环境说明:
192.168.10.100 harbor.codemiracle.com.cn
#配置hosts
echo "192.168.10.100 harbor.codemiracle.com.cn" >> /etc/hosts
#修改harbor.yml文件
#set hostname
hostname: harbor.codemiracle.com.cn
#http:
# port: 80
https:
# https port for harbor, default is 443
port: 443
# The path of cert and key files for nginx
certificate: /data/certharbor.codemiracle.com.cn.crt
private_key: /data/cert/harbor.codemiracle.com.cn.key
# 注意证书路径,直接在该路径下操作生成证书
#制作自签名证书脚本
#!/bin/bash
# 在该目录下操作生成证书,正好供harbor.yml使用
mkdir -p /data/cert
cd /data/cert
mydomain=$1
openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -sha512 -days 3650 -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=${mydomain}" -key ca.key -out ca.crt
openssl genrsa -out ${mydomain}.key 4096
openssl req -sha512 -new -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=${mydomain}" -key ${mydomain}.key -out ${mydomain}.csr
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1=${mydomain}
DNS.2=harbor
DNS.3=ks-allinone
EOF
openssl x509 -req -sha512 -days 3650 -extfile v3.ext -CA ca.crt -CAkey ca.key -CAcreateserial -in ${mydomain}.csr -out ${mydomain}.crt
openssl x509 -inform PEM -in ${mydomain}.crt -out ${mydomain}.cert
cp ${mydomain}.crt /etc/pki/ca-trust/source/anchors/${mydomain}.crt
update-ca-trust
# 把这三个证书文件复制到docker相应的目录下,注意最后的路径名,要跟上面的保持一致
mkdir -p /etc/docker/certs.d/harbor.codemiracle.com.cn/
cp harbor.codemiracle.com.cn.cert /etc/docker/certs.d/harbor.codemiracle.com.cn/
cp harbor.codemiracle.com.cn.key /etc/docker/certs.d/yharbor.codemiracle.com.cn/
cp ca.crt /etc/docker/certs.d/harbor.codemiracle.com.cn/
最终docker目录结构:
/etc/docker/certs.d/
└── harbor.codemiracle.com.cn
├── harbor.codemiracle.com.cn.cert <-- Server certificate signed by CA
├── harbor.codemiracle.com.cn.key <-- Server key signed by CA
└── ca.crt <-- Certificate authority that signed the registry certificate
# 先停止harbor
cd /usr/local/harbor
docker-compose down -v
# 重启docker
systemctl restart docker.service
#harbot
# 重新生成配置文件,增加上其他chart功能等
./prepare --with-notary --with-clair --with-chartmuseum
# 启动
docker-compose up -d
#helm操作
# 增加仓库,因为使用的自签名证书,所以命令上需要加上,若不加上则会报错:Error: Looks like "https://harbor.codemiracle.com.cn/chartrepo/myrepo" is not a valid chart repository or cannot be reached: Get https://harbor.codemiracle.com.cn/chartrepo/myrepo/index.yaml: x509: certificate signed by unknown authority
helm repo add --ca-file /usr/local/harbor/cert/ca.crt --cert-file /usr/local/harbor/cert/harbor.codemiracle.com.cn.cert --key-file /usr/local/harbor/cert/harbor.codemiracle.com.cn.key myrepo https://harbor.codemiracle.com.cn/chartrepo/myrepo
# 更新仓库
helm repo update
# 推送应用,同理也需要加上自签名证书,还需要加上用户名和密码
# 错误用法1:没有加自签名证书
helm push --username=admin --password=Harbor12345 app myrepo
Pushing app-0.1.0.tgz to myrepo...
Error: Post https://harbor.codemiracle.com.cn/api/chartrepo/myrepo/charts: x509: certificate signed by unknown authority
Error: plugin "push" exited with error
# 错误用法2:没有加上用户名和密码
helm push --ca-file /usr/local/harbor/cert/ca.crt --cert-file /usr/local/harbor/cert/harbor.codemiracle.com.cn.cert --key-file /usr/local/harbor/cert/harbor.codemiracle.com.cn.key app myrepo
Pushing app-0.1.0.tgz to myrepo...
Error: 401: could not properly parse response JSON: {"code":401,"message":"UnAuthorized"}
Error: plugin "push" exited with error
# 正确用法1,推送chart目录,app是chart应用目录
helm push --ca-file /usr/local/harbor/cert/ca.crt --cert-file /usr/local/harbor/cert/harbor.codemiracle.com.cn.cert --key-file /usr/local/harbor/cert/harbor.codemiracle.com.cn.key --username=admin --password=Harbor12345 app myrepo
# 正确用法2,推送tgz文件,redis.tgz是chart应用文件
helm push --ca-file /usr/local/harbor/cert/ca.crt --cert-file /usr/local/harbor/cert/harbor.codemiracle.com.cn.cert --key-file /usr/local/harbor/cert/harbor.codemiracle.com.cn.key --username=admin --password=Harbor12345 redis.tgz myrepo
#帮助手册
helm push --help
Helm plugin to push chart package to ChartMuseum
Examples:
$ helm push mychart-0.1.0.tgz chartmuseum # push .tgz from "helm package"
$ helm push . chartmuseum # package and push chart directory
$ helm push . --version="7c4d121" chartmuseum # override version in Chart.yaml
$ helm push . https://my.chart.repo.com # push directly to chart repo URL
Usage:
helm push [flags]
Flags:
--access-token string Send token in Authorization header [$HELM_REPO_ACCESS_TOKEN]
--auth-header string Alternative header to use for token auth [$HELM_REPO_AUTH_HEADER]
--ca-file string Verify certificates of HTTPS-enabled servers using this CA bundle [$HELM_REPO_CA_FILE]
--cert-file string Identify HTTPS client using this SSL certificate file [$HELM_REPO_CERT_FILE]
--context-path string ChartMuseum context path [$HELM_REPO_CONTEXT_PATH]
-f, --force Force upload even if chart version exists
-h, --help help for helm
--insecure Connect to server with an insecure way by skipping certificate verification [$HELM_REPO_INSECURE]
--key-file string Identify HTTPS client using this SSL key file [$HELM_REPO_KEY_FILE]
-p, --password string Override HTTP basic auth password [$HELM_REPO_PASSWORD]
-u, --username string Override HTTP basic auth username [$HELM_REPO_USERNAME]
-v, --version string Override chart version pre-push