前言
- 我的IP：192.168.0.252
部署具有https类型的harbor
生成证书
openssl req -newkey rsa:4096 -nodes -sha256 -keyout ca.key -x509 -days 3650 -out ca.crt
openssl req -newkey rsa:4096 -nodes -sha256 -keyout 192.168.0.252.key -out 192.168.0.252.csr
mkdir CA
cd CA
touch index.txt
echo "01" > serial
cd ..
echo "subjectAltName = IP:192.168.0.252" > extfile.cnf
# 42 行设置为刚刚创建CA目录，如下【不修改会报错】
vim /etc/pki/tls/openssl.cnf
42 dir = ./CA
修改如图
生成证书
# 生成证书
openssl ca -in 192.168.0.252.csr -out 192.168.0.252.crt -cert ca.crt -keyfile ca.key -extfile extfile.cnf -outdir .
下载harbor
wget https://storage.googleapis.com/harbor-releases/release-1.9.0/harbor-offline-installer-v1.9.1.tgz
修改配置文件
# 解压
tar -xf harbor-offline-installer-v1.9.1.tgz
cd harbor
# 修改配置文件
vim harbor.yaml
5 hostname: 192.168.0.252
13 https:
14 # # https port for harbor, default is 443
15 port: 443
16 # # The path of cert and key files for nginx
17 certificate: /ENV/harbor/key/192.168.0.252.crt
18 private_key: /ENV/harbor/key/192.168.0.252.key
# 密码根据自己情况修改
修改如图
启动
./install.sh
客户端登录
- 配置客户端信任证书
# 在客户端服务器上执行
[root@zhicheng ~]# mkdir -p /etc/docker/certs.d/192.168.0.252
# 服务端证书目录执行
scp ca.crt root@客户端IP:/etc/docker/certs.d/192.168.0.252/
# 客户端执行【centos7】
update-ca-trust
- 登录
[root@zhicheng ~]# docker login 192.168.0.252
Username: admin
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
如图，默认密码在配置文件中
其他操作
# 需要重新部署的时候
docker-compose down -v
./prepare
修改配置完成后
docker-compose up -d
