Rocky Linux 8.6 K8s v1.32.13 Harbor HTTPS 私有仓库 完整部署文档最终定稿一、全新环境规划最终确认版两台机器全部为 Rocky Linux 8.6角色IP 地址系统版本核心服务Kubernetes 单节点集群192.168.1.99Rocky Linux 8.6K8s v1.32.13Harbor 私有镜像仓库192.168.1.200Rocky Linux 8.6Harbor 离线版 HTTPS 证书认证二、项目整体需求你全部的需求汇总全程系统统一全部 Rocky Linux 8.6不再使用 9 系列Harbor 必须HTTPS 证书认证禁止 HTTP 明文、禁止不安全裸连自签证书必须带IP SAN杜绝 x509 证书不匹配报错Harbor 新建私有项目 k8s-offline必须账号密码证书双重验证才能拉取镜像K8s 集群完全离线部署初始化不从外网拉镜像全部从内网 Harbor 192.168.1.200 拉取所有 K8s 核心组件镜像apiserver/etcd/coredns/pause 等统一内网托管K8s 业务 Pod 私有镜像使用imagePullSecret鉴权所有机器信任 Harbor 根证书生产级安全架构三、统一密码与规范约定Harbor 管理员账号adminHarbor 密码Harbor123456证书有效期10 年镜像项目名k8s-offline私有K8s 版本v1.32.13第一部分Harbor 服务端部署192.168.1.2001. 生成带 IP-SAN 自签 TLS 证书适配 192.168.1.200Rocky8.6 专用解决证书不匹配问题bashmkdir -p /opt/harbor/certcd /opt/harbor/certcat openssl.cnf EOF[req]distinguished_name req_distinguished_namex509_extensions v3_extprompt no[req_distinguished_name]CN 192.168.1.200[v3_ext]basicConstraints CA:FALSEkeyUsage nonRepudiation, digitalSignature, keyEnciphermentsubjectAltName alt_names[alt_names]IP.1 192.168.1.200EOFopenssl req -x509 -nodes -days 3650 -newkey rsa:4096 \-keyout harbor.key -out harbor.crt \-config openssl.cnf2. Harbor 核心配置 harbor.ymlyamlhostname: 192.168.1.200harbor_admin_password: Harbor123456http:port: 80https:port: 443certificate: /opt/harbor/cert/harbor.crtprivate_key: /opt/harbor/cert/harbor.key3. 启动 Harborbash./preparedocker compose downdocker compose up -d4. 放行防火墙 443 端口bashfirewall-cmd --add-port443/tcp --permanentfirewall-cmd --reload5. 网页初始化访问https://192.168.1.200登录后新建项目k8s-offline私有第二部分K8s 节点证书信任配置192.168.1.99Rocky8.6 必须执行全程禁用 insecure 不安全模式bashmkdir -p /etc/docker/certs.d/192.168.1.200scp root192.168.1.200:/opt/harbor/cert/harbor.crt /etc/docker/certs.d/192.168.1.200/ca.crtsystemctl daemon-reloadsystemctl restart docker测试 HTTPS 登录bashdocker login https://192.168.1.200第三部分K8s 镜像批量推送至内网 Harbor1. 批量打 Tag适配新 IP 192.168.1.200bashdocker tag registry.k8s.io/kube-apiserver:v1.32.13 192.168.1.200/k8s-offline/kube-apiserver:v1.32.13docker tag registry.k8s.io/kube-controller-manager:v1.32.13 192.168.1.200/k8s-offline/kube-controller-manager:v1.32.13docker tag registry.k8s.io/kube-scheduler:v1.32.13 192.168.1.200/k8s-offline/kube-scheduler:v1.32.13docker tag registry.k8s.io/kube-proxy:v1.32.13 192.168.1.200/k8s-offline/kube-proxy:v1.32.13docker tag registry.k8s.io/coredns/coredns:v1.11.3 192.168.1.200/k8s-offline/coredns:v1.11.3docker tag registry.k8s.io/pause:3.10 192.168.1.200/k8s-offline/pause:3.10docker tag registry.k8s.io/etcd:3.5.16-0 192.168.1.200/k8s-offline/etcd:3.5.16-02. 批量推送镜像bashdocker push 192.168.1.200/k8s-offline/kube-apiserver:v1.32.13docker push 192.168.1.200/k8s-offline/kube-controller-manager:v1.32.13docker push 192.168.1.200/k8s-offline/kube-scheduler:v1.32.13docker push 192.168.1.200/k8s-offline/kube-proxy:v1.32.13docker push 192.168.1.200/k8s-offline/coredns:v1.11.3docker push 192.168.1.200/k8s-offline/pause:3.10docker push 192.168.1.200/k8s-offline/etcd:3.5.16-0第四部分K8s 192.168.1.99 离线初始化集群完全不走外网纯内网 Harbor 拉取组件镜像bashkubeadm init \--kubernetes-versionv1.32.13 \--apiserver-advertise-address192.168.1.99 \--image-repository192.168.1.200/k8s-offline第五部分私有镜像授权业务 Pod 使用1. 创建 Harbor 镜像拉取密钥bashkubectl create secret docker-registry harbor-auth \--docker-serverhttps://192.168.1.200 \--docker-usernameadmin \--docker-passwordHarbor123456 \--docker-emailadmintest.com2. Pod/YAML 引用方式yamlspec:containers:- name: demoimage: 192.168.1.200/k8s-offline/etcd:3.5.16-0imagePullSecrets:- name: harbor-auth第六部分核心硬性规范Rocky8.6 专属系统全部 Rocky Linux 8.6统一内核、统一依赖、零兼容问题网络全程HTTPS 证书加密无 http 明文、无 insecure 漏洞配置证书强制 IP-SAN彻底解决内网镜像仓库证书报错架构离线 K8s 内网私有 Harbor企业生产标准架构鉴权TLS证书 账号密码双重认证