企业官网建设流程全解析

首先Kubernetes需要采用master集群控制平面管理节点，harbor私有镜像仓库节点,node1,node2工作节点如图所示四台虚拟机

IP地址为：master172.25.254.220 harbor172.25.254.200 node172.25.254.80 node2172.25.254.90

一 . 部署本地仓库

用Xshell连接后需要给四台机器关闭防火墙，删除podman ,每台都需要

[root@master ~]# systemctl stop firewalld
[root@master ~]# systemctl disable firewalld
[root@master ~]# dnf remove podman -y

创建docker仓库文件安装软件包dnf install httpd createrepo-y安装

vim /etc/httpd/conf/httpd.conf添加4444端口

systemctl enable --now httpd开机自启

[root@harbor ~]# dnf install docker-ce --downloadonly --destdir /mnt/ -y

[root@harbor ~]# mv /mnt/*.rpm /var/www/html/docker/
[root@harbor ~]# createrepo -v /var/www/html/docker/

[root@harbor ~]# cat > /etc/yum.repos.d/docker.repo <<EOF
[docker]
name = docker
baseurl = http://172.25.254.200:4444/docker
gpgcheck = 0
EOF
[root@harbor ~]# dnf install docker-ce -y

二.安装docker在harbor仓库节点

[root@harbor ~]# echo br_netfilter > /etc/modules-load.d/docker_mod.conf

br_netfilter: 让网桥（Bridge）上转发的流量，能够经过 iptables/netfilter 防火墙规则处理。写入开机自动加载配置
[root@harbor ~]# modprobe -a br_netfilter

立即手动加载该内核模块，不用重启系统就能生效。
[root@harbor ~]# vim /etc/sysctl.d/docker.conf

vim /lib/systemd/system/docker.service

[root@harbor ~]# systemctl daemon-reload
[root@harbor ~]# systemctl enable --now docker

Harbor 的所有组件（前端、镜像仓库、认证、数据库等）都是以容器形式运行的，完全依赖 Docker 环境。
内核模块 + 网络参数：保证 Docker 容器网络、端口映射正常，Harbor 的 Web 界面、镜像推拉接口才能对外正常提供服务；
服务参数配置：明确 Docker 与 containerd 的绑定关系，确保容器运行稳定；
开机自启：保证服务器重启后，Harbor 能随 Docker 自动恢复运行，不用手动拉起。

生成证书

[root@harbor ~]# mkdir /data/certs -p 创建证书存放目录
[root@harbor ~]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout /data/certs/Sakura.org.key -addext "subjectAltName = DNS:reg.Sakura.org" -x509 -days 365 -out /data/certs/Sakura.org.crt
....+.......+.....+...+++++++++++++++++++++++++++++++++++++++++++++*..+..+.........+............+.......+.....+.+..+.......+++++++++++++++++++++++++++++++++++++++++++++*.......+..+....+....................+.......+...+...........+....+..+...+......+.+..+.............+...+..+.........+...............+.........+............+...+.......+...+......+......+........+.+.....+.........+.+...+...............+..+.+.........+........+...+...+..........+.....................+...............+...+.....+...+...+............+++++
..+...+.+++++++++++++++++++++++++++++++++++++++++++++*...........+.+..+......+......................+..+...+.......+..+.+........+....+..+.+...+..+............+.......+..............+.+...+..+++++++++++++++++++++++++++++++++++++++++++++*.+...................+.....+....+.........+...+..+.+.........+..+.........+......+.........+......+..........+...+...........................+.....+.............+...........+.+......+..+.......+......+........+....+..+......+++++
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Shannxi
Locality Name (eg, city) [Default City]:Xi'an
Organization Name (eg, company) [Default Company Ltd]:kubernetes
Organizational Unit Name (eg, section) []:harbor
Common Name (eg, your name or your server's hostname) []:reg.Sakura.org
Email Address []:admin@Sakura.org

需要安装harbor-offline-installer-v2.5.4.tgz软件包

三.编辑harbor配置文件

hostname: reg.Sakura.org
certificate: /data/certs/Sakura.org.crt
private_key: /data/certs/Sakura.org.key
harbor_admin_password: 123

[root@harbor harbor]# ./install.sh --with-chartmuseum

#编写启动脚本
[root@harbor ~]# vim /lib/systemd/system/harbor.service

[root@harbor harbor]# docker compose down

[root@harbor ~]# systemctl enable --now harbor

[root@harbor harbor]# docker compose ps