harbor仓库部署及配置自建证书

habor部署

1.GitHub的官方地址
https://github.com/goharbor/harbor

2.下载harbor
[root@centos201 ~]# wget https://github.com/goharbor/harbor/releases/download/v2.8.2/harbor-offline-installer-v2.8.2.tgz  #

    3.解压软件包
[root@centos201 ~]# tar xf harbor-offline-installer-v2.8.2.tgz -C /linuxmc/softwares/

    
    4.修改配置文件
[root@centos201 ~]# cd /linuxmc/softwares/harbor/
[root@centos201 harbor]# vim harbor.yml
# 添加主机名称
hostname: harbor.linuxmc.com
...
# 设置管理员密码
harbor_admin_password: 1

    5.安装harbor
[root@centos201 harbor]# ./install.sh 

登录harbor
# echo 1 | docker login -u admin --password-stdin harbor.linuxmc.com
# docker login -u admin -p 1 harbor.linuxmc.com
# docker login harbor.linuxmc.com

退出harbor:
# docker logout harbor.linuxmc.com

部署自建证书

1.生成ca的证书
        (1)创建证书目录并进入到证书目录
# mkdir /linuxmc/softwares/harbor/certs/custom/{ca,server,client}
# cd /linuxmc/softwares/harbor/certs/custom

        (2)生成ca的私钥
# openssl genrsa -out ca/ca.key 4096

        (3)生成ca的自签名证书
# openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=linuxmc.com" \
 -key ca/ca.key \
 -out ca/ca.crt

   
   
   2.生成harbor主机证书
    (1)生成harbor主机的私钥
# openssl genrsa -out server/harbor.linuxmc.com.key 4096

    (2)生成harbor主机的证书申请
# openssl req -sha512 -new \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor.linuxmc.com" \
    -key server/harbor.linuxmc.com.key \
    -out server/harbor.linuxmc.com.csr
    
    
    (3)生成x509 v3扩展文件
# cat > server/v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=linuxmc.com
DNS.2=linuxmc
DNS.3=harbor.linuxmc.com
EOF

    (4)使用"v3.ext"给harbor主机签发证书
# openssl x509 -req -sha512 -days 3650 \
    -extfile server/v3.ext \
    -CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial \
    -in server/harbor.linuxmc.com.csr \
    -out server/harbor.linuxmc.com.crt
    
    
    (5)将crt文件转换为cert客户端证书文件
# openssl x509 -inform PEM -in server/harbor.linuxmc.com.crt -out server/harbor.linuxmc.com.cert

温馨提示:
    docker程序认为"*.crt"文件是CA证书文件，"*.cert"客户端证书文件，于是上面第五步需要转换一下，其实使用cp一下也是可以的，内容并没有变化。

    
    3.配置harbor服务器使用证书
        (1)修改harbor的配置文件
# vim /linuxmc/softwares/harbor/harbor.yml     
...
hostname: harbor.linuxmc.com
...
https:
  ...
  certificate: /linuxmc/softwares/harbor/certs/custom/server/harbor.linuxmc.com.crt
  private_key: /linuxmc/softwares/harbor/certs/custom/server/harbor.linuxmc.com.key
...
harbor_admin_password: 1

4.客户端配置证书，推荐配置，便于后期维护。
[root@centos201 custom]# ll
total 0
drwxr-xr-x 2 root root  48 Jun 13 11:31 ca
drwxr-xr-x 2 root root   6 Jun 13 11:24 client
drwxr-xr-x 2 root root 149 Jun 13 11:31 server
[root@centos201 custom]# 
[root@centos201 custom]# cp ca/ca.crt server/harbor.linuxmc.com.key server/harbor.linuxmc.com.cert client/
[root@centos201 custom]# 
[root@centos201 custom]# 
[root@centos201 custom]# ll -R
.:
total 0
drwxr-xr-x 2 root root  48 Jun 13 11:31 ca
drwxr-xr-x 2 root root  85 Jun 13 11:43 client
drwxr-xr-x 2 root root 149 Jun 13 11:31 server

./ca:
total 12
-rw-r--r-- 1 root root 2033 Jun 13 11:25 ca.crt
-rw-r--r-- 1 root root 3243 Jun 13 11:25 ca.key
-rw-r--r-- 1 root root   17 Jun 13 11:31 ca.srl

./client:
total 12
-rw-r--r-- 1 root root 2033 Jun 13 11:43 ca.crt
-rw-r--r-- 1 root root 2122 Jun 13 11:43 harbor.linuxmc.com.cert
-rw-r--r-- 1 root root 3243 Jun 13 11:43 harbor.linuxmc.com.key

./server:
total 20
-rw-r--r-- 1 root root 2122 Jun 13 11:31 harbor.linuxmc.com.cert
-rw-r--r-- 1 root root 2122 Jun 13 11:31 harbor.linuxmc.com.crt
-rw-r--r-- 1 root root 1716 Jun 13 11:29 harbor.linuxmc.com.csr
-rw-r--r-- 1 root root 3243 Jun 13 11:29 harbor.linuxmc.com.key
-rw-r--r-- 1 root root  275 Jun 13 11:30 v3.ext
[root@centos201 custom]# 

    
    
    
    5.将客户端证书拷贝到需要登录harbor服务器的节点上
        1)创建自定义域名的证书存放路径(注意，下面的"harbor.linuxmc.com"改成你自己的自签域名)
[root@centos202 ~]# mkdir -pv /etc/docker/certs.d/harbor.linuxmc.com
mkdir: created directory ‘/etc/docker/certs.d’
mkdir: created directory ‘/etc/docker/certs.d/harbor.linuxmc.com’
[root@centos202 ~]# 

        2)拷贝证书文件
[root@centos201 custom]# scp client/* 10.0.0.202:/etc/docker/certs.d/harbor.linuxmc.com/

        3)客户端登录验证 
[root@centos202 ~]# cat /etc/docker/daemon.json 
{
  "registry-mirrors": ["https://tuv7rqqq.mirror.aliyuncs.com"]
}
[root@centos202 ~]# 
[root@centos202 ~]# systemctl restart docker
[root@centos202 ~]# 
[root@centos202 ~]# docker login -u admin -p 1 harbor.linuxmc.com
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded