【Harbor】harbor仓库证书过期处理步骤

1、上传新的证书
2、修改harbor.yml配置文件,证书名修改为新的证书名字
3、更新容器

#查看当前的容器情况
[root@harbor01 harbor]# docker ps
#停止容器
[root@harbor01 harbor]# docker-compose down
Stopping harbor-jobservice ... done
Stopping nginx             ... done
Stopping harbor-core       ... done
Stopping registryctl       ... done
Stopping redis             ... done
Stopping harbor-portal     ... done
Stopping registry          ... done
Stopping harbor-db         ... done
Stopping harbor-log        ... done
Removing harbor-jobservice ... done
Removing nginx             ... done
Removing harbor-core       ... done
Removing registryctl       ... done
Removing redis             ... done
Removing harbor-portal     ... done
Removing registry          ... done
Removing harbor-db         ... done
Removing harbor-log        ... done
Removing network harbor_harbor
[root@harbor01 harbor]# docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
#更新配置信息,替换证书要重新执行prepare 否则只重启替换证书不生效
[root@harbor01 harbor]# ./prepare
prepare base dir is set to /opt/harbor
Clearing the configuration file: /config/log/logrotate.conf
Clearing the configuration file: /config/log/rsyslog_docker.conf
Clearing the configuration file: /config/nginx/nginx.conf
Clearing the configuration file: /config/core/env
Clearing the configuration file: /config/core/app.conf
Clearing the configuration file: /config/registry/config.yml
Clearing the configuration file: /config/registry/root.crt
Clearing the configuration file: /config/registryctl/env
Clearing the configuration file: /config/registryctl/config.yml
Clearing the configuration file: /config/db/env
Clearing the configuration file: /config/jobservice/env
Clearing the configuration file: /config/jobservice/config.yml
Generated configuration file: /config/log/logrotate.conf
Generated configuration file: /config/log/rsyslog_docker.conf
Generated configuration file: /config/nginx/nginx.conf
Generated configuration file: /config/core/env
Generated configuration file: /config/core/app.conf
Generated configuration file: /config/registry/config.yml
Generated configuration file: /config/registryctl/env
Generated configuration file: /config/db/env
Generated configuration file: /config/jobservice/env
Generated configuration file: /config/jobservice/config.yml
loaded secret from file: /secret/keys/secretkey
Generated configuration file: /compose_location/docker-compose.yml
Clean up the input dir
#重新启动docker-compose
[root@harbor01 harbor]# docker-compose up -d
Creating network "harbor_harbor" with the default driver
Creating harbor-log ... done
Creating harbor-portal ... done
Creating registry      ... done
Creating redis         ... done
Creating harbor-db     ... done
Creating registryctl   ... done
Creating harbor-core   ... done
Creating harbor-jobservice ... done
Creating nginx             ... done
#检查当前容器情况
[root@harbor01 harbor]# docker ps
[root@harbor01 harbor]#
docker-comepose命令
$ docker-compose stop # 停止
$ docker-compose start # 启动(第一次需要使用 up -d)
$ docker-compose down # 停止并删除容器
$ docker-compose up -d # 创建并启动
$ docker-compose restart proxy 重启nginx
  • 0
    点赞
  • 1
    收藏
    觉得还不错? 一键收藏
  • 2
    评论
为了更新Harbor证书,需要执行以下步骤: 1. 生成新的证书和私钥文件。可以使用OpenSSL工具生成自签名证书,也可以使用证书颁发机构(CA)颁发的证书。 ```bash openssl req -newkey rsa:4096 -nodes -sha256 -keyout harbor.example.com.key -x509 -days 365 -out harbor.example.com.crt ``` 这将生成一个有效期为365天的自签名证书和私钥文件。 2. 将新证书和私钥文件存储在Kubernetes集群中的Secret对象中。 ```bash kubectl create secret tls harbor-tls --cert=harbor.example.com.crt --key=harbor.example.com.key -n <namespace> ``` 这将创建一个名为“harbor-tls”的Secret对象,并将新证书和私钥文件存储在其中。 3. 更新Harbor的ingress资源以使用新证书。 ```yaml apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: name: harbor-ingress annotations: nginx.ingress.kubernetes.io/ssl-redirect: "true" nginx.ingress.kubernetes.io/ssl-ciphers: "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256" nginx.ingress.kubernetes.io/ssl-protocols: "TLSv1.2, TLSv1.3" spec: tls: - hosts: - harbor.example.com secretName: harbor-tls rules: - host: harbor.example.com http: paths: - path: / backend: serviceName: harbor servicePort: 80 ``` 在上面的示例中,我们将新证书和私钥文件存储在名为“harbor-tls”的Secret对象中,并将其用于Harbor的ingress资源。请确保将“harbor.example.com”替换为您的Harbor域名。 4. 重新部署Harbor以使用新证书。 ```bash helm upgrade harbor harbor/harbor -f harbor.values.yaml -n <namespace> ``` 这将使用新证书重新部署Harbor

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 2
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值