kubekey离线搭建k8s高版本＞23安装，cri-dockerd通信

1.设置主机名、域名映射、配置好dns，ntp

# 设置主机名
hostnamectl hostname ksp-master-1

# 域名映射
vim /etc/hosts

2.关闭防火墙和selinux

# 关闭防火墙
systemctl stop firewalld && systemctl disable firewalld


# 使用 sed 修改配置文件，实现彻底的禁用

sed -i 's/^SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config

# 使用命令，实现临时禁用，这一步其实不做也行，KubeKey 会自动配置

setenforce 0

3.安装 Kubernetes 系统依赖包

yum install socat conntrack ebtables ipset ipvsadm

4.安装docker>24.0.x （containerd>1.6.32）

见有网络安装docker的文章，下载好rpm包

5.修改docker的通信systemd，与kubelet保持一致

mkdir -p /etc/docker
vim /etc/docker/daemon.json
{
  "exec-opts": ["native.cgroupdriver=systemd"],
  "storage-driver": "overlay2"
}

systemctl daemon-reload 
systemctl restart docker

6.安装cri-dockerd>0.3.10+

解决kubelet无法启动，默认拉取pause:3.6

修改cri-dockerd配置，指定拉取的沙箱

# 解决kubelet无法启动，默认拉取pause:3.6

vim /usr/lib/systemd/system/cri-docker.service

方案1：修改 cri-dockerd 配置（如果你使用 cri-dockerd 让 K8s 管理 Docker）
编辑 cri-dockerd 的 systemd service 文件（如 /usr/lib/systemd/system/cri-docker.service），在 ExecStart 命令中添加或修改 --pod-infra-container-image 参数：

ExecStart=/usr/bin/cri-dockerd --pod-infra-container-image=registry.cn-beijing.aliyuncs.com/kubesphereio/pause:3.9

离线：--pod-infra-container-image=your-harbor/library/pause:3.9

保存后，重新加载配置并重启服务：

sudo systemctl daemon-reload
sudo systemctl restart cri-docker.service



方案2：改kubelet，优先级更高

7.准备镜像和kubekey文件

修改配置文件

    internalLoadbalancer: haproxy
    containerManager: docker
    criSocket: /run/cri-dockerd.sock
    kubePodsCIDR: 10.244.0.0/16
    kubeServiceCIDR: 10.96.0.0/16

apiVersion: kubekey.kubesphere.io/v1alpha2
kind: Cluster
metadata:
  name: sample
spec:
  hosts:
  - {name: kk-off-m1-11, address: 192.168.88.11, internalAddress: 192.168.88.11, user: root, password: "123456"}
  - {name: kk-off-m2-12, address: 192.168.88.12, internalAddress: 192.168.88.12, user: root, password: "123456"}
  - {name: kk-off-m3-13, address: 192.168.88.13, internalAddress: 192.168.88.13, user: root, password: "123456"}
  - {name: kk-off-n1-14, address: 192.168.88.14, internalAddress: 192.168.88.14, user: root, password: "123456"}
  roleGroups:
    etcd:
    - kk-off-m1-11
    - kk-off-m2-12
    - kk-off-m3-13
    control-plane: 
    - kk-off-m1-11
    - kk-off-m2-12
    - kk-off-m3-13
    worker:
    - kk-off-m1-11
    - kk-off-m2-12
    - kk-off-m3-13
    - kk-off-n1-14
  controlPlaneEndpoint:
    ## Internal loadbalancer for apiservers 
    internalLoadbalancer: haproxy

    domain: lb.kubesphere.local
    address: ""
    port: 6443
  kubernetes:
    version: v1.30.6
    clusterName: cluster.local
    autoRenewCerts: true
    containerManager: docker
    criSocket: /run/cri-dockerd.sock
  etcd:
    type: kubekey
  network:
    plugin: calico
    kubePodsCIDR: 10.244.0.0/16
    kubeServiceCIDR: 10.96.0.0/16
    ## multus support. https://github.com/k8snetworkplumbingwg/multus-cni
    multusCNI:
      enabled: false
  registry:
    privateRegistry: ""
    namespaceOverride: ""
    registryMirrors: []
    insecureRegistries: []
  addons: []



# 指定harbor仓库的配置文件
apiVersion: kubekey.kubesphere.io/v1alpha2
kind: Cluster
metadata:
  name: sample
spec:
  hosts:
  - {name: node1, address: 192.168.9.91, internalAddress: 192.168.9.91, user: root, password: "your-password"}
.......
.......
  registry:
    # 设置 registry 类型为 harbor
    type: harbor
    # 如使用 kk 部署的 harbor 或其他需要登录的仓库，可设置对应仓库的 auths
    # 注意：如使用 kk 部署 harbor，该参数请于 harbor 启动后设置
    auths:
      "harbor.yourdomain.com:8443":  # 你的 Harbor 仓库地址和端口
        username: admin
        password: Harbor12345  # 你的 Harbor 管理员密码
    # 设置集群部署时使用的私有仓库
    privateRegistry: "harbor.yourdomain.com:8443"  # 你的 Harbor 仓库地址和端口
    namespaceOverride: "kubesphereio"  # 覆盖默认的命名空间（如需要）
    registryMirrors: []
    insecureRegistries: []
    
  addons: []

8.准备安装k8s集群

# 国内镜像环境
export KKZONE=cn

# 安装集群

./kk create cluster -f config-sample.yaml --skip-pull-images


# 重置集群
./kk delete cluster -f config-sample.yaml 

9.查看是否使用的cri-docerd通信方式

cat   /etc/crictl.yaml

runtime-endpoint: unix:///var/run/cri-dockerd.sock
image-endpoint: unix:///var/run/cri-dockerd.sock
timeout: 10



ps -ef | grep kubelet | grep -Eo 'container-runtime-endpoint=[^ ]+'

container-runtime-endpoint=unix:///var/run/cri-dockerd.sock

----以上为安装过程-----

10.配置tab补全

# 设置 Tab 键
[root@master ~]# source <(kubeadm completion bash|tee /etc/bash_completion.d/kubeadm)
[root@master ~]# source <(kubectl completion bash|tee /etc/bash_completion.d/kubectl)

11.添加节点，节点需要有沙箱镜像，需要准备好环境

将新节点的信息添加到集群配置文件中，然后应用更改。

./kk add nodes -f config-sample.yaml --skip-pull-images

12.删除节点

./kk delete node <nodeName> -f config-sample.yaml

13.如果kubelet启动失败排查

pause沙箱：pod运行的基础镜像

查看pause的版本问题

systemctl status kubelet -l --no-pager