Ubuntu 22.04 LTS 基于 Docker 部署 K8S

1、安装系统

安装 Ubuntu 22.04 LTS 系统到服务器并换源

2、配置网络连接以及hosts

确保机器可以访问互联网，并向/etc/hosts文件添加以下内容：

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

使hosts配置生效：

sudo netplan apply

3、设置root密码、开启ssh服务、允许远程登录root

设置root密码：

sudo passwd root
sudo su

开启ssh服务：

apt install ssh
systemctl start ssh
systemctl enable ssh
systemctl is-enabled ssh

允许远程登录root：

apt install vim
vim /etc/ssh/sshd_config

修改其中PermitRootLogin属性为yes：

PermitRootLogin yes

重启：

reboot

4、查看ip、检查是否可以远程登录

apt install net-tools
ifconfig

5、更新包

apt update && apt upgrade

6、安装 docker

安装docker：

sudo apt-get update
sudo apt-get install docker.io -y
sudo systemctl enable --now docker

配置docker使用systemd：
在/etc/docker/daemon.json中添加如下内容：

{
"exec-opts":["native.cgroupdriver=systemd"]
}

7、关闭 swap

sudo swapoff -a

注释/etc/fstab文件中以/swap开头的那行

ps: 22.04 LTS 默认加载了 br_netfilter 模块

8、安装 cri-dockerd

检查github.com/Mirantis/cri-dockerd的最新发行版本：

cd ~
wget https://github.com/Mirantis/cri-dockerd/releases/download/v0.3.4/cri-dockerd_0.3.4.3-0.ubuntu-jammy_amd64.deb
dpkg -i cri-dockerd_0.3.4.3-0.ubuntu-jammy_amd64.deb

ps：连接不上可以找github加速站，如：

wget http://ghproxy.com/github.com/Mirantis/cri-dockerd/releases/download/v0.3.4/cri-dockerd_0.3.4.3-0.ubuntu-jammy_amd64.deb

启动并配置开机启动：

sudo systemctl enable --now cri-docker.service
sudo systemctl enable --now cri-docker.socket

9、安装 kubeadm、kubelet、kubectl

安装所需包：

sudo apt-get update
sudo apt-get install -y apt-transport-https ca-certificates curl

配置密钥：

curl -fsSL https://mirrors.aliyun.com/kubernetes/apt/doc/apt-key.gpg | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-archive-keyring.gpg

配置源：

echo "deb [signed-by=/etc/apt/keyrings/kubernetes-archive-keyring.gpg] http://mirrors.aliyun.com/kubernetes/apt kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list

*ps：如果安装kubeadm、kubelet、kubectl很慢的话可以换别的源试试，比如清华源：

echo "deb [signed-by=/etc/apt/keyrings/kubernetes-archive-keyring.gpg] https://mirrors.tuna.tsinghua.edu.cn/kubernetes/apt kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list

安装kubeadm、kubelet、kubectl：

sudo apt-get update
sudo apt-get install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl

10、Master节点 kubeadm 初始化前准备工作（重要）

测试 docker image 拉取，由于网络问题测试会失败：

sudo kubeadm config images pull --cri-socket unix:///run/cri-dockerd.sock

查看所需images：

sudo kubeadm config images list

（示例）需要以下镜像：

registry.k8s.io/kube-apiserver:v1.27.4
registry.k8s.io/kube-controller-manager:v1.27.4
registry.k8s.io/kube-scheduler:v1.27.4
registry.k8s.io/kube-proxy:v1.27.4
registry.k8s.io/pause:3.9
registry.k8s.io/etcd:3.5.7-0
registry.k8s.io/coredns/coredns:v1.10.1

手动从国内镜像站 pull 下来：

sudo docker pull registry.aliyuncs.com/google_containers/kube-apiserver:v1.27.4
sudo docker pull registry.aliyuncs.com/google_containers/kube-controller-manager:v1.27.4
sudo docker pull registry.aliyuncs.com/google_containers/kube-scheduler:v1.27.4
sudo docker pull registry.aliyuncs.com/google_containers/kube-proxy:v1.27.4
sudo docker pull registry.aliyuncs.com/google_containers/pause:3.9
sudo docker pull registry.aliyuncs.com/google_containers/etcd:3.5.7-0
# coredns的url需要改变一下，具体随机应变吧
sudo docker pull registry.aliyuncs.com/google_containers/coredns:v1.10.1

查看docker images列表确认无误：

sudo docker images

给 pull 下来的镜像打上 kubeadm 需要的 tag：

sudo docker tag registry.aliyuncs.com/google_containers/kube-apiserver:v1.27.4 registry.k8s.io/kube-apiserver:v1.27.4
sudo docker tag registry.aliyuncs.com/google_containers/kube-controller-manager:v1.27.4 registry.k8s.io/kube-controller-manager:v1.27.4
sudo docker tag registry.aliyuncs.com/google_containers/kube-scheduler:v1.27.4 registry.k8s.io/kube-scheduler:v1.27.4
sudo docker tag registry.aliyuncs.com/google_containers/kube-proxy:v1.27.4 registry.k8s.io/kube-proxy:v1.27.4
sudo docker tag registry.aliyuncs.com/google_containers/pause:3.9 registry.k8s.io/pause:3.9
sudo docker tag registry.aliyuncs.com/google_containers/etcd:3.5.7-0 registry.k8s.io/etcd:3.5.7-0
sudo docker tag registry.aliyuncs.com/google_containers/coredns:v1.10.1 registry.k8s.io/coredns/coredns:v1.10.1

导出kubeadm默认配置文件：

cd ~
sudo kubeadm config print init-defaults > kubeadm-init-config.yaml

内容如下：

apiVersion: kubeadm.k8s.io/v1beta3
bootstrapTokens:
- groups:
  - system:bootstrappers:kubeadm:default-node-token
  token: abcdef.0123456789abcdef
  ttl: 24h0m0s
  usages:
  - signing
  - authentication
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: 1.2.3.4
  bindPort: 6443
nodeRegistration:
  criSocket: unix:///var/run/containerd/containerd.sock
  imagePullPolicy: IfNotPresent
  name: node
  taints: null
---
apiServer:
  timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta3
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns: {}
etcd:
  local:
    dataDir: /var/lib/etcd
imageRepository: registry.k8s.io
kind: ClusterConfiguration
kubernetesVersion: 1.27.0
networking:
  dnsDomain: cluster.local
  serviceSubnet: 10.96.0.0/12
scheduler: {}

需要修改的属性：advertiseAddress criSocket name imageRepository

advertiseAddress: 为master的ip
criSocket: unix:///run/cri-dockerd.sock
name: xa-C92-00 #这里使用host name
imageRepository: registry.aliyuncs.com/google_containers

需要增加的属性：

podSubnet: 10.244.0.0/16

修改后：

apiVersion: kubeadm.k8s.io/v1beta3
bootstrapTokens:
- groups:
  - system:bootstrappers:kubeadm:default-node-token
  token: abcdef.0123456789abcdef
  ttl: 24h0m0s
  usages:
  - signing
  - authentication
kind: InitConfiguration
localAPIEndpoint:
  advertiseAddress: 192.168.31.9
  bindPort: 6443
nodeRegistration:
  criSocket: unix:///run/cri-dockerd.sock
  imagePullPolicy: IfNotPresent
  name: C92-00-Master
  taints: null
---
apiServer:
  timeoutForControlPlane: 4m0s
apiVersion: kubeadm.k8s.io/v1beta3
certificatesDir: /etc/kubernetes/pki
clusterName: kubernetes
controllerManager: {}
dns: {}
etcd:
  local:
    dataDir: /var/lib/etcd
imageRepository: registry.aliyuncs.com/google_containers
kind: ClusterConfiguration
kubernetesVersion: 1.27.0
networking:
  dnsDomain: cluster.local
  serviceSubnet: 10.96.0.0/12
  podSubnet: 10.244.0.0/16
scheduler: {}

11、Master节点 kubeadm 初始化及排错

尝试初始化

# 替换为配置文件具体路径
sudo kubeadm init --config /root/kubeadm-init-config.yaml

报错1：timed out waiting for condition

[init] Using Kubernetes version: v1.27.0
[preflight] Running pre-flight checks
	[WARNING Hostname]: hostname "node" could not be reached
	[WARNING Hostname]: hostname "node": lookup node on 127.0.0.53:53: server misbehaving
[preflight] Pulling images required for setting up a Kubernetes cluster
[preflight] This might take a minute or two, depending on the speed of your internet connection
[preflight] You can also perform this action in beforehand using 'kubeadm config images pull'
W0723 02:07:59.688150    9181 checks.go:835] detected that the sandbox image "registry.k8s.io/pause:3.6" of the container runtime is inconsistent with that used by kubeadm. It is recommended that using "registry.aliyuncs.com/google_containers/pause:3.9" as the CRI sandbox image.
······
[kubeconfig] Using kubeconfig folder "/etc/kubernetes"
[kubeconfig] Writing "admin.conf" kubeconfig file
[kubeconfig] Writing "kubelet.conf" kubeconfig file
[kubeconfig] Writing "controller-manager.conf" kubeconfig file
[kubeconfig] Writing "scheduler.conf" kubeconfig file
[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[kubelet-start] Starting the kubelet
[control-plane] Using manifest folder "/etc/kubernetes/manifests"
[control-plane] Creating static Pod manifest for "kube-apiserver"
[control-plane] Creating static Pod manifest for "kube-controller-manager"
[control-plane] Creating static Pod manifest for "kube-scheduler"
[etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests"
[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s
[kubelet-check] Initial timeout of 40s passed.

Unfortunately, an error has occurred:
	timed out waiting for the condition

This error is likely caused by:
	- The kubelet is not running
	- The kubelet is unhealthy due to a misconfiguration of the node in some way (required cgroups disabled)

If you are on a systemd-powered system, you can try to troubleshoot the error with the following commands:
	- 'systemctl status kubelet'
	- 'journalctl -xeu kubelet'

Additionally, a control plane component may have crashed or exited when started by the container runtime.
To troubleshoot, list all containers using your preferred container runtimes CLI.
Here is one example how you may list all running Kubernetes containers by using crictl:
	- 'crictl --runtime-endpoint unix:///run/cri-dockerd.sock ps -a | grep kube | grep -v pause'
	Once you have found the failing container, you can inspect its logs with:
	- 'crictl --runtime-endpoint unix:///run/cri-dockerd.sock logs CONTAINERID'
error execution phase wait-control-plane: couldn't initialize a Kubernetes cluster
To see the stack trace of this error execute with --v=5 or higher

大概率是pull所需镜像超时导致的，把需要的镜像手动pull下来打tag即可

排错1：

首先查看日志：

sudo journalctl -xeu kubelet

关键内容如下：

7月 23 02:15:33 xa-C92-00 kubelet[9329]: E0723 02:15:33.493930    9329 kuberuntime_sandbox.go:72] "Failed to create sandbox for pod" err="rpc error: code = Unknown desc = failed pulling image \"registry.k8s.io/pause:3.6\": Error response from daemon: Head \"https://europe-west2-docker.pkg.dev/v2/k8s-artifacts-prod/images/pause/manifests/3.6\": dial tcp 142.250.157.82:443: i/o timeout" pod="kube-system/kube-apiserver-node"
7月 23 02:15:33 xa-C92-00 kubelet[9329]: E0723 02:15:33.493995    9329 kuberuntime_manager.go:1122] "CreatePodSandbox for pod failed" err="rpc error: code = Unknown desc = failed pulling image \"registry.k8s.io/pause:3.6\": Error response from daemon: Head \"https://europe-west2-docker.pkg.dev/v2/k8s-artifacts-prod/images/pause/manifests/3.6\": dial tcp 142.250.157.82:443: i/o timeout" pod="kube-system/kube-apiserver-node"
7月 23 02:15:33 xa-C92-00 kubelet[9329]: E0723 02:15:33.494130    9329 pod_workers.go:1294] "Error syncing pod, skipping" err="failed to \"CreatePodSandbox\" for \"kube-apiserver-node_kube-system(14e1efb20b920f675a7fa970063ebe82)\" with CreatePodSandboxError: \"Failed to create sandbox for pod \\\"kube-apiserver-node_kube-system(14e1efb20b920f675a7fa970063ebe82)\\\": rpc error: code = Unknown desc = failed pulling image \\\"registry.k8s.io/pause:3.6\\\": Error response from daemon: Head \\\"https://europe-west2-docker.pkg.dev/v2/k8s-artifacts-prod/images/pause/manifests/3.6\\\": dial tcp 142.250.157.82:443: i/o timeout\"" pod="kube-system/kube-apiserver-node" podUID=14e1efb20b920f675a7fa970063ebe82
7月 23 02:15:34 xa-C92-00 kubelet[9329]: W0723 02:15:34.624010    9329 reflector.go:533] vendor/k8s.io/client-go/informers/factory.go:150: failed to list *v1.RuntimeClass: Get "https://192.168.31.9:6443/apis/node.k8s.io/v1/runtimeclasses?limit=500&resourceVersion=0": dial tcp 192.168.31.9:6443: connect: connection refused
7月 23 02:15:34 xa-C92-00 kubelet[9329]: E0723 02:15:34.624195    9329 reflector.go:148] vendor/k8s.io/client-go/informers/factory.go:150: Failed to watch *v1.RuntimeClass: failed to list *v1.RuntimeClass: Get "https://192.168.31.9:6443/apis/node.k8s.io/v1/runtimeclasses?limit=500&resourceVersion=0": dial tcp 192.168.31.9:6443: connect: connection refused
7月 23 02:15:35 xa-C92-00 kubelet[9329]: W0723 02:15:35.027372    9329 reflector.go:533] vendor/k8s.io/client-go/informers/factory.go:150: failed to list *v1.CSIDriver: Get "https://192.168.31.9:6443/apis/storage.k8s.io/v1/csidrivers?limit=500&resourceVersion=0": dial tcp 192.168.31.9:6443: connect: connection refused

可以定位到问题是failed pulling image \"registry.k8s.io/pause:3.6\"，所以重新手动下载该镜像并tag：

sudo docker pull registry.aliyuncs.com/google_containers/pause:3.6
sudo docker tag registry.aliyuncs.com/google_containers/pause:3.6 registry.k8s.io/pause:3.6

重置kubeadm：

sudo kubeadm reset -f --cri-socket unix:///run/cri-dockerd.sock

ps：如此会残留CNI配置、iptables配置、IPVS配置、etcd状态，如果reset后还有问题的话可以手动清理（参考）：

# 清理iptables
iptables -F && iptables -t nat -F && iptables -t mangle -F && iptables -X
# 清理CNI配置
rm -rf /etc/cni/*
# 清理iptables配置
rm -rf /var/lib/etcd/*
# 清理其他杂项
rm -rf /etc/ceph \
    /etc/cni \
    /opt/cni \
    /run/secrets/kubernetes.io \
    /run/calico \
    /run/flannel \
    /var/lib/calico \
    /var/lib/cni \
    /var/lib/kubelet \
    /var/log/containers \
    /var/log/kube-audit \
    /var/log/pods \
    /var/run/calico \
    /usr/libexec/kubernetes

继续重试kubeadm 初始化

# 替换为配置文件具体路径
sudo kubeadm init --config /root/kubeadm-init-config.yaml

如果看到以下内容就成功了：

Your Kubernetes control-plane has initialized successfully!

To start using your cluster, you need to run the following as a regular user:

  mkdir -p $HOME/.kube
  sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
  sudo chown $(id -u):$(id -g) $HOME/.kube/config

Alternatively, if you are the root user, you can run:

  export KUBECONFIG=/etc/kubernetes/admin.conf

You should now deploy a pod network to the cluster.
Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
  https://kubernetes.io/docs/concepts/cluster-administration/addons/

Then you can join any number of worker nodes by running the following on each as root:

kubeadm join 192.168.31.9:6443 --token abcdef.0123456789abcdef \
	--discovery-token-ca-cert-hash sha256:d35887853c98044495f91251a878376333870dd7b622161d18b172ebb2284e8d 

最后根据上述提示执行命令（实例为root用户）：

# 临时生效 如需永久生效可以修改/etc/environment文件添加环境变量
export KUBECONFIG=/etc/kubernetes/admin.conf

12、检查 Master 节点上 Pod 运行状况

查看所有pod：

kubectl get pod -A

可以看到coredns组件一直处于pending状态：

NAMESPACE     NAME                           READY   STATUS    RESTARTS   AGE
kube-system   coredns-7bdc4cb885-5jqgk       0/1     Pending   0          12m
kube-system   coredns-7bdc4cb885-n6smf       0/1     Pending   0          12m
kube-system   etcd-node                      1/1     Running   0          12m
kube-system   kube-apiserver-node            1/1     Running   0          12m
kube-system   kube-controller-manager-node   1/1     Running   0          12m
kube-system   kube-proxy-nbn2r               1/1     Running   0          12m
kube-system   kube-scheduler-node            1/1     Running   0          12m

先查看 kubelet 日志：

sudo journalctl -u kubelet -f

kubelet 日志内容如下：

7月 23 02:59:33 xa-C92-00 kubelet[10755]: E0723 02:59:33.780224   10755 kubelet.go:2760] "Container runtime network not ready" networkReady="NetworkReady=false reason:NetworkPluginNotReady message:docker: network plugin is not ready: cni config uninitialized"

再查看该 Pod 日志：

# 替换具体pod name; 记得指定namespace;
sudo kubectl logs coredns-7bdc4cb885-5jqgk --namespace=kube-system

Pod 日志内容如下：

E0723 02:57:34.887767   11558 memcache.go:265] couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp 127.0.0.1:8080: connect: connection refused

根据network plugin is not ready: cni config uninitialized可以知道是尚未安装网络插件的问题（参照步骤14安装Calico后会解决）

13、Node 节点加入集群

参照上面步骤为 Node 节点安装 kubelet kubeadm kubectl
之后 Master 节点执行以下命令以查看 Node 节点加入集群的命令：

sudo kubeadm token create --print-join-command

在 Node 节点执行上面显示的命令（记得指定cri-socket）：

sudo kubeadm join 192.168.31.9:6443 --token pm4bmp.5qu7nqswvav4kd6s --discovery-token-ca-cert-hash sha256:d35887853c98044495f91251a878376333870dd7b622161d18b172ebb2284e8d --cri-socket unix:///run/cri-dockerd.sock

看到以下内容表示 Node 节点成功加入集群:

This node has joined the cluster:
* Certificate signing request was sent to apiserver and a response was received.
* The Kubelet was informed of the new secure connection details.

Run 'kubectl get nodes' on the control-plane to see this node join the cluster.

之后在 Master 节点上查看加入集群的节点：

kubectl get nodes

ps：如果报couldn't get current server API group list: Get "http://localhost:8080/api?timeout=32s": dial tcp 127.0.0.1:8080: connect: connection refused的话，大概率是终端断连导致之前export的环境变量失效了，可以在/etc/environment文件中加入KUBECONFIG="/etc/kubernetes/admin.conf"以使环境变量永久生效

14、Master 节点安装 Calico 网络插件（踩坑比较多建议看完再动手）

现在跟随Calico官网安装教程的指引，为集群安装Calico网络插件：

kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.26.1/manifests/tigera-operator.yaml

报错2：

The connection to the server raw.githubusercontent.com was refused - did you specify the right host or port?

由于网络问题域名解析出错

排错2：

我们直接手动下载tigera-operator.yaml后ftp到 Master 节点的/root目录下，重试：

kubectl create -f /root/tigera-operator.yaml

继续，将custom-resources.yaml由https://raw.githubusercontent.com/projectcalico/calico/v3.26.1/manifests/custom-resources.yaml手动下载，内容如下：

# This section includes base Calico installation configuration.
# For more information, see: https://projectcalico.docs.tigera.io/master/reference/installation/api#operator.tigera.io/v1.Installation
apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
spec:
  # Configures Calico networking.
  calicoNetwork:
    # Note: The ipPools section cannot be modified post-install.
    ipPools:
    - blockSize: 26
      cidr: 192.168.0.0/16
      encapsulation: VXLANCrossSubnet
      natOutgoing: Enabled
      nodeSelector: all()

---

# This section configures the Calico API server.
# For more information, see: https://projectcalico.docs.tigera.io/master/reference/installation/api#operator.tigera.io/v1.APIServer
apiVersion: operator.tigera.io/v1
kind: APIServer
metadata:
  name: default
spec: {}

其中应修改cidr: 192.168.0.0/16属性为kubeadm配置文件中podSubnet: 10.244.0.0/16属性指定的ip段（10.244.0.0/16）
之后继续部署pod：

kubectl create -f /root/custom-resources.yaml

查看所有 Pod：

kubectl get pod -A

NAMESPACE         NAME                                       READY   STATUS                  RESTARTS   AGE
calico-system     calico-kube-controllers-67cb4686c7-dllhw   0/1     Pending                 0          8m38s
calico-system     calico-node-24zzc                          0/1     Init:ImagePullBackOff   0          8m39s
calico-system     calico-node-2s6gl                          0/1     Init:0/2                0          8m39s
calico-system     calico-typha-5d9d547f8-f4w48               0/1     ContainerCreating       0          8m40s
calico-system     csi-node-driver-f8r58                      0/2     ContainerCreating       0          8m38s
calico-system     csi-node-driver-szt4w                      0/2     ContainerCreating       0          8m39s
kube-system       coredns-7bdc4cb885-mtpq4                   0/1     Pending                 0          64m
kube-system       coredns-7bdc4cb885-pxwbc                   0/1     Pending                 0          64m
kube-system       etcd-c92-00-master                         1/1     Running                 0          64m
kube-system       kube-apiserver-c92-00-master               1/1     Running                 0          64m
kube-system       kube-controller-manager-c92-00-master      1/1     Running                 0          64m
kube-system       kube-proxy-6nzkm                           1/1     Running                 0          64m
kube-system       kube-proxy-thdjg                           1/1     Running                 0          61m
kube-system       kube-scheduler-c92-00-master               1/1     Running                 0          64m
tigera-operator   tigera-operator-5f4668786-pv8cw            1/1     Running                 0          34m

报错3：Init:ImagePullBackOff

查看报错：

kubectl describe pod calico-node-24zzc --namespace calico-system

Events:
  Type     Reason     Age                    From               Message
  ----     ------     ----                   ----               -------
  Normal   Scheduled  7m32s                  default-scheduler  Successfully assigned calico-system/calico-node-24zzc to c92-00-master
  Normal   BackOff    3m52s                  kubelet            Back-off pulling image "docker.io/calico/pod2daemon-flexvol:v3.26.1"
  Warning  Failed     3m52s                  kubelet            Error: ImagePullBackOff
  Normal   Pulling    3m39s (x2 over 7m27s)  kubelet            Pulling image "docker.io/calico/pod2daemon-flexvol:v3.26.1"
  Warning  Failed     6s (x2 over 3m53s)     kubelet            Failed to pull image "docker.io/calico/pod2daemon-flexvol:v3.26.1": rpc error: code = Canceled desc = context canceled
  Warning  Failed     6s (x2 over 3m53s)     kubelet            Error: ErrImagePull

可以看到是由于网络问题 pull 不下来 image docker.io/calico/pod2daemon-flexvol:v3.26.1
之后同上查看其他calico-system命名空间下的Pods，其中calico-typha-5d9d547f8-f4w48提示无法拉取docker.io/calico/typha:v3.26.1

排错3：

可以看到calico版本为V3.26.1，前往https://raw.githubusercontent.com/projectcalico/calico/v3.26.1/manifests/calico.yaml查看所有image:属性后的内容；查看tigera-operator.yaml文件image:属性后的内容；
综上可以得知需要以下image：

docker.io/calico/cni:v3.26.1
docker.io/calico/node:v3.26.1
docker.io/calico/kube-controllers:v3.26.1
docker.io/calico/pod2daemon-flexvol:v3.26.1
docker.io/calico/typha:v3.26.1
docker.io/calico/apiserver:v3.26.1
quay.io/tigera/operator:v1.30.4

修改docker配置文件/etc/docker/daemon.json配置docker镜像站：

{
  "exec-opts": ["native.cgroupdriver=systemd"],
  "registry-mirrors": ["https://ynye4lmg.mirror.aliyuncs.com","https://hub-mirror.c.163.com","https://mirror.baidubce.com"]
}

systemctl restart docker

分别在 Master 和 Node 节点上手动pull镜像：

docker pull docker.io/calico/cni:v3.26.1
docker pull docker.io/calico/node:v3.26.1
docker pull docker.io/calico/kube-controllers:v3.26.1
docker pull docker.io/calico/pod2daemon-flexvol:v3.26.1
docker pull docker.io/calico/typha:v3.26.1
docker pull docker.io/calico/apiserver:v3.26.1
docker pull quay.io/tigera/operator:v1.30.4

回退部署：

kubectl delete -f customer-resources.yaml --grace-period=0
kubectl delete -f tigera-operator.yaml --grace-period=0

重试部署：

kubectl create -f /root/tigera-operator.yaml
kubectl create -f /root/custom-resources.yaml

ps：如果回退部署有问题，可以重置一下K8S，再用kubeadm重新初始化

sudo kubeadm reset -f --cri-socket unix:///run/cri-dockerd.sock
# 记得根据之前重置k8s的内容清理残余项

最后查看一下所有 pod 和 node：

kubectl get pods -A
kubectl get nodes

可以看到全部正常运行了