bantu 24。
集群规划（3 节点），使用sealos v4.3.7 部署 k8s + kubesphere v3.4.0
master节点01，主机名：k8s-master-01，ip：172.29.128.1
工作节点01：主机名：k8s-worker-01，ip：172.29.132.68
工作节点02：主机名：k8s-worker-02，ip：172.29.132.69
| 机器名 | 内网 ip |
| k8s-master-01 | 172.29.128.1 |
| k8s-worker-01 | 172.29.132.68 |
| k8s-worker-02 | 172.29.132.69 |
一、两个重要的镜像仓库网站
交互式公开容器镜像浏览器：https://explore.ggcr.dev
渡渡鸟：https://docker.aityp.com
输入镜像名字搜索镜像，看有没有需要的镜像。
二，御载以前安装的containerd等。
1. 停止并删除服务
#停止服务，御载软件包
systemctl stop containerd
systemctl disable containerd
apt remove -y containerd.io containerd
apt autoremove -y
apt autoclean
rm -f /usr/bin/containerd
rm -f /usr/bin/ctr
rm -rf /etc/containerd /var/lib/containerd /run/containerd /var/lib/cri /var/lib/nerdctl
rm -rf /var/lib/sealos /etc/kubernetes /var/lib/kubelet /var/lib/etcd
三、所有节点统一前置初始化脚本（所有机器执行）
1. 修改主机名
# master节点执行 hostnamectl set-hostname k8s-master-01 # worker01执行 hostnamectl set-hostname k8s-worker-01 # worker02执行 hostnamectl set-hostname k8s-worker-02
2. 配置 hosts 解析（所有节点统一写入 /etc/hosts）
cat >> /etc/hosts << EOF 172.29.128.1 k8s-master-01 172.29.132.68 k8s-worker-01 172.29.132.69 k8s-worker-02 EOF
/etc/hosts 完整内容：
127.0.0.1 localhost
# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
172.29.128.1 k8s-master-01
172.29.132.68 k8s-worker-01
172.29.132.69 k8s-worker-02
3. 系统内核 & 资源优化
# 关闭swap永久生效
swapoff -a
sed -i '/swap/s/^/#/' /etc/fstab
# 开启root密码登录
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config
sed -i 's/#PasswordAuthentication no/PasswordAuthentication yes/' /etc/ssh/sshd_config
systemctl restart ssh
systemctl enable ssh# 关闭ufw防火墙
systemctl stop ufw
systemctl disable ufwcat >> /etc/sysctl.conf << EOF
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
EOF
sysctl -p#把下面两行的值改为1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter = 1# 加载网桥模块
modprobe overlay
modprobe br_netfilter#系统开机自动加载里面写的内核模块。
echo "overlay" >> /etc/modules-load.d/k8s.conf
echo "br_netfilter" >> /etc/modules-load.d/k8s.conf
4. 补齐网络依赖，解决 calico的ipset与宿主机内核版本不兼容的问题。
modprobe ipip tunnel4 ip_tunnel xt_conntrack xt_mark xt_set iptable_filtercat >> /etc/sysctl.d/99-calico-tunnel.conf <<EOF
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter = 1
EOF
sysctl -p /etc/sysctl.d/99-calico-tunnel.confiptables -F;iptables -t nat -F;iptables -X;ipvsadm -C
ip link del tunl0 2>/dev/null;ip link del cni0 2>/dev/null
rm -rf /etc/cni/net.d/*
5. 安装基础依赖
apt update && apt upgrade -y
apt update && apt install -y curl wget openssl ca-certificates gnupg lsb-release openssh-server sshpass tar unzip ipset ipvsadm conntrack socat lvm2
6. 时间同步
apt install chrony -y systemctl enable --now chronyd timedatectl set-timezone Asia/Shanghai
7. 免密互通（仅 master 执行，打通所有节点 ssh）
# master节点生成密钥 ssh-keygen -t ed25519 -N "" -f /root/.ssh/id_ed25519 # 分发公钥 sshpass ssh-copy-id root@172.29.128.1 sshpass ssh-copy-id root@172.29.132.68 sshpass ssh-copy-id root@172.29.132.69# 验证免密连通 ssh root@172.29.128.1 hostname ssh root@172.29.132.68 hostname ssh root@172.29.132.69 hostname
8. 批量校验所有节点 SSH 连通性（最关键前置检查）
nodes=(172.29.128.1 172.29.132.68 172.29.132.69)
for ip in ${nodes[@]};
doecho "=== 测试 $ip SSH ==="sshpass -p "你的root密码" ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no root@$ip "hostname; echo 连接正常"
done
ster 节点安装 Sealos v5.1.1
试过用二进制方式安装不了，改换下载离线包到本机，然后人本机copy到远程服务器。
下载地址：https://github.com/labring/sealos/releases/download/v5.1.1/sealos_5.1.1_linux_amd64.tar.gz
在本机打开 powershell 窗口，用scp命令拷贝到远程服务器，然后在服务器上执行安装：
#上传到服务器
scp D:/softs/k8s/sealos_5.1.1_linux_amd64.tar.gz root@121.40.63.235:/data/sealos-5 cd /data/sealos-5 # 解压 tar -zxvf sealos_5.1.1_linux_amd64.tar.gz # 赋予执行权限并全局放置 chmod +x sealos mv sealos /usr/local/bin/ # 验证版本 sealos version
六、拉镜像
1，查看已经下载的镜像
sealos images
2,删除指定镜像
sealos rmi -f 镜像名:标签
3.用sealos拉取五个镜像
1，先把镜像拉取到本地（验证有没有镜像）
从渡渡鸟仓库拉取镜像，渡渡鸟有kubernetes v1.33.6镜像，阿里云上海仓库没有这么高的版本。
查询阿里云仓库的镜像：https://explore.ggcr.dev
查查渡渡鸟的镜像：https://docker.aityp.com
#从渡渡鸟拉取镜像 sealos pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/kubernetes:v1.33.6 sealos pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/helm:v3.17.1 sealos pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/calico:v3.28.1
2，安装kubernetes v1.33.6
sealos run \ swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/kubernetes:v1.33.6 \ swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/helm:v3.17.1 \ swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/labring/calico:v3.28.1 \ --masters 172.29.128.1 \ --nodes 172.29.132.68,172.29.132.69 \ --user root \ --passwd yihan@123
安装完成后，查看集群状态
kubectl get nodes
查看pod状态有没有全部Runing，并且全部Ready（就绪）
kubectl get pod -A
