私有镜像仓库Nexus3 搭建及使用

私有镜像仓库Nexus3

安装环境

cat /etc/lsb -release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE =22.04
DISTRIB_CODENAME=jammy
DISTRIB_DESCRIPTION="Ubuntu 22.04.1 LTS"

前提：先安装Java8
下载地址为：
https://www.oracle.com/java/technologies/downloads/#java8

sudo su
tar -zxf jdk -8u371 -linux -x64.tar.gz -C /usr/local/
cat >> /etc/profile << "EOF"
export JAVA_HOME=/usr/local/jdk1.8.0_371
export PATH=$PATH:$JAVA_HOME/bin
EOF
tail -n 2 /etc/profile
source /etc/profile
java -version

Ubuntu 下运行java8 需要安装如下依赖包
apt install libxrender1 libxtst6 libxi6

部署Nexus3

方式一：下载Nexus3 源码并build&run

git clone https://github.com/sonatype/nexus-public.git
cd nexus -public/
git fetch --tags
git checkout -b release -3.56.0 -01 origin/release -3.56.0 -01 --
./mvnw clean install
unzip -d target assemblies/nexus -base -template/target/nexus -base -template -*.zip
./target/nexus -base -template -*/bin/nexus console

方式二：官网下载nexus 二进制包安装

下载地址为：
https://help.sonatype.com/repomanager3/download/download-archives—repository-manager-3

1. 解压
   解压出来有两个目录，所以我先在/usr/local/中先创建一个叫做nexus3 的目录，然后再进行解压。

[root@localhost src]# mkdir -p /usr/local/nexus3
[root@localhost src]# tar -zxf nexus -3.19.0-01-unix.tar.gz -C /usr/local/nexus3/
[root@localhost src]# cd /usr/local/nexus3/
[root@localhost nexus3]# ls
nexus -3.19.0 -01 sonatype -work

2. 创建nexus 用户

我们要用非root 用户来启动nexus，这也是官网给出的建议。

[root@localhost ~]# useradd nexus
[root@localhost ~]# chown -R nexus:nexus /usr/local/nexus3

3. 把nexus 加入到系统服务中
   当然，nexus 不加入到系统服务也是完全可以运行的，运行方式如下：

[root@localhost ~]# su nexus
[nexus@localhost ~]$ /usr/local/nexus3/nexus -3.19.0 -01/bin/nexus start|stop|run|run -
redirect|status|restart|force -reload

但是加入到系统服务中显然是更为方便管理的。加入系统服务也是很简单，
到/etc/systemd/system/目录下创建一个nexus.service 文件即可。

[root@localhost ~]# cd /etc/systemd/system
[root@localhost system]# cat > nexus.service << EOF
[Unit]
Description=nexus service
After=network.target
[Service]
Type=forking
LimitNOFILE =65536
ExecStart=/usr/local/nexus3/nexus -3.31.1 -01/bin/nexus start
ExecStop=/usr/local/nexus3/nexus -3.31.1 -01/bin/nexus stop
User=nexus
Restart=on-abort
[Install]
WantedBy=multi -user.target
EOF
[root@localhost ~]# systemctl daemon -reload
[root@localhost ~]# systemctl enable nexus.service
[root@localhost ~]# systemctl start nexus.service
[root@localhost ~]# systemctl status nexus.service

创建Repository

使用浏览器打开：http://ip:8081
Nexus 默认的用户名是admin
密码保存在如下文件中，首次登陆后修改
/usr/local/nexus3/sonatype-work/nexus3/admin.password
创建docker-hosted、docker-proxy、docker-group 3 个repository 并配置对应的端口号

配置HTTPS 对Nexus 的访问

Generate public private key pair using keytool:

keytool -genkeypair -keystore keystore.jks -storepass password -alias example.com
-keyalg RSA -keysize 2048 -validity 5000 -keypass password
-dname ‘CN=*.example.com, OU=Sonatype, O=Sonatype, L=Unspecified, ST=Unspecified, C=US’
-ext ‘SAN=DNS:nexus.example.com,DNS:clm.example.com,DNS:repo.example.com,DNS:www.example.com’
Output: keystore.jks

Generate PEM encoded public certificate file using keytool:

keytool -exportcert -keystore keystore.jks -alias example.com -rfc > example.cert
Output: example.cert

Convert our Java specific keystore binary".jks" file to a widely compatible PKCS12 keystore “.p12” file:

keytool -importkeystore -srckeystore keystore.jks -destkeystore example.p12 -deststoretype PKCS12
Output: example.p12

(Optional) List and verify new keystore file contents:

keytool -list -keystore example.p12 -storetype PKCS12
(Optional) Extract pem (certificate) from “.p12” keystore file ( this is same as step 2, but openssl spits out more verbose contents ):

openssl pkcs12 -nokeys -in example.p12 -out example.pem
Output: example.pem

Extract unencrypted private key file from “.p12” keystore file:

openssl pkcs12 -nocerts -nodes -in example.p12 -out example.key
Output: example.key

如果上面在生成证书时设置的密码不是password，需要替换更新
/usr/local/nexus3/nexus-3.31.1-01/etc/jetty/jetty-https.xml 中的password。
修改nexus 配置文件，设置端口等

/usr/local/nexus3/sonatype -work/nexus3/etc# cat nexus.properties
# Jetty section
application -port -ssl=8443
# application -port =8081
application -host =0.0.0.0
nexus -args=${jetty.etc}/jetty.xml ,${jetty.etc}/jetty -https.xml ,${jetty.etc}/jetty -requestlog.xml
nexus -context -path=/
# Nexus section
nexus -edition=nexus -pro -edition
nexus -features=\
nexus -pro -feature
nexus.hazelcast.discovery.isEnabled=true

重启nexus3 后，使用浏览器打开：https://ip:8443

验证使用Nexus 中的镜像发布容器

前提：已经使用Rancher2 部署kubernetes 集群
通过Rancher 给对应cluster 配置私有镜像库

发布一个POD进行测试

使用Nexus 不用提前上传镜像到私有镜像仓库，Nexus 会自动从配置的remote repository 进行下载

参考链接：
https://help.sonatype.com/repomanager3/installation-and-upgrades/
https://help.sonatype.com/repomanager3/nexus-repository-administration/
configuring-ssl
https://support.sonatype.com/hc/en-us/articles/213465768-SSL-Certificate-Guide#common-keytool-commands