Harbor私有仓库部署与配置-https

lldhsds2024-07-04 0:33

Harbor私有仓库部署与配置-https

Harbor 是一个开源的云原生镜像仓库，用于存储和分发容器镜像的企业级Registry服务器，通过添加一些企业必需的功能特性，例如安全、标识和管理等，扩展了开源 Docker Distribution。作为一个企业级私有 Registry 服务器，Harbor 提供了更好的性能和安全。

本文用https+自签名证书部署。

1. 准备工作

  1. 下载 Harbor 离线安装包

从 Harbor GitHub releases 页面下载离线安装包，例如 harbor-offline-installer-v2.11.0.tgz。

  1. 安装 Docker 和 Docker Compose

确保目标机器上已经安装了 Docker 和 Docker Compose。

  1. 证书相关

生成证书颁发机构证书及私钥：

shell 复制代码 
# 修改主机名
root@ubuntu-svr:~# hostnamectl set-hostname harbor

root@harbor:~# mkdir -p /data/harbor/certs
root@harbor:~# cd /data/harbor/certs/
root@harbor:/data/harbor/certs# openssl genrsa -out ca.key 4096

root@harbor:/data/harbor/certs# openssl req -x509 -new -nodes -sha512 -days 3650  -subj "/C=CN/ST=Beijing/L=Beijing/O=matrix/OU=test/CN=harbor.test.com"  -key ca.key  -out ca.crt
root@harbor:/data/harbor/certs# ls
ca.crt  ca.key

生成服务器私钥及证书签名请求（CSR）:

shell 复制代码 
root@harbor:/data/harbor/certs# openssl genrsa -out harbor.test.com.key 4096
# 生成证书签名请求
root@harbor:/data/harbor/certs# openssl req -sha512 -new -subj "/C=CN/ST=Beijing/L=Beijing/O=matrix/OU=test/CN=harbor.test.com" -key harbor.test.com.key  -out harbor.test.com.csr
root@harbor:/data/harbor/certs# ls
ca.crt  ca.key  harbor.test.com.csr  harbor.test.com.key

生成 x509 v3 扩展文件:

shell 复制代码 
root@harbor:/data/harbor/certs# cat v3.ext
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=harbor.test.com
DNS.2=test.com
DNS.3=harbor

使用该v3.ext文件为 Harbor 服务器生成证书:

shell 复制代码 
root@harbor:/data/harbor/certs# openssl x509 -req -sha512 -days 3650 -extfile v3.ext -CA ca.crt -CAkey ca.key -CAcreateserial -in harbor.test.com.csr -out harbor.test.com.crt
Certificate request self-signature ok
subject=C = CN, ST = Beijing, L = Beijing, O = matrix, OU = test, CN = harbor.test.com

将 harbor.snow.com.crt 转换为 harbor.snow.com.cert , 供 Docker 使用。Docker 守护进程将.crt文件解释为 CA 证书，.cert将文件解释为客户端证书:

shell 复制代码 
root@harbor:/data/harbor/certs# openssl x509 -inform PEM -in harbor.test.com.crt -out harbor.test.com.cert

2. 安装部署

将 harbor-offline-installer-v2.11.0.tgz 上传到待部署机器并解压：

bash 复制代码 
root@harbor:~# tar xf harbor-offline-installer-v2.11.0.tgz
root@harbor:~# cd harbor/
root@harbor:~/harbor# ls
common.sh  harbor.v2.11.0.tar.gz  harbor.yml.tmpl  install.sh  LICENSE  prepare

配置 Harbor：

shell 复制代码 
root@harbor:~/harbor# cp harbor.yml.tmpl harbor.yml
root@harbor:~/harbor# vi harbor.yml

编辑 harbor.yml 文件，根据实际需求进行配置:

yaml 复制代码 
hostname: harbor.test.com   # 使用域名
...
http:
  port: 80  # http端口
...
harbor_admin_password: Harbor12345  # web界面admin密码
...
database:
  password: root123 # 后端数据库root密码
...
data_volume: /data/harbor  # 数据存放路径

...
https:
  # https port for harbor, default is 443
  port: 443     # https端口
  # The path of cert and key files for nginx
  certificate: /data/harbor/certs/harbor.test.com.cert
  private_key: /data/harbor/certs/harbor.test.com.key
  # enable strong ssl ciphers (default: false)
  # strong_ssl_ciphers: false

...

加载镜像和启动 Harbor:

shell 复制代码 
# 执行安装
root@harbor:~/harbor# bash install.sh

[Step 0]: checking if docker is installed ...

Note: docker version: 26.1.3

[Step 1]: checking docker-compose is installed ...

Note: Docker Compose version v2.27.0

[Step 2]: loading Harbor images ...
Loaded image: goharbor/harbor-core:v2.11.0
Loaded image: goharbor/harbor-db:v2.11.0
Loaded image: goharbor/nginx-photon:v2.11.0
Loaded image: goharbor/trivy-adapter-photon:v2.11.0
Loaded image: goharbor/redis-photon:v2.11.0
Loaded image: goharbor/registry-photon:v2.11.0
Loaded image: goharbor/prepare:v2.11.0
Loaded image: goharbor/harbor-portal:v2.11.0
Loaded image: goharbor/harbor-log:v2.11.0
Loaded image: goharbor/harbor-jobservice:v2.11.0
Loaded image: goharbor/harbor-registryctl:v2.11.0
Loaded image: goharbor/harbor-exporter:v2.11.0


[Step 3]: preparing environment ...

[Step 4]: preparing harbor configs ...
prepare base dir is set to /root/harbor
Clearing the configuration file: /config/log/rsyslog_docker.conf
Clearing the configuration file: /config/log/logrotate.conf
Clearing the configuration file: /config/db/env
Clearing the configuration file: /config/registry/config.yml
Clearing the configuration file: /config/registry/root.crt
Clearing the configuration file: /config/registry/passwd
Clearing the configuration file: /config/core/env
Clearing the configuration file: /config/core/app.conf
Clearing the configuration file: /config/jobservice/config.yml
Clearing the configuration file: /config/jobservice/env
Clearing the configuration file: /config/portal/nginx.conf
Clearing the configuration file: /config/registryctl/config.yml
Clearing the configuration file: /config/registryctl/env
Clearing the configuration file: /config/nginx/nginx.conf
Generated configuration file: /config/portal/nginx.conf
Generated configuration file: /config/log/logrotate.conf
Generated configuration file: /config/log/rsyslog_docker.conf
Generated configuration file: /config/nginx/nginx.conf
Generated configuration file: /config/core/env
Generated configuration file: /config/core/app.conf
Generated configuration file: /config/registry/config.yml
Generated configuration file: /config/registryctl/env
Generated configuration file: /config/registryctl/config.yml
Generated configuration file: /config/db/env
Generated configuration file: /config/jobservice/env
Generated configuration file: /config/jobservice/config.yml
loaded secret from file: /data/secret/keys/secretkey
Generated configuration file: /compose_location/docker-compose.yml
Clean up the input dir


Note: stopping existing Harbor instance ...
WARN[0000] /root/harbor/docker-compose.yml: `version` is obsolete
[+] Running 10/10
 ✔ Container registryctl        Removed                                                                                                                                                                                                                      0.3s
 ✔ Container harbor-jobservice  Removed                                                                                                                                                                                                                      0.4s
 ✔ Container nginx              Removed                                                                                                                                                                                                                      0.0s
 ✔ Container harbor-portal      Removed                                                                                                                                                                                                                      0.3s
 ✔ Container harbor-core        Removed                                                                                                                                                                                                                      3.1s
 ✔ Container registry           Removed                                                                                                                                                                                                                      0.2s
 ✔ Container redis              Removed                                                                                                                                                                                                                      0.3s
 ✔ Container harbor-db          Removed                                                                                                                                                                                                                      0.2s
 ✔ Container harbor-log         Removed                                                                                                                                                                                                                     10.2s
 ✔ Network harbor_harbor        Removed                                                                                                                                                                                                                      0.2s


[Step 5]: starting Harbor ...
WARN[0000] /root/harbor/docker-compose.yml: `version` is obsolete
[+] Running 10/10
 ✔ Network harbor_harbor        Created                                                                                                                                                                                                                      0.1s
 ✔ Container harbor-log         Started                                                                                                                                                                                                                      0.3s
 ✔ Container harbor-db          Started                                                                                                                                                                                                                      1.0s
 ✔ Container redis              Started                                                                                                                                                                                                                      0.9s
 ✔ Container harbor-portal      Started                                                                                                                                                                                                                      0.9s
 ✔ Container registry           Started                                                                                                                                                                                                                      1.0s
 ✔ Container registryctl        Started                                                                                                                                                                                                                      1.3s
 ✔ Container harbor-core        Started                                                                                                                                                                                                                      1.4s
 ✔ Container nginx              Started                                                                                                                                                                                                                      2.0s
 ✔ Container harbor-jobservice  Started                                                                                                                                                                                                                      1.9s
✔ ----Harbor has been installed and started successfully.----

说明：

  1. 当前机器如果存在同名的容器，也会导致harbor部署失败，例如redis,nginx等，部署之前停止可能冲突的容器。
  2. 注意端口冲突，如果本地已经部署nginx或者httpd等web服务器，注意修改端口。

3. 检查部署情况

  1. 查看 Harbor 服务状态
shell 复制代码 
[root@harbor harbor]# docker ps
CONTAINER ID   IMAGE                                               COMMAND                  CREATED          STATUS                   PORTS                                   NAMES
cb5c79df4e4c   goharbor/harbor-jobservice:v2.11.0                  "/harbor/entrypoint...."   3 minutes ago    Up 3 minutes (healthy)                                           harbor-jobservice
39486ae87f17   goharbor/nginx-photon:v2.11.0                       "nginx -g 'daemon of..."   3 minutes ago    Up 3 minutes (healthy)   0.0.0.0:80->8080/tcp, :::80->8080/tcp   nginx
09098205ec51   goharbor/harbor-core:v2.11.0                        "/harbor/entrypoint...."   3 minutes ago    Up 3 minutes (healthy)                                           harbor-core
0e968a41d58c   goharbor/redis-photon:v2.11.0                       "redis-server /etc/r..."   3 minutes ago    Up 3 minutes (healthy)                                           redis
8552f9919837   goharbor/harbor-db:v2.11.0                          "/docker-entrypoint...."   3 minutes ago    Up 3 minutes (healthy)                                           harbor-db
4985901e00f5   goharbor/harbor-portal:v2.11.0                      "nginx -g 'daemon of..."   3 minutes ago    Up 3 minutes (healthy)                                           harbor-portal
9c297f67dd64   goharbor/harbor-registryctl:v2.11.0                 "/home/harbor/start...."   3 minutes ago    Up 3 minutes (healthy)                                           registryctl
e0d91f7bfd29   goharbor/registry-photon:v2.11.0                    "/home/harbor/entryp..."   3 minutes ago    Up 3 minutes (healthy)                                           registry
3c06f80eb9f0   goharbor/harbor-log:v2.11.0                         "/bin/sh -c /usr/loc..."   3 minutes ago    Up 3 minutes (healthy)   127.0.0.1:1514->10514/tcp               harbor-log
  1. 访问 Harbor Web 界面

打开浏览器，访问 https://harbor.test.com，或https://ip，使用配置文件中设置的管理员用户名（默认是 admin）和密码登录。

  1. 推送镜像测试

配置docker客户端：

shell 复制代码 
root@harbor:~# mkdir -p /etc/docker/certs.d/harbor.test.com
root@harbor:~# cp /data/harbor/certs/harbor.test.com.cert /etc/docker/certs.d/harbor.test.com/

修改docker的daemon.json文件，使其信任harbor.test.com仓库：

shell 复制代码 
[root@k8s ~]# cat /etc/docker/daemon.json
{

  "exec-opts": ["native.cgroupdriver=systemd"],
  "registry-mirrors": [
        "https://registry.docker-cn.com",
        "https://registry-1.docker.io",
        "https://registry.hub.docker.com",
        "https://mirror.baidubce.com",
        "https://ccr.ccs.tencentyun.com",
        "https://wnsrsn9i.mirror.aliyuncs.com"
    ],
   "insecure-registries": ["192.168.0.159", "harbor.test.com"]

修改完成后重启docker服务生效。

测试登录：

shell 复制代码 
[root@k8s ~]# docker login -u admin -p Harbor12345 harbor.test.com
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

推送镜像测试：

shell 复制代码 
[root@k8s ~]# docker tag 192.168.0.159/library/nginx:1.27.0 harbor.test.com/library/nginx:1.27.0
[root@k8s ~]# docker push harbor.test.com/library/nginx:1.27.0
The push refers to repository [harbor.test.com/library/nginx]
3cf30c944fca: Pushed
16d40ad06803: Pushed
cf1614267117: Pushed
e5ec4dd3995c: Pushed
e8186e892c11: Pushed
a9a1ca1cae25: Pushed
1387079e86ad: Pushed
1.27.0: digest: sha256:9d1cac272a1ff8c4f4d6607940f179c9716b28c956231e61ae40a63990400c15 size: 1778

说明：

library为harbor默认自带的项目，根据自己使用需求创建自定义的项目存放容器镜像。

4. 常见问题排查

  1. 确保防火墙允许 Harbor 端口
bash 复制代码 
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
  1. 检查 Docker 和 Docker Compose 版本

确保安装的 Docker 和 Docker Compose 版本满足 Harbor 的最低要求。

  1. x509: cannot validate certificate
shell 复制代码 
[root@k8s ~]# docker login -u admin -p Harbor12345 192.168.0.157
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Error response from daemon: Get https://192.168.0.157/v2/: x509: cannot validate certificate for 192.168.0.157 because it doesn't contain any IP SANs

解决：改用域名登录。

  1. 502 Bad Gateway
shell 复制代码 
[root@k8s ~]# docker login -u admin -p Harbor12345 harbor.test.com
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Error response from daemon: login attempt to https://harbor.test.com/v2/ failed with status: 502 Bad Gateway

解决：

重启下部署harbor机器的docker服务，然后重新登录：

shell 复制代码 
[root@k8s ~]# docker login -u admin -p Harbor12345 harbor.test.com
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

另外在harbor本地机器使用docker测试登录，报错如下，暂时未找到原因：

shell 复制代码 
root@harbor:~# docker login -u admin -p Harbor12345 harbor.test.com
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Error response from daemon: Get "http://harbor.test.com/v2/": EOF
相关推荐
运维&陈同学19 分钟前
【kafka04】消息队列与微服务之Kafka 图形工具
后端·微服务·zookeeper·云原生·架构·kafka·消息队列·云计算
陌殇殇殇7 小时前
基于Kubernetes编排部署EFK日志收集系统
云原生·容器·kubernetes
斑驳竹影8 小时前
Zookeeper实现分布式锁、Zookeeper实现配置中心
分布式·zookeeper·云原生
yunmoon0111 小时前
一个专为云原生环境设计的高性能分布式文件系统
云原生·分布式文件系统
极小狐12 小时前
极狐GitLab 17.6 正式发布几十项与 DevSecOps 相关的功能【三】
ci/cd·gitlab·devsecops·devops·极狐gitlab
XMYX-012 小时前
使用 Django 构建支持 Kubernetes API 测试连接的 POST 接口
python·kubernetes·django
怡雪～14 小时前
K8s的水平自动扩容和缩容HPA
云原生·容器·kubernetes
史努比.14 小时前
HPA - k8s自动伸缩机制
云原生·容器·kubernetes
运维&陈同学15 小时前
【kafka01】消息队列与微服务之Kafka详解
运维·分布式·后端·微服务·云原生·容器·架构·kafka
极小狐17 小时前
极狐GitLab 17.6 正式发布几十项与 DevSecOps 相关的功能【四】
gitlab·devops·极狐gitlab
热门推荐
01软件工程从理论到实践客观题汇总(头歌第一章至第八章)02(欧拉)openEuler系统添加网卡文件配置流程、(欧拉)openEuler系统手动配置ipv6地址流程、(欧拉)openEuler系统网络管理说明03【HarmonyOS】HUAWEI DevEco Studio 下载地址汇总04基于微信小程序的自习室预约系统的设计与实现05玄机平台应急响应—webshell查杀06PyTorch机器学习实现液态神经网络07Docker 夺命连环 15 问0804 - matlab m_map地学绘图工具基础函数 - 设置网格09RAG 实践- Ollama+RagFlow 部署本地知识库10【软考经验分享】软考-中级-嵌入式备考