Harbor2.0

官方下载

​ https://github.com/goharbor/harbor/releases/

官方文档

​ https://goharbor.io/docs/2.0.0/install-config/

docker配置注册表, oss存储驱动

​ https://docs.docker.com/registry/configuration/#storage

​ https://docs.docker.com/registry/storage-drivers/oss/

配置https访问

生成证书颁发机构证书

cd /data/harbor
mkdir certs.d  && cd certs.d

#生成CA证书私钥
openssl genrsa -out ca.key 4096

# 生成CA证书
openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=www.harbor.com" \
 -key ca.key \
 -out ca.crt

生成服务器证书

# 生成私钥
openssl genrsa -out www.harbor.com.key 4096

# 生成证书签名请求（CSR）
openssl req -sha512 -new \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=www.harbor.com" \
    -key www.harbor.com.key \
    -out www.harbor.com.csr

# 生成一个x509 v3扩展文件。
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=www.harbor.com
DNS.2=harbor
DNS.3=www
EOF

# 使用该v3.ext文件为您的Harbor主机生成证书。
openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in www.harbor.com.csr \
    -out www.harbor.com.crt

配置harbor

配置harbor.yml

hostname: www.harbor.com           # 配置什么地址，拉取就要用这个地址
  certificate: /data/harbor/certs.d/www.harbor.com.crt
  private_key: /data/harbor/certs.d/www.harbor.com.key
harbor_admin_password: 123456
data_volume: /data/harbor_data

mkdir -p /data/harbor_data/  
# 初始化安装
./install.sh --with-notary --with-clair --with-trivy  --with-chartmuseum

# 重加载配置文件： ./prepare  --with-notary --with-clair --with-trivy  --with-chartmuseum
# 重建实例：  docker-compose down -v   && docker-compose up -d

docker访问

配置hosts

cat >>/etc/hosts<<-EOF
10.0.0.4  www.harbor.com
EOF

通过https访问

生产客户端证书

# Docker守护程序将.crt文件解释为CA证书，并将.cert文件解释为客户端证书。
openssl x509 -inform PEM -in www.harbor.com.crt -out www.harbor.com.cert

mkdir  /etc/docker/certs.d/www.harbor.com
cp www.harbor.com.cert www.harbor.com
cp www.harbor.com.key www.harbor.com
cp ca.crt  www.harbor.com

# 把www.harbor.com文件夹移到docker的/etc/docker/certs.d/供docker使用
systemctl daemon-reload
systemctl restart docker.service

通过http访问

www.harbor.com添加到仓库信任

cat >/etc/docker/daemon.json<<-EOF
{
        "registry-mirrors": [
                "https://6zmzhe7k.mirror.aliyuncs.com"
        ],
        "insecure-registries": [
                "www.harbor.com"
        ]
}

EOF

systemctl daemon-reload
systemctl restart docker.service