第 26 篇 : 安装Harbor

说明

新开157机器, 配置为2核6G, Harbor安装要求

1. 下载 docker-compose

需先安装docker, 参考之前的文章

cd /usr/local/bin

上传下载的文件, 重命名覆盖, 并创建软链接

mv docker-compose-linux-x86_64 docker-compose
chmod -R 777 docker-compose
docker-compose version
ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose

2. 开启端口443, 4443

firewall-cmd --query-port=443/tcp
firewall-cmd --query-port=4443/tcp
firewall-cmd --zone=public --add-port=443/tcp --permanent
firewall-cmd --zone=public --add-port=4443/tcp --permanent
firewall-cmd --reload

3. Harbor官网

3.1 下载 Harbor-2.8.3-Offline及验证文件

cd /usr/local/src

上传harbor-offline-installer-v2.8.3.tgz文件及harbor-offline-installer-v2.8.3.tgz.asc

3.2 验证

gpg --keyserver hkps://keyserver.ubuntu.com --receive-keys 644FF454C0B4115C
gpg -v --keyserver hkps://keyserver.ubuntu.com --verify harbor-offline-installer-v2.8.3.tgz.asc
tar -zxvf harbor-offline-installer-v2.8.3.tgz
rm -rf harbor-offline-installer-v2.8.3.tgz
rm -rf harbor-offline-installer-v2.8.3.tgz.asc

3.3 配置证书, 因为无论是docker镜像推送, 还是官方建议, 都建议使用https

ca证书

openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=CN/ST=ShangHai/L=ShangHai/O=hahashou/OU=Personal/CN=www.harbor.com" \
 -key ca.key \
 -out ca.crt

harbor证书

openssl genrsa -out www.harbor.com.key 4096
openssl req -sha512 -new \
    -subj "/C=CN/ST=ShangHai/L=ShangHai/O=example/OU=Personal/CN=www.harbor.com" \
    -key www.harbor.com.key \
    -out www.harbor.com.csr

cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=www.harbor.com
DNS.2=www.harbor
DNS.3=harbor
EOF

openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in www.harbor.com.csr \
    -out www.harbor.com.crt

为docker和harbor创建证书

mkdir cert
cp www.harbor.com.crt cert/
cp www.harbor.com.key cert/
openssl x509 -inform PEM -in www.harbor.com.crt -out www.harbor.com.cert

mkdir /etc/docker/certs.d
mkdir /etc/docker/certs.d/www.harbor.com
cp www.harbor.com.cert /etc/docker/certs.d/www.harbor.com/
cp www.harbor.com.key /etc/docker/certs.d/www.harbor.com/
cp ca.crt /etc/docker/certs.d/www.harbor.com/
systemctl restart docker

3.4 配置 harbor.yml

cd harbor
cp harbor.yml.tmpl harbor.yml
vi harbor.yml

第 5 行

hostname: www.harbor.com

第 8和10 行 注释掉, 不使用http
第 17和18 行 证书和秘钥key

certificate: /usr/local/src/www.harbor.com.cert
private_key: /usr/local/src/www.harbor.com.key

第 34 行 admin用户登录密码, 自行设置

harbor_admin_password: 123

3.5 启动Harbor

./prepare
docker-compose down -v
docker-compose up -d

访问Harbor

4. 156机器的Nginx配置https

4.1 配置https

cd /usr/local/src/nginx-1.24.0
yum -y install openssl openssl-devel
./configure --prefix=/usr/local/nginx --with-http_ssl_module
make
nginx -s stop
cd objs
cp nginx /usr/local/nginx/sbin/
cd ~
nginx -V

4.2 将157机器上生成的证书放到nginx/cert文件夹下

将如下文件先下载到本地

cd /usr/local/nginx
mkdir cert
cd cert

上传4个文件

4.3 nginx.conf新增配置

vi ../conf/nginx.conf

在最后面新增一个server

server {
        listen              443 ssl;
        server_name         www.harbor.go;
        ssl_certificate     /usr/local/nginx/cert/www.harbor.com.crt;
        ssl_certificate_key /usr/local/nginx/cert/www.harbor.com.key;
        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
        ssl_ciphers         HIGH:!aNULL:!MD5;

        location / {
             proxy_pass https://192.168.109.157;
        }
    }

cd ../sbin
./nginx

4.4 修改本机hosts文件&通过域名访问harbor

在文件地址栏输入 C:\Windows\System32\drivers\etc\hosts, 最后一行增加如下内容

192.168.109.156 www.harbor.go

访问harbor

5. 将156机器上的一个docker镜像推送到harbor

cd ~
docker pull hello-world
docker images

登录harbor, 进入初始的项目library, 查看推送命令

5.1 修改156机器上的hosts文件

vi /etc/hosts

在最后添加如下内容

192.168.109.157 www.harbor.com

5.2 给156机器的docker安装harbor的证书

mkdir /etc/docker/certs.d
mkdir /etc/docker/certs.d/www.harbor.com
cp /usr/local/nginx/cert/www.harbor.com.cert /etc/docker/certs.d/www.harbor.com/
cp /usr/local/nginx/cert/www.harbor.com.key /etc/docker/certs.d/www.harbor.com/
cp /usr/local/nginx/cert/ca.crt /etc/docker/certs.d/www.harbor.com/
systemctl restart docker

5.3 docker登录harbor并推送镜像

docker login www.harbor.com -u admin -p 123
docker tag hello-world:latest www.harbor.com/library/hello-world:v1
docker push www.harbor.com/library/hello-world:v1

6. 将第 25 篇的阿里云docker仓库替换成harbor

自行解决