kubeadm 对接本地 Harbor 私有镜像仓库imageRepository操作环境内网 Harbor harbor.local:8443自签 HTTPS项目 k8s 中已推送全部组件镜像。对接原理kubeadm 拉取组件镜像时以 imageRepository 为前缀拼接镜像名把它指向 Harbor 项目路径并让 containerd 信任 Harbor 证书即可全程走内网仓库。详细步骤bash暗色复制# 1. 全部节点containerd 信任 Harbor 自签证书mkdir -p /etc/containerd/certs.d/harbor.local:8443cp ca.crt /etc/containerd/certs.d/harbor.local:8443/cat /etc/containerd/certs.d/harbor.local:8443/hosts.toml EOFserver https://harbor.local:8443[host.https://harbor.local:8443]capabilities [pull, resolve]ca /etc/containerd/certs.d/harbor.local:8443/ca.crtEOF# 确认 config.toml 已启用# [plugins.io.containerd.grpc.v1.cri.registry] config_path /etc/containerd/certs.dsystemctl restart containerd# 2. Harbor 上准备镜像联网端推送或离线 ctr 导入后 push# 命名形如 harbor.local:8443/k8s/kube-apiserver:v1.28.15# 3. kubeadm-config.yaml 指定仓库前缀yaml暗色复制apiVersion: kubeadm.k8s.io/v1beta3kind: ClusterConfigurationkubernetesVersion: v1.28.15imageRepository: harbor.local:8443/k8snetworking:podSubnet: 10.244.0.0/16bash暗色复制# 4. 预检确认镜像可拉crictl pull harbor.local:8443/k8s/kube-apiserver:v1.28.15kubeadm init --configkubeadm-config.yaml验证流程bash暗色复制crictl images | grep harbor.local # 组件镜像全部来自 Harborkubectl get pods -n kube-system # Running无 ImagePullBackOff排错ImagePullBackOff x509 unknown authority → hosts.toml 未生效确认 containerd ≥1.7 且 config_path 配置正确并重启coredns 拉取 404 → Harbor 中 coredns 镜像路径须保留 coredns/coredns 子路径harbor.local:8443/k8s/coredns/coredns:v1.10.1。