架构
kubernetes 1.27.7 + sealos 4.3+ 版本+ CentOS Linux release 8.4.2105

一、基础配置

1.将镜像源切换到 vault.centos.org
在三台机器上分别执行：
cd /etc/yum.repos.d/
sed -i ‘s/mirror.centos.org/vault.centos.org/g’ *.repo
sed -i ‘s/#baseurl/baseurl/g’ *.repo
sed -i ‘s/metalink/#metalink/g’ *.repo
dnf clean all
dnf makecache
验证源是否可用（如果能列出包，说明成功）
if dnf list | head > /dev/null 2>&1; then
echo “Yum 源修复成功！”
else
echo " Yum 源修复失败，请检查网络连接！"
exit 1
fi
#!/bin/bash
echo “>>> 开始初始化系统环境…”

2. 关闭防火墙 (测试环境直接关闭，生产环境需配置规则)
   systemctl stop firewalld
   systemctl disable firewalld
   echo " 防火墙已关闭"

3. 关闭 Swap (K8s 强制要求，否则 Pod 无法启动)
   swapoff -a
   永久生效：注释掉 /etc/fstab 中的 swap 行
   sed -i ‘/ swap / s/^(.*)$/#\1/g’ /etc/fstab
   echo " Swap 已关闭"

4. 设置 SELinux 为 Permissive 模式
   setenforce 0
   sed -i ‘s/^SELINUX=enforcing$/SELINUX=permissive/’ /etc/selinux/config
   echo " SELinux 已设置为 Permissive"

5. 加载必要的内核模块
   cat <<EOF | tee /etc/modules-load.d/k8s.conf
   br_netfilter
   overlay
   EOF
   modprobe br_netfilter
   modprobe overlay
   echo “内核模块已加载”

6. 设置内核参数 (允许桥接流量通过 iptables)
   cat <<EOF | tee /etc/sysctl.d/k8s.conf
   net.bridge.bridge-nf-call-iptables = 1
   net.bridge.bridge-nf-call-ip6tables = 1
   net.ipv4.ip_forward = 1
   EOF
   sysctl --system
   echo “内核参数已配置”

7. 安装并配置时间同步 (Chrony)
   如果没安装 chrony，先安装
   dnf install -y chrony
   systemctl start chronyd
   systemctl enable chronyd
   立即同步时间
   chronyc -a makestep
   echo “时间同步服务已启动”

8. 生成密钥对 (一路回车即可)
   ssh-keygen -t rsa -P “” -f ~/.ssh/id_rsa

9. 将公钥分发到所有节点 (包括自己)
   这里的 root@IP 需要输入一次密码，之后就不再需要了
   ssh-copy-id root@10.128.5.39
   ssh-copy-id root@10.128.5.41
   ssh-copy-id root@10.128.5.42

10. 验证免密 (关键步骤)
    如果下面三条命令都能直接输出信息而不提示输入密码，则成功
    echo “— 验证免密 —”
    ssh root@10.128.5.39 “hostname”
    ssh root@10.128.5.41 “hostname”
    ssh root@10.128.5.42 “hostname”
    echo “— 验证结束 —”

二、部署sealos
tar zxvf sealos_4.3.7_linux_amd64.tar.gz sealos && chmod +x sealos && mv sealos /usr/bin
拉取阿里云镜像：
sealos pull registry.cn-shanghai.aliyuncs.com/labring/kubernetes:v1.27.7
sealos pull registry.cn-shanghai.aliyuncs.com/labring/calico:v3.24.1
sealos pull registry.cn-shanghai.aliyuncs.com/labring/helm:v3.9.4
Sealos images --查看获取镜像
三、部署k8s
sealos run
registry.cn-shanghai.aliyuncs.com/labring/kubernetes:v1.27.7
registry.cn-shanghai.aliyuncs.com/labring/calico:v3.24.1
registry.cn-shanghai.aliyuncs.com/labring/helm:v3.9.4
–masters 10.128.5.39
–nodes 10.128.5.41,10.128.5.42
–port 16120
–cluster why-cluster
安装网络插件
wget https://raw.githubusercontent.com/projectcalico/calico/v3.24.1/manifests/calico.yaml
kubectl apply -f calico.yaml
四、部署k9s
tar -xzf k9s_Linux_amd64.tar.gz
sudo mv k9s /usr/local/bin/
sudo chmod +x /usr/local/bin/k9s
五、回退
铲除集群
sealos reset --cluster why-cluster --force
六、build离线包
##配置文件
cat > Sealfile <<EOF
FROM registry.cn-shanghai.aliyuncs.com/labring/kubernetes:v1.27.7
COPY --from=registry.cn-shanghai.aliyuncs.com/labring/calico:v3.24.1 / /
COPY --from=registry.cn-shanghai.aliyuncs.com/labring/helm:v3.9.4 / /
EOF

##build包
sealos build -f Sealfile -t k8s-offline-v1.27 .

##导出为离线文件
sealos save k8s-offline-v1.27 -o k8s-offline-v1.27.tar