Harbor镜像仓库的安装与配置一、安装Harbor1.环境准备 1.一台Centos7服务器(docker已安装, ip : 192.168.1.105),此服务器准备安装镜像仓库; 2.一台Centos7服务器(docker已安装, ip : 192.168.1.106),此服务器测试从Harbor镜像仓库push和pull镜像用。2.下载Harbor安装下载安装包https://github.com/goharbor/h…1.解压压缩包tarzxvf harbor-online-installer-v1.8.1.tgz2.配置harbor.yml文件hostname:192.168.1.105 http: port will redirect to https port port:80https: port:443certificate: /data/cert/192.168.1.105.crt private_key: /data/cert/192.168.1.105.key harbor_admin_password: Harbor12345 database: password: root123 data_volume: /data3.运行prepare文件./prepare4.安装 服务器必须先安装Docker Compose./install.sh安装完成,可以在浏览器中登录;但是使用另一台主机从镜像仓库中拉取镜像时将报错:http: server gave HTTP response to HTTPS client原因是docker作为客户端,发送的是https请求,仓库未配置https.二、配置Harbor的HTTPS访问可参考: https://goharbor.io/docs/2.0…以下ip修改为Harbor服务器的ip1.创建CA证书 生成CA证书私钥openssl genrsa-outca.key4096 生成CA证书openssl req-x509-new-nodes-sha512-days3650\-subj/CCN/STBeijing/LBeijing/Oexample/OUPersonal/CN192.168.1.105\-keyca.key\-outca.crt2.生成服务器证书 生成服务器证书私钥openssl genrsa-out192.168.1.105.key4096 生成服务器证书openssl req-sha512-new\-subj/CCN/STBeijing/LBeijing/Oexample/OUPersonal/CN192.168.1.105\-key92.168.1.105.key\-out92.168.1.105.csr3.生成 x509 v3扩展文件这里不能按照官网的安装,官网使用的是域名.catv3.ext-EOF authorityKeyIdentifierkeyid,issuer basicConstraintsCA:FALSE keyUsage digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment extendedKeyUsage serverAuth subjectAltName 192.168.1.105 EOF4.向Harbor和Docker提供证书1.向Harbor提供证书harbor.yml配置文件中,certificate和private_key文件路径在/data/cert/下,所以要把生成的服务器证书放在这个目录下mkdir/data/cert/cp192.168.1.105.crt /data/cert/cp192.168.1.105.key /data/cert/2.向docker提供证书将.crt文件转换为.cert文件,供docker使用openssl x509-informPEM-inyourdomain.com.crt-outyourdomain.com.certmkdir-p/etc/docker/certs.d/192.168.1.105/cp192.168.1.105.cert /etc/docker/certs.d/192.168.1.105/cp192.168.1.105.key /etc/docker/certs.d/192.168.1.105/cpca.crt /etc/docker/certs.d/192.168.1.105/3.重启dockersystemctl restartdocker三、验证,测试1.浏览器使用https登录将192.168.1.105.crt拷贝至本机安装,浏览器就能用https正常访问.2.测试docker能否正常登录1.使用192.168.1.106服务器登录Harbordockerlogin192.168.1.105将报错:Error response from daemon: Get https://192.168.1.105/v2/: x509: certificate signed by unknown authority2.制作的ca证书添加到信任因为是自签名证书):将ca.crt拷贝至192.168.1.106主机mkdir–p /etc/docker/certs.d/192.168.1.105cpca.crt /etc/docker/certs.d/192.168.1.105/ca.crtsystemctl restartdocker出现:Login Succeeded,表示登录成功四、推送和拉取镜像1.标记镜像dockertag SOURCE_IMAGE[:TAG]192.168.1.105/项目名/IMAGE[:TAG]2.推送镜像到Harbordockerpush192.168.1.105/项目名/IMAGE[:TAG]3.从Harbor中拉取镜像dockerpull192.168.1.105/项目名/IMAGE[:TAG]
