k8s上部署Harbor通过Nginx-Ingress域名访问

原创

已于 2024-11-23 14:50:20 修改

· 4.3k 阅读

8 ·

版权

文章标签：

#kubernetes #nginx #运维

于 2022-11-28 19:47:47 首次发布

1、k8s集群环境，通过kubesphere安装部署。

2.9、编辑ingress文件，类型vim操作

2.9.1、部署nginx-ingress-controller

2.9.2、查看配置Ingress的配置结果

3、访问

3.1、window配置hosts

3.2、访问地址

1、k8s集群环境，通过kubesphere安装部署。

1.1 集群基本信息

1.2 集群节点信息

2、安装Harbor

2.1、使用Helm添加Harbor仓库

helm repo add harbor https://helm.goharbor.io
helm pull harbor/harbor

运行上面命令，得到文件harbor-1.10.2.tgz，将文件解压，并重命名为harbor。

如果是高版本，可能需要升级到helm版本

2.2 、通过openssl生成证书

harbor目录下存在cert，执行cp -r cert bak，对默认的cert文件进行备份。

cd cert

openssl genrsa -des3 -passout pass:over4chars -out tls.pass.key 2048
...
openssl rsa -passin pass:over4chars -in tls.pass.key -out tls.key
# Writing RSA key

rm -rf tls.pass.key

openssl req -new -key tls.key -out tls.csr
...
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:liebe
Organizational Unit Name (eg, section) []:liebe
Common Name (eg, your name or your server's hostname) []:harbon.liebe.com.cn
Email Address []:你的邮箱地址

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:talent
An optional company name []:liebe

生成 SSL 证书
自签名 SSL 证书是从私钥和文件生成的。tls.keytls.csr
openssl x509 -req -sha256 -days 365 -in tls.csr -signkey tls.key -out tls.crt

2.3、创建secret

执行命令

kubectl create secret tls harbor.liebe.com.cn --key tls.key --cert tls.crt -n pig-dev

查看创建结果

kubectl get secret -n pig-dev

2.4、创建nfs存储目录

  mkdir -p /home/data/nfs-share/harbor/registry
  mkdir -p /home/data/nfs-share/harbor/chartmuseum
  mkdir -p /home/data/nfs-share/harbor/jobservice
  mkdir -p /home/data/nfs-share/harbor/database
  mkdir -p /home/data/nfs-share/harbor/redis
  mkdir -p /home/data/nfs-share/harbor/trivy  
  mkdir -p /home/data/nfs-share/harbor/jobservicedata
  mkdir -p /home/data/nfs-share/harbor/jobservicelog
  chmod 777 /home/data/nfs-share/harbor/*

2.5、创建pv

#第1个
apiVersion: v1
kind: PersistentVolume
metadata:
  name: harbor-registry
  namespace: pig-dev
  labels:
    app: harbor-registry
spec:
  capacity:
    storage: 150Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: "managed-nfs-storage"
  mountOptions:
    - hard
  nfs:
    path: /home/data/nfs-share/harbor/registry
    server: 10.10.10.89
---
#第2个
apiVersion: v1
kind: PersistentVolume
metadata:
  name: harbor-chartmuseum
  namespace: pig-dev
  labels:
    app: harbor-chartmuseum
spec:
  capacity:
    storage: 10G
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: "managed-nfs-storage"
  mountOptions:
    - hard
  nfs:
    path: /home/data/nfs-share/harbor/chartmuseum
    server: 10.10.10.89
---
#第3个
apiVersion: v1
kind: PersistentVolume
metadata:
  name: harbor-jobservicelog
  namespace: pig-dev
  labels:
    app: harbor-jobservicelog
spec:
  capacity:
    storage: 10G
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: "managed-nfs-storage"
  mountOptions:
    - hard
  nfs:
    path: /home/data/nfs-share/harbor/jobservicelog
    server: 10.10.10.89
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: harbor-jobservicedata
  namespace: pig-dev
  labels:
    app: harbor-jobservicedata
spec:
  capacity:
    storage: 10G
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: "managed-nfs-storage"
  mountOptions:
    - hard
  nfs:
    path: /home/data/nfs-share/harbor/jobservicedata
    server: 10.10.10.89
---
#第4个
apiVersion: v1
kind: PersistentVolume
metadata:
  name: harbor-database
  namespace: pig-dev
  labels:
    app: harbor-database
spec:
  capacity:
    storage: 10G
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: "managed-nfs-storage"
  mountOptions:
    - hard
  nfs:
    path: /home/data/nfs-share/harbor/database
    server: 10.10.10.89
---
#第5个
apiVersion: v1
kind: PersistentVolume
metadata:
  name: harbor-redis
  namespace: pig-dev
  labels:
    app: harbor-redis
spec:
  capacity:
    storage: 10G
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: "managed-nfs-storage"
  mountOptions:
    - hard
  nfs:
    path: /home/data/nfs-share/harbor/redis
    server: 10.10.10.89
---
#第6个
apiVersion: v1
kind: PersistentVolume
metadata:
  name: harbor-trivy
  namespace: pig-dev
  labels:
    app: harbor-trivy
spec:
  capacity:
    storage: 10G
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: "managed-nfs-storage"
  mountOptions:
    - hard
  nfs:
    path: /home/data/nfs-share/harbor/trivy
    server: 10.10.10.89

2.6、创建pvc

#第1个
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: harbor-registry
  namespace: pig-dev
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: "managed-nfs-storage"
  resources:
    requests:
      storage: 150Gi
---
#第2个
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: harbor-chartmuseum
  namespace: pig-dev
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: "managed-nfs-storage"
  resources:
    requests:
      storage: 10Gi
---
#第3个
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: harbor-jobservicelog
  namespace: pig-dev
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: "managed-nfs-storage"
  resources:
    requests:
      storage: 5Gi
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: harbor-jobservicedata
  namespace: pig-dev
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: "managed-nfs-storage"
  resources:
    requests:
      storage: 5Gi
---
#第4个
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: harbor-database
  namespace: pig-dev
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: "managed-nfs-storage"
  resources:
    requests:
      storage: 10Gi
---
#第5个
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: harbor-redis
  namespace: pig-dev
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: "managed-nfs-storage"
  resources:
    requests:
      storage: 10Gi
---
#第6个
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: harbor-trivy
  namespace: pig-dev
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: "managed-nfs-storage"
  resources:
    requests:
      storage: 10Gi

2.7、values.yaml配置文件

expose:
  # Set how to expose the service. Set the type as "ingress", "clusterIP", "nodePort" or "loadBalancer"
  # and fill the information in the corresponding section
  type: ingress
  tls:
    # Enable TLS or not.
    # Delete the "ssl-redirect" annotations in "expose.ingress.annotations" when TLS is disabled and "expose.type" is "ingress"
    # Note: if the "expose.type" is "ingress" and TLS is disabled,
    # the port must be included in the command when pulling/pushing images.
    # Refer to https://github.com/goharbor/harbor/issues/5291 for details.
    enabled: true
    # The source of the tls certificate. Set as "auto", "secret"
    # or "none" and fill the information in the corresponding section
    # 1) auto: generate the tls certificate automatically
    # 2) secret: read the tls certificate from the specified secret.
    # The tls certificate can be generated manually or by cert manager
    # 3) none: configure no tls certificate for the ingress. If the default
    # tls certificate is configured in the ingress controller, choose this option
    certSource: "secret"
    auto:
      # The common name used to generate the certificate, it's necessary
      # when the type isn't "ingress"
      commonName: ""
    secret:
      # The name of secret which contains keys named:
      # "tls.crt" - the certificate
      # "tls.key" - the private key
      secretName: "harbor.liebe.com.cn"
      # The name of secret which contains keys named:
      # "tls.crt" - the certificate
      # "tls.key" - the private key
      # Only needed when the "expose.type" is "ingress".
      notarySecretName: "harbor.liebe.com.cn"
  ingress:
    hosts:
      core: harbor.liebe.com.cn
      notary: notary-harbor.liebe.com.cn
    # set to the type of ingress controller if it has specific requirements.
    # leave as `default` for most ingress controllers.
    # set to `gce` if using the GCE ingress controller
    # set to `ncp` if using the NCP (NSX-T Container Plugin) ingress controller
    # set to `alb` if using the ALB ingress controller
    controller: default
    ## Allow .Capabilities.KubeVersion.Version to be overridden while creating ingress
    kubeVersionOverride: ""
    className: ""
    annotations:
      # note different ingress controllers may require a different ssl-redirect annotation
      # for Envoy, use ingress.kubernetes.io/force-ssl-redirect: "true" and remove the nginx lines below
      ingress.kubernetes.io/ssl-redirect: "true"
      ingress.kubernetes.io/proxy-body-size: "1024m"
      #### 如果是 traefik ingress，则按下面配置：
#      kubernetes.io/ingress.class: "traefik"
#      traefik.ingress.kubernetes.io/router.tls: 'true'
#      traefik.ingress.kubernetes.io/router.entrypoints: websecure
      #### 如果是 nginx ingress，则按下面配置：
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
      nginx.ingress.kubernetes.io/proxy-body-size: "1024m"
      nginx.org/client-max-body-size: "1024m"
    notary:
      # notary ingress-specific annotations
      annotations: {}
      # notary ingress-specific labels
      labels: {}
    harbor:
      # harbor ingress-specific annotations
      annotations: {}
      # harbor ingress-specific labels
      labels: {}
  clusterIP:
    # The name of ClusterIP service
    name: harbor
    # Annotations on the ClusterIP service
    annotations: {}
    ports:
      # The service port Harbor listens on when serving HTTP
      httpPort: 80
      # The service port Harbor listens on when serving HTTPS
      httpsPort: 443
      # The service port Notary listens on. Only needed when notary.enabled
      # is set to true
      notaryPort: 4443
  nodePort:
    # The name of NodePort service
    name: harbor
    ports:
      http:
        # The service port Harbor listens on when serving HTTP
        port: 80
        # The node port Harbor listens on when serving HTTP
        nodePort: 30102
      https:
        # The service port Harbor listens on when serving HTTPS
        port: 443
        # The node port Harbor listens on when serving HTTPS
        nodePort: 30103
      # Only needed when notary.enabled is set to true
      notary:
        # The service port Notary listens on
        port: 4443
        # The node port Notary listens on
        nodePort: 30104
  loadBalancer:
    # The name of LoadBalancer service
    name: harbor
    # Set the IP if the LoadBalancer supports assigning IP
    IP: ""
    ports:
      # The service port Harbor listens on when serving HTTP
      httpPort: 80
      # The service port Harbor listens on when serving HTTPS
      httpsPort: 443