Harbor服务部署
简介
该服务应用于内网测试；
测试环境
| 主机名 | 系统 | IP | 公网访问 | 备注 |
|---|---|---|---|---|
| harbor | CentOS 7.9 | 172.17.80.82 | 可（桥接） | 个人办公电脑上的虚拟机； |
| 账号 | 密码 |
|---|---|
| root | root@123 |
配置ntp服务
安装ntpdate
yum -y install ntpdate
配置crontab和开机自动同步时间
crontab -e
0 */2 * * * /usr/sbin/ntpdate 114.118.7.161
# 在/etc/rc.d/rc.local文件中添加开机后自动执行的命令；
vim /etc/rc.d/rc.local
.
.
/usr/sbin/ntpdate 114.118.7.161
.
.
安装docker，docker-compose
安装docker-ce
docker-ce是docker的社区版，安装过程参考链接；
参考链接：docker-ce | 镜像站使用帮助 | 清华大学开源软件镜像站 | Tsinghua Open Source Mirror
安装docker-compose
采用二进制包方式安装；
下载链接：Releases · docker/compose · GitHub
mkdir -p /opt/docker-compose
cd /opt/docker-compose
mv /tmp/docker-compose-linux-x86_64 ./
chmod +x docker-compose-linux-x86_64
ln -s /opt/docker-compose/docker-compose-linux-x86_64 /usr/local/bin/docker-compose
[root@harbor ~]# docker-compose --version
Docker Compose version v2.18.1
注意：本环境为个人测试环境，没有专门数据盘，所以没有修改docker存储路径；
配置ssl证书
由于要使用ssl证书来保证harbor访问安全性，所以要先自签证书，如已有证书可以直接使用；
参考链接：Harbor docs | Configure HTTPS Access to Harbor (goharbor.io)
创建相关目录
mkdir -p /opt/Harbor/certs
cd /opt/Harbor/certs
创建自签ca私钥
openssl genrsa -out ca.key 4096
[root@harbor certs]# ls
ca.key
生成ca证书
其中属性部分需要根据实际情况配置
[root@harbor certs]# openssl req -x509 -new -nodes -sha512 -days 3650 \
> -subj "/C=CN/ST=LiaoNing/L=ShenYang/O=lnsz/OU=om/CN=test.harbor.guofei" \
> -key ca.key \
> -out ca.crt
[root@harbor certs]# ls
ca.crt ca.key
生成服务器证书
其中属性部分需要根据实际情况配置
[root@harbor certs]# openssl genrsa -out test.harbor.guofei.key 4096
Generating RSA private key, 4096 bit long modulus
.................................................................++
............................................................................................++
e is 65537 (0x10001)
[root@harbor certs]# ls
ca.crt ca.key test.harbor.guofei.key
生成证书签名请求
其中属性部分需要根据实际情况配置
[root@harbor certs]# openssl req -sha512 -new \
> -subj "/C=CN/ST=LiaoNing/L=ShenYang/O=lnsz/OU=om/CN=test.harbor.guofei" \
> -key test.harbor.guofei.key \
> -out test.harbor.guofei.csr
[root@harbor certs]# ls
ca.crt ca.key test.harbor.guofei.csr test.harbor.guofei.key
生成 x509 v3 扩展文件
alt_names部分需要填写绑定ssl证书的域名或ip，可写多个
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1=test.harbor.guofei
DNS.2=172.17.80.82
DNS.3=harbor
EOF
使用该文件为 Harbor 主机生成证书
其中属性部分需要根据实际情况配置
[root@harbor certs]# openssl x509 -req -sha512 -days 3650 \
> -extfile v3.ext \
> -CA ca.crt -CAkey ca.key -CAcreateserial \
> -in test.harbor.guofei.csr \
> -out test.harbor.guofei.crt
Signature ok
subject=/C=CN/ST=LiaoNing/L=ShenYang/O=lnsz/OU=om/CN=test.harbor.guofei
Getting CA Private Key
[root@harbor certs]# ls
ca.crt ca.key ca.srl test.harbor.guofei.crt test.harbor.guofei.csr test.harbor.guofei.key v3.ext
自签证书流程结束；
转换证书格式，并配置给docker使用
由于本次部署采用docker方式，为保证docker可以正常使用证书，所以需要将现有的crt和key格式，转换为crt和cert格式；
[root@harbor certs]# openssl x509 -inform PEM -in test.harbor.guofei.crt -out test.harbor.guofei.cert
[root@harbor certs]# ls
ca.crt ca.key ca.srl test.harbor.guofei.cert test.harbor.guofei.crt test.harbor.guofei.csr test.harbor.guofei.key v3.ext
[root@harbor test.harbor.guofei]# cp /opt/Harbor/certs/test.harbor.guofei.cert /etc/docker/certs.d/test.harbor.guofei/
[root@harbor test.harbor.guofei]# cp /opt/Harbor/certs/test.harbor.guofei.key /etc/docker/certs.d/test.harbor.guofei/
[root@harbor test.harbor.guofei]# cp /opt/Harbor/certs/ca.crt /etc/docker/certs.d/test.harbor.guofei/
[root@harbor test.harbor.guofei]# cd /etc/docker/certs.d/test.harbor.guofei/
[root@harbor test.harbor.guofei]# ls
ca.crt test.harbor.guofei.cert test.harbor.guofei.key
重启docker
systemctl restart docker
部署Harbor服务
采用docker方式部署；
下载链接：Releases · goharbor/harbor (github.com)
创建相关目录
mkdir /opt/Harbor
cd /opt/Harbor
[root@harbor Harbor]# tar -xvf harbor-offline-installer-v2.8.1.tgz
harbor/harbor.v2.8.1.tar.gz
harbor/prepare
harbor/LICENSE
harbor/install.sh
harbor/common.sh
harbor/harbor.yml.tmpl
[root@harbor Harbor]# ls
certs harbor harbor-offline-installer-v2.8.1.tgz
修改harbor配置文件
cd /opt/Harbor/harbor
cp ./harbor.yml.tmpl ./harbor.yml
vim /opt/Harbor/harbor/harbor.yml
.
.
5 hostname: test.harbor.guofei
.
13 https:
14 # https port for harbor, default is 443
15 port: 14433
16 # The path of cert and key files for nginx
17 # certificate: /your/certificate/path
18 # private_key: /your/private/key/path
19 certificate: /etc/docker/certs.d/test.harbor.guofei/test.harbor.guofei.cert
20 private_key: /etc/docker/certs.d/test.harbor.guofei/test.harbor.guofei.key
.
.
运行脚本部署服务
cd /opt/Harbor/harbor
./install.sh --with-trivy
看到以下输出则表示服务搭建成功；
.
.
[Step 5]: starting Harbor ...
[+] Building 0.0s (0/0)
[+] Running 11/11
✔ Network harbor_harbor Created 0.8s
✔ Container harbor-log Started 1.0s
✔ Container registry Started 2.8s
✔ Container registryctl Started 2.2s
✔ Container harbor-db Started 2.7s
✔ Container harbor-portal Started 2.5s
✔ Container redis Started 2.4s
✔ Container harbor-core Started 3.4s
✔ Container trivy-adapter Started 3.2s
✔ Container nginx Started 5.1s
✔ Container harbor-jobservice Started 4.5s
✔ ----Harbor has been installed and started successfully.----
Harbor访问测试
web测试
链接地址：https://test.harbor.guofei:14433/harbor/projects
根据环境不同可能需要配置hosts；
客户端连接测试
由于实验用证书为自签证书，会被认定为不安全证书所以访问测试之前需要在/lib/systemd/system/docker.service中，添加 --insecure-registry=仓库地址，以确保浏览器不会因为是危险证书而不让访问。注意：修改后需要重启docker服务；；
示例：
vim /lib/systemd/system/docker.service
.
.
[Service]
Type=notify
# the default is not to use systemd for cgroups because the delegate issues still
# exists and systemd currently does not support the cgroup feature set required
# for containers run by docker
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --insecure-registry=test.harbor.guofei:14433
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutStartSec=0
RestartSec=2
Restart=always
.
.
systemctl daemon-reload
systemctl restart docker
向客户端传输SSL证书：
scp -P 2200 ./test.harbor.guofei.crt test@192.168.1.20:/tmp #将公钥文件传输给目标主机；
客户端SSL证书的保存需要遵守特定规则：
mkdir -p /etc/docker/certs.d/test.harbor.guofei/ #创建公钥保存目录；
mv /tmp/test.harbor.guofei.crt /etc/docker/certs.d/test.harbor.guofei/ #注意certs.d目录一定不要写错；
chown root:root /etc/docker/certs.d/test.harbor.guofei/test.harbor.guofei.crt
vim /etc/hosts #客户端配置域名解析；
使用docker登录测试：
docker login test.harbor.guofei:14433 # 由于自定义了默认端口所以此处要加上端口号；
Username:
Password:
管理命令
由于是通过docker镜像方式运行，所以此处所谓对服务管理，其实就是对docker容器进行管理。而该服务容器是由docker-compose.yml创建所以管理命令如下；
停止
cd /opt/Harbor/harbor/
[root@harbor harbor]# docker-compose down
[+] Running 11/11
✔ Container harbor-jobservice Removed 0.4s
✔ Container registryctl Removed 10.4s
✔ Container trivy-adapter Removed 0.4s
✔ Container nginx Removed 0.6s
✔ Container harbor-portal Removed 0.2s
✔ Container harbor-core Removed 3.2s
✔ Container redis Removed 0.5s
✔ Container harbor-db Removed 0.4s
✔ Container registry Removed 0.4s
✔ Container harbor-log Removed 10.3s
✔ Network harbor_harbor Removed
启动
cd /opt/Harbor/harbor/
[root@harbor harbor]# docker-compose up -d
[+] Building 0.0s (0/0)
[+] Running 11/11
✔ Network harbor_harbor Created 0.6s
✔ Container harbor-log Started 1.0s
✔ Container harbor-db Started 4.6s
✔ Container harbor-portal Started 4.2s
✔ Container registry Started 4.7s
✔ Container registryctl Started 4.3s
✔ Container redis Started 4.4s
✔ Container trivy-adapter Started 5.4s
✔ Container harbor-core Started 5.6s
✔ Container harbor-jobservice Started 6.9s
✔ Container nginx Started
