K8s 工具安装文档 — Harbor + ArgoCD

环境信息项目详情主机 IP8.147.67.244内网 172.16.78.0操作系统Rocky Linux 9.7 (Blue Onyx)内核5.14.0-611.36.1.el9_7.x86_64Kubernetesv1.35.0容器运行时containerd 2.2.2CNICalico v3.29.1内存14Gi磁盘50G (已用 ~6.5G)节点单节点 (k8s-master, control-plane)安装总览组件版本暴露方式端口状态Helmv3.17.0CLI-✅ 已安装local-path-provisionerv0.0.30--✅ 默认 StorageClassHarborv2.12.3 (Chart 1.16.3)NodePortHTTP 30002 / HTTPS 30003✅ 已部署ArgoCDv2.13.5NodePortHTTP 30080 / HTTPS 30443✅ 已部署目录结构k8s-tools-install/ ├── install-all.sh # 一键安装总脚本 ├── 00-prerequisites.sh # 前置依赖安装Helm StorageClass 镜像加速 ├── 01-install-harbor.sh # Harbor 安装脚本 ├── 02-install-argocd.sh # ArgoCD 安装脚本 └── README.md # 本文档快速安装# 方式一一键安装 bash install-all.sh # 方式二分步安装 bash 00-prerequisites.sh # 1. 安装前置依赖 bash 01-install-harbor.sh # 2. 安装 Harbor bash 02-install-argocd.sh # 3. 安装 ArgoCD一、前置依赖安装1.1 安装 Helm 3从华为云镜像下载 Helm v3.17.0HELM_VERSIONv3.17.0 curl -fsSL https://mirrors.huaweicloud.com/helm/${HELM_VERSION}/helm-${HELM_VERSION}-linux-amd64.tar.gz -o /tmp/helm.tar.gz tar -zxf /tmp/helm.tar.gz -C /tmp/ mv /tmp/linux-amd64/helm /usr/local/bin/helm chmod x /usr/local/bin/helm1.2 配置 containerd 国内镜像加速创建/etc/containerd/conf.d/mirrors.toml[plugins.io.containerd.grpc.v1.cri.registry.mirrors] [plugins.io.containerd.grpc.v1.cri.registry.mirrors.docker.io] endpoint [https://docker.m.daocloud.io] [plugins.io.containerd.grpc.v1.cri.registry.mirrors.registry.k8s.io] endpoint [https://k8s.m.daocloud.io] [plugins.io.containerd.grpc.v1.cri.registry.mirrors.gcr.io] endpoint [https://gcr.m.daocloud.io] [plugins.io.containerd.grpc.v1.cri.registry.mirrors.ghcr.io] endpoint [https://ghcr.m.daocloud.io] [plugins.io.containerd.grpc.v1.cri.registry.mirrors.quay.io] endpoint [https://quay.m.daocloud.io]systemctl restart containerd1.3 安装 local-path-provisioner使用 kubectl 直接安装Helm 方式在国内网络不稳定kubectl apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/v0.0.30/deploy/local-path-storage.yaml kubectl patch storageclass local-path -p {metadata: {annotations:{storageclass.kubernetes.io/is-default-class:true}}}1.4 移除 master 节点 taint单节点必需kubectl taint nodes k8s-master node-role.kubernetes.io/control-plane:NoSchedule-⚠️ 踩坑记录local-path-provisioner 的WaitForFirstConsumer模式单节点集群中使用Immediate绑定模式会导致 no node was specified 错误必须保持WaitForFirstConsumerbusybox 镜像local-path-provisioner 的 helper pod 需要 busybox 镜像国内网络必须预拉取crictl pull busybox:latestGitHub 被墙ArgoCD 的 Helm 仓库和 YAML 清单需要通过代理下载二、Harbor 安装2.1 安装方式使用 Helm 安装 Harbor 2.12.3helm repo add harbor https://helm.goharbor.io helm repo update kubectl create namespace harbor helm install harbor harbor/harbor \ --namespace harbor \ --version 1.16.3 \ --set expose.typenodePort \ --set expose.nodePort.ports.http.nodePort30002 \ --set expose.nodePort.ports.https.nodePort30003 \ --set externalURLhttps://8.147.67.244:30003 \ --set expose.tls.auto.commonName8.147.67.244 \ --set persistence.persistentVolumeClaim.registry.size20Gi \ --set persistence.persistentVolumeClaim.database.size10Gi \ --set persistence.persistentVolumeClaim.redis.size5Gi \ --set persistence.persistentVolumeClaim.trivy.size5Gi \ --set harborAdminPasswordHarbor12345 \ --set chartmuseum.enabledfalse \ --set trivy.enabledtrue \ --set portal.replicas1 \ --set core.replicas1 \ --set registry.replicas1 \ --set jobservice.replicas12.2 访问信息项目值HTTP 地址http://8.147.67.244:30002HTTPS 地址https://8.147.67.244:30003用户名admin密码Harbor12345浏览器访问 HTTPS 会提示证书不安全自签名证书点击高级→继续访问即可。2.3 Docker Login 配置# 方式一HTTP推荐无证书问题 echo Harbor12345 | docker login 8.147.67.244:30002 -u admin --password-stdin # 方式二HTTPS需配置 insecure-registries # 编辑 /etc/docker/daemon.json 添加: # insecure-registries: [8.147.67.244:30003]2.4 验证安装kubectl get pods -n harbor kubectl get svc -n harbor2.5 存储分配组件存储大小存储类Registry20Gilocal-pathDatabase (PostgreSQL)10Gilocal-pathRedis5Gilocal-pathTrivy5Gilocal-path存储位置/opt/local-path-provisioner/2.6 常用操作# 查看 Harbor 日志 kubectl logs -f deployment/harbor-core -n harbor # 修改 admin 密码 helm upgrade harbor harbor/harbor -n harbor --set harborAdminPasswordNewPassword123 # 卸载 Harbor helm uninstall harbor -n harbor kubectl delete pvc --all -n harbor三、ArgoCD 安装3.1 安装方式由于国内网络无法访问 ArgoCD Helm 仓库使用 kubectl patch 方式安装kubectl create namespace argocd # 使用 GitHub 代理下载安装清单 curl -sL https://ghfast.top/https://raw.githubusercontent.com/argoproj/argo-cd/v2.13.5/manifests/install.yaml \ -o /tmp/argocd-install.yaml # 应用清单必须指定 -n argocd kubectl apply -f /tmp/argocd-install.yaml -n argocd # 修改 Service 为 NodePort kubectl patch svc argocd-server -n argocd \ --type merge \ -p {spec:{type:NodePort,ports:[{name:http,port:80,protocol:TCP,targetPort:8080,nodePort:30080},{name:https,port:443,protocol:TCP,targetPort:8080,nodePort:30443}]}} # 设置 insecure 模式跳过 TLS 验证 kubectl set env deployment/argocd-server -n argocd ARGOCD_SERVER_INSECUREtrue3.2 访问信息项目值Web UIhttps://8.147.67.244:30443APIhttps://8.147.67.244:30443/api/v1用户名admin密码见下方命令获取3.3 获取初始密码kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath{.data.password} | base64 -d3.4 安装 ArgoCD CLIcurl -sL https://ghfast.top/https://github.com/argoproj/argo-cd/releases/download/v2.13.5/argocd-linux-amd64 \ -o /usr/local/bin/argocd chmod x /usr/local/bin/argocd argocd version3.5 CLI 登录argocd login 8.147.67.244:30443 --insecure --username admin3.6 修改默认密码# 方式一通过 CLI argocd account update-password # 方式二通过 kubectl kubectl -n argocd exec -it deployment/argocd-server -- argocd account update-password3.7 常用操作# 查看 ArgoCD 状态 kubectl get pods -n argocd # 查看 ArGoCD Server 日志 kubectl logs -f deployment/argocd-server -n argocd # 卸载 ArgoCD kubectl delete -f /tmp/argocd-install.yaml -n argocd kubectl delete namespace argocd四、端口汇总服务协议端口用途HarborHTTP30002Harbor Web UI (HTTP) / Docker RegistryHarborHTTPS30003Harbor Web UI (HTTPS) / Docker RegistryArgoCDHTTP30080ArgoCD Web UI (HTTP) / APIArgoCDHTTPS30443ArgoCD Web UI (HTTPS) / API五、防火墙配置如需从外网访问需在云安全组中开放以下端口端口协议说明30002TCPHarbor HTTP30003TCPHarbor HTTPS30080TCPArgoCD HTTP30443TCPArgoCD HTTPS六、快速验证命令# 检查所有 Pod echo Harbor kubectl get pods -n harbor echo ArgoCD kubectl get pods -n argocd # 检查 Service echo Harbor Service kubectl get svc -n harbor harbor echo ArgoCD Service kubectl get svc -n argocd argocd-server # 检查存储 echo PVC kubectl get pvc -n harbor kubectl get pvc -n argocd