harbor单机安装

Harbor 是一个企业级 Registry 服务。它对开源的 Docker Registry 服务进行了扩展，添加了更多企业用户需要的功能。Harbor 被设计用于部署一套组织内部使用的私有环境，这个私有 Registry 服务对于非常关心安全的组织来说是十分重要的。另外，私有 Registry 服务可以通过避免从公域网下载镜 像而提高企业生产力。这对于没有良好的 Internet 连接状态，使用 Docker Container 的用户是一个福音。

• 基于角色的访问控制：用户与 Docker 镜像仓库通过“项目”进行组织管理，一个用户可以对多个镜像仓库在同一命名空间(project)里有不同的权限。

• 图形化用户界面：用户可以通过浏览器来浏览，检索当前 Docker 镜像仓库，管理项目和命名空间。

• 审计管理：所有针对镜像仓库的操作都可以被记录追溯，用于审计管理。

• 国际化：基于英文与中文语言进行了本地化。可以增加更多的语言支持。

• RESTful API - RESTful API：提供给管理员对于 Harbor 更多的操控, 使得与其它管理软件集成变得更容易。

环境

OS:ubuntu server 16.04

python2.7

docker 1.10.0+

docker-compose 1.7.1+

服务器端配置

下载安装包

   
   
wget https://github.com/vmware/harbor/releases/download/0.5.0/harbor-online-installer-0.5.0.tgz

harbor 主要的安装文件harbor.cfg、install.sh、prepare

harbor.cfg用于配置安装安装选项

install.sh主要用于环境检查并根据harbor.cfg调用prepare生成harbor相关组件的配置文件及docker-compose.yml

创建字签名ssl证书

   
   
openssl req \
  -newkey rsa:4096 -nodes -sha256 -keyout harbor.xxx.com.key \
  -x509 -days 3650 -out harbor.xxx.com.crt

    
    
Generating a 4096 bit RSA private key
.................................++
............................++
unable to write 'random state'
writing new private key to 'harbor.xxx.com.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Beijing
Locality Name (eg, city) []:Beijing
Organization Name (eg, company) [Internet Widgits Pty Ltd]:xxx
Organizational Unit Name (eg, section) []:xxx
Common Name (e.g. server FQDN or YOUR name) []:harbor.xxx.com
Email Address []:

配置harbor.cfg文件

    
    
## Configuration file of Harbor
#The IP address or hostname to access admin UI and registry service.
#DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
hostname = harbor.xxx.com
#The protocol for accessing the UI and token/notification service, by default it is http.
#It can be set to https if ssl is enabled on nginx.
ui_url_protocol = https
#Email account settings for sending out password resetting emails.
#Email server uses the given username and password to authenticate on TLS connections to host and act as identity.
#Identity left blank to act as username.
email_identity = true 
email_server = smtp.xxx.com
email_server_port = 25
email_username = xxx@xxx.com
email_password = xxxx
email_from = admin <xxx@xxx.com>
email_ssl = false
##The initial password of Harbor admin, only works for the first time when Harbor starts. 
#It has no effect after the first launch of Harbor.
#Change the admin password from UI after launching Harbor.
harbor_admin_password = Harbor12345
##By default the auth mode is db_auth, i.e. the credentials are stored in a local database.
#Set it to ldap_auth if you want to verify a user's credentials against an LDAP server.
auth_mode = db_auth
#The url for an ldap endpoint.
ldap_url = ldaps://ldap.mydomain.com
#A user's DN who has the permission to search the LDAP/AD server. 
#If your LDAP/AD server does not support anonymous search, you should configure this DN and ldap_search_pwd.
#ldap_searchdn = uid=searchuser,ou=people,dc=mydomain,dc=com
#the password of the ldap_searchdn
#ldap_search_pwd = password
#The base DN from which to look up a user in LDAP/AD
ldap_basedn = ou=people,dc=mydomain,dc=com
#Search filter for LDAP/AD, make sure the syntax of the filter is correct.
#ldap_filter = (objectClass=person)
# The attribute used in a search to match a user, it could be uid, cn, email, sAMAccountName or other attributes depending on your LDAP/AD  
ldap_uid = uid 
#the scope to search for users, 1-LDAP_SCOPE_BASE, 2-LDAP_SCOPE_ONELEVEL, 3-LDAP_SCOPE_SUBTREE
ldap_scope = 3 
#The password for the root user of mysql db, change this before any production use.
db_password = root123
#Turn on or off the self-registration feature
self_registration = on
#Determine whether the UI should use compressed js files. 
#For production, set it to on. For development, set it to off.
use_compressed_js = on
#Maximum number of job workers in job service  
max_job_workers = 3 
#The expiration time (in minute) of token created by token service, default is 30 minutes
token_expiration = 30
#Determine whether the job service should verify the ssl cert when it connects to a remote registry.
#Set this flag to off when the remote registry uses a self-signed or untrusted certificate.
verify_remote_cert = on
#Determine whether or not to generate certificate for the registry's token.
#If the value is on, the prepare script creates new root cert and private key 
#for generating token to access the registry. If the value is off, a key/certificate must 
#be supplied for token generation.
customize_crt = on
#Information of your organization for certificate
crt_country = CN
crt_state = State
crt_location = CN
crt_organization = organization
crt_organizationalunit = organizational unit
crt_commonname = example.com
crt_email = example@example.com
#The flag to control what users have permission to create projects
#Be default everyone can create a project, set to "adminonly" such that only admin can create project.
project_creation_restriction = everyone
#The path of cert and key files for nginx, they are applied only the protocol is set to https
ssl_cert = /data/cert/harbor.leju.com.crt
ssl_cert_key = /data/cert/harbor.leju.com.key

主要配置项

hostname = harbor.xxx.com　用于配置ui以及registry访问主机名，必须与ｄｎｓ或ｈｏｓｔｓ一致

ui_url_protocol = https　如果想通过ｈｔｔｐｓ访问ｒｅｇｉｓｔｒｙ此项需要注意

复制签名到ssl_cert 、ssl_cert_key配置项相应位置

    
    
cp harbor.xxx.com.crt harbor.xxx.com.key /data/cert/

执行install.sh完成安装

    
    
sudo ./install.sh

客户端配置

修改/etc/hosts，添加如下内容

#resistry_server_ip  registry_domain_name
10.207.2.27  harbor.xxx.com

操作系统层面信任证书

ubuntu

scp develop@10.207.2.27:/home/develop/harbor/harbor.xxx.com.crt  /usr/local/share/ca-certificates/
update-ca-certificates

centos

scp develop@10.207.2.27:/home/develop/harbor/harbor.leju.com.crt  /etc/pki/ca-trust/source/anchors/
update-ca-trust

重新启动docker service

systemctl restart docker

首次使用需要登陆registry

docker login registry.xxx.com

Username: youruser    
Password: yourpassword
Email: