一、下载helm
## 添加仓库源
# helm repo add harbor https://helm.goharbor.io
## 查找
# helm search repo harbor
## 下载
# helm pull harbor/harbor
![](https://i-blog.csdnimg.cn/direct/58805fd9ce04410ca2c5463b1689c835.png)
![](https://i-blog.csdnimg.cn/direct/e2bf48990bc742199c9ac9a33338a95a.png)
![](https://i-blog.csdnimg.cn/direct/edcf3e4283b14fa2a677e17070cab3f7.png)
二、修改vules.yaml
# egrep -v "^#|^$|^ *#" values.yaml
expose:
type: ingress
tls:
enabled: true
certSource: auto
auto:
commonName: ""
secret:
secretName: ""
ingress:
hosts:
core: harbor.test.com
notary: notary.test.com
controller: default
kubeVersionOverride: ""
className: "nginx"
annotations:
cert-manager.io/cluster-issuer: letsencrypt-dns01
ingress.kubernetes.io/ssl-redirect: "true"
ingress.kubernetes.io/proxy-body-size: "0"
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/proxy-body-size: "0"
labels: {}
clusterIP:
name: harbor
staticClusterIP: ""
ports:
httpPort: 80
httpsPort: 443
annotations: {}
labels: {}
nodePort:
name: harbor
ports:
http:
port: 80
nodePort: 30002
https:
port: 443
nodePort: 31234
annotations: {}
labels: {}
loadBalancer:
name: harbor
IP: ""
ports:
httpPort: 80
httpsPort: 443
annotations: {}
labels: {}
sourceRanges: []
externalURL: https://harbor.test.com
persistence:
enabled: true
resourcePolicy: "keep"
persistentVolumeClaim:
registry:
existingClaim: ""
storageClass: "nfs-li"
subPath: ""
accessMode: ReadWriteOnce
size: 150Gi
annotations: {}
jobservice:
jobLog:
existingClaim: ""
storageClass: "nfs-li"
subPath: ""
accessMode: ReadWriteOnce
size: 50Gi
annotations: {}
database:
existingClaim: ""
storageClass: "nfs-li"
subPath: ""
accessMode: ReadWriteOnce
size: 100Gi
annotations: {}
redis:
existingClaim: ""
storageClass: "nfs-li"
subPath: ""
accessMode: ReadWriteOnce
size: 50Gi
annotations: {}
trivy:
existingClaim: ""
storageClass: "nfs-li"
subPath: ""
accessMode: ReadWriteOnce
size: 50Gi
annotations: {}
imageChartStorage:
disableredirect: false
type: filesystem
filesystem:
rootdirectory: /storage
azure:
accountname: accountname
accountkey: base64encodedaccountkey
container: containername
existingSecret: ""
gcs:
bucket: bucketname
encodedkey: base64-encoded-json-key-file
existingSecret: ""
useWorkloadIdentity: false
s3:
region: us-west-1
bucket: bucketname
swift:
authurl: https://storage.myprovider.com/v3/auth
username: username
password: password
container: containername
existingSecret: ""
oss:
accesskeyid: accesskeyid
accesskeysecret: accesskeysecret
region: regionname
bucket: bucketname
existingSecret: ""
existingSecretAdminPasswordKey: HARBOR_ADMIN_PASSWORD
harborAdminPassword: "Harbor12345"
internalTLS:
enabled: false
strong_ssl_ciphers: false
certSource: "auto"
trustCa: ""
core:
secretName: ""
crt: ""
key: ""
jobservice:
secretName: ""
crt: ""
key: ""
registry:
secretName: ""
crt: ""
key: ""
portal:
secretName: ""
crt: ""
key: ""
trivy:
secretName: ""
crt: ""
key: ""
ipFamily:
ipv6:
enabled: true
ipv4:
enabled: true
imagePullPolicy: IfNotPresent
imagePullSecrets:
updateStrategy:
type: RollingUpdate
logLevel: info
caSecretName: ""
secretKey: "not-a-secure-key"
existingSecretSecretKey: ""
proxy:
httpProxy:
httpsProxy:
noProxy: 127.0.0.1,localhost,.local,.internal
components:
- core
- jobservice
- trivy
enableMigrateHelmHook: false
metrics:
enabled: false
core:
path: /metrics
port: 8001
registry:
path: /metrics
port: 8001
jobservice:
path: /metrics
port: 8001
exporter:
path: /metrics
port: 8001
serviceMonitor:
enabled: false
additionalLabels: {}
interval: ""
metricRelabelings:
[]
relabelings:
[]
trace:
enabled: false
provider: jaeger
sample_rate: 1
jaeger:
endpoint: http://hostname:14268/api/traces
otel:
endpoint: hostname:4318
url_path: /v1/traces
compression: false
insecure: true
timeout: 10
cache:
enabled: false
expireHours: 24
containerSecurityContext:
privileged: false
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
capabilities:
drop:
- ALL
nginx:
image:
repository: goharbor/nginx-photon
tag: v2.11.0
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
extraEnvVars: []
nodeSelector: {}
tolerations: []
affinity: {}
topologySpreadConstraints: []
podAnnotations: {}
podLabels: {}
priorityClassName:
portal:
image:
repository: goharbor/harbor-portal
tag: v2.11.0
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
extraEnvVars: []
nodeSelector: {}
tolerations: []
affinity: {}
topologySpreadConstraints: []
podAnnotations: {}
podLabels: {}
serviceAnnotations: {}
priorityClassName:
initContainers: []
core:
image:
repository: goharbor/harbor-core
tag: v2.11.0
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
startupProbe:
enabled: true
initialDelaySeconds: 10
extraEnvVars: []
nodeSelector: {}
tolerations: []
affinity: {}
topologySpreadConstraints: []
podAnnotations: {}
podLabels: {}
serviceAnnotations: {}
priorityClassName:
initContainers: []
configureUserSettings:
quotaUpdateProvider: db # Or redis
secret: ""
existingSecret: ""
secretName: ""
tokenKey: |
tokenCert: |
xsrfKey: ""
existingXsrfSecret: ""
existingXsrfSecretKey: CSRF_KEY
artifactPullAsyncFlushDuration:
gdpr:
deleteUser: false
auditLogsCompliant: false
jobservice:
image:
repository: goharbor/harbor-jobservice
tag: v2.11.0
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
extraEnvVars: []
nodeSelector: {}
tolerations: []
affinity: {}
topologySpreadConstraints:
podAnnotations: {}
podLabels: {}
priorityClassName:
initContainers: []
maxJobWorkers: 10
jobLoggers:
- file
loggerSweeperDuration: 14 #days
notification:
webhook_job_max_retry: 3
webhook_job_http_client_timeout: 3 # in seconds
reaper:
max_update_hours: 24
max_dangling_hours: 168
secret: ""
existingSecret: ""
existingSecretKey: JOBSERVICE_SECRET
registry:
registry:
image:
repository: goharbor/registry-photon
tag: v2.11.0
extraEnvVars: []
controller:
image:
repository: goharbor/harbor-registryctl
tag: v2.11.0
extraEnvVars: []
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
nodeSelector: {}
tolerations: []
affinity: {}
topologySpreadConstraints: []
podAnnotations: {}
podLabels: {}
priorityClassName:
initContainers: []
secret: ""
existingSecret: ""
existingSecretKey: REGISTRY_HTTP_SECRET
relativeurls: false
credentials:
username: "harbor_registry_user"
password: "harbor_registry_password"
existingSecret: ""
htpasswdString: ""
middleware:
enabled: false
type: cloudFront
cloudFront:
baseurl: example.cloudfront.net
keypairid: KEYPAIRID
duration: 3000s
ipfilteredby: none
privateKeySecret: "my-secret"
upload_purging:
enabled: true
age: 168h
interval: 24h
dryrun: false
trivy:
enabled: true
image:
repository: goharbor/trivy-adapter-photon
tag: v2.11.0
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
resources:
requests:
cpu: 200m
memory: 512Mi
limits:
cpu: 1
memory: 1Gi
extraEnvVars: []
nodeSelector: {}
tolerations: []
affinity: {}
topologySpreadConstraints: []
podAnnotations: {}
podLabels: {}
priorityClassName:
initContainers: []
debugMode: false
vulnType: "os,library"
severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
ignoreUnfixed: false
insecure: false
gitHubToken: ""
skipUpdate: false
skipJavaDBUpdate: false
offlineScan: false
securityCheck: "vuln"
timeout: 5m0s
database:
type: internal
internal:
image:
repository: goharbor/harbor-db
tag: v2.11.0
serviceAccountName: ""
automountServiceAccountToken: false
livenessProbe:
timeoutSeconds: 1
readinessProbe:
timeoutSeconds: 1
extraEnvVars: []
nodeSelector: {}
tolerations: []
affinity: {}
priorityClassName:
extrInitContainers: []
password: "changeit"
shmSizeLimit: 512Mi
initContainer:
migrator: {}
permissions: {}
external:
host: "192.168.0.1"
port: "5432"
username: "user"
password: "password"
coreDatabase: "registry"
existingSecret: ""
sslmode: "disable"
maxIdleConns: 100
maxOpenConns: 900
podAnnotations: {}
podLabels: {}
redis:
type: internal
internal:
image:
repository: goharbor/redis-photon
tag: v2.11.0
serviceAccountName: ""
automountServiceAccountToken: false
extraEnvVars: []
nodeSelector: {}
tolerations: []
affinity: {}
priorityClassName:
initContainers: []
jobserviceDatabaseIndex: "1"
registryDatabaseIndex: "2"
trivyAdapterIndex: "5"
external:
addr: "192.168.0.2:6379"
sentinelMasterSet: ""
coreDatabaseIndex: "0"
jobserviceDatabaseIndex: "1"
registryDatabaseIndex: "2"
trivyAdapterIndex: "5"
username: ""
password: ""
existingSecret: ""
podAnnotations: {}
podLabels: {}
exporter:
image:
repository: goharbor/harbor-exporter
tag: v2.11.0
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
extraEnvVars: []
podAnnotations: {}
podLabels: {}
nodeSelector: {}
tolerations: []
affinity: {}
topologySpreadConstraints: []
priorityClassName:
cacheDuration: 23
cacheCleanInterval: 14400
![](https://i-blog.csdnimg.cn/direct/046f08e823c840999aac291183eb5567.png)
三、檢驗
## 運行
# kubectl create ns harbor2
# helm upgrade --install harbor -n harbor2 . -f values.yaml
![](https://i-blog.csdnimg.cn/direct/50d2d8121f654a06b2a27d7074ba69e3.png)
![](https://i-blog.csdnimg.cn/direct/bd56ee76e01843aea019a37a47741724.png)
四、客户端证书配置
## master导出证书
# kubectl -n harbor2 get secrets harbor-ingress -o jsonpath="{.data.ca\.crt}" | base64 -d >ca.crt
## 在node端配置证书
# mkdir -p /etc/docker/certs.d/harbor.test.com/
# # ls /etc/docker/certs.d/harbor.test.com/ -lh
total 4.0K
-rw-r--r-- 1 root root 1.2K Aug 17 13:30 ca.crt
## 从master上拷贝证书到node节点
# scp ca.crt root@node_ip:/etc/docker/certs.d/harbor.test.com/
注:无需重启docker
## containerd配置
root@ubuntu:~# mkdir -p /etc/containerd/certs.d/harbor.test.com/
root@ubuntu:~# ls /etc/containerd/certs.d/harbor.test.com/
ca.crt
五、参考
https://blog.csdn.net/codelearning/article/details/140552556