Harbor 安装
本教程适用系统 CentOS 7
环境
+----------+------------+----------------------+
| Protocol | Server | IP/Domain |
+----------+------------+----------------------+
| http | harbor | 192.168.0.76 |
+----------+------------+----------------------+
| https | harbor | harbor.example.com |
+----------+------------+----------------------+
本教程提供2种方式安装(任选其一)
- http ip地址方式访问 http://192.168.0.70
- https 域名方式访问 https://harbor.example.com
前提条件
docker, docker-compose 安装环境请参考此链接
- docker
- docker-compose
Harbor 代码仓库地址 https://github.com/goharbor/harbor
下载软件
1. 获取最新版本号
HARBOR_VER=$( \
curl -sSL https://api.github.com/repos/goharbor/harbor/releases/latest | \
grep '"name"' | head -n 1 | awk -F ":" '{print $2}' | sed 's/\"//g;s/,//g;s/ //g')
2. 下载在线安装包
VER="$(echo $HARBOR_VER | tr -d '[a-z]' | cut -d. -f1,2).0"
curl -LO --progress \
https://storage.googleapis.com/harbor-releases/release-${VER}/harbor-online-installer-${HARBOR_VER}.tgz
HTTP IP方式安装
1. 解压
tar zxf harbor-online-installer-${HARBOR_VER}.tgz
cd harbor
2. 创建配置文件
cp harbor.yml harbor.yml.default
sed -i 's#hostname:.*#hostname: 192.168.0.76#' harbor.yml
sed -i '13 s/https:/#https:/' harbor.yml
sed -i '15 s/ port:/ #port:/' harbor.yml
sed -i '17 s/ certificate:/ #certificate:/' harbor.yml
sed -i '18 s/ private_key:/ #private_key:/' harbor.yml
sed -i "s#data_volume:.*#data_volume: /data/harbor#" harbor.yml
sed -i "s#harbor_admin_password:.*#harbor_admin_password: admin#" harbor.yml
2. 生成容器配置
./prepare
3. 下载镜像 && 启动服务
./install.sh
4. 客户端配置
docker 配置文件添加 harbor 服务器IP(信任http协议通信) "insecure-registries": ["192.168.0.76"],
sed -i '/insecure-registries/d' /etc/docker/daemon.json
sed -i '/registry-mirrors/a\ "insecure-registries": ["192.168.0.76"],' /etc/docker/daemon.json
重启 docker 服务
systemctl restart docker
客户端命令行登录验证
docker login 192.168.0.76 -u admin -p admin
浏览器验证
http://192.168.0.76 admin/admin
HTTPS Domain 方式安装
1. 生成证书
# 0. 创建证书路径/定义域名
mkdir -p ~/.harbor
domain=harbor.hc-yun.com
# 1. 生成 CA 证书私钥
openssl genrsa -out ~/.harbor/ca.key 4096
# 2. 生成CA证书
openssl req -x509 -new -nodes -sha512 -days 3650 \
-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=${domain}" \
-key ~/.harbor/ca.key \
-out ~/.harbor/ca.crt
# 3. 生成服务器证书私钥
openssl genrsa -out ~/.harbor/${domain}.key 4096
# 4. 生成证书签名请求(CSR)
openssl req -sha512 -new \
-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=${domain}" \
-key ~/.harbor/${domain}.key \
-out ~/.harbor/${domain}.csr
# 5. 生成一个 x509 v3 扩展文件
cat > ~/.harbor/v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1=${domain}
DNS.2=$(hostname)
EOF
# 6. 使用 v3.ext 文件为 Harbor 主机生成证书
openssl x509 -req -sha512 -days 3650 \
-extfile ~/.harbor/v3.ext \
-CA ~/.harbor/ca.crt -CAkey ~/.harbor/ca.key -CAcreateserial \
-in ~/.harbor/${domain}.csr \
-out ~/.harbor/${domain}.crt
# 7. 提供证书给 Harbor
mkdir -p /data/cert/
/bin/cp ~/.harbor/${domain}.crt /data/cert/
/bin/cp ~/.harbor/${domain}.key /data/cert/
# 8. 转换 domain.crt 为 domain.cert, 供 Docker 使用.(Docker 守护程序将 .crt 文件解释为 CA 证书, 并将 .cert 文件解释为客户端证书)
openssl x509 -inform PEM -in ~/.harbor/${domain}.crt -out ~/.harbor/${domain}.cert
# 9. 将服务器证书, 密钥和 CA 文件复制到 Harbor 主机上的 Docker 证书文件夹中
domain=harbor.hc-yun.com
mkdir -p /etc/docker/certs.d/${domain}
/bin/cp ~/.harbor/ca.crt /etc/docker/certs.d/${domain}/
/bin/cp ~/.harbor/${domain}.key /etc/docker/certs.d/${domain}/
/bin/cp ~/.harbor/${domain}.cert /etc/docker/certs.d/${domain}/
# 10. 重启 Docker
systemctl restart docker
2. 解压
tar zxf harbor-online-installer-${HARBOR_VER}.tgz
cd harbor
3. 创建配置文件
cp harbor.yml harbor.yml.default
sed -i 's#hostname:.*#hostname: harbor.hc-yun.com#' harbor.yml
sed -i "s#data_volume:.*#data_volume: /data/harbor#" harbor.yml
sed -i "s#harbor_admin_password:.*#harbor_admin_password: admin#" harbor.yml
sed -i "s@ certificate:.*@ certificate: /data/cert/${domain}.crt@" harbor.yml
sed -i "s@ private_key:.*@ private_key: /data/cert/${domain}.key@" harbor.yml
4. 生成容器配置
./prepare
5. 下载镜像 && 启动服务
./install.sh
6. 客户端配置
添加 hosts 解析
echo "192.168.2.71 harbor.hc-yun.com" >> /etc/hosts
配置证书
domain=harbor.hc-yun.com
mkdir -p /etc/docker/certs.d/${domain}
scp -r harbor.hc-yun.com:~/.harbor/ca.crt /etc/docker/certs.d/${domain}/
scp -r harbor.hc-yun.com:~/.harbor/${domain}.key /etc/docker/certs.d/${domain}/
scp -r harbor.hc-yun.com:~/.harbor/${domain}.cert /etc/docker/certs.d/${domain}/
重启 docker 服务
systemctl restart docker
客户端命令行登录验证
docker login harbor.hc-yun.com -u admin -p admin
浏览器验证
https://harbor.hc-yun.com admin/admin
评论区