概述
当我们使用docker登录私有化镜像仓库时，如果不使用https请求，那么docker会直接报错
Get "https://192.168.1.100/v2/": http: server gave HTTP response to HTTPS client这是因为Docker daemon 默认所有镜像仓库走 HTTPS 443 端口；如果 Harbor 仅开放 HTTP（80 / 自定义端口），直接docker login会报错
如果我们要必须使用http请求登录的话，那么可以参考下面，但是生产环境不推荐这样
编辑/etc/docker/daemon.json（文件不存在就新建）：
# 添加下面的内容
{
"insecure-registries": ["192.168.1.100:8080"]
}本文主要就是为了解决这个问题，基于自建证书搭建harbor仓库
实操
harbor主机通过openssl生成自建证书
root@master:~# mkdir -pv /data00/certs/{ca,harbor-server,docker-client}
root@master:~# cd /data00/certs/
# 创建ca证书
root@master:/data00/certs# openssl genrsa -out ca/ca.key 4096
Generating RSA private key, 4096 bit long modulus (2 primes)
...................................++++
.++++
e is 65537 (0x010001)
# 生成ca.srt证书
root@master:/data00/certs# openssl req -x509 -new -nodes -sha512 -days 36500 \
> -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=huangsir.com" \
> -key ca/ca.key \
> -out ca/ca.crt
# 检查生成的证书
root@master:/data00/certs# tree
.
├── ca
│ ├── ca.crt
│ └── ca.key
├── docker-client
└── harbor-server
# 基于自建ca创建harbor证书
root@master:/data00/certs# openssl genrsa -out harbor-server/harbor.huangsir.com.key 4096
Generating RSA private key, 4096 bit long modulus (2 primes)
..................++++
............................................................................++++
e is 65537 (0x010001)
root@master:/data00/certs# tree
.
├── ca
│ ├── ca.crt
│ └── ca.key
├── docker-client
└── harbor-server
# 生成的harbor证书
└── harbor.huangsir.com.key
3 directories, 3 files
# 生成证书文件
root@master:/data00/certs# openssl req -sha512 -new \
> -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor.huangsir.com" \
> -key harbor-server/harbor.huangsir.com.key \
> -out harbor-server/harbor.huangsir.com.csr
root@master:/data00/certs# tree
.
├── ca
│ ├── ca.crt
│ └── ca.key
├── docker-client
└── harbor-server
├── harbor.huangsir.com.csr
└── harbor.huangsir.com.key
# 生成 x509 v3 的扩展文件用于认证
root@master:/data00/certs# cat harbor-server/v3.ext
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1=harbor.huangsir.com
# 基于 x509 v3 的扩展文件认证签发harbor server证书
root@master:/data00/certs# openssl x509 -req -sha512 -days 3650 \
-extfile harbor-server/v3.ext \
-CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial \
-in harbor-server/harbor.huangsir.com.csr \
-out harbor-server/harbor.huangsir.com.crt
Signature ok
subject=C = CN, ST = Beijing, L = Beijing, O = example, OU = Personal, CN = harbor.huangsir.com
Getting CA Private Key
# 在harbor服务端生成docker客户端文件
root@master:/data00/certs# openssl x509 -inform PEM -in harbor-server/harbor.huangsir.com.crt \
-out docker-client/harbor.huangsir.com.cert
# 将harbor的证书拷贝到docker客户端文件中
root@master:/data00/certs# cp harbor-server/harbor.huangsir.com.key docker-client/
root@master:/data00/certs# cp ca/ca.crt docker-client/
# 整体的目录
root@master:/data00/certs# tree
.
├── ca
│ ├── ca.crt
│ ├── ca.key
│ └── ca.srl
├── docker-client
│ ├── ca.crt
│ ├── harbor.huangsir.com.cert
│ └── harbor.huangsir.com.key
└── harbor-server
├── harbor.huangsir.com.crt
├── harbor.huangsir.com.csr
├── harbor.huangsir.com.key
└── v3.extdocker主机节点配置
-
添加hosts解析
root@master:~# echo "10.37.97.56 harbor.huangsir.com" >> /etc/hosts
-
将harbor主机生成的证书拷贝到docker主机节点
先创建证书存储目录
root@master:~# mkdir -p /etc/docker/certs.d/harbor.huangsir.com
拷贝证书
root@master:~# scp harbor.huangsir.com:/data00/certs/docker-client/* /etc/docker/certs.d/harbor.huangsir.com/
检查
root@master:~# ll /etc/docker/certs.d/harbor.huangsir.com/
total 12
-rw-r--r-- 1 root root 2049 Jul 22 10:52 ca.crt
-rw-r--r-- 1 root root 2098 Jul 22 10:52 harbor.huangsir.com.cert
-rw------- 1 root root 3243 Jul 22 10:52 harbor.huangsir.com.key
harbor主机安装docker-compose
关于docker-compose的使用方法可以参考这篇文章：一文搞懂docker-compose
# 下载Docker Compose
[root@lb ~]# wget https://github.com/docker/compose/releases/download/v2.35.0/docker-compose-linux-x86_64
[root@lb ~]# ll docker-compose-linux-x86_64
-rw-r--r-- 1 root root 73664588 Apr 19 14:42 docker-compose-linux-x86_64
# 移动至/usr/bin/docker-compose
[root@lb ~]# mv docker-compose-linux-x86_64 /usr/bin/docker-compose
# 授予权限
[root@lb ~]# chmod +x /usr/bin/docker-compose
[root@lb ~]# ll /usr/bin/docker-compose
-rwxr-xr-x 1 root root 73664588 Apr 19 14:42 /usr/bin/docker-compose*
# 检查
[root@lb ~]# docker-compose version
Docker Compose version v2.35.0harbor主机安装harbor
GitHub官方地址：https://github.com/goharbor/harbor
# 下载
root@master:/data00/software# wget https://github.com/goharbor/harbor/releases/download/v2.14.2/harbor-offline-installer-v2.14.2.tgz
# 解压
root@master:/data00/software# tar -xvf harbor-offline-installer-v2.14.2.tgz harbor/
harbor/harbor.v2.14.2.tar.gz
harbor/prepare
harbor/LICENSE
harbor/install.sh
harbor/common.sh
harbor/harbor.yml.tmpl
# 修改harbor的配置文件
root@master:/data00/software# cd harbor/
root@master:/data00/software/harbor# cp harbor.yml.tmpl harbor.yml
root@master:/data00/software/harbor# vim harbor.yml
# 第五行
5 hostname: harbor.huangsir.com
# 证书文件
17 certificate: /data00/certs/harbor-server/harbor.huangsir.com.crt
18 private_key: /data00/certs/harbor-server/harbor.huangsir.com.key
# harbor的登录密码
47 harbor_admin_password: "huangsir"
# harbor的存储路径
66 data_volume: /data00/harbor/data
# 创建存储路径
root@master:/data00/software/harbor# mkdir -p /data00/harbor/data
# 导入镜像
root@master:/data00/software/harbor# docker load -i harbor.v2.14.2.tar.gz
d68f78b1a244: Loading layer [==================================================>] 40.84MB/40.84MB
3d0a43d2720e: Loading layer [==================================================>] 102.8MB/102.8MB
c8778864f212: Loading layer [==================================================>] 42.22MB/42.22MB
9e3f6d6299ab: Loading layer [==================================================>] 15.02MB/15.02MB
50838d9acece: Loading layer [==================================================>] 66.05kB/66.05kB
32f95b916769: Loading layer [==================================================>] 2.56kB/2.56kB
c885d0d41990: Loading layer [==================================================>] 1.536kB/1.536kB
b2590692b5ee: Loading layer [==================================================>] 9.728kB/9.728kB
e3641940a596: Loading layer [==================================================>] 1.106MB/1.106MB
dc67019791c0: Loading layer [==================================================>] 596.5kB/596.5kB
Loaded image: goharbor/prepare:v2.14.2
424c10202537: Loading layer [==================================================>] 10.06MB/10.06MB
2fb50c07ea6c: Loading layer [==================================================>] 4.096kB/4.096kB
cfa76521468f: Loading layer [==================================================>] 3.072kB/3.072kB
881a2cb434eb: Loading layer [==================================================>] 159.2MB/159.2MB
8d67d5d41e42: Loading layer [==================================================>] 16.49MB/16.49MB
318ae186e226: Loading layer [==================================================>] 176.6MB/176.6MB
# ...省略内容
# 执行前置校验，无报错即可
root@master:/data00/software/harbor# ./prepare
prepare base dir is set to /data00/software/harbor
Generated configuration file: /config/portal/nginx.conf
Generated configuration file: /config/log/logrotate.conf
Generated configuration file: /config/log/rsyslog_docker.conf
Generated configuration file: /config/nginx/nginx.conf
Generated configuration file: /config/core/env
Generated configuration file: /config/core/app.conf
Generated configuration file: /config/registry/config.yml
Generated configuration file: /config/registryctl/env
Generated configuration file: /config/registryctl/config.yml
Generated configuration file: /config/db/env
Generated configuration file: /config/jobservice/env
Generated configuration file: /config/jobservice/config.yml
copy /data/secret/tls/harbor_internal_ca.crt to shared trust ca dir as name harbor_internal_ca.crt ...
ca file /hostfs/data/secret/tls/harbor_internal_ca.crt is not exist
copy to shared trust ca dir as name storage_ca_bundle.crt ...
copy None to shared trust ca dir as name redis_tls_ca.crt ...
Generated and saved secret to file: /data/secret/keys/secretkey
Successfully called func: create_root_cert
Generated configuration file: /compose_location/docker-compose.yml
Clean up the input dir
# 执行安装
root@master:/data00/software/harbor# ./install.sh
# 安装后检查
root@master:/data00/software/harbor# docker-compose ps -a
NAME IMAGE COMMAND SERVICE CREATED STATUS PORTS
harbor-core goharbor/harbor-core:v2.14.2 "/harbor/entrypoint...." core 47 seconds ago Up 45 seconds (healthy)
harbor-db goharbor/harbor-db:v2.14.2 "/docker-entrypoint...." postgresql 47 seconds ago Up 46 seconds (healthy)
harbor-jobservice goharbor/harbor-jobservice:v2.14.2 "/harbor/entrypoint...." jobservice 47 seconds ago Up 42 seconds (healthy)
harbor-log goharbor/harbor-log:v2.14.2 "/bin/sh -c /usr/loc..." log 47 seconds ago Up 46 seconds (healthy) 127.0.0.1:1514->10514/tcp
harbor-portal goharbor/harbor-portal:v2.14.2 "nginx -g 'daemon of..." portal 47 seconds ago Up 46 seconds (healthy)
nginx goharbor/nginx-photon:v2.14.2 "nginx -g 'daemon of..." proxy 47 seconds ago Up 45 seconds (healthy) 0.0.0.0:80->8080/tcp, [::]:80->8080/tcp, 0.0.0.0:443->8443/tcp, [::]:443->8443/tcp
redis goharbor/redis-photon:v2.14.2 "redis-server /etc/r..." redis 47 seconds ago Up 46 seconds (healthy)
registry goharbor/registry-photon:v2.14.2 "/home/harbor/entryp..." registry 47 seconds ago Up 46 seconds (healthy)
registryctl goharbor/harbor-registryctl:v2.14.2 "/home/harbor/start...." registryctl 47 seconds ago Up 46 seconds (healthy) docker主机进行登录测试
root@node02:~# docker login -u admin harbor.huangsir.com
# 输入你的密码
Password:
WARNING! Your credentials are stored unencrypted in '/root/.docker/config.json'.
Configure a credential helper to remove this warning. See
https://docs.docker.com/go/credential-store/
# 这里显示登录成功即可
Login Succeeded