Centos7下配置Harbor离线仓库

Harbor对docker以及docker-compose版本要求

On a Linux host: docker 17.06.0-ce+ and docker-compose 1.18.0+ .

1.使用wget下载harbor离线包

mkdir -p /mnt/src && cd /mnt/src
wget https://github.com/goharbor/harbor/releases/download/v2.5.6/harbor-offline-installer-v2.5.6.tgz

2.解压tgz

tar -zxvf harbor-offline-installer-v2.5.6.tgz

 3.配置密钥以自签名证书

#创建证书存放目录
mkdir -p /mnt/data/ssl & cd /mnt/data/ssl
#创建服务器证书密钥
openssl genrsa -out ca.key 4096

openssl req -x509 -new -nodes -sha512 -days 3650 -subj "/C=CN/ST=Chengdu/L=Chengdu/O=example/OU=Personal/CN=harbor.tonystark.com" -key ca.key -out ca.crt

openssl genrsa -out harbor.tonystark.com.key 4096

openssl req -sha512 -new -subj "/C=CN/ST=Chengdu/L=Chengdu/O=example/OU=Personal/CN=harbor.tonystark.com"  -key harbor.tonystark.com.key -out harbor.tonystark.com.csr


cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=harbor.tonystark.com
DNS.2=tonystark
DNS.3=tonystark
EOF

openssl x509 -req -sha512 -days 3650 -extfile v3.ext -CA ca.crt -CAkey ca.key -CAcreateserial -in harbor.tonystark.com.csr -out harbor.tonystark.com.crt

openssl x509 -inform PEM -in harbor.tonystark.com.crt -out harbor.tonystark.com.cert

#查看证书是否全部生成
ca.crt
ca.key
ca.srl
harbor.tonystark.com.cert
harbor.tonystark.com.crt
harbor.tonystark.com.csr
harbor.tonystark.com.key

#创建目录并拷贝对应证书文件
mkdir -p /data/cert/
cp harbor.tonystark.com.crt /data/cert/
cp harbor.tonystark.com.key /data/cert/

#将生成的证书拷贝到对应docker证书目录下
mkdir -p /etc/docker/certs.d/harbor.tonystark.com/
cp harbor.tonystark.com.cert /etc/docker/certs.d/harbor.tonystark.com/
cp harbor.tonystark.com.key /etc/docker/certs.d/harbor.tonystark.com/
cp ca.crt /etc/docker/certs.d/harbor.tonystark.com/

4.修改配置文件

#拷贝并修改配置文件
cd /mnt/src/harbor && cp harbor.yml.tmpl harbor.yml
#编辑配置文件
vim harbor.yml
#修改以下参数
5 hostname: harbor.tonystark.com #自定义域名
17 certificate: /data/cert/harbor.tonystark.com.crt
18 private_key: /data/cert/harbor.tonystark.com.key
34 harbor_admin_password: Harbor12345 #建议修改为强密码
47 data_volume: /data #默认镜像存储位置
#保存并退出
:wq

5.执行安装

#启动
./install.sh
#停止
docker-compose stop

6.测试登陆harbor仓库

#执行docker login输入账号密码
[root@tonystark ~]# docker login harbor.tonystark.com
Username: admin
Password: 
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
#需要推送privite镜像时将/etc/docker/harbor.tonystark.com下证书拷贝到对应机器docker login即可

 至此Harbor镜像仓库搭建完毕，后续将更新gitlab相关内容

7.测试firefox浏览器登录