harbor v1.9.1
centos 7.6
docker 18.06.1-ce
前期工作
配置yum源为阿里云
cd /etc/yum.repos.d
mv CentOS-Base.repo CentOS-Base.repo.bak
mv epel.repo epel.repo.bak
curl https://mirrors.aliyun.com/repo/Centos-7.repo -o CentOS-Base.repo
sed -i 's/gpgcheck=1/gpgcheck=0/g' /etc/yum.repos.d/CentOS-Base.repo
curl https://mirrors.aliyun.com/repo/epel-7.repo -o epel.repo
update cache 更新缓存
yum clean all
yum makecache
yum repolist
配置docker repo
wget https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo -O/etc/yum.repos.d/docker-ce.repo
安装docker
yum install -y docker-ce # 安装docker
systemctl enable docker && systemctl start docker # 运行docker服务
安装docker-compose
yum install docker-compose
1、下载二进制harbor
github:https://github.com/goharbor/harbor
下载离线版 Harbor offline installer
wget下载呗
2、修改配置文件harbor.yml,配置因人而异,可以都使用默认配置
a、http端口:默认是80,可以改成其他,我改成5050
b、指定主机名称:hostname可以是自定义的域名或者主机的ip,为了简单我使用的是主机ip 192.168.200.101
c、数据存储路径:data_volume,可以另外指定存储路径
d、日志存储路径:log里面的location,也可以指定日志存储路径
# Configuration file of Harbor
# The IP address or hostname to access admin UI and registry service.
# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
hostname: harbor.test.com
# http related config
http:
# port for http, default is 80. If https enabled, this port will redirect to https port
port: 5050
# https related config
https:
# https port for harbor, default is 443
port: 5443
# The path of cert and key files for nginx
certificate: /etc/nginx/cert/harbor.test.com/cacert.pem
private_key: /etc/nginx/cert/harbor.test.com/privkey.pem
# Uncomment external_url if you want to enable external proxy
# And when it enabled the hostname will no longer used
# external_url: https://reg.mydomain.com:8433
# The initial password of Harbor admin
# It only works in first time to install harbor
# Remember Change the admin password from UI after launching Harbor.
harbor_admin_password: 123456
# Harbor DB configuration
database:
# The password for the root user of Harbor DB. Change this before any production use.
password: root123
# The maximum number of connections in the idle connection pool. If it <=0, no idle connections are retained.
max_idle_conns: 50
# The maximum number of open connections to the database. If it <= 0, then there is no limit on the number of open connections.
# Note: the default number of connections is 100 for postgres.
max_open_conns: 100
# The default data volume
data_volume: /data/harbor/data
# Harbor Storage settings by default is using /data dir on local filesystem
# Uncomment storage_service setting If you want to using external storage
# storage_service:
# # ca_bundle is the path to the custom root ca certificate, which will be injected into the truststore
# # of registry's and chart repository's containers. This is usually needed when the user hosts a internal storage with self signed certificate.
# ca_bundle:
# # storage backend, default is filesystem, options include filesystem, azure, gcs, s3, swift and oss
# # for more info about this configuration please refer https://docs.docker.com/registry/configuration/
# filesystem:
# maxthreads: 100
# # set disable to true when you want to disable registry redirect
# redirect:
# disabled: false
# Clair configuration
clair:
# The interval of clair updaters, the unit is hour, set to 0 to disable the updaters.
updaters_interval: 12
jobservice:
# Maximum number of job workers in job service
max_job_workers: 10
notification:
# Maximum retry count for webhook job
webhook_job_max_retry: 10
chart:
# Change the value of absolute_url to enabled can enable absolute url in chart
absolute_url: disabled
# Log configurations
log:
# options are debug, info, warning, error, fatal
level: info
# configs for logs in local storage
local:
# Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.
rotate_count: 50
# Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes.
# If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G
# are all valid.
rotate_size: 200M
# The directory on your host that store log
location: /data/harbor/log
# Uncomment following lines to enable external syslog endpoint.
# external_endpoint:
# # protocol used to transmit log to external endpoint, options is tcp or udp
# protocol: tcp
# # The host of external endpoint
# host: localhost
# # Port of external endpoint
# port: 5140
#This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY!
_version: 1.9.0
# Uncomment external_database if using external database.
# external_database:
# harbor:
# host: harbor_db_host
# port: harbor_db_port
# db_name: harbor_db_name
# username: harbor_db_username
# password: harbor_db_password
# ssl_mode: disable
# max_idle_conns: 2
# max_open_conns: 0
# clair:
# host: clair_db_host
# port: clair_db_port
# db_name: clair_db_name
# username: clair_db_username
# password: clair_db_password
# ssl_mode: disable
# notary_signer:
# host: notary_signer_db_host
# port: notary_signer_db_port
# db_name: notary_signer_db_name
# username: notary_signer_db_username
# password: notary_signer_db_password
# ssl_mode: disable
# notary_server:
# host: notary_server_db_host
# port: notary_server_db_port
# db_name: notary_server_db_name
# username: notary_server_db_username
# password: notary_server_db_password
# ssl_mode: disable
# Uncomment external_redis if using external Redis server
# external_redis:
# host: redis
# port: 6379
# password:
# # db_index 0 is for core, it's unchangeable
# registry_db_index: 1
# jobservice_db_index: 2
# chartmuseum_db_index: 3
# Uncomment uaa for trusting the certificate of uaa instance that is hosted via self-signed cert.
# uaa:
# ca_file: /path/to/ca
# Global proxy
# Config http proxy for components, e.g. http://my.proxy.com:3128
# Components doesn't need to connect to each others via http proxy.
# Remove component from `components` array if want disable proxy
# for it. If you want use proxy for replication, MUST enable proxy
# for core and jobservice, and set `http_proxy` and `https_proxy`.
# Add domain to the `no_proxy` field, when you want disable proxy
# for some special registry.
proxy:
http_proxy:
https_proxy:
no_proxy: 127.0.0.1,localhost,.local,.internal,log,db,redis,nginx,core,portal,postgresql,jobservice,registry,registryctl,clair
components:
- core
- jobservice
- clair
注:harbor是基于docker官方registry的,registry端口默认是5000,由于harbor附带nginx,会通过nginx转发到5000端口。所以防火墙外部只需要暴露http指定的端口即可,我这里是5050
3、由于修改了默认配置文件,需要执行一下prepare文件
4、执行install.sh安装
5、push镜像
由于我的harbor默认使用http方式部署,因为docker默认使用https方式push到私库,想通过http方式push,需要设置docker的配置文件,
vim /etc/docker/daemon.json
加上如下内容
# 使用ip
"insecure-registries":["192.168.200.101:5050"]
# 如果在192.168.200.101做了/etc/host的域名解析,并且再192.168.200.101上做了nginx用80使用域名harbor.xxx.com转发5050端口,这里可以设置成域名
"insecure-registries":["harbor.test.com"]
设置完docker后,重启docker
systemctl daemon-reload
systemctl restart docker
然后可以push镜像,先给现有镜像打tag,tag格式为:ip:端口/harbor项目名/镜像名:tag名
# 使用ip
docker tag mysql:latest 192.168.200.101:5050/library/mysql:latest
# 同理使用域名可以tag成
docker tag mysql:latest harbor.test.com/library/mysql:latest
登录到镜像私库,输入harbor的帐号密码
# 使用ip
docker login 192.168.200.101:5050
# 使用域名
docker login harbor.test.com
提示登录成功,并且帐号密码信息存储在/root/.docker/config.json文件
Authenticating with existing credentials...
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
开始push镜像
# 使用ip
docker push 192.168.200.101:5050/library/mysql:latest
# 使用域名
docker push harbor.test.com/library/mysql:latest
提示push成功,提示类似如下
The push refers to repository [192.168.200.101:5050/library/latest]
9ce0bb155166: Pushed
3f3a4ce2b719: Pushed
9b48060f404d: Pushed
5d3f68f6da8f: Pushed
7bff100f35cb: Pushed
latest: digest: sha256:bd76b84c74ad70368a2341c2402841b75950df881388e43fc2aca000c546653a size: 1369
5、安装后如果需要修改配置文件,可通过以下方式
$ sudo docker-compose down -v
$ vim harbor.yml
$ sudo prepare
$ sudo docker-compose up -d
6、如果修改了harbor用户登录密码,push镜像时报错提示
harbor denied requested access to the resource is denied
去/root/.docker/config.json删除生成的验证
然后再重新docker login ip:端口
7、harbor启用https
首先安装步骤5处理
# 先关闭
$ sudo docker-compose down -v
# 修改harbor.yml的配置
$ vim harbor.yml
# 执行这个脚本
$ sudo prepare
# 再启动
$ sudo docker-compose up -d
其中harbor.yml默认是注释掉https的配置的,
a、先把https前面#号去掉,给https设置合适的端口,本人设置6443
b、用openssl生成证书,指定证书和key路径
如下
http:
# port for http, default is 80. If https enabled, this port will redirect to https port
port: 5050
# https related config
https:
# https port for harbor, default is 443
port: 6443
# The path of cert and key files for nginx
certificate: /root/Downloads/harbor/cert/cacert.pem
private_key: /root/Downloads/harbor/cert/privkey.pem