# 内核版本规划要点
1. 稳定性优先
– 选择长期支持（LTS）版本
– 避免使用最新的开发版本
– 关注厂商的维护周期

2. 功能需求
– 确认容器平台最低要求
– 检查必需的内核特性
– 评估新特性的必要性

3. 兼容性矩阵
– Docker: 内核 ≥ 3.10（建议 ≥ 4.0）
– Podman: 内核 ≥ 4.0（建议 ≥ 4.18）
– Kubernetes: 内核 ≥ 4.0（建议 ≥ 4.18）
– CRI-O: 内核 ≥ 4.18

4. 测试验证
– 在测试环境验证兼容性
– 运行完整的测试套件
– 监控性能指标

# 容器/K8s兼容性检查清单
□ 内核版本检查
– 主版本号 ≥ 4
– 次版本号 ≥ 18（推荐）
– 发行版标识正确

□ 内核功能检查
– cgroups v1/v2支持
– namespaces支持
– netfilter/iptables支持
– overlayfs支持
– bridge netfilter支持

□ 内核参数检查
– net.ipv4.ip_forward = 1
– net.bridge.bridge-nf-call-iptables = 1
– net.bridge.bridge-nf-call-ip6tables = 1

□ 内核模块检查
– overlay模块已加载
– br_netfilter模块已加载
– 必需模块可自动加载

□ 系统配置检查
– swap已禁用
– SELinux配置正确
– 防火墙规则合理

# 查看当前内核版本
# uname -r
5.14.0-123.el10.x86_64

# 查看完整内核信息
# uname -a
Linux gf-linux-server 5.14.0-123.el10.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Jan 15 10:23:45 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux

# 查看内核版本详细信息
# cat /proc/version
Linux version 5.14.0-123.el10.x86_64 (mockbuild@x86-vm-10.build.eng.bos.redhat.com) (gcc (GCC) 11.3.1 20221121 (Red Hat 11.3.1-2), GNU ld version 2.37-25.el10) #1 SMP PREEMPT_DYNAMIC Mon Jan 15 10:23:45 UTC 2026

# 查看已安装的内核包
# rpm -qa | grep kernel
kernel-core-5.14.0-123.el10.x86_64
kernel-modules-5.14.0-123.el10.x86_64
kernel-5.14.0-123.el10.x86_64
kernel-tools-5.14.0-123.el10.x86_64

# 查看默认启动内核
# grubby –default-kernel
/boot/vmlinuz-5.14.0-123.el10.x86_64

# 查看所有启动项
# grubby –info=ALL
index=0
kernel=/boot/vmlinuz-5.14.0-123.el10.x86_64
args=”ro crashkernel=1G-4G:192M,4G-64G:256M,64G-:512M resume=/dev/mapper/rhel-swap rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet”
root=/dev/mapper/rhel-root
initrd=/boot/initramfs-5.14.0-123.el10.x86_64.img
title=Red Hat Enterprise Linux (5.14.0-123.el10.x86_64) 10.0 (Plow)

# 创建兼容性检查脚本
# cat > /fgedu/shell/check-container-kernel.sh << 'EOF' #!/bin/bash # from:www.itpux.com.qq113257174.wx:itpux-com echo "=========================================" echo "容器/K8s内核兼容性检查" echo "时间: $(date)" echo "主机名: $(hostname)" echo "=========================================" echo "" PASS=0 FAIL=0 WARN=0 check_pass() { echo "[PASS] $1" ((PASS++)) } check_fail() { echo "[FAIL] $1" ((FAIL++)) } check_warn() { echo "[WARN] $1" ((WARN++)) } # 1. 检查内核版本 echo "1. 检查内核版本" KERNEL_VERSION=$(uname -r | cut -d. -f1-2) KERNEL_MAJOR=$(echo $KERNEL_VERSION | cut -d. -f1) KERNEL_MINOR=$(echo $KERNEL_VERSION | cut -d. -f2) if [ "$KERNEL_MAJOR" -ge 4 ]; then if [ "$KERNEL_MINOR" -ge 18 ]; then check_pass "内核版本: $(uname -r) (推荐版本)" elif [ "$KERNEL_MINOR" -ge 0 ]; then check_warn "内核版本: $(uname -r) (最低要求，建议升级到4.18+)" else check_fail "内核版本: $(uname -r) (版本过低)" fi else check_fail "内核版本: $(uname -r) (版本过低，最低要求4.0)" fi echo "" # 2. 检查cgroups支持 echo "2. 检查cgroups支持" if [ -d /sys/fs/cgroup ]; then if [ -f /sys/fs/cgroup/cgroup.controllers ]; then check_pass "cgroups v2已启用" else check_pass "cgroups v1已启用" fi else check_fail "cgroups未启用" fi echo "" # 3. 检查namespaces支持 echo "3. 检查namespaces支持" NS_COUNT=$(ls -la /proc/self/ns/ 2>/dev/null | wc -l)
if [ $NS_COUNT -gt 5 ]; then
check_pass “namespaces支持正常 (发现$((NS_COUNT-1))种namespace)”
else
check_fail “namespaces支持不完整”
fi
echo “”

# 4. 检查overlayfs支持
echo “4. 检查overlayfs支持”
if grep -q “overlay” /proc/filesystems; then
check_pass “overlayfs文件系统支持”
else
check_fail “overlayfs文件系统不支持”
fi

if lsmod | grep -q “^overlay”; then
check_pass “overlay内核模块已加载”
else
check_warn “overlay内核模块未加载（可能按需加载）”
fi
echo “”

# 5. 检查bridge netfilter支持
echo “5. 检查bridge netfilter支持”
if lsmod | grep -q “br_netfilter”; then
check_pass “br_netfilter模块已加载”
else
check_warn “br_netfilter模块未加载”
fi

BR_IPTABLES=$(sysctl -n net.bridge.bridge-nf-call-iptables 2>/dev/null || echo “0”)
if [ “$BR_IPTABLES” == “1” ]; then
check_pass “net.bridge.bridge-nf-call-iptables = 1”
else
check_fail “net.bridge.bridge-nf-call-iptables = $BR_IPTABLES (应为1)”
fi
echo “”

# 6. 检查IP转发
echo “6. 检查IP转发”
IP_FORWARD=$(sysctl -n net.ipv4.ip_forward)
if [ “$IP_FORWARD” == “1” ]; then
check_pass “net.ipv4.ip_forward = 1”
else
check_fail “net.ipv4.ip_forward = $IP_FORWARD (应为1)”
fi
echo “”

# 7. 检查swap
echo “7. 检查swap”
SWAP_TOTAL=$(free -m | awk ‘/^Swap:/{print $2}’)
if [ $SWAP_TOTAL -eq 0 ]; then
check_pass “Swap已禁用”
else
check_fail “Swap未禁用: ${SWAP_TOTAL}MB”
fi
echo “”

# 8. 检查必需的内核模块
echo “8. 检查必需的内核模块”
REQUIRED_MODULES=”overlay br_netfilter ip_tables iptable_filter iptable_nat”
for module in $REQUIRED_MODULES; do
if lsmod | grep -q “^$module” || modprobe -n -v $module 2>&1 | grep -q “insmod”; then
check_pass “内核模块 $module 可用”
else
check_warn “内核模块 $module 不可用”
fi
done
echo “”

# 检查总结
echo “=========================================”
echo “检查结果汇总”
echo “=========================================”
echo “通过: $PASS”
echo “警告: $WARN”
echo “失败: $FAIL”
echo “”

if [ $FAIL -eq 0 ]; then
echo “所有关键检查项通过，系统满足容器/K8s部署要求。”
if [ $WARN -gt 0 ]; then
echo “存在 $WARN 个警告项，建议优化。”
fi
exit 0
else
echo “存在 $FAIL 个关键检查项未通过，请修复后再部署容器/K8s。”
exit 1
fi
EOF

# 执行检查脚本
# chmod +x /fgedu/shell/check-container-kernel.sh
# /fgedu/shell/check-container-kernel.sh
=========================================
容器/K8s内核兼容性检查
时间: Fri Apr 2 15:00:00 CST 2026
主机名: gf-linux-server
=========================================

1. 检查内核版本
[PASS] 内核版本: 5.14.0-123.el10.x86_64 (推荐版本)

2. 检查cgroups支持
[PASS] cgroups v2已启用

3. 检查namespaces支持
[PASS] namespaces支持正常 (发现7种namespace)

4. 检查overlayfs支持
[PASS] overlayfs文件系统支持
[PASS] overlay内核模块已加载

5. 检查bridge netfilter支持
[PASS] br_netfilter模块已加载
[PASS] net.bridge.bridge-nf-call-iptables = 1

6. 检查IP转发
[PASS] net.ipv4.ip_forward = 1

7. 检查swap
[PASS] Swap已禁用

8. 检查必需的内核模块
[PASS] 内核模块 overlay 可用
[PASS] 内核模块 br_netfilter 可用
[PASS] 内核模块 ip_tables 可用
[PASS] 内核模块 iptable_filter 可用
[PASS] 内核模块 iptable_nat 可用

=========================================
检查结果汇总
=========================================
通过: 13
警告: 0
失败: 0

所有关键检查项通过，系统满足容器/K8s部署要求。

# 查看已加载的内核模块
# lsmod | head -20
Module Size Used by
overlay 151552 0
br_netfilter 24576 0
bridge 311296 1 br_netfilter
ip_tables 28672 3 iptable_filter,iptable_nat,iptable_mangle
x_tables 57344 7 ip_tables,iptable_filter,iptable_nat,iptable_mangle,xt_conntrack,xt_MASQUERADE,xt_comment
nfsd 638976 13
auth_rpcgss 172032 1 nfsd
nfs_acl 16384 1 nfsd
lockd 118784 1 nfsd
grace 16384 2 nfsd,lockd
sunrpc 565248 16 nfsd,auth_rpcgss,lockd
dm_mirror 28672 0
dm_region_hash 20480 1 dm_mirror
dm_log 20480 2 dm_mirror,dm_region_hash
dm_mod 163840 3 dm_mirror,dm_log
intel_rapl_msr 20480 0
intel_rapl_common 32768 1 intel_rapl_msr

# 查看特定模块信息
# modinfo overlay
filename: /lib/modules/5.14.0-123.el10.x86_64/kernel/fs/overlayfs/overlay.ko.xz
license: GPL
description: Overlay filesystem
author: Miklos Szeredi
rhelversion: 10.0
srcversion: A1B2C3D4E5F6G7H8I9J0K1L
depends:
retpoline: Y
name: overlay
vermagic: 5.14.0-123.el10.x86_64 SMP preempt mod_unload modversions

# 加载内核模块
# modprobe br_netfilter

# 设置开机自动加载
# cat > /etc/modules-load.d/k8s.conf << EOF overlay br_netfilter EOF # 验证模块加载 # lsmod | grep -E "overlay|br_netfilter" overlay 151552 0 br_netfilter 24576 0

# Docker环境部署前内核检查
# cat > /fgedu/shell/check-docker-kernel.sh << 'EOF' #!/bin/bash # from:www.itpux.com.qq113257174.wx:itpux-com echo "=========================================" echo "Docker环境内核检查" echo "=========================================" # 检查内核版本 KERNEL_VERSION=$(uname -r | cut -d. -f1-2) KERNEL_MAJOR=$(echo $KERNEL_VERSION | cut -d. -f1) KERNEL_MINOR=$(echo $KERNEL_VERSION | cut -d. -f2) echo "内核版本: $(uname -r)" if [ "$KERNEL_MAJOR" -ge 3 ] && [ "$KERNEL_MINOR" -ge 10 ]; then echo "[OK] 内核版本满足Docker要求 (≥3.10)" else echo "[ERROR] 内核版本过低，Docker要求≥3.10" exit 1 fi # 检查必需功能 echo "" echo "检查必需功能:" REQUIRED_FEATURES="cgroups namespaces" for feature in $REQUIRED_FEATURES; do case $feature in cgroups) if [ -d /sys/fs/cgroup ]; then echo "[OK] cgroups支持" else echo "[ERROR] cgroups不支持" fi ;; namespaces) if [ -d /proc/self/ns ]; then echo "[OK] namespaces支持" else echo "[ERROR] namespaces不支持" fi ;; esac done # 检查存储驱动 echo "" echo "检查存储驱动支持:" if grep -q "overlay" /proc/filesystems; then echo "[OK] overlay存储驱动支持" else echo "[WARN] overlay存储驱动不支持，可能影响性能" fi echo "" echo "=========================================" echo "Docker环境内核检查完成" echo "=========================================" EOF # chmod +x /fgedu/shell/check-docker-kernel.sh # /fgedu/shell/check-docker-kernel.sh ========================================= Docker环境内核检查 ========================================= 内核版本: 5.14.0-123.el10.x86_64 [OK] 内核版本满足Docker要求 (≥3.10) 检查必需功能: [OK] cgroups支持 [OK] namespaces支持 检查存储驱动支持: [OK] overlay存储驱动支持 ========================================= Docker环境内核检查完成 =========================================

# K8s集群节点内核验证脚本
# cat > /fgedu/shell/verify-k8s-kernel.sh << 'EOF' #!/bin/bash # from:www.itpux.com.qq113257174.wx:itpux-com NODE_NAME=$(hostname) echo "=========================================" echo "Kubernetes节点内核验证" echo "节点: $NODE_NAME" echo "时间: $(date)" echo "=========================================" echo "" # 内核版本验证 KERNEL_VERSION=$(uname -r) KERNEL_MAJOR=$(echo $KERNEL_VERSION | cut -d. -f1) KERNEL_MINOR=$(echo $KERNEL_VERSION | cut -d. -f2 | cut -d- -f1) echo "1. 内核版本验证" echo " 当前版本: $KERNEL_VERSION" echo " 主版本号: $KERNEL_MAJOR" echo " 次版本号: $KERNEL_MINOR" if [ "$KERNEL_MAJOR" -ge 4 ]; then if [ "$KERNEL_MINOR" -ge 18 ]; then echo " [PASS] 内核版本符合K8s推荐要求 (≥4.18)" else echo " [WARN] 内核版本满足最低要求但低于推荐版本 (推荐≥4.18)" fi else echo " [FAIL] 内核版本过低 (要求≥4.0)" exit 1 fi echo "" # 内核参数验证 echo "2. 内核参数验证" PARAMS_OK=true IP_FORWARD=$(sysctl -n net.ipv4.ip_forward) if [ "$IP_FORWARD" == "1" ]; then echo " [PASS] net.ipv4.ip_forward = 1" else echo " [FAIL] net.ipv4.ip_forward = $IP_FORWARD (应为1)" PARAMS_OK=false fi BR_IPTABLES=$(sysctl -n net.bridge.bridge-nf-call-iptables 2>/dev/null || echo “未设置”)
if [ “$BR_IPTABLES” == “1” ]; then
echo ” [PASS] net.bridge.bridge-nf-call-iptables = 1″
else
echo ” [FAIL] net.bridge.bridge-nf-call-iptables = $BR_IPTABLES (应为1)”
PARAMS_OK=false
fi

BR_IP6TABLES=$(sysctl -n net.bridge.bridge-nf-call-ip6tables 2>/dev/null || echo “未设置”)
if [ “$BR_IP6TABLES” == “1” ]; then
echo ” [PASS] net.bridge.bridge-nf-call-ip6tables = 1″
else
echo ” [FAIL] net.bridge.bridge-nf-call-ip6tables = $BR_IP6TABLES (应为1)”
PARAMS_OK=false
fi
echo “”

# 内核模块验证
echo “3. 内核模块验证”
MODULES_OK=true

check_module() {
local module=$1
if lsmod | grep -q “^$module” || [ -f /lib/modules/$(uname -r)/kernel/$module.ko* ]; then
echo ” [PASS] $module 模块可用”
return 0
else
echo ” [FAIL] $module 模块不可用”
return 1
fi
}

check_module “overlay” || MODULES_OK=false
check_module “br_netfilter” || MODULES_OK=false
check_module “ip_tables” || MODULES_OK=false
echo “”

# Swap验证
echo “4. Swap验证”
SWAP_TOTAL=$(free -m | awk ‘/^Swap:/{print $2}’)
if [ $SWAP_TOTAL -eq 0 ]; then
echo ” [PASS] Swap已禁用”
else
echo ” [FAIL] Swap未禁用 (${SWAP_TOTAL}MB)”
fi
echo “”

# 总结
echo “=========================================”
echo “验证结果汇总”
echo “=========================================”
if [ “$PARAMS_OK” = true ] && [ “$MODULES_OK” = true ]; then
echo “节点 $NODE_NAME 内核配置满足K8s要求”
exit 0
else
echo “节点 $NODE_NAME 内核配置存在问题，请修复”
exit 1
fi
EOF

# chmod +x /fgedu/shell/verify-k8s-kernel.sh
# /fgedu/shell/verify-k8s-kernel.sh
=========================================
Kubernetes节点内核验证
节点: gf-linux-master01
时间: Fri Apr 2 15:30:00 CST 2026
=========================================

1. 内核版本验证
当前版本: 5.14.0-123.el10.x86_64
主版本号: 5
次版本号: 14
[PASS] 内核版本符合K8s推荐要求 (≥4.18)

2. 内核参数验证
[PASS] net.ipv4.ip_forward = 1
[PASS] net.bridge.bridge-nf-call-iptables = 1
[PASS] net.bridge.bridge-nf-call-ip6tables = 1

3. 内核模块验证
[PASS] overlay 模块可用
[PASS] br_netfilter 模块可用
[PASS] ip_tables 模块可用

4. Swap验证
[PASS] Swap已禁用

=========================================
验证结果汇总
=========================================
节点 gf-linux-master01 内核配置满足K8s要求

# 为容器/K8s环境优化内核参数
# cat > /etc/sysctl.d/99-k8s-container.conf << 'EOF' # 网络参数优化 net.ipv4.ip_forward = 1 net.bridge.bridge-nf-call-iptables = 1 net.bridge.bridge-nf-call-ip6tables = 1 # TCP参数优化 net.ipv4.tcp_keepalive_time = 600 net.ipv4.tcp_keepalive_intvl = 30 net.ipv4.tcp_keepalive_probes = 10 net.ipv4.tcp_fin_timeout = 30 net.ipv4.tcp_max_syn_backlog = 4096 net.ipv4.tcp_max_tw_buckets = 4096 # 连接跟踪优化 net.netfilter.nf_conntrack_max = 1048576 net.netfilter.nf_conntrack_tcp_timeout_established = 86400 # 文件描述符优化 fs.file-max = 2097152 fs.inotify.max_user_instances = 8192 fs.inotify.max_user_watches = 524288 # 内存参数优化 vm.max_map_count = 262144 vm.swappiness = 0 vm.overcommit_memory = 1 # 内核信号量优化 kernel.sem = 250 32000 100 128 EOF # 应用内核参数 # sysctl --system * Applying /usr/lib/sysctl.d/10-default-yama-scope.conf ... * Applying /usr/lib/sysctl.d/50-coredump.conf ... * Applying /usr/lib/sysctl.d/50-default.conf ... * Applying /usr/lib/sysctl.d/99-sysctl.conf ... * Applying /etc/sysctl.d/99-k8s-container.conf ... net.ipv4.ip_forward = 1 net.bridge.bridge-nf-call-iptables = 1 net.bridge.bridge-nf-call-ip6tables = 1 net.ipv4.tcp_keepalive_time = 600 net.ipv4.tcp_keepalive_intvl = 30 net.ipv4.tcp_keepalive_probes = 10 net.ipv4.tcp_fin_timeout = 30 net.ipv4.tcp_max_syn_backlog = 4096 net.ipv4.tcp_max_tw_buckets = 4096 net.netfilter.nf_conntrack_max = 1048576 net.netfilter.nf_conntrack_tcp_timeout_established = 86400 fs.file-max = 2097152 fs.inotify.max_user_instances = 8192 fs.inotify.max_user_watches = 524288 vm.max_map_count = 262144 vm.swappiness = 0 vm.overcommit_memory = 1 kernel.sem = 250 32000 100 128 # 验证参数生效 # sysctl -a | grep -E "ip_forward|bridge-nf-call" net.bridge.bridge-nf-call-arptables = 0 net.bridge.bridge-nf-call-ip6tables = 1 net.bridge.bridge-nf-call-iptables = 1 net.ipv4.ip_forward = 1 net.ipv4.ip_forward_update_priority = 1 net.ipv4.ip_forward_use_pmtu = 0