二进制安装Kubernetesk8sv1.36.0为什么选择二进制安装在生产环境中Kubernetes集群的安装方式直接决定了后续运维的复杂度。虽然kubeadm提供了便捷的一键部署但二进制安装有几个不可替代的优势-完全可控每个组件kube-apiserver、etcd、kubelet等的版本、启动参数、证书都由你亲手指定便于深度定制和排障。-性能优化跳过容器化封装直接使用系统级二进制减少一层抽象适合对延迟敏感的场景。-离线部署友好二进制文件可以预先下载无需依赖外部仓库适合内网环境。-学习价值理解每个组件如何协同工作是进阶K8s运维的必经之路。本文将以v1.36.0假设未来版本实际以官方发布为准为例演示从零开始搭建一个单Master、单Worker的最小集群。我们将使用systemd管理服务并基于etcd存储。—### 环境准备与架构规划我们准备两台Ubuntu 22.04虚拟机或裸机-master01192.168.1.102C4G-worker01192.168.1.112C4G所需二进制包从kubernetes release下载v1.36.0-kube-apiserver、kube-controller-manager、kube-schedulerMaster节点-kubelet、kube-proxyWorker节点-etcdv3.5.x单独下载证书体系使用cfssl生成自签CA分别签发apiserver、etcd、kubelet等证书。为简化这里我们使用openssl生成一个通用的自签证书生产环境务必使用正规CA或cfssl。—### 第一步下载并解压二进制在所有节点上执行以下命令bash# 创建目录结构sudo mkdir -p /etc/kubernetes/{pki,manifests}sudo mkdir -p /var/lib/kubernetessudo mkdir -p /var/lib/etcd# 下载K8s v1.36.0二进制以Linux amd64为例wget https://dl.k8s.io/v1.36.0/kubernetes-server-linux-amd64.tar.gztar -xzf kubernetes-server-linux-amd64.tar.gzcd kubernetes/server/bin# 将需要的二进制复制到/usr/local/binsudo cp kube-apiserver kube-controller-manager kube-scheduler kubelet kube-proxy /usr/local/bin/# 下载etcd单独wget https://github.com/etcd-io/etcd/releases/download/v3.5.13/etcd-v3.5.13-linux-amd64.tar.gztar -xzf etcd-v3.5.13-linux-amd64.tar.gzsudo cp etcd-v3.5.13-linux-amd64/etcd* /usr/local/bin/注意v1.36.0的二进制包可能包含kubeadm等工具但我们只取需要的部分。解压后请确认文件有执行权限chmod x。—### 第二步生成证书与加密配置在master01上生成CA和服务器证书简化版使用opensslbash# 生成CA私钥和自签证书openssl genrsa -out /etc/kubernetes/pki/ca.key 2048openssl req -x509 -new -nodes -key ca.key -subj /CNkubernetes-ca -days 3650 -out ca.crt# 生成apiserver密钥和证书需包含IP和DNSopenssl genrsa -out apiserver.key 2048cat apiserver-openssl.cnf EOF[req]req_extensions v3_reqdistinguished_name req_distinguished_name[req_distinguished_name][ v3_req ]basicConstraints CA:FALSEkeyUsage nonRepudiation, digitalSignature, keyEnciphermentsubjectAltName alt_names[alt_names]IP.1 192.168.1.10IP.2 127.0.0.1DNS.1 kubernetes.defaultDNS.2 master01EOFopenssl req -new -key apiserver.key -subj /CNkube-apiserver -out apiserver.csr -config apiserver-openssl.cnfopenssl x509 -req -in apiserver.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out apiserver.crt -days 3650 -extensions v3_req -extfile apiserver-openssl.cnf# 生成etcd证书类似略重要这个证书生成过程是高度简化的生产环境必须使用cfssl管理每个组件的独立证书并设置正确的Extended Key Usage。这里为了演示可运行性使用了宽松配置。—### 第三步配置etcd集群单节点在master01上创建etcd的systemd服务bashsudo tee /etc/systemd/system/etcd.service EOF[Unit]Descriptionetcd key-value storeAfternetwork.target[Service]ExecStart/usr/local/bin/etcd \\ --nameetcd-master \\ --data-dir/var/lib/etcd \\ --listen-client-urlshttps://192.168.1.10:2379,https://127.0.0.1:2379 \\ --advertise-client-urlshttps://192.168.1.10:2379 \\ --listen-peer-urlshttps://192.168.1.10:2380 \\ --initial-advertise-peer-urlshttps://192.168.1.10:2380 \\ --initial-clusteretcd-masterhttps://192.168.1.10:2380 \\ --client-cert-authtrue \\ --cert-file/etc/kubernetes/pki/etcd.crt \\ --key-file/etc/kubernetes/pki/etcd.key \\ --peer-cert-file/etc/kubernetes/pki/etcd-peer.crt \\ --peer-key-file/etc/kubernetes/pki/etcd-peer.key \\ --trusted-ca-file/etc/kubernetes/pki/ca.crt \\ --peer-trusted-ca-file/etc/kubernetes/pki/ca.crtRestartalwaysRestartSec5[Install]WantedBymulti-user.targetEOFsudo systemctl daemon-reloadsudo systemctl start etcdsudo systemctl enable etcd验证bashsudo ETCDCTL_API3 etcdctl --cacert/etc/kubernetes/pki/ca.crt --cert/etc/kubernetes/pki/etcd.crt --key/etc/kubernetes/pki/etcd.key --endpointshttps://192.168.1.10:2379 endpoint health—### 第四步启动kube-apiserver这是K8s的核心组件负责所有RESTful API请求。需要配置--etcd-servers、--service-cluster-ip-range等。bashsudo tee /etc/systemd/system/kube-apiserver.service EOF[Unit]DescriptionKubernetes API ServerAfteretcd.service[Service]ExecStart/usr/local/bin/kube-apiserver \\ --advertise-address192.168.1.10 \\ --allow-privilegedtrue \\ --apiserver-count1 \\ --audit-log-maxage30 \\ --audit-log-maxbackup3 \\ --audit-log-maxsize100 \\ --audit-log-path/var/log/audit.log \\ --authorization-modeNode,RBAC \\ --bind-address0.0.0.0 \\ --client-ca-file/etc/kubernetes/pki/ca.crt \\ --enable-admission-pluginsNamespaceLifecycle,NodeRestriction,LimitRanger,ServiceAccount,DefaultStorageClass,ResourceQuota \\ --etcd-cafile/etc/kubernetes/pki/ca.crt \\ --etcd-certfile/etc/kubernetes/pki/apiserver.crt \\ --etcd-keyfile/etc/kubernetes/pki/apiserver.key \\ --etcd-servershttps://192.168.1.10:2379 \\ --kubelet-certificate-authority/etc/kubernetes/pki/ca.crt \\ --kubelet-client-certificate/etc/kubernetes/pki/apiserver.crt \\ --kubelet-client-key/etc/kubernetes/pki/apiserver.key \\ --kubelet-preferred-address-typesInternalIP,ExternalIP,Hostname \\ --secure-port6443 \\ --service-account-issuerhttps://kubernetes.default.svc \\ --service-account-key-file/etc/kubernetes/pki/sa.pub \\ --service-account-signing-key-file/etc/kubernetes/pki/sa.key \\ --service-cluster-ip-range10.96.0.0/12 \\ --tls-cert-file/etc/kubernetes/pki/apiserver.crt \\ --tls-private-key-file/etc/kubernetes/pki/apiserver.key \\ --v2RestartalwaysRestartSec5[Install]WantedBymulti-user.targetEOF# 生成ServiceAccount密钥对用于JWTopenssl genrsa -out /etc/kubernetes/pki/sa.key 2048openssl rsa -in sa.key -pubout -out sa.pubsudo systemctl daemon-reloadsudo systemctl start kube-apiserversudo systemctl enable kube-apiserver验证bashcurl -k https://192.168.1.10:6443/healthz—### 第五步启动controller-manager和scheduler这两个组件相对简单只需指向正确的apiserver地址。bash# controller-managersudo tee /etc/systemd/system/kube-controller-manager.service EOF[Unit]DescriptionKubernetes Controller ManagerAfterkube-apiserver.service[Service]ExecStart/usr/local/bin/kube-controller-manager \\ --bind-address0.0.0.0 \\ --kubeconfig/etc/kubernetes/controller-manager.kubeconfig \\ --leader-electtrue \\ --cluster-signing-cert-file/etc/kubernetes/pki/ca.crt \\ --cluster-signing-key-file/etc/kubernetes/pki/ca.key \\ --controllers*,bootstrapsigner,tokencleaner \\ --use-service-account-credentialstrue \\ --v2RestartalwaysRestartSec5[Install]WantedBymulti-user.targetEOF# schedulersudo tee /etc/systemd/system/kube-scheduler.service EOF[Unit]DescriptionKubernetes SchedulerAfterkube-apiserver.service[Service]ExecStart/usr/local/bin/kube-scheduler \\ --bind-address0.0.0.0 \\ --kubeconfig/etc/kubernetes/scheduler.kubeconfig \\ --leader-electtrue \\ --v2RestartalwaysRestartSec5[Install]WantedBymulti-user.targetEOF注意这里需要生成两个kubeconfig文件controller-manager和scheduler用于与apiserver认证。核心是用kubectl config set-cluster和set-credentials命令创建。—### 第六步配置Worker节点kubelet和kube-proxy在worker01上kubelet需要注册到apiserver。我们使用bootstrap token简化流程bash# 生成bootstrap token在master上执行kubeadm token create --print-join-command # 或者手动生成随机token但因为是纯二进制我们手动创建kubelet的kubeconfigbash# 在worker01上创建kubelet.kubeconfigkubectl config set-cluster kubernetes --serverhttps://192.168.1.10:6443 --certificate-authority/etc/kubernetes/pki/ca.crt --kubeconfig/etc/kubernetes/kubelet.kubeconfigkubectl config set-credentials kubelet --tokenYOUR_TOKEN --kubeconfig/etc/kubernetes/kubelet.kubeconfigkubectl config set-context default --clusterkubernetes --userkubelet --kubeconfig/etc/kubernetes/kubelet.kubeconfigkubectl config use-context default --kubeconfig/etc/kubernetes/kubelet.kubeconfig然后创建kubelet服务bashsudo tee /etc/systemd/system/kubelet.service EOF[Unit]DescriptionKubernetes KubeletAftercontainerd.service[Service]ExecStart/usr/local/bin/kubelet \\ --kubeconfig/etc/kubernetes/kubelet.kubeconfig \\ --config/etc/kubernetes/kubelet-config.yaml \\ --cgroup-driversystemd \\ --network-plugincni \\ --pod-infra-container-imageregistry.k8s.io/pause:3.10 \\ --v2RestartalwaysRestartSec5[Install]WantedBymulti-user.targetEOF对应的kubelet-config.yamlyamlapiVersion: kubelet.config.k8s.io/v1beta1kind: KubeletConfigurationaddress: 0.0.0.0port: 10250authentication: anonymous: enabled: false webhook: enabled: trueauthorization: mode: WebhookclusterDomain: cluster.localclusterDNS: - 10.96.0.10最后启动kubelet和kube-proxykube-proxy使用daemonset方式部署即可但也可用二进制。—### 第七步验证集群在master上设置kubectlbashkubectl config set-cluster kubernetes --serverhttps://192.168.1.10:6443 --certificate-authority/etc/kubernetes/pki/ca.crtkubectl config set-credentials admin --tokenYOUR_ADMIN_TOKENkubectl config set-context default --clusterkubernetes --useradminkubectl config use-context default查看节点状态bashkubectl get nodes如果一切正常你应该看到worker01处于Ready状态。—### 常见问题与排障1.证书不匹配确保所有证书的Subject Alternative Name包含正确的IP和DNS。2.etcd连接失败检查etcdctl endpoint health确认证书路径正确。3.kubelet无法注册查看journalctl -u kubelet -f日志通常为token过期或RBAC问题。4.Pod内DNS解析失败检查CoreDNS是否部署以及clusterDNS配置是否正确。—### 总结二进制安装Kubernetes v1.36.0虽然步骤繁琐但每一步都清晰可控。本文从环境准备、证书生成、etcd、apiserver、controller-manager、scheduler到kubelet/kube-proxy完整演示了一个最小集群的搭建过程。关键点在于-证书体系必须严谨否则后续所有组件通信都会失败。-systemd管理让服务自动重启提升稳定性。-kubeconfig是连接apiserver的“钥匙”必须正确配置。这种安装方式适合对K8s有深入理解需求的运维人员虽然初始成本高但长期维护中能避免黑盒问题。如果你追求快速部署kubeadm依然是不错的选择但若需要定制化或离线环境二进制方案值得掌握。提示v1.36.0的完整二进制包可能包含更多CNI插件请确保安装cni-plugins如bridge、host-local到/opt/cni/bin否则Pod无法获得网络。