K8s部署实操

一.搭建 Harbor 私有镜像仓库

1.1 制作 docker 本地 yum 源

[root@harbor ~]# cat > /etc/yum.repos.d/docker.repo <<EOF [docker] name = docker baseurl = https://mirrors.aliyun.com/docker-ce/linux/rhel/9.6/x86_64/stable/ gpgcheck = 0 EOF [root@harbor ~]# dnf install httpd createrepo-y [root@harbor ~]# mkdir /var/www/html/docker/ -p [root@harbor ~]# vim /etc/httpd/conf/httpd.conf Listen 4444 [root@harbor ~]# systemctl enable --now httpd [root@harbor ~]# dnf install docker-ce -downloadonly --destdir /mnt/ -y [root@harbor ~]# mv /mnt/*.rpm /var/www/html/docker/ [root@harbor ~]# createrepo -v /var/www/html/docker/ [root@harbor ~]# cat > /etc/yum.repos.d/docker.repo <<EOF [docker] name = docker baseurl = http://172.25.254.254:4444/docker gpgcheck = 0 EOF [root@harbor ~]# dnf install docker-ce -y

1.2 Harbor 节点配置 docker 内核参数

[root@harbor ~]# dnf install docker-ce -y [root@harbor ~]# echo br_netfilter > /etc/modules-load.d/docker_mod.conf [root@harbor ~]# modprobe -a br_netfilter [root@harbor ~]# vim /etc/sysctl.d/docker.conf net.bridge.bridge-nf-call-iptables = 1 net.bridge.bridge-nf-call-ip6tables = 1 net.ipv4.ip_forward = 1 [root@harbor ~]# systemctl restart systemd-modules-load.service [root@harbor ~]# sysctl --system [root@harbor ~]# vim /lib/systemd/system/docker.service ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --iptables=true [root@harbor ~]# systemctl daemon-reload [root@harbor ~]# systemctl enable --now docker

1.3 OpenSSL 自签 HTTPS 证书

[root@harbor ~]# mkdir /data/certs -p [root@harbor ~]# mkdir /data/certs -p [root@harbor ~]# openssl req -newkey rsa:4096 \ -nodes -sha256 -keyout /data/certs/timinglee.org.key \ -addext "subjectAltName = DNS:reg.timinglee.org" \ -x509 -days 365 -out /data/certs/timinglee.org.crt You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [XX]:CN State or Province Name (full name) []:Shannxi Locality Name (eg, city) [Default City]:Xi'an Organization Name (eg, company) [Default Company Ltd]:kubernetes Organizational Unit Name (eg, section) []:harbor Common Name (eg, your name or your server's hostname) []:reg.timinglee.org Email Address []:[e-mail]

1.4 配置并启动 Harbor

[root@harbor ~]# tar zxf harbor-offline-installer-v2.5.4.tgz -C /opt/ [root@harbor ~]# cd /opt/harbor/ [root@harbor harbor]# ls common.sh harbor.v2.5.4.tar.gz harbor.yml.tmpl install.sh LICENSE prepare [root@harbor harbor]# cp harbor.yml.tmpl harbor.yml [root@harbor harbor]# vim harbor.yml hostname: reg.timinglee.org certificate: /data/certs/timinglee.org.crt private_key: /data/certs/timinglee.org.key harbor_admin_password: lee [root@harbor harbor]# ./install.sh --with-chartmuseum #编写启动脚本 [root@harbor ~]# vim /lib/systemd/system/harbor.service [Unit] Description=harbor with Docker Compose Documentation=https://reg.timinglee.com/compose/ After=docker.service network-online.target Requires=docker.service [Service] Type=oneshot WorkingDirectory=/opt/harbor ExecStart=/usr/bin/docker compose up -d ExecStop=/usr/bin/docker compose down RemainAfterExit=yes [Install] WantedBy=multi-user.target [root@harbor harbor]# docker compose down WARN[0000] /opt/harbor/docker-compose.yml: the attribute `version` is obsolete, it will be ignored, please remove it to avoid potential confusion [+] down 4/6 ⠇ Container registryctl Stopping 1.9s ✔ Container nginx Removed 0.2s ✔ Container chartmuseum Removed 0.2s ✔ Container harbor-jobservice Removed 0.1s ✔ Container harbor-portal Removed 0.1s ⠦ Container harbor-core Stopping 1.7s[root@harbor harbor]# docker compose down WARN[0000] /opt/harbor/docker-compose.yml: the attribute `version` is obsolete, it will be ignored, please remove it to avoid potential confusion [+] down 4/6 ⠇ Container registryctl Stopping 1.9s ✔ Container nginx Removed 0.2s ✔ Container chartmuseum Removed 0.2s ✔ Container harbor-jobservice Removed 0.1s ✔ Container harbor-portal Removed 0.1s ⠦ Container harbor-core Stopping 1.7s [root@harbor ~]# systemctl enable --now harbor Created symlink /etc/systemd/system/multi-user.target.wants/harbor.service → /usr/lib/systemd/system/harbor.service. [root@harbor harbor]# docker compose ps [root@harbor harbor]# mkdir /etc/docker/certs.d/reg.timinglee.org/ -p [root@harbor harbor]# cp /data/certs/timinglee.org.crt /etc/docker/certs.d/reg.timinglee.org/ca.crt [root@harbor harbor]# vim /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 172.25.254.200 harbor reg.timinglee.org [root@harbor harbor]# systemctl restart docker [root@harbor harbor]# docker compose up -d [root@harbor harbor]# docker login reg.timinglee.org -u admin Password: WARNING! Your credentials are stored unencrypted in '/root/.docker/config.json'. Configure a credential helper to remove this warning. See https://docs.docker.com/go/credential-store/ Login Succeeded

二.所有 K8s 主机统一环境预处理（master、node1、node2 全部执行）

2.1 彻底关闭 swap

原理：k8s 不允许 swap 开启，会造成资源调度统计错乱。

systemctl disable --now swap.target systemctl mask swap.target sed '/swap/s/^/#/g' -i /etc/fstab

2.2 分发 harbor 证书，安装 docker，配置加速器

在 harbor 节点推送证书到所有 k8s 节点：

mkdir /etc/docker/certs.d/reg.timinglee.org/ -p [root@harbor ~]# for i in 100 10 20 > do > scp /data/certs/timinglee.org.crt root@172.25.254.$i:/etc/docker/certs.d/reg.timinglee.org/ca.crt > done systemctl enable docker systemctl restart docker

所有 k8s 节点配置 docker 加速器：

cat >/etc/docker/daemon.json <<EOF { "registry-mirrors":["https://reg.timinglee.org"] } EOF systemctl restart docker docker info 可以看到 Registry Mirrors: https://reg.timinglee.org/

2.3 配置 hosts 主机解析（所有节点）

vim /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 172.25.254.100 master 172.25.254.10 node1 172.25.254.20 node2 172.25.254.200 reg.timinglee.org

2.4 配置 kubernetes yum 源

vim /etc/yum.repos.d/kubernetes.repo [kubernetes] name = kubernetes baseurl = https://mirrors.aliyun.com/kubernetes-new/core/stable/v1.35/rpm/ gpgcheck = 0 #检测 dnf list kubelet

三.部署 Kubernetes 集群

3.1 部署 cri‑dockerd（所有节点）

二进制包方式部署cri-dockerd

#下载二进制包 [root@docker-node1 ~]# wget https://github.com/Mirantis/cri-dockerd/releases/download/v0.4.4/cri-dockerd-0.4.4.amd64.tgz #解压二进制压缩包 [root@docker-node1 ~]# tar zxf cri-dockerd-0.4.4.amd64.tgz [root@docker-node1 ~]# cd cri-dockerd/ [root@docker-node1 cri-dockerd]# ls cri-dockerd cri-docker.service cri-docker.socket #安装cri-docker命令到系统 [root@docker-node1 cri-dockerd]# install -o root -g root -m 0755 cri-dockerd /usr/local/bin/cri-dockerd [root@docker-node1 cri-dockerd]# ls -l /usr/local/bin/cri-dockerd -rwxr-xr-x 1 root root 51638434 Aug 16 19:11 /usr/local/bin/cri-dockerd #生成启动文件 [root@docker-node1 cri-dockerd]# cp cri-docker.s* /lib/systemd/system cp: overwrite '/lib/systemd/system/cri-docker.service'? y [root@docker-node1 cri-dockerd]# chmod +x /lib/systemd/system/cri-docker.s* [root@docker-node1 cri-dockerd]# vim /lib/systemd/system/cri-docker.service [Service] Type=notify ExecStart=/usr/local/bin/cri-dockerd --network-plugin=cni --pod-infra-container-image=reg.timinglee.org/k8s/pause:3.10.1 --container-runtime-endpoint fd:// ExecReload=/bin/kill -s HUP $MAINPID TimeoutSec=0 RestartSec=2 Restart=always [root@docker-node1 cri-dockerd]# systemctl daemon-reload #启动服务 [root@docker-node1 cri-dockerd]# systemctl enable --now cri-docker.service Created symlink /etc/systemd/system/multi-user.target.wants/cri-docker.service → /usr/lib/systemd/system/cri-docker.service. [root@docker-node1 cri-dockerd]# systemctl status cri-docker.service ● cri-docker.service - CRI Interface for Docker Application Container Engine Loaded: loaded (/usr/lib/systemd/system/cri-docker.service; enabled; prese> Active: active (running) since Sun 2026-08-16 19:28:38 CST; 5s ago TriggeredBy: ● cri-docker.socket Docs: https://docs.mirantis.com Main PID: 15525 (cri-dockerd) Tasks: 8 Memory: 62.7M CGroup: /system.slice/cri-docker.service └─15525 /usr/local/bin/cri-dockerd --network-plugin=cni --pod-infr>

3.2安装构建kubernetes 集群所需软件

master 节点：

dnf install kubelet kubeadm kubectl -y systemctl enable --now kubelet.service

node 节点：

dnf install kubelet kubeadm -y systemctl enable --now kubelet.service