goharbor/harbor
#停止harbor
systemctl stop harbor.service
使用prepare脚本重新加载harbor.yml中的配置
[root@harbor harbor]#./prepare
稍等一会harbor会自动启动起来
查看一下,可以看到nginx的443端口已经打开了
[root@harbor harbor]#docker-compose ps
#如果没启动起来, 改用systemclt来启动Harbor
[root@harbor harbor]# systemctl enable --now harbor.service
HTTPS
创建一个生成证书的目录
mkdir -p /usr/local/harbor/certs
生成CA证书
openssl req -newkey rsa:2048 -nodes -x509 -subj "/C=CN/ST=Beijing/L=Beijing/O=david/OU=IT/CN=ca.david.com/emailAddress=ca.david.com" -set_serial 01 -keyout ca.key -days 3650 -out ca.crt
生成harbor证书申请
openssl req -newkey rsa:2048 -nodes -subj "/C=CN/ST=Beijing/L=Beijing/O=david/OU=devops/CN=harbor.david.com" -set_serial 02 -keyout harbor.key -out harbor.csr
为harbor颁发证书
需要使用SAN(Subject Alternative Name) 扩展,所以在颁发证书的需要做一些处理,不然登录时会报以下异常
[root@bogon config]# docker login harbor.david.com
Username: admin
Password:
Error response from daemon: Get "https://harbor.david.com/v2/": tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead
创建v3_req的配置文件 *.david.com 支持该域名下的所有子域名
参考:https://www.cnblogs.com/punchlinux/p/16499966.html
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1=*.david.com
EOF
开始为harbor颁发带SAN扩展的证书 -extfile v3.ext
openssl x509 -req -in harbor.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out harbor.crt -extfile v3.ext
查看证书 支持所有子域名 DNS:*.david.com
X509v3 extensions:
X509v3 Authority Key Identifier:
keyid:B8:44:82:67:B2:E3:2C:70:B3:A9:04:66:BE:D4:C6:95:FD:2F:95:0F
X509v3 Basic Constraints:
CA:FALSE
X509v3 Key Usage:
Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Subject Alternative Name:
DNS:*.david.com
修改harbor.yml
打开之前被我们注释掉的https配置,并配置好crt和key的路径:
Harbor.crt 和 Harbor.key 中的harbor是小写,不是大写
certificate: /root/harbor/certs/Harbor.crt
private_key: /root/harbor/certs/Harbor.key
修改为正确的路径
-rw-r--r-- 1 root root 1391 Oct 26 15:18 ca.crt
-rw------- 1 root root 1708 Oct 26 15:18 ca.key
-rw-r--r-- 1 root root 41 Oct 26 15:20 ca.srl
-rw-r--r-- 1 root root 1261 Oct 26 15:20 harbor.crt
-rw-r--r-- 1 root root 1013 Oct 26 15:19 harbor.csr
-rw------- 1 root root 1704 Oct 26 15:19 harbor.key
certificate: /usr/local/harbor/certs/harbor.crt
private_key: /usr/local/harbor/certs/harbor.key
将证书复制到harbor目录下,推送我使用的是reg.david.com域名
mkdir -pv /etc/docker/certs.d/reg.david.com
cp ca.crt /etc/docker/certs.d/reg.david.com/
mkdir -pv /etc/docker/certs.d/harbor.david.com
cp ca.crt /etc/docker/certs.d/harbor.david.com/
登录harbor
docker login harbor.david.com
退出harbor
docker logout harbor.david.com
本地host添加域名 harbor.david.com / ca.david.com / reg.david.com
[root@bogon config]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.221.129 reg.david.com
192.168.221.129 harbor.david.com
192.168.221.129 ca.david.com
docker push 报错:unauthorized: unauthorized to access repository: library/xx处理方法
#daemon.json中添加insecure-registries字段,代表上传不受IP限制
cat /etc/docker/daemon.json
{
"insecure-registries": ["0.0.0.0/0"],
"registry-mirrors": ["https://wbdhknhl.mirror.aliyuncs.com"]
}
再次重启docker服务
systemctl daemon-reload && systemctl restart docker.service
不一定是这个造成的,我看直接推送到library目录中就正常
为镜像打Tag
docker tag seatunnel:2.3.3 reg.david.com/library/seatunnel:2.3.3
向仓库推荐镜像
docker push reg.david.com/library/seatunnel:2.3.3