K8s部署实操

一.搭建 Harbor 私有镜像仓库

1.1 制作 docker 本地 yum 源

[root@harbor ~]# cat > /etc/yum.repos.d/docker.repo <<EOF
[docker]
name = docker
baseurl = https://mirrors.aliyun.com/docker-ce/linux/rhel/9.6/x86_64/stable/
gpgcheck = 0
EOF

[root@harbor ~]# dnf install httpd createrepo-y
[root@harbor ~]# mkdir  /var/www/html/docker/ -p
[root@harbor ~]# vim /etc/httpd/conf/httpd.conf
Listen 4444
[root@harbor ~]# systemctl enable --now httpd

[root@harbor ~]# dnf  install docker-ce -downloadonly  --destdir /mnt/ -y
[root@harbor ~]# mv /mnt/*.rpm /var/www/html/docker/
[root@harbor ~]# createrepo -v /var/www/html/docker/

[root@harbor ~]# cat > /etc/yum.repos.d/docker.repo <<EOF
[docker]
name = docker
baseurl = http://172.25.254.254:4444/docker
gpgcheck = 0
EOF

[root@harbor ~]# dnf install docker-ce -y

1.2 Harbor 节点配置 docker 内核参数

[root@harbor ~]# dnf install docker-ce -y

[root@harbor ~]# echo br_netfilter > /etc/modules-load.d/docker_mod.conf
[root@harbor ~]# modprobe -a br_netfilter
[root@harbor ~]# vim /etc/sysctl.d/docker.conf
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1

[root@harbor ~]# systemctl restart  systemd-modules-load.service
[root@harbor ~]# sysctl  --system

[root@harbor ~]# vim /lib/systemd/system/docker.service
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --iptables=true
[root@harbor ~]# systemctl daemon-reload
[root@harbor ~]# systemctl enable --now docker

1.3 OpenSSL 自签 HTTPS 证书

[root@harbor ~]# mkdir /data/certs -p
[root@harbor ~]# mkdir /data/certs -p
[root@harbor ~]# openssl req -newkey  rsa:4096 \
-nodes -sha256 -keyout /data/certs/timinglee.org.key \
-addext "subjectAltName = DNS:reg.timinglee.org" \
-x509 -days 365 -out /data/certs/timinglee.org.crt

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Shannxi
Locality Name (eg, city) [Default City]:Xi'an
Organization Name (eg, company) [Default Company Ltd]:kubernetes
Organizational Unit Name (eg, section) []:harbor
Common Name (eg, your name or your server's hostname) []:reg.timinglee.org
Email Address []:admin@timinglee.org

1.4 配置并启动 Harbor

[root@harbor ~]# tar zxf  harbor-offline-installer-v2.5.4.tgz -C /opt/
[root@harbor ~]# cd /opt/harbor/
[root@harbor harbor]# ls
common.sh  harbor.v2.5.4.tar.gz  harbor.yml.tmpl  install.sh  LICENSE  prepare
[root@harbor harbor]# cp harbor.yml.tmpl harbor.yml
[root@harbor harbor]# vim harbor.yml
hostname: reg.timinglee.org
  certificate: /data/certs/timinglee.org.crt
  private_key: /data/certs/timinglee.org.key
harbor_admin_password: lee


[root@harbor harbor]# ./install.sh --with-chartmuseum


#编写启动脚本
[root@harbor ~]# vim /lib/systemd/system/harbor.service
[Unit]
Description=harbor with Docker Compose
Documentation=https://reg.timinglee.com/compose/
After=docker.service network-online.target
Requires=docker.service

[Service]
Type=oneshot
WorkingDirectory=/opt/harbor
ExecStart=/usr/bin/docker compose up -d
ExecStop=/usr/bin/docker compose down
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

[root@harbor harbor]# docker compose  down
WARN[0000] /opt/harbor/docker-compose.yml: the attribute `version` is obsolete, it will be ignored, please remove it to avoid potential confusion
[+] down 4/6
 ⠇ Container registryctl       Stopping                                                1.9s
 ✔ Container nginx             Removed                                                 0.2s
 ✔ Container chartmuseum       Removed                                                 0.2s
 ✔ Container harbor-jobservice Removed                                                 0.1s
 ✔ Container harbor-portal     Removed                                                 0.1s
 ⠦ Container harbor-core       Stopping                                                1.7s[root@harbor harbor]# docker compose  down
WARN[0000] /opt/harbor/docker-compose.yml: the attribute `version` is obsolete, it will be ignored, please remove it to avoid potential confusion
[+] down 4/6
 ⠇ Container registryctl       Stopping                                                1.9s
 ✔ Container nginx             Removed                                                 0.2s
 ✔ Container chartmuseum       Removed                                                 0.2s
 ✔ Container harbor-jobservice Removed                                                 0.1s
 ✔ Container harbor-portal     Removed                                                 0.1s
 ⠦ Container harbor-core       Stopping                                                1.7s
 
 
[root@harbor ~]# systemctl enable --now harbor
Created symlink /etc/systemd/system/multi-user.target.wants/harbor.service → /usr/lib/systemd/system/harbor.service.

[root@harbor harbor]# docker compose  ps

[root@harbor harbor]# mkdir  /etc/docker/certs.d/reg.timinglee.org/ -p
[root@harbor harbor]# cp /data/certs/timinglee.org.crt  /etc/docker/certs.d/reg.timinglee.org/ca.crt
[root@harbor harbor]# vim /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
172.25.254.200     harbor reg.timinglee.org


[root@harbor harbor]# systemctl restart docker
[root@harbor harbor]# docker compose up -d

[root@harbor harbor]# docker login  reg.timinglee.org -u admin
Password:

WARNING! Your credentials are stored unencrypted in '/root/.docker/config.json'.
Configure a credential helper to remove this warning. See
https://docs.docker.com/go/credential-store/

Login Succeeded

二.所有 K8s 主机统一环境预处理（master、node1、node2 全部执行）

2.1 彻底关闭 swap

原理：k8s 不允许 swap 开启，会造成资源调度统计错乱。

systemctl disable --now  swap.target
systemctl mask swap.target
sed '/swap/s/^/#/g' -i /etc/fstab

2.2 分发 harbor 证书，安装 docker，配置加速器

在 harbor 节点推送证书到所有 k8s 节点：

mkdir  /etc/docker/certs.d/reg.timinglee.org/ -p

[root@harbor ~]# for i in 100 10 20
> do
> scp /data/certs/timinglee.org.crt root@172.25.254.$i:/etc/docker/certs.d/reg.timinglee.org/ca.crt
> done

systemctl enable  docker
systemctl restart docker

所有 k8s 节点配置 docker 加速器：

cat >/etc/docker/daemon.json <<EOF
{
  "registry-mirrors":["https://reg.timinglee.org"]
}
EOF
systemctl restart docker

docker info
可以看到
Registry Mirrors:
  https://reg.timinglee.org/

2.3 配置 hosts 主机解析（所有节点）

vim /etc/hosts

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
172.25.254.100     master
172.25.254.10      node1
172.25.254.20      node2
172.25.254.200     reg.timinglee.org

2.4 配置 kubernetes yum 源

vim /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name = kubernetes
baseurl = https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.35/rpm/
gpgcheck = 0


#检测
dnf list kubelet

三.部署 Kubernetes 集群

3.1 部署 cri‑dockerd（所有节点）

二进制包方式部署cri-dockerd

#下载二进制包
[root@docker-node1 ~]# wget https://github.com/Mirantis/cri-dockerd/releases/download/v0.4.4/cri-dockerd-0.4.4.amd64.tgz

#解压二进制压缩包
[root@docker-node1 ~]# tar zxf cri-dockerd-0.4.4.amd64.tgz

[root@docker-node1 ~]# cd cri-dockerd/
[root@docker-node1 cri-dockerd]# ls
cri-dockerd  cri-docker.service  cri-docker.socket



#安装cri-docker命令到系统
[root@docker-node1 cri-dockerd]# install -o root -g root -m 0755 cri-dockerd  /usr/local/bin/cri-dockerd

[root@docker-node1 cri-dockerd]# ls -l /usr/local/bin/cri-dockerd
-rwxr-xr-x 1 root root 51638434 Aug 16 19:11 /usr/local/bin/cri-dockerd

#生成启动文件
[root@docker-node1 cri-dockerd]# cp cri-docker.s* /lib/systemd/system
cp: overwrite '/lib/systemd/system/cri-docker.service'? y
[root@docker-node1 cri-dockerd]# chmod  +x /lib/systemd/system/cri-docker.s*


[root@docker-node1 cri-dockerd]# vim /lib/systemd/system/cri-docker.service
[Service]
Type=notify
ExecStart=/usr/local/bin/cri-dockerd --network-plugin=cni --pod-infra-container-image=reg.timinglee.org/k8s/pause:3.10.1 --container-runtime-endpoint fd://
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=2
Restart=always
[root@docker-node1 cri-dockerd]# systemctl daemon-reload

#启动服务
[root@docker-node1 cri-dockerd]# systemctl enable --now cri-docker.service
Created symlink /etc/systemd/system/multi-user.target.wants/cri-docker.service → /usr/lib/systemd/system/cri-docker.service.
[root@docker-node1 cri-dockerd]# systemctl status cri-docker.service
● cri-docker.service - CRI Interface for Docker Application Container Engine
     Loaded: loaded (/usr/lib/systemd/system/cri-docker.service; enabled; prese>
     Active: active (running) since Sun 2026-08-16 19:28:38 CST; 5s ago
TriggeredBy: ● cri-docker.socket
       Docs: https://docs.mirantis.com
   Main PID: 15525 (cri-dockerd)
      Tasks: 8
     Memory: 62.7M
     CGroup: /system.slice/cri-docker.service
             └─15525 /usr/local/bin/cri-dockerd --network-plugin=cni --pod-infr>

3.2安装构建kubernetes 集群所需软件

master 节点：

dnf install kubelet kubeadm kubectl -y
systemctl enable --now kubelet.service

node 节点：

dnf install kubelet kubeadm  -y
systemctl enable --now kubelet.service