先把四个主机的hosts文件添加各个ip以及hostname

172.25.254.100     master
172.25.254.10      node1
172.25.254.20      node2
172.25.254.100     reg.timinglee.org
172.25.254.254     kubernetes
如例

防火墙都应关闭

systemctl stop firewalld && systemctl disable firewalld
setenforce 0 && sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config

加载内核模块并调整 sysctl

安装前先删除红帽系统自带的盗版docker

dnf remove -y podman* buildah* skopeo*

安装docker ce

先换成国内镜像，下载会快点

[root@harbor harbor]# ln -s /usr/bin/docker /usr/local/bin/docker-compose
[root@harbor harbor]# chmod +x /usr/local/bin/docker-compose
[root@harbor harbor]# ./install.sh

[root@master ~]# tar xvf cri-dockerd-0.4.4.amd64.tgz
cri-dockerd/
cri-dockerd/cri-dockerd
[root@master ~]# mv cri-dockerd /usr/local/bin/
mv：是否覆盖'/usr/local/bin/cri-dockerd'？ y
mv: 无法以目录'cri-dockerd' 来覆盖非目录'/usr/local/bin/cri-dockerd'
[root@master ~]# cd /usr/local/bin/
[root@master bin]# ls
cri-dockerd
[root@master bin]# ll cri-dockerd 
-rwxr-xr-x 1 1001 1001 51638434  6月 30 16:49 cri-dockerd
[root@master bin]# cat > /etc/systemd/system/cri-docker.service <<EOF
[Unit]
Description=CRI Docker daemon for Kubernetes
After=docker.service
Requires=docker.service

[Service]
ExecStart=/usr/local/bin/cri-dockerd --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF
[root@master bin]# cat > /etc/systemd/system/cri-docker.socket <<EOF
[Unit]
Description=CRI Docker Socket for Kubernetes
PartOf=cri-docker.service

[Socket]
ListenStream=/var/run/cri-dockerd.sock
SocketMode=0660
SocketUser=root
SocketGroup=docker

[Install]
WantedBy=sockets.target
EOF
[root@master bin]# systemctl daemon-reload3
Unknown command verb daemon-reload3.
[root@master bin]# cd 
[root@master ~]# cd cri-dockerd/
[root@master cri-dockerd]# ls
cri-dockerd
[root@master cri-dockerd]# systemctl daemon-reload
[root@master cri-dockerd]# systemctl enable cri-docker --now
[root@master cri-dockerd]# mv cri-dockerd /usr/local/bin/
mv：是否覆盖'/usr/local/bin/cri-dockerd'？ y
[root@master cri-dockerd]# chmod +x /usr/local/bin/cri-dockerd
[root@master cri-dockerd]# cri-dockerd --version
cri-dockerd 0.4.4 (98c4823)
[root@master cri-dockerd]# cat > /etc/yum.repos.d/kubernetes.repo <<EOF
[kubernetes]
name=Kubernetes
baseurl=https://pkgs.k8s.io/core:/stable:/v1.35/rpm/
enabled=1
gpgcheck=1
gpgkey=https://pkgs.k8s.io/core:/stable:/v1.35/rpm/repodata/repomd.xml.key
EOF
[root@master cri-dockerd]# dnf install -y kubeadm-1.35.7 kubelet-1.35.7 kubectl-1.35.7
完毕！
[root@master cri-dockerd]# docker login reg.timinglee.org -u admin -p lee
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Login Succeeded
[root@master cri-dockerd]# images=$(kubeadm config images list --image-repository registry.aliyuncs.com/google_containers --kubernetes-version v1.35.7)
[root@master cri-dockerd]# for img in $images; do
  docker pull $img
  local_name=$(basename $img)
  new_img="reg.timinglee.org/k8s/$local_name"
  docker tag $img $new_img
  docker push $new_img
done

[root@master cri-dockerd]# kubeadm init --pod-network-cidr=10.244.0.0/16 \
  --image-repository reg.timinglee.org/k8s \
  --kubernetes-version v1.35.7 \
  --cri-socket unix:///var/run/cri-dockerd.sock
[init] Using Kubernetes version: v1.35.7
[preflight] Running pre-flight checks
    [WARNING SystemVerification]: kernel release 5.14.0-687.5.3.el9_8.x86_64 is unsupported. Supported LTS versions from the 5.x series are 5.4, 5.10 and 5.15. Any 6.x version is also supported. For cgroups v2 support, the recommended version is 5.10 or newer
[preflight] Some fatal errors occurred:
    [ERROR Port-6443]: Port 6443 is in use
    [ERROR Port-10259]: Port 10259 is in use
    [ERROR Port-10257]: Port 10257 is in use
    [ERROR FileAvailable--etc-kubernetes-manifests-kube-apiserver.yaml]: /etc/kubernetes/manifests/kube-apiserver.yaml already exists
    [ERROR FileAvailable--etc-kubernetes-manifests-kube-controller-manager.yaml]: /etc/kubernetes/manifests/kube-controller-manager.yaml already exists
    [ERROR FileAvailable--etc-kubernetes-manifests-kube-scheduler.yaml]: /etc/kubernetes/manifests/kube-scheduler.yaml already exists
    [ERROR FileAvailable--etc-kubernetes-manifests-etcd.yaml]: /etc/kubernetes/manifests/etcd.yaml already exists
    [ERROR Port-10250]: Port 10250 is in use
    [ERROR Port-2379]: Port 2379 is in use
    [ERROR Port-2380]: Port 2380 is in use
    [ERROR DirAvailable--var-lib-etcd]: /var/lib/etcd is not empty
[preflight] If you know what you are doing, you can make a check non-fatal with `--ignore-preflight-errors=...`
error: error execution phase preflight: preflight checks failed
To see the stack trace of this error execute with --v=5 or higher
[root@master cri-dockerd]# docker stop $(docker ps -aqf "name=kube-apiserver|etcd|kube-controller|kube-scheduler") 2>/dev/null
c6445280b82a
f93459e8f0e8
5d9ab039b8cc
2750dc88715e
29bc686e1532
b3cd65f684a8
c20b3aad602d
2a65e8de6e37
[root@master cri-dockerd]# docker rm $(docker ps -aqf "name=kube-apiserver|etcd|kube-controller|kube-scheduler") 2>/dev/null
c6445280b82a
f93459e8f0e8
5d9ab039b8cc
2750dc88715e
29bc686e1532
b3cd65f684a8
c20b3aad602d
2a65e8de6e37
[root@master cri-dockerd]# kubeadm reset --cri-socket=unix:///var/run/cri-dockerd.sock
[reset] Reading configuration from the "kubeadm-config" ConfigMap in namespace "kube-system"...
[reset] Use 'kubeadm init phase upload-config kubeadm --config your-config-file' to re-upload it.
W0821 22:10:18.223101  210254 preflight.go:55] [reset] WARNING: Changes made to this host by 'kubeadm init' or 'kubeadm join' will be reverted.
[reset] Are you sure you want to proceed? [y/N]: y
[preflight] Running pre-flight checks
[reset] Deleted contents of the etcd data directory: /var/lib/etcd
[reset] Stopping the kubelet service
[reset] Unmounting mounted directories in "/var/lib/kubelet"
[reset] Deleting contents of directories: [/etc/kubernetes/manifests /var/lib/kubelet /etc/kubernetes/pki]
[reset] Deleting files: [/etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf /etc/kubernetes/kubelet.conf /etc/kubernetes/bootstrap-kubelet.conf /etc/kubernetes/controller-manager.conf /etc/kubernetes/scheduler.conf]

The reset process does not perform cleanup of CNI plugin configuration,
network filtering rules and kubeconfig files.

For information on how to perform this cleanup manually, please see:
    https://k8s.io/docs/reference/setup-tools/kubeadm/kubeadm-reset/

[root@master cri-dockerd]# rm -rf /etc/kubernetes /var/lib/kubelet /var/lib/etcd /root/.kube
[root@master cri-dockerd]# netstat -tlnp | grep -E "6443|10259|10257|10250|2379|2380"
[root@master cri-dockerd]# systemctl restart kubelet
[root@master cri-dockerd]# kubeadm init --pod-network-cidr=10.244.0.0/16 \
  --image-repository reg.timinglee.org/k8s \
  --kubernetes-version v1.35.7 \
  --cri-socket unix:///var/run/cri-dockerd.sock
如果报错了，跟我学

[root@master cri-dockerd]# mkdir -p $HOME/.kube
[root@master cri-dockerd]# cp /etc/kubernetes/admin.conf $HOME/.kube/config
[root@master cri-dockerd]# chown $(id -u):$(id -g) $HOME/.kube/config
[root@master cri-dockerd]# kubectl get nodes
NAME     STATUS   ROLES           AGE   VERSION
master   Ready    control-plane   2m    v1.35.7

接下来配置node1，node2

[root@node1 ~]# tar xvf cri-dockerd-0.4.4.amd64.tgz
cri-dockerd/
cri-dockerd/cri-dockerd
[root@node1 ~]# cd cri-dockerd/
[root@node1 cri-dockerd]# mv cri-dockerd /usr/local/bin/
mv：是否覆盖'/usr/local/bin/cri-dockerd'？ y
[root@node1 cri-dockerd]# chmod +x /usr/local/bin/cri-dockerd
[root@node1 cri-dockerd]# cat > /etc/systemd/system/cri-docker.service <<EOF
[Unit]
Description=CRI Docker daemon for Kubernetes
After=docker.service
Requires=docker.service

[Service]
ExecStart=/usr/local/bin/cri-dockerd --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF
[root@node1 cri-dockerd]# cat > /etc/systemd/system/cri-docker.socket <<EOF
[Unit]
Description=CRI Docker Socket for Kubernetes
PartOf=cri-docker.service

[Socket]
ListenStream=/var/run/cri-dockerd.sock
SocketMode=0660
SocketUser=root
SocketGroup=docker

[Install]
WantedBy=sockets.target
EOF
[root@node1 cri-dockerd]# systemctl daemon-reload
[root@node1 cri-dockerd]# systemctl enable cri-docker --now
[root@node1 cri-dockerd]# cat > /etc/yum.repos.d/kubernetes.repo <<EOF
[kubernetes]
name=Kubernetes
baseurl=https://pkgs.k8s.io/core:/stable:/v1.35/rpm/
enabled=1
gpgcheck=1
gpgkey=https://pkgs.k8s.io/core:/stable:/v1.35/rpm/repodata/repomd.xml.key
EOF
[root@node1 cri-dockerd]# dnf install -y kubeadm-1.35.7 kubelet-1.35.7
[root@node1 cri-dockerd]# systemctl enable kubelet --now
[root@node1 cri-dockerd]# docker login reg.timinglee.org -u admin -p lee
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Login Succeeded
[root@node1 cri-dockerd]# kubeadm join 172.25.254.100:6443 --token xxxxx --^Cscovery-token-ca-cert-hash sha256:xxxxx
[root@node1 cri-dockerd]# kubeadm join 172.25.254.100:6443 --token <to^Cn> \
  --discovery-token-ca-cert-hash sha256:<hash> \
  --cri-socket unix:///var/run/cri-dockerd.sock
[root@node1 cri-dockerd]# kubeadm join 172.25.254.100:6443 --token zppv87.t4kx9ugaviz7faqb \
  --discovery-token-ca-cert-hash sha256:5dc6a185e6e36825889178763d5453e53c082e77374968aa0edcb5003b6a7976 \
  --cri-socket unix:///var/run/cri-dockerd.sock
[preflight] Running pre-flight checks
    [WARNING SystemVerification]: kernel release 5.14.0-687.5.3.el9_8.x86_64 is unsupported. Supported LTS versions from the 5.x series are 5.4, 5.10 and 5.15. Any 6.x version is also supported. For cgroups v2 support, the recommended version is 5.10 or newer
[preflight] Some fatal errors occurred:
    [ERROR FileAvailable--etc-kubernetes-kubelet.conf]: /etc/kubernetes/kubelet.conf already exists
    [ERROR Port-10250]: Port 10250 is in use
    [ERROR FileAvailable--etc-kubernetes-pki-ca.crt]: /etc/kubernetes/pki/ca.crt already exists
[preflight] If you know what you are doing, you can make a check non-fatal with `--ignore-preflight-errors=...`
error: error execution phase preflight: preflight checks failed
To see the stack trace of this error execute with --v=5 or higher
[root@node1 cri-dockerd]# kubeadm reset --cri-socket unix:///var/run/cri-dockerd.sock
[root@node1 cri-dockerd]# rm -rf /etc/kubernetes /var/lib/kubelet
[root@node1 cri-dockerd]# netstat -tlnp | grep 10250
[root@node1 cri-dockerd]# systemctl restart kubelet
[root@node1 cri-dockerd]# kubeadm join 172.25.254.100:6443 --token zppv87.t4kx9ugaviz7faqb \
  --discovery-token-ca-cert-hash sha256:5dc6a185e6e36825889178763d5453e53c082e77374968aa0edcb5003b6a7976 \
  --cri-socket unix:///var/run/cri-dockerd.sock
[root@node1 cri-dockerd]# docker pull reg.timinglee.org/k8s/kube-proxy:v1.35.7
v1.35.7: Pulling from k8s/kube-proxy
a6c8b26f7345: Pull complete 
3d17fab17123: Pull complete 
Digest: sha256:c77d584d0a5e075f33f2a72a7f45890ed450a0b6ebab86271671a7692825157b
Status: Downloaded newer image for reg.timinglee.org/k8s/kube-proxy:v1.35.7
reg.timinglee.org/k8s/kube-proxy:v1.35.7
 

node2操作一样

[root@master cri-dockerd]# kubectl get nodes
NAME     STATUS   ROLES           AGE     VERSION
master   Ready    control-plane   16m     v1.35.7
node1    Ready    <none>          5m33s   v1.35.7
node2    Ready    <none>          5s      v1.35.7

截个图证明又做了一遍