Docker Harbor安装和使用

 goharbor/harbor

 参考：Docker Harbor安装和使用

 #停止harbor

 systemctl stop harbor.service

 使用prepare脚本重新加载harbor.yml中的配置

 [root@harbor harbor]#./prepare
 稍等一会harbor会自动启动起来
 查看一下，可以看到nginx的443端口已经打开了
 [root@harbor harbor]#docker-compose ps

 #如果没启动起来， 改用systemclt来启动Harbor

 [root@harbor harbor]# systemctl enable --now harbor.service

 HTTPS

 创建一个生成证书的目录

 mkdir -p  /usr/local/harbor/certs

 生成CA证书

 openssl req -newkey rsa:2048 -nodes -x509 -subj "/C=CN/ST=Beijing/L=Beijing/O=david/OU=IT/CN=ca.david.com/emailAddress=ca.david.com" -set_serial 01 -keyout ca.key -days 3650 -out ca.crt
 

 生成harbor证书申请

 openssl req -newkey rsa:2048 -nodes -subj "/C=CN/ST=Beijing/L=Beijing/O=david/OU=devops/CN=harbor.david.com" -set_serial 02 -keyout harbor.key -out harbor.csr
 

 为harbor颁发证书

 参考：OpenSSL SAN 证书

 需要使用SAN(Subject Alternative Name) 扩展，所以在颁发证书的需要做一些处理，不然登录时会报以下异常

 [root@bogon config]# docker login harbor.david.com
 Username: admin
 Password:
 Error response from daemon: Get "https://harbor.david.com/v2/": tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead

 创建v3_req的配置文件 *.david.com 支持该域名下的所有子域名

 参考：https://www.cnblogs.com/punchlinux/p/16499966.html
 cat > v3.ext <<-EOF
 authorityKeyIdentifier=keyid,issuer
 basicConstraints=CA:FALSE
 keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
 extendedKeyUsage = serverAuth
 subjectAltName = @alt_names
 [alt_names]
 DNS.1=*.david.com
 EOF

 开始为harbor颁发带SAN扩展的证书  -extfile v3.ext

 openssl x509 -req -in harbor.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out harbor.crt  -extfile v3.ext

 查看证书  支持所有子域名 DNS:*.david.com

X509v3 extensions:
X509v3 Authority Key Identifier:
keyid:B8:44:82:67:B2:E3:2C:70:B3:A9:04:66:BE:D4:C6:95:FD:2F:95:0F
X509v3 Basic Constraints:
    CA:FALSE
X509v3 Key Usage:
    Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment
X509v3 Extended Key Usage:
    TLS Web Server Authentication
X509v3 Subject Alternative Name:
    DNS:*.david.com

 修改harbor.yml

 打开之前被我们注释掉的https配置，并配置好crt和key的路径：
 Harbor.crt 和 Harbor.key 中的harbor是小写，不是大写
 certificate: /root/harbor/certs/Harbor.crt
 private_key: /root/harbor/certs/Harbor.key
 修改为正确的路径
 -rw-r--r-- 1 root root 1391 Oct 26 15:18 ca.crt
 -rw------- 1 root root 1708 Oct 26 15:18 ca.key
 -rw-r--r-- 1 root root   41 Oct 26 15:20 ca.srl
 -rw-r--r-- 1 root root 1261 Oct 26 15:20 harbor.crt
 -rw-r--r-- 1 root root 1013 Oct 26 15:19 harbor.csr
 -rw------- 1 root root 1704 Oct 26 15:19 harbor.key
 certificate: /usr/local/harbor/certs/harbor.crt
 private_key: /usr/local/harbor/certs/harbor.key

 将证书复制到harbor目录下，推送我使用的是reg.david.com域名

 mkdir -pv /etc/docker/certs.d/reg.david.com
 cp ca.crt /etc/docker/certs.d/reg.david.com/
 mkdir -pv /etc/docker/certs.d/harbor.david.com
 cp ca.crt /etc/docker/certs.d/harbor.david.com/

 登录harbor

 docker login harbor.david.com

 退出harbor

 docker logout harbor.david.com

 本地host添加域名 harbor.david.com / ca.david.com / reg.david.com

 [root@bogon config]# cat /etc/hosts
 127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
 ::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
 192.168.221.129 reg.david.com
 192.168.221.129 harbor.david.com
 192.168.221.129 ca.david.com

 docker push 报错:unauthorized: unauthorized to access repository: library/xx处理方法

 #daemon.json中添加insecure-registries字段，代表上传不受IP限制
 

 cat  /etc/docker/daemon.json
 {
    "insecure-registries": ["0.0.0.0/0"],
    "registry-mirrors": ["https://wbdhknhl.mirror.aliyuncs.com"]
 }

 再次重启docker服务

 systemctl   daemon-reload &&  systemctl   restart docker.service

 不一定是这个造成的，我看直接推送到library目录中就正常

 为镜像打Tag

 docker tag seatunnel:2.3.3  reg.david.com/library/seatunnel:2.3.3

 向仓库推荐镜像

 
 docker push reg.david.com/library/seatunnel:2.3.3