habor-deploy docker https 私有仓库搭建

habor-deploy docker https 私有仓库搭建

---

环境要求

• Python 2.7 以上
• Docker 1.10以上
• Docker Compose 1.6.0 以上
• Openssl

开放端口

• 443 HTTPS
• 80 HTTP
• 5000 仓库地址

下载离线安装包

 wget https://storage.googleapis.com/harbor-releases/release-1.7.0/harbor-offline-installer-v1.7.1.tgz

解压

tar xvf harbor-online-installer-v1.7.1.tgz

准备证书

• 生成ca证书 (假设域名为node40)

   openssl genrsa -out ca.key 4096
  

   openssl req -x509 -new -nodes -sha512 -days 3650 \
      -subj "/C=CN/ST=NJ/L=NJ/O=Originaltek/OU=dev/CN=node40" \
      -key ca.key \
      -out ca.crt
  

• 生成服务证书

  openssl genrsa -out node40.key 4096
  

  openssl req -x509 -new -nodes -sha512 -days 3650 \
        -subj "/C=CN/ST=NJ/L=NJ/O=Originaltek/OU=dev/CN=node40" \
        -key node40.key \
        -out node40.crt
  

• 使用ca证书签名生成的server证书

  cat > v3.ext <<-EOF
  authorityKeyIdentifier=keyid,issuer
  basicConstraints=CA:FALSE
  keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
  extendedKeyUsage = serverAuth 
  subjectAltName = @alt_names
  
  [alt_names]
  DNS.1=node40
  EOF
  

  openssl x509 -req -sha512 -days 3650 \
      -extfile v3.ext \
      -CA ca.crt -CAkey ca.key -CAcreateserial \
      -in node40.csr \
      -out node40.crt
  

• 证书转化 (此步骤不能少)

  openssl x509 -inform PEM -in node40.crt -outnode40.cert
  

• 拷贝证书

      mkdir -p /data/cert/
      mkdir -p  /etc/docker/certs.d/node40/
      cp node40.crt /data/cert/
      cp node40.key /data/cert/ 
      cp node40.cert /etc/docker/certs.d/node40/
      cp node40.key /etc/docker/certs.d/node40/
      cp ca.crt /etc/docker/certs.d/node40/
  

进入解压后的habor安装包修改habor配置

  vim habor.cfg
      # 必选
      hostname = 192.168.31.221
      ui_url_protocol = https
      ssl_cert = /data/cert/node40.crt
      ssl_cert_key = /data/cert/node40.key
      # 可选
      email_server = smtp.mydomain.com
      email_server_port = 25
      email_username = sample_admin@mydomain.com
      email_password = abc
      email_from = admin <sample_admin@mydomain.com>
      email_ssl = false
      email_insecure = false
      db_host = postgresql
      db_password = root123
      db_port = 5432
      db_user = postgres
      redis_host = redis
      redis_port = 6379
      redis_password =

修改docker-compose 坑（注意官方教程没有讲述该点导致服务搭建好5000端口无法访问）

 registry:
        image: goharbor/registry-photon:v2.6.2-v1.7.0
        container_name: registry
        restart: always
        cap_drop:
          - ALL
        cap_add:
          - CHOWN
          - SETGID
          - SETUID
        volumes:
          - /data/registry:/storage:z
          - ./common/config/registry/:/etc/registry/:z
          - ./common/config/custom-ca-bundle.crt:/harbor_cust_cert/custom-ca-bundle.crt:z
        networks:
          - harbor
        ports:
          - 5000:5000
        dns_search: .
        depends_on:
          - log
        logging:
          driver: "syslog"
          options:
            syslog-address: "tcp://127.0.0.1:1514"
            tag: "registry"

安装

    ./prepare
    ./install.sh

如果配置错误需要重新安装准备

    rm -rf /data/config
    rm -rf /data/registry
    rm -rf /data/database
    rm -rf /data/redis

docker登录前准备

• 查看/etc/docker/daemon.json是否存在若不存在则添加文件内容如下

   {
     "registry-mirrors": [
       "https://registry.docker-cn.com"
     ],
     "insecure-registries": [
       "node40:5000"
     ]
   }

• 执行命令

systemctl daemon-reload
systemctl restart docker.service

• 查看 /etc/docker/certs.d/node40/ 下的证书是否存在若不存在拷贝之前生成的证书到该文件夹下

 cp node40.cert /etc/docker/certs.d/node40/
 cp node40.key /etc/docker/certs.d/node40/
 cp ca.crt /etc/docker/certs.d/node40/

登录

• 修改/etc/hosts文件 添加node40 所对应的ip

    docker login node40:5000

遇到的坑

• 默认5000端口没有开启导致登录不上，错误认为是证书的原因
• 密码错误想重新修改初始化密码没有把/data/* 文件删除干净
• redis 修改配置文件添加密码后registry-core 无限重启经排查是密码导致认证失败无法启动
• 仓库框架修改了日志配置默认情况无法直接通过docker logs 或 docker-compose logs 直接查看日志该日志已经被放置在了本机的/var/log/habor下