Harbor自建证书实现Https访问

一、环境准备

主机名：harbor250.lyx.com   IP:10.0.0.250

二、 准备Harbor安装包

root@harbor250:~# wget https://github.com/goharbor/harbor/releases/download/v2.12.2/harbor-offline-installer-v2.12.2.tgz

三、 安装docker，docker-compose并解压harbor安装包

 root@harbor250:~# tar xf oldboyedu-autoinstall-docker-docker-compose.tar.gz
root@harbor250:~# ./install-docker.sh i

root@harbor250:~# tar xf harbor-offline-installer-v2.12.2.tgz -C /usr/local/

四、 配置CA证书

1、进入到harbor程序根目录

 root@harbor250:/usr/local/harbor# ll
total 636508
drwxr-xr-x  2 root root      4096 Mar 25 10:30 ./
drwxr-xr-x 11 root root      4096 Mar 25 10:30 ../
-rw-r--r--  1 root root      3646 Jan 16 22:10 common.sh
-rw-r--r--  1 root root 651727378 Jan 16 22:11 harbor.v2.12.2.tar.gz
-rw-r--r--  1 root root     14288 Jan 16 22:10 harbor.yml.tmpl
-rwxr-xr-x  1 root root      1975 Jan 16 22:10 install.sh*
-rw-r--r--  1 root root     11347 Jan 16 22:10 LICENSE
-rwxr-xr-x  1 root root      2211 Jan 16 22:10 prepare*

 2、创建存放证书的目录

 root@harbor250:/usr/local/harbor# mkdir -pv certs/{ca,harbor-server,docker-client}
mkdir: created directory 'certs'
mkdir: created directory 'certs/ca'
mkdir: created directory 'certs/harbor-server'
mkdir: created directory 'certs/docker-client'
root@harbor250:/usr/local/harbor# tree certs
certs
├── ca
├── docker-client
└── harbor-server

3 directories, 0 files

3、 创建CA的私钥

 root@harbor250:/usr/local/harbor# cd certs/
root@harbor250:/usr/local/harbor/certs# openssl genrsa -out ca/ca.key 4096
root@harbor250:/usr/local/harbor/certs# tree
.
├── ca
│   └── ca.key
├── docker-client
└── harbor-server

3 directories, 1 file

4、 基于自建的CA私钥创建CA证书(注意，证书签发的域名范围)

 root@harbor250:/usr/local/harbor/certs# openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=oldboyedu.com" \
 -key ca/ca.key \
 -out ca/ca.crt
 
 root@harbor250:/usr/local/harbor/certs# tree
 .
├── ca
│   ├── ca.crt
│   └── ca.key
├── docker-client
└── harbor-server

3 directories, 2 files

5、查看自建证书信息

 root@harbor250:/usr/local/harbor/certs# openssl  x509 -in ca/ca.crt -noout -text

五、 配置harbor服务端证书

 1、生成harbor服务器私钥

 root@harbor250:/usr/local/harbor/certs# openssl genrsa -out harbor-server/harbor250.oldboyedu.com.key 4096

root@harbor250:/usr/local/harbor/certs# tree
.
├── ca
│   ├── ca.crt
│   └── ca.key
├── docker-client
└── harbor-server
    └── harbor250.oldboyedu.com.key

3 directories, 3 files

2、 harbor服务器基于私钥签发证书认证请求（csr文件）让自建CA认证

 root@harbor250:/usr/local/harbor/certs# openssl req -sha512 -new \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor250.oldboyedu.com" \
    -key harbor-server/harbor250.oldboyedu.com.key \
    -out harbor-server/harbor250.oldboyedu.com.csr
    
root@harbor250:/usr/local/harbor/certs# tree
.
├── ca
│   ├── ca.crt
│   └── ca.key
├── docker-client
└── harbor-server
    ├── harbor250.oldboyedu.com.csr
    └── harbor250.oldboyedu.com.key

3 directories, 4 files

3、 生成x509 v3 的扩展文件用于认证

 root@harbor250:/usr/local/harbor/certs# cat > harbor-server/v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=harbor250.oldboyedu.com
EOF

root@harbor250:/usr/local/harbor/certs# tree
.
├── ca
│   ├── ca.crt
│   └── ca.key
├── docker-client
└── harbor-server
    ├── harbor250.oldboyedu.com.csr
    ├── harbor250.oldboyedu.com.key
    └── v3.ext

3 directories, 5 files

 4、基于 x509 v3 的扩展文件认证签发harbor server证书

 root@harbor250:/usr/local/harbor/certs# openssl x509 -req -sha512 -days 3650 \
    -extfile harbor-server/v3.ext \
    -CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial \
    -in harbor-server/harbor250.oldboyedu.com.csr \
    -out harbor-server/harbor250.oldboyedu.com.crt
    
root@harbor250:/usr/local/harbor/certs# tree
.
├── ca
│   ├── ca.crt
│   └── ca.key
├── docker-client
└── harbor-server
    ├── harbor250.oldboyedu.com.crt
    ├── harbor250.oldboyedu.com.csr
    ├── harbor250.oldboyedu.com.key
    └── v3.ext

3 directories, 6 files

 5、修改harbor的配置文件使用自建证书

root@harbor250:/usr/local/harbor/certs# cp ../harbor.yml{.tmpl,}
root@harbor250:/usr/local/harbor/certs# vim ../harbor.yml
...
hostname: harbor250.oldboyedu.com
https:
  ...
  certificate: /usr/local/harbor/certs/harbor-server/harbor250.oldboyedu.com.crt
  private_key: /usr/local/harbor/certs/harbor-server/harbor250.oldboyedu.com.key
...
harbor_admin_password: 1
...
data_volume: /var/lib/harbor
... 

 6、安装harbor服务

 root@harbor250:/usr/local/harbor/certs# ../install.sh

 六、访问harbor的webUI

 #在windows上做hosts解析
10.0.0.250 harbor250.oldboyedu.com
#访问测试
https://harbor250.oldboyedu.com/harbor/projects/1/repositories

七、 配置docker客户端证书

1、生成docker客户端证书

 

root@harbor250:/usr/local/harbor/certs# cp ca/ca.crt harbor-server/harbor250.oldboyedu.com.key docker-client/
root@harbor250:/usr/local/harbor/certs# cp harbor-server/harbor250.oldboyedu.com.crt docker-client/harbor250.oldboyedu.com.cert

root@harbor250:/usr/local/harbor/certs# tree
.
├── ca
│   ├── ca.crt
│   └── ca.key
├── docker-client
│   ├── ca.crt
│   ├── harbor250.oldboyedu.com.cert
│   └── harbor250.oldboyedu.com.key
└── harbor-server
    ├── harbor250.oldboyedu.com.crt
    ├── harbor250.oldboyedu.com.csr
    ├── harbor250.oldboyedu.com.key
    └── v3.ext

3 directories, 9 files

 2、docker客户端创建自建证书的目录结构(注意域名的名称和目录要一致~)

 root@elk91:~# mkdir -pv /etc/docker/certs.d/harbor250.oldboyedu.com/

3、 拷贝docker client证书文件到客户端

root@elk91:~# echo 10.0.0.250 harbor250.oldboyedu.com >> /etc/hosts
root@elk91:~# scp harbor250.oldboyedu.com:/usr/local/harbor/certs/docker-client/* /etc/docker/certs.d/harbor250.oldboyedu.com/
root@elk91:~# ll /etc/docker/certs.d/harbor250.oldboyedu.com/
total 20
drwxr-xr-x 2 root root 4096 Mar 25 12:10 ./
drwxr-xr-x 3 root root 4096 Mar 25 12:01 ../
-rw-r--r-- 1 root root 2049 Mar 25 12:10 ca.crt
-rw-r--r-- 1 root root 2155 Mar 25 12:10 harbor250.oldboyedu.com.cert
-rw------- 1 root root 3272 Mar 25 12:10 harbor250.oldboyedu.com.key

4、 客户端登录测试

 root@elk91:~# docker login -u admin -p 1 harbor250.oldboyedu.com
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded