完整安装总 Runbook：5 台 Ubuntu 到可用平台

for k in 154.201.73.31 154.201.73.81 45.205.31.214 45.205.31.180 45.205.31.10 \
         m1 m2 m3 m4 m5 k8s-cp-1 k8s-cp-2 k8s-cp-3 k8s-w-1 k8s-w-2; do
  ssh-keygen -R "$k"
done

ssh-copy-id -o StrictHostKeyChecking=accept-new root@154.201.73.31   # 输入控制台给的密码
# 其余 4 台同理

ssh -v root@154.201.73.31 true 2>&1 | grep "can continue"
# debug1: Authentications that can continue: password
#                                            ^^^^^^^^ 只有 password、没有 publickey = 公钥认证被关

ssh root@<ip> "sshd -T | grep -i pubkeyauth"       # pubkeyauthentication no  ← 就是它
ssh root@<ip> "sed -i 's/^PubkeyAuthentication no/PubkeyAuthentication yes/' /etc/ssh/sshd_config \
               && systemctl reload ssh"

for h in m1 m2 m3 m4 m5; do echo "$h: $(ssh -o BatchMode=yes $h hostname)"; done

for h in m1 m2 m3 m4 m5; do
  echo "== $h =="
  ssh -o BatchMode=yes $h '
    hostname
    ip -4 -o addr show | awk "{print \$2, \$4}" | grep "10\\."
    . /etc/os-release && echo "$PRETTY_NAME  $(uname -r)"
    echo "mem=$(free -h | awk "/Mem/{print \$2}") cpu=$(nproc)"
  '
done

ssh root@154.201.73.31 'hostnamectl set-hostname k8s-cp-1'
ssh root@154.201.73.81 'hostnamectl set-hostname k8s-cp-2'
ssh root@45.205.31.214 'hostnamectl set-hostname k8s-cp-3'
ssh root@45.205.31.180 'hostnamectl set-hostname k8s-w-1'
ssh root@45.205.31.10 'hostnamectl set-hostname k8s-w-2'

for ip in 154.201.73.31 154.201.73.81 45.205.31.214 45.205.31.180 45.205.31.10; do
  ssh root@$ip 'set -eu
    cp -a /etc/hosts /etc/hosts.bak.$(date +%Y%m%d-%H%M%S)
    cp -a /etc/cloud/cloud.cfg /etc/cloud/cloud.cfg.bak.$(date +%Y%m%d-%H%M%S) 2>/dev/null || true

    if grep -q "^manage_etc_hosts:" /etc/cloud/cloud.cfg 2>/dev/null; then
      sed -i "s/^manage_etc_hosts:.*/manage_etc_hosts: false/" /etc/cloud/cloud.cfg
    else
      printf "\nmanage_etc_hosts: false\n" >> /etc/cloud/cloud.cfg
    fi

    cat > /etc/hosts <<HOSTS
127.0.0.1 localhost k8s-api
127.0.1.1 $(hostname)
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

10.0.24.31 k8s-cp-1 m1
10.0.24.29 k8s-cp-2 m2
10.0.24.32 k8s-cp-3 m3
10.0.24.28 k8s-w-1  m4
10.0.24.30 k8s-w-2  m5
HOSTS

    getent hosts k8s-api
  '
done

for ip in 154.201.73.31 154.201.73.81 45.205.31.214 45.205.31.180 45.205.31.10; do
  ssh root@$ip 'set -eu
    swapoff -a
    sed -i.bak "/ swap / s/^/#/" /etc/fstab

    cat > /etc/modules-load.d/k8s.conf <<EOF
overlay
br_netfilter
EOF
    modprobe overlay
    modprobe br_netfilter

    cat > /etc/sysctl.d/99-k8s.conf <<EOF
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
EOF
    sysctl --system

    apt-get update
    apt-get install -y ca-certificates curl gnupg lsb-release chrony jq ipset ipvsadm conntrack socat ebtables ethtool
    systemctl enable --now chrony
  '
done

for ip in 154.201.73.31 154.201.73.81 45.205.31.214 45.205.31.180 45.205.31.10; do
  ssh root@$ip 'set -eu
    install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
      | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
    chmod a+r /etc/apt/keyrings/docker.gpg
    . /etc/os-release
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu ${VERSION_CODENAME} stable" \
      > /etc/apt/sources.list.d/docker.list

    apt-get update
    apt-get install -y containerd.io

    mkdir -p /etc/containerd
    containerd config default > /etc/containerd/config.toml
    sed -i "s/SystemdCgroup = false/SystemdCgroup = true/" /etc/containerd/config.toml
    sed -i "s|config_path = \"\"|config_path = \"/etc/containerd/certs.d\"|" /etc/containerd/config.toml

    mkdir -p /etc/containerd/certs.d/docker.io
    cat > /etc/containerd/certs.d/docker.io/hosts.toml <<EOF
server = "https://docker.io"
[host."https://docker.m.daocloud.io"]
  capabilities = ["pull", "resolve"]
EOF

    systemctl enable --now containerd
    systemctl restart containerd
    systemctl is-active containerd
  '
done

ssh root@<ip> 'systemctl is-active containerd; containerd --version'
# active
# containerd containerd.io 2.2.4 ...

for ip in 154.201.73.31 154.201.73.81 45.205.31.214 45.205.31.180 45.205.31.10; do
  ssh root@$ip 'set -eu
    curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.30/deb/Release.key \
      | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
    echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.30/deb/ /" \
      > /etc/apt/sources.list.d/kubernetes.list
    apt-get update
    apt-get install -y kubelet kubeadm kubectl
    apt-mark hold kubelet kubeadm kubectl

    cat > /etc/crictl.yaml <<EOF
runtime-endpoint: unix:///run/containerd/containerd.sock
image-endpoint: unix:///run/containerd/containerd.sock
timeout: 10
debug: false
EOF
  '
done

for ip in 154.201.73.31 154.201.73.81 45.205.31.214 45.205.31.180 45.205.31.10; do
  ssh root@$ip 'set -eu
    apt-get install -y haproxy
    cat > /etc/haproxy/haproxy.cfg <<EOF
global
    log /dev/log local0
    log /dev/log local1 notice
    daemon

defaults
    log global
    mode tcp
    option tcplog
    option dontlognull
    timeout connect 5s
    timeout client  1m
    timeout server  1m

frontend k8s_api
    bind 127.0.0.1:16443
    default_backend k8s_api_backends

backend k8s_api_backends
    option tcp-check
    server cp1 10.0.24.31:6443 check
    server cp2 10.0.24.29:6443 check
    server cp3 10.0.24.32:6443 check
EOF
    systemctl enable haproxy
    systemctl restart haproxy
    ss -tlnp | grep 16443 || true
  '
done

ssh root@154.201.73.31

cat > /root/kubeadm-init.yaml <<'EOF'
apiVersion: kubeadm.k8s.io/v1beta3
kind: ClusterConfiguration
kubernetesVersion: v1.30.14
controlPlaneEndpoint: k8s-api:16443
networking:
  podSubnet: 10.244.0.0/16
  serviceSubnet: 10.96.0.0/12
apiServer:
  certSANs:
  - k8s-api
  - 127.0.0.1
  - 10.0.24.31
  - 10.0.24.29
  - 10.0.24.32
---
apiVersion: kubeadm.k8s.io/v1beta3
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: 10.0.24.31
  bindPort: 6443
nodeRegistration:
  criSocket: unix:///run/containerd/containerd.sock
---
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
cgroupDriver: systemd
EOF

kubeadm init --config /root/kubeadm-init.yaml --upload-certs

mkdir -p ~/.kube
cp -f /etc/kubernetes/admin.conf ~/.kube/config
chmod 600 ~/.kube/config

kubectl get nodes

kubeadm join k8s-api:16443 \
  --token <token> \
  --discovery-token-ca-cert-hash sha256:<hash> \
  --control-plane \
  --certificate-key <cert-key> \
  --cri-socket unix:///run/containerd/containerd.sock

kubeadm join k8s-api:16443 \
  --token <token> \
  --discovery-token-ca-cert-hash sha256:<hash> \
  --cri-socket unix:///run/containerd/containerd.sock

kubeadm token create --print-join-command
kubeadm init phase upload-certs --upload-certs

kubectl get nodes -o wide

kubeadm token create --print-join-command          # 打印 worker join（含新 token+hash）
kubeadm init phase upload-certs --upload-certs      # 重新上传证书，打印新 certificate-key（控制面 join 要）

kubectl get nodes -o wide

kubectl get pods -A \
  --field-selector=status.phase!=Running,status.phase!=Succeeded \
  -o wide

helm list -A

cilium status --wait=false

kubectl get sc

kubectl get pvc -A

kubectl get svc -A | grep NodePort