k0s 离线安装与 k0sctl 自动化 —— 从制作镜像包到多节点升级

#!/usr/bin/env bash
# collect-k0s.sh —— 能连互联网的预发布设备
set -euo pipefail

K0S_VERSION="v1.36.3+k0s.0"
ARCH="amd64"
URLVER="${K0S_VERSION/+/%2B}"
BASE="https://github.com/k0sproject/k0s/releases/download/${URLVER}"
OUT="./k0s-airgap-${K0S_VERSION}"

mkdir -p "${OUT}" && cd "${OUT}"

curl -fL -o k0s "${BASE}/k0s-${K0S_VERSION}-${ARCH}"
chmod +x k0s

curl -fL -o "k0s-airgap-bundle-${K0S_VERSION}-linux-${ARCH}.tar" \
  "${BASE}/k0s-airgap-bundle-${K0S_VERSION}-linux-${ARCH}.tar"

# 导入清单自己动手做 —— 这是进入内部环境后判断介质是否损坏的唯一依据
sha256sum k0s "k0s-airgap-bundle-${K0S_VERSION}-linux-${ARCH}.tar" > MANIFEST.sha256
echo "${K0S_VERSION}" > VERSION
ls -la

# 在能连互联网的机器上，用 k0s 二进制执行
./k0s airgap list-images --all > airgap-images.txt
wc -l airgap-images.txt
cat airgap-images.txt

# 方法 A —— k0s 内置工具(既不需要 Docker，也不需要正在运行的 k0s)
./k0s airgap bundle-artifacts -v -o image-bundle.tar < airgap-images.txt

# 方法 B —— 从已经运行的工作节点的 containerd 存储中导出
k0s ctr images export image-bundle.tar $(k0s airgap list-images | xargs)

# 方法 C —— 在装有 Docker 的机器上
k0s airgap list-images --all > airgap-images.txt
xargs -I{} docker pull {} < airgap-images.txt
docker image save -o image-bundle.tar $(xargs < airgap-images.txt)

# 1) 提取 k0s 系统镜像清单
./k0s airgap list-images --all > airgap-images.txt

# 2) 把内部工作负载镜像追加到同一份清单里
cat >> airgap-images.txt <<'EOF'
registry.internal.example:5000/apps/api:1.4.2
registry.internal.example:5000/apps/worker:1.4.2
registry.internal.example:5000/infra/postgres:16.4
registry.internal.example:5000/infra/prometheus:v3.1.0
EOF

# 3) 去重之后一次性打包
sort -u airgap-images.txt -o airgap-images.txt
./k0s airgap bundle-artifacts -v -o image-bundle.tar < airgap-images.txt

# 4) 更新清单
sha256sum image-bundle.tar >> MANIFEST.sha256

#!/usr/bin/env bash
# install-k0s-single.sh —— 离线单节点
set -euo pipefail
STAGE=/opt/staging/k0s-airgap-v1.36.3+k0s.0

# 0) 先做完整性校验
cd "${STAGE}" && sha256sum -c MANIFEST.sha256

# 1) 部署二进制
sudo install -m 0755 "${STAGE}/k0s" /usr/local/bin/k0s
k0s version

# 2) 部署镜像包 —— 必须在启动之前放好
sudo mkdir -p /var/lib/k0s/images
sudo cp "${STAGE}"/k0s-airgap-bundle-*.tar /var/lib/k0s/images/image-bundle.tar

# 3) 单节点安装
sudo k0s install controller --single
sudo k0s start

# 4) 检查状态(镜像包导入需要时间，未必立刻就是 Ready)
sudo k0s status
sudo k0s kubectl get nodes -o wide
sudo k0s kubectl -n kube-system get pods

# controller 节点
sudo install -m 0755 /opt/staging/k0s /usr/local/bin/k0s
sudo k0s install controller --enable-worker --no-taints
sudo k0s start
sudo k0s status

# 签发 worker 加入令牌(在 controller 上执行)
sudo k0s token create --role=worker > /opt/staging/worker.token

# worker 节点
sudo install -m 0755 /opt/staging/k0s /usr/local/bin/k0s
sudo mkdir -p /var/lib/k0s/images
sudo cp /opt/staging/image-bundle.tar /var/lib/k0s/images/image-bundle.tar
sudo k0s install worker --token-file /opt/staging/worker.token
sudo k0s start
sudo k0s status

# k0s.yaml
apiVersion: k0s.k0sproject.io/v1beta1
kind: ClusterConfig
spec:
  images:
    default_pull_policy: Never

# 把 k0sctl 二进制部署到离线跳板机上(这个也需要导入)
sudo install -m 0755 /opt/staging/k0sctl /usr/local/bin/k0sctl
k0sctl version

# 生成初始配置文件
k0sctl init > k0sctl.yaml

# k0sctl.yaml —— 离线 3 节点配置
apiVersion: k0sctl.k0sproject.io/v1beta1
kind: Cluster
metadata:
  name: onprem-airgap
spec:
  k0s:
    version: v1.36.3+k0s.0
    config:
      apiVersion: k0s.k0sproject.io/v1beta1
      kind: ClusterConfig
      spec:
        images:
          default_pull_policy: Never
  hosts:
    - role: controller
      uploadBinary: true
      k0sBinaryPath: /opt/staging/k0s
      ssh:
        address: 10.10.20.11
        user: k0sadmin
        keyPath: /home/k0sadmin/.ssh/id_ed25519
    - role: worker
      uploadBinary: true
      k0sBinaryPath: /opt/staging/k0s
      ssh:
        address: 10.10.20.21
        user: k0sadmin
        keyPath: /home/k0sadmin/.ssh/id_ed25519
      files:
        - src: /opt/staging/image-bundle.tar
          dstDir: /var/lib/k0s/images
          perm: 0755
    - role: worker
      uploadBinary: true
      k0sBinaryPath: /opt/staging/k0s
      ssh:
        address: 10.10.20.22
        user: k0sadmin
        keyPath: /home/k0sadmin/.ssh/id_ed25519
      files:
        - src: /opt/staging/image-bundle.tar
          dstDir: /var/lib/k0s/images
          perm: 0755

# 应用配置 —— 二进制上传、镜像包传输、集群搭建一次完成
k0sctl apply --config k0sctl.yaml

# 获取 kubeconfig
k0sctl kubeconfig --config k0sctl.yaml > kubeconfig
kubectl --kubeconfig kubeconfig get nodes -o wide
kubectl --kubeconfig kubeconfig -n kube-system get pods

# 1) 把新版本的二进制和镜像包导入到跳板机
sha256sum -c /opt/staging/k0s-v1.36.3/MANIFEST.sha256

# 2) 只更新 k0sctl.yaml 里的版本字符串和文件路径
#    spec.k0s.version: v1.36.3+k0s.0
#    hosts[].files[].src: /opt/staging/k0s-v1.36.3/image-bundle.tar

# 3) 用同一条命令应用 —— k0sctl 会按顺序处理各个节点
k0sctl apply --config k0sctl.yaml

# 4) 验证
kubectl --kubeconfig kubeconfig get nodes -o wide
kubectl --kubeconfig kubeconfig get pods -A --field-selector=status.phase!=Running

# 节点移除是手动操作
kubectl --kubeconfig kubeconfig drain worker-03 --ignore-daemonsets --delete-emptydir-data
kubectl --kubeconfig kubeconfig delete node worker-03

# 在该节点上清理 k0s
sudo k0s stop
sudo k0s reset

sudo journalctl -u k0scontroller -f    # controller
sudo journalctl -u k0sworker -f        # worker
sudo k0s ctr images ls | wc -l         # 已导入的镜像数量是否在增加