Skip to content

Commit f2f7698

Browse files
windsonseawindsonsea
committed
[zh] Sync /kubeadm/install-kubeadm.md
1 parent f53ca06 commit f2f7698

File tree

1 file changed

+67
-173
lines changed

1 file changed

+67
-173
lines changed

‎content/zh-cn/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md

Lines changed: 67 additions & 173 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,12 @@ see the [Creating a cluster with kubeadm](/docs/setup/production-environment/too
4040
* Full network connectivity between all machines in the cluster (public or private network is fine).
4141
* Unique hostname, MAC address, and product_uuid for every node. See [here](#verify-mac-address) for more details.
4242
* Certain ports are open on your machines. See [here](#check-required-ports) for more details.
43-
* Swap disabled. You **MUST** disable swap in order for the kubelet to work properly.
44-
* For example, `sudo swapoff -a` will disable swapping temporarily. To make this change persistent across reboots, make sure swap is disabled in config files like `/etc/fstab`, `systemd.swap`, depending how it was configured on your system.
43+
* Swap configuration. The default behavior of a kubelet was to fail to start if swap memory was detected on a node.
44+
Swap has been supported since v1.22. And since v1.28, Swap is supported for cgroup v2 only; the NodeSwap feature
45+
gate of the kubelet is beta but disabled by default.
46+
* You **MUST** disable swap if the kubelet is not properly configured to use swap. For example, `sudo swapoff -a`
47+
will disable swapping temporarily. To make this change persistent across reboots, make sure swap is disabled in
48+
config files like `/etc/fstab`, `systemd.swap`, depending how it was configured on your system.
4549
-->
4650
* 一台兼容的 Linux 主机。Kubernetes 项目为基于 Debian 和 Red Hat 的 Linux
4751
发行版以及一些不提供包管理器的发行版提供通用的指令。
@@ -50,12 +54,30 @@ see the [Creating a cluster with kubeadm](/docs/setup/production-environment/too
5054
* 集群中的所有机器的网络彼此均能相互连接（公网和内网都可以）。
5155
* 节点之中不可以有重复的主机名、MAC 地址或 product_uuid。请参见[这里](#verify-mac-address)了解更多详细信息。
5256
* 开启机器上的某些端口。请参见[这里](#check-required-ports)了解更多详细信息。
53-
* 禁用交换分区。为了保证 kubelet 正常工作，你**必须**禁用交换分区。
54-
* 例如，`sudo swapoff -a` 将暂时禁用交换分区。要使此更改在重启后保持不变，请确保在如
57+
* 交换分区的配置。kubelet 的默认行为是在节点上检测到交换内存时无法启动。
58+
kubelet 自 v1.22 起已开始支持交换分区。自 v1.28 起，仅针对 cgroup v2 支持交换分区；
59+
kubelet 的 NodeSwap 特性门控处于 Beta 阶段，但默认被禁用。
60+
* 如果 kubelet 未被正确配置使用交换分区，则你**必须**禁用交换分区。
61+
例如，`sudo swapoff -a` 将暂时禁用交换分区。要使此更改在重启后保持不变，请确保在如
5562
`/etc/fstab`、`systemd.swap` 等配置文件中禁用交换分区，具体取决于你的系统如何配置。
5663

5764
<!-- steps -->
5865

66+
{{< note >}}
67+
<!--
68+
The `kubeadm` installation is done via binaries that use dynamic linking and assumes that your target system provides `glibc`.
69+
This is a reasonable assumption on many Linux distributions (including Debian, Ubuntu, Fedora, CentOS, etc.)
70+
but it is not always the case with custom and lightweight distributions which don't include `glibc` by default, such as Alpine Linux.
71+
The expectation is that the distribution either includes `glibc` or a [compatibility layer](https://wiki.alpinelinux.org/wiki/Running_glibc_programs)
72+
that provides the expected symbols.
73+
-->
74+
`kubeadm` 的安装是通过使用动态链接的二进制文件完成的，安装时假设你的目标系统提供 `glibc`。
75+
这个假设在许多 Linux 发行版（包括 Debian、Ubuntu、Fedora、CentOS 等）上是合理的，
76+
但对于不包含默认 `glibc` 的自定义和轻量级发行版（如 Alpine Linux），情况并非总是如此。
77+
预期的情况是，发行版要么包含 `glibc`，
78+
要么提供了一个[兼容层](https://wiki.alpinelinux.org/wiki/Running_glibc_programs)以提供所需的符号。
79+
{{< /note >}}
80+
5981
<!--
6082
## Verify the MAC address and product_uuid are unique for every node {#verify-mac-address}
6183
@@ -214,7 +236,7 @@ You will install these packages on all of your machines:
214236
* `kubeadm`: the command to bootstrap the cluster.
215237
216238
* `kubelet`: the component that runs on all of the machines in your cluster
217-
and does things like starting pods and containers.
239+
and does things like starting pods and containers.
218240
219241
* `kubectl`: the command line util to talk to your cluster.
220242
-->
@@ -271,49 +293,25 @@ For more information on version skews, see:
271293

272294
{{< note >}}
273295
<!--
274-
Kubernetes has two different package repositories starting from August 2023.
275-
The Google-hosted repository is deprecated and it's being replaced with the
276-
Kubernetes (community-owned) package repositories. The Kubernetes project strongly
277-
recommends using the Kubernetes community-owned package repositories, because the
278-
project plans to stop publishing packages to the Google-hosted repository in the future.
279-
-->
280-
自2023年8月起，Kubernetes 有两个不同的软件包仓库。
281-
Google 托管的仓库已被弃用，并正在被 Kubernetes（由社区拥有）软件包仓库替代。
282-
Kubernetes 项目强烈建议使用 Kubernetes 社区拥有的软件包仓库，
283-
因为该项目计划将来停止向 Google 托管的仓库发布软件包。
284-
285-
286-
<!--
287-
There are some important considerations for the Kubernetes package repositories:
296+
Kubernetes has [new package repositories hosted at `pkgs.k8s.io`](/blog/2023/08/15/pkgs-k8s-io-introduction/)
297+
starting from August 2023. The legacy package repositories (`apt.kubernetes.io` and `yum.kubernetes.io`)
298+
have been frozen starting from September 13, 2023. Please read our
299+
[deprecation and freezing announcement](/blog/2023/08/31/legacy-package-repository-deprecation/)
300+
for more details.
288301
-->
289-
对于 Kubernetes 软件包仓库，有一些重要的考虑事项：
290-
<!--
291-
- The Kubernetes package repositories contain packages beginning with those
292-
Kubernetes versions that were still under support when the community took
293-
over the package builds. This means that anything before v1.24.0 will only be
294-
available in the Google-hosted repository.
295-
- There's a dedicated package repository for each Kubernetes minor version.
296-
When upgrading to a different minor release, you must bear in mind that
297-
the package repository details also change.
298-
-->
299-
- Kubernetes 软件包仓库包含从社区接管软件包构建时仍在支持范围内的 Kubernetes 版本开始的软件包。
300-
这意味着v1.24.0之前的版本只在 Google 托管的仓库中提供。
301-
- 每个 Kubernetes 次要版本都有一个专用的软件包仓库。
302-
当升级到不同的次要版本时，必须记住软件包仓库的详细信息也会发生变化。
302+
Kubernetes 从 2023 年 8 月开始使用托管在 `pkgs.k8s.io`
303+
上的[新软件包仓库](/zh-cn/blog/2023/08/15/pkgs-k8s-io-introduction/)。
304+
自 2023 年 9 月 13 日起，老旧的软件包仓库（`apt.kubernetes.io` 和 `yum.kubernetes.io`）已被冻结。
305+
更多细节参阅[弃用和冻结公告](/zh-cn/blog/2023/08/31/legacy-package-repository-deprecation/)。
303306
{{< /note >}}
304307

305308
{{< tabs name="k8s_install" >}}
306309
{{% tab name="基于 Debian 的发行版" %}}
307310

308-
<!--
309-
### Kubernetes package repositories {#dpkg-k8s-package-repo}
310-
-->
311-
### Kubernetes 软件包仓库 {#dpkg-k8s-package-repo}
312-
313311
<!--
314312
These instructions are for Kubernetes {{< skew currentVersion >}}.
315313
-->
316-
这些说明适用于 Kubernetes {{< skew currentVersion >}}.
314+
以下指令适用于 Kubernetes {{< skew currentVersion >}}.
317315

318316
<!--
319317
1. Update the `apt` package index and install packages needed to use the Kubernetes `apt` repository:
@@ -327,7 +325,8 @@ These instructions are for Kubernetes {{< skew currentVersion >}}.
327325
```
328326

329327
<!--
330-
2. Download the public signing key for the Kubernetes package repositories. The same signing key is used for all repositories so you can disregard the version in the URL:
328+
2. Download the public signing key for the Kubernetes package repositories.
329+
The same signing key is used for all repositories so you can disregard the version in the URL:
331330
-->
332331
2. 下载用于 Kubernetes 软件包仓库的公共签名密钥。所有仓库都使用相同的签名密钥，因此你可以忽略URL中的版本：
333332

@@ -356,66 +355,6 @@ These instructions are for Kubernetes {{< skew currentVersion >}}.
356355
sudo apt-mark hold kubelet kubeadm kubectl
357356
```
358357

359-
{{< note >}}
360-
<!--
361-
In releases older than Debian 12 and Ubuntu 22.04, `/etc/apt/keyrings` does not exist by default.
362-
You can create this directory if you need to, making it world-readable but writeable only by admins.
363-
-->
364-
在低于 Debian 12 和 Ubuntu 22.04 的发行版本中，`/etc/apt/keyrings` 默认不存在。
365-
如有需要，你可以创建此目录，并将其设置为对所有人可读，但仅对管理员可写。
366-
{{< /note >}}
367-
368-
<!--
369-
### Google-hosted package repository (deprecated) {#dpkg-google-package-repo}
370-
-->
371-
### Google 托管的软件包仓库（已弃用） {#dpkg-google-package-repo}
372-
373-
<!--
374-
These instructions are for Kubernetes {{< skew currentVersion >}}.
375-
-->
376-
这些说明适用于 Kubernetes {{< skew currentVersion >}}.
377-
378-
<!--
379-
1. Update the `apt` package index and install packages needed to use the Kubernetes `apt` repository:
380-
-->
381-
1. 更新 `apt` 软件包索引并安装使用 Kubernetes `apt` 仓库所需的软件包:
382-
383-
```shell
384-
sudo apt-get update
385-
# apt-transport-https 可能是一个虚拟包（dummy package）；如果是的话，你可以跳过安装这个包
386-
sudo apt-get install -y apt-transport-https ca-certificates curl
387-
```
388-
389-
<!--
390-
2. Download the Google Cloud public signing key:
391-
-->
392-
2. 下载 Google Cloud 公共签名密钥:
393-
394-
```shell
395-
curl -fsSL https://dl.k8s.io/apt/doc/apt-key.gpg | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-archive-keyring.gpg
396-
```
397-
398-
<!--
399-
Add the Google-hosted `apt` repository:
400-
-->
401-
3. 添加 Google 托管的 `apt` 仓库:
402-
403-
```shell
404-
# 此操作会覆盖 /etc/apt/sources.list.d/kubernetes.list 中现存的所有配置
405-
echo "deb [signed-by=/etc/apt/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list
406-
```
407-
408-
<!--
409-
4. Update the `apt` package index, install kubelet, kubeadm and kubectl, and pin their version:
410-
-->
411-
4. 更新 `apt` 软件包索引，安装 kubelet、kubeadm 和 kubectl，并锁定它们的版本:
412-
413-
```shell
414-
sudo apt-get update
415-
sudo apt-get install -y kubelet kubeadm kubectl
416-
sudo apt-mark hold kubelet kubeadm kubectl
417-
```
418-
419358
{{< note >}}
420359
<!--
421360
In releases older than Debian 12 and Ubuntu 22.04, `/etc/apt/keyrings` does not exist by default;
@@ -431,9 +370,19 @@ you can create it by running `sudo mkdir -m 755 /etc/apt/keyrings`
431370

432371
<!--
433372
1. Set SELinux to `permissive` mode:
373+
374+
These instructions are for Kubernetes {{< skew currentVersion >}}.
375+
376+
```shell
377+
# Set SELinux in permissive mode (effectively disabling it)
378+
sudo setenforce 0
379+
sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config
380+
```
434381
-->
435382
1. 将 SELinux 设置为 `permissive` 模式:
436383

384+
以下指令适用于 Kubernetes {{< skew currentVersion >}}。
385+
437386
```shell
438387
# 将 SELinux 设置为 permissive 模式（相当于将其禁用）
439388
sudo setenforce 0
@@ -455,16 +404,6 @@ you can create it by running `sudo mkdir -m 755 /etc/apt/keyrings`
455404
- 如果你知道如何配置 SELinux 则可以将其保持启用状态，但可能需要设定部分 kubeadm 不支持的配置。
456405
{{< /caution >}}
457406

458-
<!--
459-
### Kubernetes package repositories {#rpm-k8s-package-repo}
460-
-->
461-
### Kubernetes 软件包仓库 {#rpm-k8s-package-repo}
462-
463-
<!--
464-
These instructions are for Kubernetes {{< skew currentVersion >}}.
465-
-->
466-
这些说明适用于 Kubernetes {{< skew currentVersion >}}.
467-
468407
<!--
469408
2. Add the Kubernetes `yum` repository. The `exclude` parameter in the
470409
repository definition ensures that the packages related to Kubernetes are
@@ -498,61 +437,6 @@ These instructions are for Kubernetes {{< skew currentVersion >}}.
498437
sudo systemctl enable --now kubelet
499438
```
500439
501-
<!--
502-
### Google-hosted package repository (deprecated) {#rpm-google-package-repo}
503-
-->
504-
### Google 托管的软件包仓库（已弃用） {#rpm-google-package-repo}
505-
506-
<!--
507-
These instructions are for Kubernetes {{< skew currentVersion >}}.
508-
-->
509-
这些说明适用于 Kubernetes {{< skew currentVersion >}}.
510-
511-
<!--
512-
2. Add the Kubernetes `yum` repository. The `exclude` parameter in the
513-
repository definition ensures that the packages related to Kubernetes are
514-
not upgraded upon running `yum update` as there's a special procedure that
515-
must be followed for upgrading Kubernetes.
516-
-->
517-
2. 添加 Google 托管的 `yum` 仓库。
518-
仓库定义中的 `exclude` 参数确保了与 Kubernetes 相关的软件包在运行
519-
`yum update` 时不会升级，因为升级 Kubernetes 需要遵循特定的过程。"
520-
521-
```shell
522-
# 此操作会覆盖 /etc/yum.repos.d/kubernetes.repo 中现存的所有配置
523-
cat <<EOF | sudo tee /etc/yum.repos.d/kubernetes.repo
524-
[kubernetes]
525-
name=Kubernetes
526-
baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-\$basearch
527-
enabled=1
528-
gpgcheck=1
529-
gpgkey=https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
530-
exclude=kubelet kubeadm kubectl
531-
EOF
532-
```
533-
534-
<!--
535-
3. Install kubelet, kubeadm and kubectl, and enable kubelet to ensure it's automatically started on startup:
536-
-->
537-
3. 安装 kubelet、kubeadm 和 kubectl，并启用 kubelet 以确保它在启动时自动启动:
538-
539-
```shell
540-
sudo yum install -y kubelet kubeadm kubectl --disableexcludes=kubernetes
541-
sudo systemctl enable --now kubelet
542-
```
543-
544-
{{< note >}}
545-
<!--
546-
If the `baseurl` fails because your RPM-based distribution cannot interpret `$basearch`, replace `\$basearch` with your computer's architecture.
547-
Type `uname -m` to see that value.
548-
For example, the `baseurl` URL for `x86_64` could be: `https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64`.
549-
-->
550-
如果 `baseurl` 因为你的基于 RPM 的 Linux 发行版无法解释 `$basearch` 而失败，
551-
你需要将 `\$basearch` 替换为你的计算机的体系结构。
552-
输入 `uname -m` 命令来查看该值。
553-
例如，对于 `x86_64` 架构，`baseurl` URL 可能是：`https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64`。
554-
{{< /note >}}
555-
556440
{{% /tab %}}
557441
{{% tab name="无包管理器的情况" %}}
558442
<!--
@@ -569,9 +453,9 @@ curl -L "https://github.com/containernetworking/plugins/releases/download/${CNI_
569453
```
570454
571455
<!--
572-
Define the directory to download command files
456+
Define the directory to download command files:
573457
-->
574-
定义要下载命令文件的目录。
458+
定义要下载命令文件的目录：
575459
576460
{{< note >}}
577461
<!--
@@ -588,9 +472,9 @@ sudo mkdir -p "$DOWNLOAD_DIR"
588472
```
589473
590474
<!--
591-
Install crictl (required for kubeadm / Kubelet Container Runtime Interface (CRI))
475+
Install crictl (required for kubeadm / Kubelet Container Runtime Interface (CRI)):
592476
-->
593-
安装 crictl（kubeadm/kubelet 容器运行时接口（CRI）所需）
477+
安装 crictl（kubeadm/kubelet 容器运行时接口（CRI）所需）：
594478
595479
```bash
596480
CRICTL_VERSION="v1.28.0"
@@ -616,6 +500,14 @@ sudo mkdir -p /etc/systemd/system/kubelet.service.d
616500
curl -sSL "https://raw.githubusercontent.com/kubernetes/release/${RELEASE_VERSION}/cmd/kubepkg/templates/latest/deb/kubeadm/10-kubeadm.conf" | sed "s:/usr/bin:${DOWNLOAD_DIR}:g" | sudo tee /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
617501
```
618502
503+
{{< note >}}
504+
<!--
505+
Please refer to the note in the [Before you begin](#before-you-begin) section for Linux distributions
506+
that do not include `glibc` by default.
507+
-->
508+
对于默认不包括 `glibc` 的 Linux 发行版，请参阅[开始之前](#before-you-begin)一节的注释。
509+
{{< /note >}}
510+
619511
<!--
620512
Install `kubectl` by following the instructions on [Install Tools page](/docs/tasks/tools/#kubectl).
621513
Enable and start `kubelet`:
@@ -631,7 +523,8 @@ systemctl enable --now kubelet
631523
<!--
632524
The Flatcar Container Linux distribution mounts the `/usr` directory as a read-only filesystem.
633525
Before bootstrapping your cluster, you need to take additional steps to configure a writable directory.
634-
See the [Kubeadm Troubleshooting guide](/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/#usr-mounted-read-only/) to learn how to set up a writable directory.
526+
See the [Kubeadm Troubleshooting guide](/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/#usr-mounted-read-only/)
527+
to learn how to set up a writable directory.
635528
-->
636529
Flatcar Container Linux 发行版会将 `/usr/` 目录挂载为一个只读文件系统。
637530
在启动引导你的集群之前，你需要执行一些额外的操作来配置一个可写入的目录。
@@ -652,13 +545,13 @@ kubelet 现在每隔几秒就会重启，因为它陷入了一个等待 kubeadm
652545
## Configuring a cgroup driver
653546
654547
Both the container runtime and the kubelet have a property called
655-
["cgroup driver"](/docs/setup/production-environment/container-runtimes/), which is important
548+
["cgroup driver"](/docs/setup/production-environment/container-runtimes/#cgroup-drivers), which is important
656549
for the management of cgroups on Linux machines.
657550
-->
658551
## 配置 cgroup 驱动程序 {#configuring-a-cgroup-driver}
659552
660553
容器运行时和 kubelet 都具有名字为
661-
["cgroup driver"](/zh-cn/docs/setup/production-environment/container-runtimes/)
554+
["cgroup driver"](/zh-cn/docs/setup/production-environment/container-runtimes/#cgroup-drivers)
662555
的属性，该属性对于在 Linux 机器上管理 CGroups 而言非常重要。
663556
664557
{{< warning >}}
@@ -676,7 +569,8 @@ See [Configuring a cgroup driver](/docs/tasks/administer-cluster/kubeadm/configu
676569
<!--
677570
## Troubleshooting
678571
679-
If you are running into difficulties with kubeadm, please consult our [troubleshooting docs](/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/).
572+
If you are running into difficulties with kubeadm, please consult our
573+
[troubleshooting docs](/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/).
680574
-->
681575
## 故障排查 {#troubleshooting}
682576

0 commit comments

Comments
 (0)