环境
Harbor version : harbor.v2.5.3
Docker version : 20.10.8
官方文档 : Configure HTTPS Access to Harbor
照抄文档 : 基本照抄该链接,只为记录
在合适的目录下创建 key 文件:
> openssl genrsa -out ca.key 4096
生成证书:
> openssl req -x509 -new -nodes -sha512 -days 3650 -subj "/CN=my.harbor.com" -key ca.key -out ca.crt
创建私钥
> openssl genrsa -out server.key 4096
生成证书签名请求
>openssl req -new -sha512 -subj "/CN=my.harbor.com" -key server.key -out server.csr
创建一个 v3.ext 文件
> cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1=my.harbor.com
EOF
生成harbor仓库主机的证书
> openssl x509 -req -sha512 -days 3650 -extfile v3.ext -CA ca.crt -CAkey ca.key -CAcreateserial -in server.csr -out server.crt
配置 harbor.yml
> vim harbor.yml
hostname: my.harbor.com
https:
port: 443
certificate: /PATH/server.crt
private_key: /PATH/server.key
执行 prepare && restart harbor
> ./prepare
> docker-compose down -v
> docker-compose up -d
配置 /etc/hosts
> echo 127.0.0.1 my.harbor.com >> /etc/hosts
cp 证书 到 docker 固定目录中
> mkdir -p /etc/docker/certs.d/my.harbor.com
> cp server.crt /etc/docker/certs.d/my.harbor.com/server.crt
docker login
> docker login my.harbor.com