一.搭建 Harbor 私有镜像仓库1.1 制作 docker 本地 yum 源[rootharbor ~]# cat /etc/yum.repos.d/docker.repo EOF [docker] name docker baseurl https://mirrors.aliyun.com/docker-ce/linux/rhel/9.6/x86_64/stable/ gpgcheck 0 EOF [rootharbor ~]# dnf install httpd createrepo-y [rootharbor ~]# mkdir /var/www/html/docker/ -p [rootharbor ~]# vim /etc/httpd/conf/httpd.conf Listen 4444 [rootharbor ~]# systemctl enable --now httpd [rootharbor ~]# dnf install docker-ce -downloadonly --destdir /mnt/ -y [rootharbor ~]# mv /mnt/*.rpm /var/www/html/docker/ [rootharbor ~]# createrepo -v /var/www/html/docker/ [rootharbor ~]# cat /etc/yum.repos.d/docker.repo EOF [docker] name docker baseurl http://172.25.254.254:4444/docker gpgcheck 0 EOF [rootharbor ~]# dnf install docker-ce -y1.2 Harbor 节点配置 docker 内核参数[rootharbor ~]# dnf install docker-ce -y [rootharbor ~]# echo br_netfilter /etc/modules-load.d/docker_mod.conf [rootharbor ~]# modprobe -a br_netfilter [rootharbor ~]# vim /etc/sysctl.d/docker.conf net.bridge.bridge-nf-call-iptables 1 net.bridge.bridge-nf-call-ip6tables 1 net.ipv4.ip_forward 1 [rootharbor ~]# systemctl restart systemd-modules-load.service [rootharbor ~]# sysctl --system [rootharbor ~]# vim /lib/systemd/system/docker.service ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock --iptablestrue [rootharbor ~]# systemctl daemon-reload [rootharbor ~]# systemctl enable --now docker1.3 OpenSSL 自签 HTTPS 证书[rootharbor ~]# mkdir /data/certs -p [rootharbor ~]# mkdir /data/certs -p [rootharbor ~]# openssl req -newkey rsa:4096 \ -nodes -sha256 -keyout /data/certs/timinglee.org.key \ -addext subjectAltName DNS:reg.timinglee.org \ -x509 -days 365 -out /data/certs/timinglee.org.crt You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ., the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:Shannxi Locality Name (eg, city) [Default City]:Xian Organization Name (eg, company) [Default Company Ltd]:kubernetes Organizational Unit Name (eg, section) []:harbor Common Name (eg, your name or your servers hostname) []:reg.timinglee.org Email Address []:admintiminglee.org1.4 配置并启动 Harbor[rootharbor ~]# tar zxf harbor-offline-installer-v2.5.4.tgz -C /opt/ [rootharbor ~]# cd /opt/harbor/ [rootharbor harbor]# ls common.sh harbor.v2.5.4.tar.gz harbor.yml.tmpl install.sh LICENSE prepare [rootharbor harbor]# cp harbor.yml.tmpl harbor.yml [rootharbor harbor]# vim harbor.yml hostname: reg.timinglee.org certificate: /data/certs/timinglee.org.crt private_key: /data/certs/timinglee.org.key harbor_admin_password: lee [rootharbor harbor]# ./install.sh --with-chartmuseum #编写启动脚本 [rootharbor ~]# vim /lib/systemd/system/harbor.service [Unit] Descriptionharbor with Docker Compose Documentationhttps://reg.timinglee.com/compose/ Afterdocker.service network-online.target Requiresdocker.service [Service] Typeoneshot WorkingDirectory/opt/harbor ExecStart/usr/bin/docker compose up -d ExecStop/usr/bin/docker compose down RemainAfterExityes [Install] WantedBymulti-user.target [rootharbor harbor]# docker compose down WARN[0000] /opt/harbor/docker-compose.yml: the attribute version is obsolete, it will be ignored, please remove it to avoid potential confusion [] down 4/6 ⠇ Container registryctl Stopping 1.9s ✔ Container nginx Removed 0.2s ✔ Container chartmuseum Removed 0.2s ✔ Container harbor-jobservice Removed 0.1s ✔ Container harbor-portal Removed 0.1s ⠦ Container harbor-core Stopping 1.7s[rootharbor harbor]# docker compose down WARN[0000] /opt/harbor/docker-compose.yml: the attribute version is obsolete, it will be ignored, please remove it to avoid potential confusion [] down 4/6 ⠇ Container registryctl Stopping 1.9s ✔ Container nginx Removed 0.2s ✔ Container chartmuseum Removed 0.2s ✔ Container harbor-jobservice Removed 0.1s ✔ Container harbor-portal Removed 0.1s ⠦ Container harbor-core Stopping 1.7s [rootharbor ~]# systemctl enable --now harbor Created symlink /etc/systemd/system/multi-user.target.wants/harbor.service → /usr/lib/systemd/system/harbor.service. [rootharbor harbor]# docker compose ps [rootharbor harbor]# mkdir /etc/docker/certs.d/reg.timinglee.org/ -p [rootharbor harbor]# cp /data/certs/timinglee.org.crt /etc/docker/certs.d/reg.timinglee.org/ca.crt [rootharbor harbor]# vim /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 172.25.254.200 harbor reg.timinglee.org [rootharbor harbor]# systemctl restart docker [rootharbor harbor]# docker compose up -d [rootharbor harbor]# docker login reg.timinglee.org -u admin Password: WARNING! Your credentials are stored unencrypted in /root/.docker/config.json. Configure a credential helper to remove this warning. See https://docs.docker.com/go/credential-store/ Login Succeeded二.所有 K8s 主机统一环境预处理master、node1、node2 全部执行2.1 彻底关闭 swap原理k8s 不允许 swap 开启会造成资源调度统计错乱。systemctl disable --now swap.target systemctl mask swap.target sed /swap/s/^/#/g -i /etc/fstab2.2 分发 harbor 证书安装 docker配置加速器在 harbor 节点推送证书到所有 k8s 节点mkdir /etc/docker/certs.d/reg.timinglee.org/ -p [rootharbor ~]# for i in 100 10 20 do scp /data/certs/timinglee.org.crt root172.25.254.$i:/etc/docker/certs.d/reg.timinglee.org/ca.crt done systemctl enable docker systemctl restart docker所有 k8s 节点配置 docker 加速器cat /etc/docker/daemon.json EOF { registry-mirrors:[https://reg.timinglee.org] } EOF systemctl restart docker docker info 可以看到 Registry Mirrors: https://reg.timinglee.org/2.3 配置 hosts 主机解析所有节点vim /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 172.25.254.100 master 172.25.254.10 node1 172.25.254.20 node2 172.25.254.200 reg.timinglee.org2.4 配置 kubernetes yum 源vim /etc/yum.repos.d/kubernetes.repo [kubernetes] name kubernetes baseurl https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.35/rpm/ gpgcheck 0 #检测 dnf list kubelet三.部署 Kubernetes 集群3.1 部署 cri‑dockerd所有节点二进制包方式部署cri-dockerd#下载二进制包 [rootdocker-node1 ~]# wget https://github.com/Mirantis/cri-dockerd/releases/download/v0.4.4/cri-dockerd-0.4.4.amd64.tgz #解压二进制压缩包 [rootdocker-node1 ~]# tar zxf cri-dockerd-0.4.4.amd64.tgz [rootdocker-node1 ~]# cd cri-dockerd/ [rootdocker-node1 cri-dockerd]# ls cri-dockerd cri-docker.service cri-docker.socket #安装cri-docker命令到系统 [rootdocker-node1 cri-dockerd]# install -o root -g root -m 0755 cri-dockerd /usr/local/bin/cri-dockerd [rootdocker-node1 cri-dockerd]# ls -l /usr/local/bin/cri-dockerd -rwxr-xr-x 1 root root 51638434 Aug 16 19:11 /usr/local/bin/cri-dockerd #生成启动文件 [rootdocker-node1 cri-dockerd]# cp cri-docker.s* /lib/systemd/system cp: overwrite /lib/systemd/system/cri-docker.service? y [rootdocker-node1 cri-dockerd]# chmod x /lib/systemd/system/cri-docker.s* [rootdocker-node1 cri-dockerd]# vim /lib/systemd/system/cri-docker.service [Service] Typenotify ExecStart/usr/local/bin/cri-dockerd --network-plugincni --pod-infra-container-imagereg.timinglee.org/k8s/pause:3.10.1 --container-runtime-endpoint fd:// ExecReload/bin/kill -s HUP $MAINPID TimeoutSec0 RestartSec2 Restartalways [rootdocker-node1 cri-dockerd]# systemctl daemon-reload #启动服务 [rootdocker-node1 cri-dockerd]# systemctl enable --now cri-docker.service Created symlink /etc/systemd/system/multi-user.target.wants/cri-docker.service → /usr/lib/systemd/system/cri-docker.service. [rootdocker-node1 cri-dockerd]# systemctl status cri-docker.service ● cri-docker.service - CRI Interface for Docker Application Container Engine Loaded: loaded (/usr/lib/systemd/system/cri-docker.service; enabled; prese Active: active (running) since Sun 2026-08-16 19:28:38 CST; 5s ago TriggeredBy: ● cri-docker.socket Docs: https://docs.mirantis.com Main PID: 15525 (cri-dockerd) Tasks: 8 Memory: 62.7M CGroup: /system.slice/cri-docker.service └─15525 /usr/local/bin/cri-dockerd --network-plugincni --pod-infr3.2安装构建kubernetes 集群所需软件master 节点dnf install kubelet kubeadm kubectl -y systemctl enable --now kubelet.servicenode 节点dnf install kubelet kubeadm -y systemctl enable --now kubelet.service K8s部署实操
一.搭建 Harbor 私有镜像仓库1.1 制作 docker 本地 yum 源[rootharbor ~]# cat /etc/yum.repos.d/docker.repo EOF [docker] name docker baseurl https://mirrors.aliyun.com/docker-ce/linux/rhel/9.6/x86_64/stable/ gpgcheck 0 EOF [rootharbor ~]# dnf install httpd createrepo-y [rootharbor ~]# mkdir /var/www/html/docker/ -p [rootharbor ~]# vim /etc/httpd/conf/httpd.conf Listen 4444 [rootharbor ~]# systemctl enable --now httpd [rootharbor ~]# dnf install docker-ce -downloadonly --destdir /mnt/ -y [rootharbor ~]# mv /mnt/*.rpm /var/www/html/docker/ [rootharbor ~]# createrepo -v /var/www/html/docker/ [rootharbor ~]# cat /etc/yum.repos.d/docker.repo EOF [docker] name docker baseurl http://172.25.254.254:4444/docker gpgcheck 0 EOF [rootharbor ~]# dnf install docker-ce -y1.2 Harbor 节点配置 docker 内核参数[rootharbor ~]# dnf install docker-ce -y [rootharbor ~]# echo br_netfilter /etc/modules-load.d/docker_mod.conf [rootharbor ~]# modprobe -a br_netfilter [rootharbor ~]# vim /etc/sysctl.d/docker.conf net.bridge.bridge-nf-call-iptables 1 net.bridge.bridge-nf-call-ip6tables 1 net.ipv4.ip_forward 1 [rootharbor ~]# systemctl restart systemd-modules-load.service [rootharbor ~]# sysctl --system [rootharbor ~]# vim /lib/systemd/system/docker.service ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock --iptablestrue [rootharbor ~]# systemctl daemon-reload [rootharbor ~]# systemctl enable --now docker1.3 OpenSSL 自签 HTTPS 证书[rootharbor ~]# mkdir /data/certs -p [rootharbor ~]# mkdir /data/certs -p [rootharbor ~]# openssl req -newkey rsa:4096 \ -nodes -sha256 -keyout /data/certs/timinglee.org.key \ -addext subjectAltName DNS:reg.timinglee.org \ -x509 -days 365 -out /data/certs/timinglee.org.crt You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ., the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:Shannxi Locality Name (eg, city) [Default City]:Xian Organization Name (eg, company) [Default Company Ltd]:kubernetes Organizational Unit Name (eg, section) []:harbor Common Name (eg, your name or your servers hostname) []:reg.timinglee.org Email Address []:admintiminglee.org1.4 配置并启动 Harbor[rootharbor ~]# tar zxf harbor-offline-installer-v2.5.4.tgz -C /opt/ [rootharbor ~]# cd /opt/harbor/ [rootharbor harbor]# ls common.sh harbor.v2.5.4.tar.gz harbor.yml.tmpl install.sh LICENSE prepare [rootharbor harbor]# cp harbor.yml.tmpl harbor.yml [rootharbor harbor]# vim harbor.yml hostname: reg.timinglee.org certificate: /data/certs/timinglee.org.crt private_key: /data/certs/timinglee.org.key harbor_admin_password: lee [rootharbor harbor]# ./install.sh --with-chartmuseum #编写启动脚本 [rootharbor ~]# vim /lib/systemd/system/harbor.service [Unit] Descriptionharbor with Docker Compose Documentationhttps://reg.timinglee.com/compose/ Afterdocker.service network-online.target Requiresdocker.service [Service] Typeoneshot WorkingDirectory/opt/harbor ExecStart/usr/bin/docker compose up -d ExecStop/usr/bin/docker compose down RemainAfterExityes [Install] WantedBymulti-user.target [rootharbor harbor]# docker compose down WARN[0000] /opt/harbor/docker-compose.yml: the attribute version is obsolete, it will be ignored, please remove it to avoid potential confusion [] down 4/6 ⠇ Container registryctl Stopping 1.9s ✔ Container nginx Removed 0.2s ✔ Container chartmuseum Removed 0.2s ✔ Container harbor-jobservice Removed 0.1s ✔ Container harbor-portal Removed 0.1s ⠦ Container harbor-core Stopping 1.7s[rootharbor harbor]# docker compose down WARN[0000] /opt/harbor/docker-compose.yml: the attribute version is obsolete, it will be ignored, please remove it to avoid potential confusion [] down 4/6 ⠇ Container registryctl Stopping 1.9s ✔ Container nginx Removed 0.2s ✔ Container chartmuseum Removed 0.2s ✔ Container harbor-jobservice Removed 0.1s ✔ Container harbor-portal Removed 0.1s ⠦ Container harbor-core Stopping 1.7s [rootharbor ~]# systemctl enable --now harbor Created symlink /etc/systemd/system/multi-user.target.wants/harbor.service → /usr/lib/systemd/system/harbor.service. [rootharbor harbor]# docker compose ps [rootharbor harbor]# mkdir /etc/docker/certs.d/reg.timinglee.org/ -p [rootharbor harbor]# cp /data/certs/timinglee.org.crt /etc/docker/certs.d/reg.timinglee.org/ca.crt [rootharbor harbor]# vim /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 172.25.254.200 harbor reg.timinglee.org [rootharbor harbor]# systemctl restart docker [rootharbor harbor]# docker compose up -d [rootharbor harbor]# docker login reg.timinglee.org -u admin Password: WARNING! Your credentials are stored unencrypted in /root/.docker/config.json. Configure a credential helper to remove this warning. See https://docs.docker.com/go/credential-store/ Login Succeeded二.所有 K8s 主机统一环境预处理master、node1、node2 全部执行2.1 彻底关闭 swap原理k8s 不允许 swap 开启会造成资源调度统计错乱。systemctl disable --now swap.target systemctl mask swap.target sed /swap/s/^/#/g -i /etc/fstab2.2 分发 harbor 证书安装 docker配置加速器在 harbor 节点推送证书到所有 k8s 节点mkdir /etc/docker/certs.d/reg.timinglee.org/ -p [rootharbor ~]# for i in 100 10 20 do scp /data/certs/timinglee.org.crt root172.25.254.$i:/etc/docker/certs.d/reg.timinglee.org/ca.crt done systemctl enable docker systemctl restart docker所有 k8s 节点配置 docker 加速器cat /etc/docker/daemon.json EOF { registry-mirrors:[https://reg.timinglee.org] } EOF systemctl restart docker docker info 可以看到 Registry Mirrors: https://reg.timinglee.org/2.3 配置 hosts 主机解析所有节点vim /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 172.25.254.100 master 172.25.254.10 node1 172.25.254.20 node2 172.25.254.200 reg.timinglee.org2.4 配置 kubernetes yum 源vim /etc/yum.repos.d/kubernetes.repo [kubernetes] name kubernetes baseurl https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.35/rpm/ gpgcheck 0 #检测 dnf list kubelet三.部署 Kubernetes 集群3.1 部署 cri‑dockerd所有节点二进制包方式部署cri-dockerd#下载二进制包 [rootdocker-node1 ~]# wget https://github.com/Mirantis/cri-dockerd/releases/download/v0.4.4/cri-dockerd-0.4.4.amd64.tgz #解压二进制压缩包 [rootdocker-node1 ~]# tar zxf cri-dockerd-0.4.4.amd64.tgz [rootdocker-node1 ~]# cd cri-dockerd/ [rootdocker-node1 cri-dockerd]# ls cri-dockerd cri-docker.service cri-docker.socket #安装cri-docker命令到系统 [rootdocker-node1 cri-dockerd]# install -o root -g root -m 0755 cri-dockerd /usr/local/bin/cri-dockerd [rootdocker-node1 cri-dockerd]# ls -l /usr/local/bin/cri-dockerd -rwxr-xr-x 1 root root 51638434 Aug 16 19:11 /usr/local/bin/cri-dockerd #生成启动文件 [rootdocker-node1 cri-dockerd]# cp cri-docker.s* /lib/systemd/system cp: overwrite /lib/systemd/system/cri-docker.service? y [rootdocker-node1 cri-dockerd]# chmod x /lib/systemd/system/cri-docker.s* [rootdocker-node1 cri-dockerd]# vim /lib/systemd/system/cri-docker.service [Service] Typenotify ExecStart/usr/local/bin/cri-dockerd --network-plugincni --pod-infra-container-imagereg.timinglee.org/k8s/pause:3.10.1 --container-runtime-endpoint fd:// ExecReload/bin/kill -s HUP $MAINPID TimeoutSec0 RestartSec2 Restartalways [rootdocker-node1 cri-dockerd]# systemctl daemon-reload #启动服务 [rootdocker-node1 cri-dockerd]# systemctl enable --now cri-docker.service Created symlink /etc/systemd/system/multi-user.target.wants/cri-docker.service → /usr/lib/systemd/system/cri-docker.service. [rootdocker-node1 cri-dockerd]# systemctl status cri-docker.service ● cri-docker.service - CRI Interface for Docker Application Container Engine Loaded: loaded (/usr/lib/systemd/system/cri-docker.service; enabled; prese Active: active (running) since Sun 2026-08-16 19:28:38 CST; 5s ago TriggeredBy: ● cri-docker.socket Docs: https://docs.mirantis.com Main PID: 15525 (cri-dockerd) Tasks: 8 Memory: 62.7M CGroup: /system.slice/cri-docker.service └─15525 /usr/local/bin/cri-dockerd --network-plugincni --pod-infr3.2安装构建kubernetes 集群所需软件master 节点dnf install kubelet kubeadm kubectl -y systemctl enable --now kubelet.servicenode 节点dnf install kubelet kubeadm -y systemctl enable --now kubelet.service