0.4.4 (98c4823)
[root@master cri-dockerd]# cat > /etc/yum.repos.d/kubernetes.repo <<EOF
[kubernetes]
name=Kubernetes
baseurl=https://pkgs.k8s.io/core:/stable:/v1.35/rpm/
enabled=1
gpgcheck=1
gpgkey=https://pkgs.k8s.io/core:/stable:/v1.35/rpm/repodata/repomd.xml.key
EOF
[root@master cri-dockerd]# dnf install -y kubeadm-1.35.7 kubelet-1.35.7 kubectl-1.35.7
完毕！
 

配置node1和node2

[root@node1 ~]# tar xvf cri-dockerd-0.4.4.amd64.tgz
cri-dockerd/
cri-dockerd/cri-dockerd
[root@node1 ~]# cd cri-dockerd/
[root@node1 cri-dockerd]# mv cri-dockerd /usr/local/bin/
mv：是否覆盖'/usr/local/bin/cri-dockerd'？ y
[root@node1 cri-dockerd]# chmod +x /usr/local/bin/cri-dockerd
[root@node1 cri-dockerd]# cat > /etc/systemd/system/cri-docker.service <<EOF
[Unit]
Description=CRI Docker daemon for Kubernetes
After=docker.service
Requires=docker.service

[Service]
ExecStart=/usr/local/bin/cri-dockerd --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF
[root@node1 cri-dockerd]# cat > /etc/systemd/system/cri-docker.socket <<EOF
[Unit]
Description=CRI Docker Socket for Kubernetes
PartOf=cri-docker.service

[Socket]
ListenStream=/var/run/cri-dockerd.sock
SocketMode=0660
SocketUser=root
SocketGroup=docker

[Install]
WantedBy=sockets.target
EOF
[root@node1 cri-dockerd]# systemctl daemon-reload
[root@node1 cri-dockerd]# systemctl enable cri-docker --now
[root@node1 cri-dockerd]# cat > /etc/yum.repos.d/kubernetes.repo <<EOF
[kubernetes]
name=Kubernetes
baseurl=https://pkgs.k8s.io/core:/stable:/v1.35/rpm/
enabled=1
gpgcheck=1
gpgkey=https://pkgs.k8s.io/core:/stable:/v1.35/rpm/repodata/repomd.xml.key
EOF
[root@node1 cri-dockerd]# dnf install -y kubeadm-1.35.7 kubelet-1.35.7
[root@node1 cri-dockerd]# systemctl enable kubelet --now
[root@node1 cri-dockerd]# docker login reg.timinglee.org -u admin -p lee
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Login Succeeded
[root@node1 cri-dockerd]# kubeadm join 172.25.254.100:6443 --token xxxxx --^Cscovery-token-ca-cert-hash sha256:xxxxx
[root@node1 cri-dockerd]# kubeadm join 172.25.254.100:6443 --token <to^Cn> \
  --discovery-token-ca-cert-hash sha256:<hash> \
  --cri-socket unix:///var/run/cri-dockerd.sock
[root@node1 cri-dockerd]# kubeadm join 172.25.254.100:6443 --token zppv87.t4kx9ugaviz7faqb \
  --discovery-token-ca-cert-hash sha256:5dc6a185e6e36825889178763d5453e53c082e77374968aa0edcb5003b6a7976 \
  --cri-socket unix:///var/run/cri-dockerd.sock
[preflight] Running pre-flight checks
    [WARNING SystemVerification]: kernel release 5.14.0-687.5.3.el9_8.x86_64 is unsupported. Supported LTS versions from the 5.x series are 5.4, 5.10 and 5.15. Any 6.x version is also supported. For cgroups v2 support, the recommended version is 5.10 or newer
[preflight] Some fatal errors occurred:
    [ERROR FileAvailable--etc-kubernetes-kubelet.conf]: /etc/kubernetes/kubelet.conf already exists
    [ERROR Port-10250]: Port 10250 is in use
    [ERROR FileAvailable--etc-kubernetes-pki-ca.crt]: /etc/kubernetes/pki/ca.crt already exists
[preflight] If you know what you are doing, you can make a check non-fatal with `--ignore-preflight-errors=...`
error: error execution phase preflight: preflight checks failed
To see the stack trace of this error execute with --v=5 or higher
[root@node1 cri-dockerd]# kubeadm reset --cri-socket unix:///var/run/cri-dockerd.sock
[root@node1 cri-dockerd]# rm -rf /etc/kubernetes /var/lib/kubelet
[root@node1 cri-dockerd]# netstat -tlnp | grep 10250
[root@node1 cri-dockerd]# systemctl restart kubelet
[root@node1 cri-dockerd]# kubeadm join 172.25.254.100:6443 --token zppv87.t4kx9ugaviz7faqb \
  --discovery-token-ca-cert-hash sha256:5dc6a185e6e36825889178763d5453e53c082e77374968aa0edcb5003b6a7976 \
  --cri-socket unix:///var/run/cri-dockerd.sock
[root@node1 cri-dockerd]# docker pull reg.timinglee.org/k8s/kube-proxy:v1.35.7
v1.35.7: Pulling from k8s/kube-proxy
a6c8b26f7345: Pull complete 
3d17fab17123: Pull complete 
Digest: sha256:c77d584d0a5e075f33f2a72a7f45890ed450a0b6ebab86271671a7692825157b
Status: Downloaded newer image for reg.timinglee.org/k8s/kube-proxy:v1.35.7
reg.timinglee.org/k8s/kube-proxy:v1.35.7
 

node2同理