本文主要介绍了Harbor的两种方式搭建。后期会整理主从复制,现高可用教程。
Http方式部署
第一步:下载docker-compose,授权放到/usr/bin下面
[root@liusongjie ~]# curl -L https://get.daocloud.io/docker/compose/releases/download/1.25.1/docker-compose-`uname -s`-`uname -m` -o /usr/bin/docker-compose && chmod +x /usr/bin/docker-compose
第二步:下载harbor
如果不知道harbor应该下载哪个版本,在官方网选择最新或者可以在网上寻找下载资源。以下提供一种方式可以选择不同的版本https://github.com/goharbor/harbor/tags
[root@liusongjie ~]# wget https://github.com/goharbor/harbor/releases/download/v2.0.0/harbor-offline-installer-v2.0.0.tgz
第三步:解压下载好的安装包,并且配置harbor.yaml文件
[root@liusongjie ~]# mkdir harbor
[root@liusongjie ~]# cp ./harbor-offline-installer-v2.0.0.tgz ./harbor
[root@liusongjie ~]# cd harbor
[root@liusongjie ~]# tar xf harbor-offline-installer-v2.0.0.tgz
[root@liusongjie harbor]# ls
common common.sh docker-compose.yml harbor.v2.0.0.tar.gz harbor.yml harbor.yml.tmpl install.sh LICENSE prepare
[root@liusongjie harbor]# mv harbor.yml.tmpl harbor.yml
第四步:编辑 harbor.yml 配置文件,修改 hostname 并注释
[root@liusongjie harbor]# vim harbor.yml
---------------------------------------------------------------------
hostname: reg.xxx.com
http related config
http:
# port for http, default is 80. If https enabled, this port will redirect to https port
port: 80
# https related config
# https:
# https port for harbor, default is 443
# port: 443
# The path of cert and key files for nginx
# certificate: /your/certificate/path
# private_key: /your/private/key/path
第五步:安装harbor
# 安装 harbor
[root@liusongjie harbor]# ./prepare
[root@liusongjie harbor]# ./install.sh
第六步:在 docker-compose.yml 文件存在的目录下,执行 docker-compose ps
[root@liusongjie harbor]# docker-compose ps
Name Command State Ports
-----------------------------------------------------------------------------------
harbor-core /harbor/entrypoint.sh Up (healthy)
harbor-db /docker-entrypoint.sh Up (healthy) 5432/tcp
harbor-jobservice /harbor/entrypoint.sh Up (healthy)
harbor-log /bin/sh -c /usr/local/bin/ ... Up (healthy) 127.0.0.1:1514->10514/tcp
harbor-portal nginx -g daemon off; Up (healthy) 8080/tcp
nginx nginx -g daemon off; Up (healthy) 0.0.0.0:80->8080/tcp,:::80->8080/tcp
redis redis-server /etc/redis.conf Up (healthy) 6379/tcp
registry /home/harbor/entrypoint.sh Up (healthy) 5000/tcp
registryctl /home/harbor/start.sh Up (healthy)
注意:如果docker服务被重启了,Harbor服务不一定能全部起来并且保持healthy。可以从以下方法解决该问题。
# 这种情况下可以进入该 docker-compose.yml 所在目录执行下述命令,重启
[root@liusongjie harbor]# docker-compose down
[root@liusongjie harbor]# docker-compose up -d
如果以上操作发现无法解决该问题,大概率是harbor.yml配置被修改,因此需要重新执行prepare文件,然后再重启一次。
[root@liusongjie harbor]# ./prepare
[root@liusongjie harbor]# docker-compose down
[root@liusongjie harbor]# docker-compose up -d
第七步:以http方式配置好之后,需要配置daemon.json才能登录。
[root@liusongjie harbor]# vi /etc/docker/daemon.json
{
"registry-mirrors": ["https://xxxxxxx.mirror.aliyuncs.com"],
"insecure-registries": ["172.1.1.1"] # 这里需要修改成你的域名或者IP
}
注意这里如果使用的域名(如果有dns则不需要配置),则需要做好域名映射。具体方法如下
[root@liusongjie harbor]# vi /etc/hosts
172.1.1.1 reg.XXX.com # 这里是要新增的内容,后面是域名,前面是对应的IP
第八步:重启docker服务
[root@liusongjie harbor]# systemctl restart docker
以上操作都已经成功了之后,可以登录成功
[root@liusongjie harbor]# docker login 172.1.1.1
Username: admin
Password: # 密码在配置文件里面,自行百度
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
第九步:测试下拉和上传镜像
[root@liusongjie harbor]# docker tag mysql:latest 172.1.1.1/library/mysql:latest
[root@liusongjie harbor]# docker push 172.1.1.1/library/mysql:latest
Https方式部署
准备数字证书,可以自行百度怎么生成。
(我使用的是cfssl工具)
第一步:生成ca.pem和ca-key.pem
# 根据 ca-csr.json 文件初始化生成 CA 机构,生成 ca.pem 和 ca-key.pem
[root@liusongjie ~] cd ssl
[root@liusongjie ssl]# ll
total 8
-rwxr-xr-x 1 root root 994 Jul 22 09:22 certs.sh
-rwxr-xr-x 1 root root 313 Jul 22 09:22 cfssl.sh
[root@liusongjie ssl]cfssl gencert -initca ca-csr.json | cfssljson -bare ca -
第二步:生成指定域名的证书
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes reg.ctnrs.com-csr.json | cfssljson -bare reg.ctnrs.com
这里需要替换一下我们自己的域名
[root@liusongjie ssl]# sed -i "s#reg.ctnrs.com#reg.xxx.com#g" certs.sh
第三步:生成新的文件
# 执行脚本
[root@liusongjie ssl]# ./cfssl.sh
[root@liusongjie ssl]# ./certs.sh
# 检查文件是否生成
[root@liusongjie ssl]# ll
total 44
-rw-r--r-- 1 root root 294 Jul 14 11:56 ca-config.json
-rw-r--r-- 1 root root 960 Jul 14 11:56 ca.csr
-rw-r--r-- 1 root root 212 Jul 14 11:56 ca-csr.json
-rw------- 1 root root 1675 Jul 14 11:56 ca-key.pem
-rw-r--r-- 1 root root 1273 Jul 14 11:56 ca.pem
-rwxr-xr-x 1 root root 998 Jul 14 11:31 certs.sh
-rwxr-xr-x 1 root root 313 Jul 14 11:28 cfssl.sh
-rw-r--r-- 1 root root 964 Jul 14 11:56 reg.xxx.com.csr
-rw-r--r-- 1 root root 187 Jul 14 11:56 reg.xxx.com-csr.json
-rw------- 1 root root 1679 Jul 14 11:56 reg.xxx.com-key.pem
-rw-r--r-- 1 root root 1314 Jul 14 11:56 reg.xxx.com.pem
最后两个文件,是我们需要的文件。
第四步:配置harbor文件,写入以上的文件路径。
[root@liusongjie ssl]# cat /root/harbor/harbor.yml | head -20
...
# https related config
https:
# https port for harbor, default is 443
port: 443
# The path of cert and key files for nginx
certificate: /root/ssl/reg.xxx.com.pem
private_key: /root/ssl/reg.xxx.com.pem
...
第五步:重新生成配置文件
[root@liusongjie harbor]# cd /root/harbor/ && ./prepare
prepare base dir is set to /root/harbor
Clearing the configuration file: /config/nginx/nginx.conf
Clearing the configuration file: /config/jobservice/env
第六步:重启harbor有关的容器
[root@liusongjie harbor]# docker-compose down
[root@liusongjie harbor]# docker-compose up -d
第七步:检查daemon.json中是否配置了insecure registries,如果配置需要删除后重启docker服务
[root@liusongjie harbor]# vi /etc/docker/daemon.json
{
"registry-mirrors": ["https://xxxxxxx.mirror.aliyuncs.com"],
# "insecure-registries": ["172.1.1.1"] # 这里需要修改成你的域名或者IP
}
[root@liusongjie harbor]# systemctl restart docker
第八步:登录配置好的镜像仓库
[root@liusongjie harbor]# docker login reg.xxx.com
Authenticating with existing credentials...
Login did not succeed, error: Error response from daemon: Get https://reg.xxx.com/v2/: x509: certificate signed by unknown authority
这一步原因是我们服务器上没有配置这个ca证书导致的,解决方法如下:
# 需要将数字证书复制到服务器上,并重命名以 crt 为后缀
[root@liusongjie harbor]# mkdir /etc/docker/certs.d/reg.xxx.com -p
[root@liusongjie harbor]# cp /root/ssl/reg.xxx.com.pem /etc/docker/certs.d/reg.xxx.com/reg.xxx.com.crt
重新登录;
# 如果报错重启一下harbor
[root@liusongjie harbor]# docker login reg.xxx.com
Username: admin
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
第九步:如果搭建的是集群,需要用到,每台机子都需要在host文件里面添加域名映射
[root@linux ~]# vim /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
172.1.1.1 reg.xxx.com
第十步:测试从镜像仓库拉取镜像