Harbor镜像仓库使用SSL双向认证设置

Harbor镜像仓库使用SSL双向认证设置

环境信息

名称	版本信息
操作系统	Kylin V10
Harbor	2.7.0
Nginx	1.21.5
Docker	20.10.8
Continerd	1.6.14

备注：文档中 reg.mydomain.com 替换为实际使用的域名或IP

1. 证书

1.1 证书生成

（1）使用 https://github.com/hurricane1988/cert-generator.git 进行证书生成

（2）或使用 openssl 命令生成

# 1 生成CA证书

# 生成CA私钥
openssl genrsa -out ca.key 2048
# 生成CA证书
openssl req -new -x509 -days 365 -key ca.key -out ca.crt -subj "/C=CN/ST=Beijing/L=Beijing/O=Personal/OU=Personal/CN=Registry CA"



# 2 创建v3.ext文件

cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=reg.mydomain.com
EOF



# 3 生成服务端证书

# 生成服务端私钥
openssl genrsa -out server.key 2048
# 生成服务端CSR（证书签名请求）
openssl req -new -key server.key -out server.csr -subj "/C=CN/ST=Beijing/L=Beijing/O=Personal/OU=Personal/CN=reg.mydomain.com"
# 使用CA证书签名生成服务端证书
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 365 -extfile v3.ext




# 4 生成客户端证书

# 生成客户端私钥
openssl genrsa -out client.key 2048
# 生成客户端CSR
openssl req -new -key client.key -out client.csr -subj "/C=CN/ST=Beijing/L=Beijing/O=Personal/OU=Personal/CN=Registry client"
# 使用CA证书签名生成客户端证书
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 365
# 生成cert格式客户端证书
openssl x509 -inform PEM -in client.crt -out client.cert

1.2 证书上传

根证书（ca.crt）和服务端证书（server.cert、server.key）上传至Nginx服务器和Harbor服务器使用

根证书（ca.crt）和客户端证书（client.cert、client.key）上传至容器环境服务器使用

2. Harbor镜像仓库设置

双向认证方案：使用 Nginx 代理 Harbor镜像仓库，Nginx开启双向认证

2.1 Nginx配置

2.1.1 安装Nginx

参照官网：https://nginx.org/

2.1.2 Nginx配置

增加代理Harbor配置，Harbor地址为 127.0.0.1:8443 （Nginx和Harbor部署在一台服务器）

vim /etc/nginx/conf.d/harbor.conf

  upstream harbor {
    server 127.0.0.1:8443;
  }

  server {
    listen 443 ssl;
    server_name reg.mydomain.com;
    server_tokens off;
    # SSL
    ssl_certificate /data/ca/server.crt;
    ssl_certificate_key /data/ca/server.key;

    ssl_client_certificate /data/ca/ca.crt;
    ssl_verify_client on;

    # Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
    ssl_protocols TLSv1.2;
    ssl_ciphers '!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES:';
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;

    # disable any limits to avoid HTTP 413 for large image uploads
    client_max_body_size 0;

    # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
    chunked_transfer_encoding on;

    # Add extra headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
    add_header X-Frame-Options DENY;
    add_header Content-Security-Policy "frame-ancestors 'none'";

    location / {
      proxy_pass https://harbor/;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      #proxy_set_header X-Forwarded-Proto $x_forwarded_proto;

      proxy_cookie_path / "/; HttpOnly; Secure";

      proxy_buffering off;
      proxy_request_buffering off;
    }
  }

Nginx配置生效

nginx -t
nginx -s reload

2.2 Harbor配置

2.2.1 安装Harbor

参照官网 https://goharbor.io

2.2.2 Harbor配置

编辑 Harbor 配置文件 vim harbor/harbor.yml，关闭http连接，配置https连接中证书信息，修改https端口号为8443，和nginx代理地址端口保持一致，使Harbor配置生效重启服务

3. 容器环境拉取和推送镜像证书认证设置

3.1 Docker配置

存放证书

/etc/docker/certs.d/reg.mydomain.com/ca.crt
/etc/docker/certs.d/reg.mydomain.com/client.cert
/etc/docker/certs.d/reg.mydomain.com/client.key

重启Doceker服务

systemctl restart docker

3.2 Containerd配置

ctr存放证书（Kubernetes默认使用）

vim /etc/containerd/config.toml

      [plugins."io.containerd.grpc.v1.cri".registry.configs]
        [plugins."io.containerd.grpc.v1.cri".registry.configs."reg.mydomain.com".tls]
          ca_file = "/etc/containerd/certs.d/reg.mydomain.com/ca.crt"
          cert_file = "/etc/containerd/certs.d/reg.mydomain.com/client.cert"
          key_file = "/etc/containerd/certs.d/reg.mydomain.com/client.key"

crictl和nerdctl存放证书

/etc/containerd/certs.d/reg.mydomain.com/ca.crt
/etc/containerd/certs.d/reg.mydomain.com/client.cert
/etc/containerd/certs.d/reg.mydomain.com/client.key

重启Containerd服务

systemctl restart containerd