环境准备:安装docker-ce,docker-compose。
参考文档:https://blog.csdn.net/qq_39626154/article/details/82753412
下载harbor离线包:https://github.com/vmware/harbor/releases
解压:
[root@harbor opt]# tar xf harbor-offline-installer-v1.8.1.tgz
修改配置文件:
[root@harbor harbor]# vim harbor.yml
版本不同配置文件略有不同,注意区分
生成证书文件:
参考官方文档:https://github.com/goharbor/harbor/blob/master/docs/1.10/install-config/configure-https.md
mkdir ssl
cd sslopenssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -sha512 -days 3650 \
-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=192.168.10.9" \
-key ca.key \
-out ca.crtopenssl genrsa -out 192.168.10.9.key 4096
openssl req -sha512 -new \
-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=192.168.10.9" \
-key 192.168.10.9.key \
-out 192.168.10.9.csrcat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = IP:192.168.10.9
EOFopenssl x509 -req -sha512 -days 3650 \
-extfile v3.ext \
-CA ca.crt -CAkey ca.key -CAcreateserial \
-in 192.168.10.9.csr \
-out 192.168.10.9.crtmkdir -p /data/cert/
cp 192.168.10.9.crt /data/cert/
cp 192.168.10.9.key /data/cert/openssl x509 -inform PEM -in 192.168.10.9.crt -out 192.168.10.9.cert
mkdir /etc/docker/certs.d/192.168.10.9/
cp 192.168.10.9.cert /etc/docker/certs.d/192.168.10.9/
cp 192.168.10.9.key /etc/docker/certs.d/192.168.10.9/
cp ca.crt /etc/docker/certs.d/192.168.10.9/systemctl restart docker
./prepare
./install.sh
Harbor依赖的镜像及启动服务如下:
重启命令:
docker-compose stop
docker-compose down -v
docker-compose up -d
在另一台Linux实现docker login登录
拷贝ca.crt到另一台运行docker容器的主机下/etc/pki/ca-trust/source/anchors/路径:
更新证书,并登录:
update-ca-trust extract
systemctl restart docker
docker login 192.168.10.9