说明
新开157机器, 配置为2核6G, Harbor安装要求
1. 下载 docker-compose
需先安装docker, 参考之前的文章
cd /usr/local/bin
上传下载的文件, 重命名覆盖, 并创建软链接
mv docker-compose-linux-x86_64 docker-compose
chmod -R 777 docker-compose
docker-compose version
ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
2. 开启端口443, 4443
firewall-cmd --query-port=443/tcp
firewall-cmd --query-port=4443/tcp
firewall-cmd --zone=public --add-port=443/tcp --permanent
firewall-cmd --zone=public --add-port=4443/tcp --permanent
firewall-cmd --reload
3. Harbor官网
3.1 下载 Harbor-2.8.3-Offline及验证文件
cd /usr/local/src
上传harbor-offline-installer-v2.8.3.tgz文件及harbor-offline-installer-v2.8.3.tgz.asc
3.2 验证
gpg --keyserver hkps://keyserver.ubuntu.com --receive-keys 644FF454C0B4115C
gpg -v --keyserver hkps://keyserver.ubuntu.com --verify harbor-offline-installer-v2.8.3.tgz.asc
tar -zxvf harbor-offline-installer-v2.8.3.tgz
rm -rf harbor-offline-installer-v2.8.3.tgz
rm -rf harbor-offline-installer-v2.8.3.tgz.asc
3.3 配置证书, 因为无论是docker镜像推送, 还是官方建议, 都建议使用https
ca证书
openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -sha512 -days 3650 \
-subj "/C=CN/ST=ShangHai/L=ShangHai/O=hahashou/OU=Personal/CN=www.harbor.com" \
-key ca.key \
-out ca.crt
harbor证书
openssl genrsa -out www.harbor.com.key 4096
openssl req -sha512 -new \
-subj "/C=CN/ST=ShangHai/L=ShangHai/O=example/OU=Personal/CN=www.harbor.com" \
-key www.harbor.com.key \
-out www.harbor.com.csr
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1=www.harbor.com
DNS.2=www.harbor
DNS.3=harbor
EOF
openssl x509 -req -sha512 -days 3650 \
-extfile v3.ext \
-CA ca.crt -CAkey ca.key -CAcreateserial \
-in www.harbor.com.csr \
-out www.harbor.com.crt
为docker和harbor创建证书
mkdir cert
cp www.harbor.com.crt cert/
cp www.harbor.com.key cert/
openssl x509 -inform PEM -in www.harbor.com.crt -out www.harbor.com.cert
mkdir /etc/docker/certs.d
mkdir /etc/docker/certs.d/www.harbor.com
cp www.harbor.com.cert /etc/docker/certs.d/www.harbor.com/
cp www.harbor.com.key /etc/docker/certs.d/www.harbor.com/
cp ca.crt /etc/docker/certs.d/www.harbor.com/
systemctl restart docker
3.4 配置 harbor.yml
cd harbor
cp harbor.yml.tmpl harbor.yml
vi harbor.yml
第 5 行
hostname: www.harbor.com
第 8和10 行 注释掉, 不使用http
第 17和18 行 证书和秘钥key
certificate: /usr/local/src/www.harbor.com.cert
private_key: /usr/local/src/www.harbor.com.key
第 34 行 admin用户登录密码, 自行设置
harbor_admin_password: 123
3.5 启动Harbor
./prepare
docker-compose down -v
docker-compose up -d
4. 156机器的Nginx配置https
4.1 配置https
cd /usr/local/src/nginx-1.24.0
yum -y install openssl openssl-devel
./configure --prefix=/usr/local/nginx --with-http_ssl_module
make
nginx -s stop
cd objs
cp nginx /usr/local/nginx/sbin/
cd ~
nginx -V
4.2 将157机器上生成的证书放到nginx/cert文件夹下
将如下文件先下载到本地
cd /usr/local/nginx
mkdir cert
cd cert
上传4个文件
4.3 nginx.conf新增配置
vi ../conf/nginx.conf
在最后面新增一个server
server {
listen 443 ssl;
server_name www.harbor.go;
ssl_certificate /usr/local/nginx/cert/www.harbor.com.crt;
ssl_certificate_key /usr/local/nginx/cert/www.harbor.com.key;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
location / {
proxy_pass https://192.168.109.157;
}
}
cd ../sbin
./nginx
4.4 修改本机hosts文件&通过域名访问harbor
在文件地址栏输入 C:\Windows\System32\drivers\etc\hosts, 最后一行增加如下内容
192.168.109.156 www.harbor.go
5. 将156机器上的一个docker镜像推送到harbor
cd ~
docker pull hello-world
docker images
登录harbor, 进入初始的项目library, 查看推送命令
5.1 修改156机器上的hosts文件
vi /etc/hosts
在最后添加如下内容
192.168.109.157 www.harbor.com
5.2 给156机器的docker安装harbor的证书
mkdir /etc/docker/certs.d
mkdir /etc/docker/certs.d/www.harbor.com
cp /usr/local/nginx/cert/www.harbor.com.cert /etc/docker/certs.d/www.harbor.com/
cp /usr/local/nginx/cert/www.harbor.com.key /etc/docker/certs.d/www.harbor.com/
cp /usr/local/nginx/cert/ca.crt /etc/docker/certs.d/www.harbor.com/
systemctl restart docker
5.3 docker登录harbor并推送镜像
docker login www.harbor.com -u admin -p 123
docker tag hello-world:latest www.harbor.com/library/hello-world:v1
docker push www.harbor.com/library/hello-world:v1
6. 将第 25 篇的阿里云docker仓库替换成harbor
自行解决