K8S离线部署笔记-5-Harbor

下载离线安装包

https://github.com/goharbor/harbor/releases

开始安装

# 解压
tar -zxvf harbor-offline-installer-v2.1.0.tgz
cd harbor 
cp harbor.yml.tmpl harbor.yml

# 修改配置文件
vi harbor.yml
hostname: harbor.yourcompany.com
harbor_admin_password = yourpassword

#开始安装
./install.sh

# 开机自启
docker-compose stop
docker-compose up -d

# 卸载
docker-compose down -v

# 检查
docker ps

# 查看日志
cd /var/log/harbor

图形界面配置

# 浏览器访问
http://10.10.51.77/
admin/yourpassword

# 新建用户
operator/yourpassword

# 新建项目
yourproject

客户端配置

# 允许HTTP访问
vi /etc/docker/daemon.json
{ "insecure-registries":["10.10.51.77:80"] }
systemctl daemon-reload 
systemctl restart docker

# docker登录
docker login -u operator -p yourpassword 10.10.51.77:80

# Push镜像
docker images tag nginx 10.10.51.77:80/yourproject/nginx
docker push 10.10.51.77:80/yourproject/nginx

配置SSL（可选）

# 创建自签名CA
openssl genrsa -out ca.key 2048
openssl req -new -x509 -key ca.key -out ca.crt -days 3650 -subj "/C=CN/ST=HB/L=WH/O=DM/OU=YPT/CN=CA" 
openssl x509 -in ca.crt -noout -text
# 签发证书
openssl genrsa -out harbor.key 2048
openssl req -new -sha256 -key harbor.key -out harbor.csr -subj "/C=CN/ST=HB/L=WH/O=DM/OU=YPT/CN=yourcompany.com"
cat <<EOF > harbor.cnf
extensions = san
[san]
keyUsage = digitalSignature
extendedKeyUsage = clientAuth,serverAuth
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
subjectAltName = IP:10.10.51.77,DNS:harbor.yourcompany.com
EOF
openssl x509 -req -sha256 -days 3650 -in harbor.csr -out harbor.crt -CA ca.crt -CAkey ca.key -CAcreateserial -extfile harbor.cnf
openssl x509 -in harbor.crt -noout -text

# 修改harbor.yml
certificate: /root/cert/harbor.crt
private_key: /root/cert/harbor.key

# 重新安装
docker-compose down -v
./install.sh

# 修改hosts
vi /etc/hosts
10.10.51.77    harbor.yourcompany.com

# 浏览器访问
https://harbor.yourcompany.com

# docker信任证书
cp /root/cert/ca.crt /etc/pki/ca-trust/source/anchors
update-ca-trust extract
systemctl restart docker