https访问的Harbor仓库是如何搭建的（另附开机无法启动解决办法）

w275649210

已于 2024-12-20 21:28:59 修改

阅读量597

点赞数 8

文章标签： docker kubernetes https

于 2024-12-09 20:22:48 首次发布

本文链接：https://blog.youkuaiyun.com/w275649210/article/details/144356613

版权

一、配置

内存 4G
CPU 2c
DISK 20G

二、docker的安装与配置

1.安装docker

sudo yum remove docker docker-client docker-client-latest docker-common docker-latest docker-latest-logrotate docker-logrotate docker-engine

# 1.安装必要的一些系统工具
sudo yum install -y yum-utils device-mapper-persistent-data lvm2
# 2.添加软件源信息
sudo yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
# 3.安装软件源
sudo sed -i 's+download.docker.com+mirrors.aliyun.com/docker-ce+' /etc/yum.repos.d/docker-ce.repo
# 4.更新并安装Docker-CE，这里用的是26.1.4
sudo yum makecache fast
sudo yum -y install docker-ce-26.1.4
# 5.创建docker文件夹
sudo mkdir -p /etc/docker

docker version

#Client: Docker Engine - Community
# Version:           26.1.4
# API version:       1.45
# Go version:        go1.21.11
# Git commit:        5650f9b
# Built:             Wed Jun  5 11:32:04 2024
# OS/Arch:           linux/amd64
# Context:           default

2.配置镜像加速器

cat > /etc/docker/daemon.json << EOF
{
    "insecure-registries": [
        "harbor.cn"
    ],
    "registry-mirrors": [
        "https://docker.linkedbus.com",
        "https://docker.xuanyuan.me",
        "https://hub.iyuu.cn"
]
}
EOF
#注意：后续如果不打算配置https访问harbor，这里就需要配置insecure-registries，如果后续配置https的话，就不用写insecure-registries了。
systemctl daemon-reload
systemctl restart docker.service

3.验证docker加速

docker info | grep "Registry Mirrors" -A 1

4.开机自启动

systemctl enable docker

三、安装harbor

1.下载harbor包

#这里以2.10.3为例
wget https://github.com/goharbor/harbor/releases/download/v2.10.3/harbor-offline-installer-v2.10.3.tgz

2.安装docker-compose

#docker23以后有自带的docker compose了，不用额外安装docker-compose，但是需要将docker compose软连接到docker-compose
yum -y install epel-release
yum -y install docker-compose

3.安装harbor

mkdir -p /app/softwares
tar xzvf harbor-offline-installer-v2.10.3.tgz -C /app/softwares

4.生成自建CA证书

mkdir -pv /app/softwares/harbor/certs/{ca,server,client}
cd /app/softwares/harbor/certs/
openssl genrsa -out ca/ca.key 4096
openssl req -x509 -new -nodes -sha512 -days 3650  -subj "/C=CN/ST=Shanghai/L=Shanghai/O=example/OU=Personal/CN=harbor.cn"  -key ca/ca.key  -out ca/ca.crt
ll -R

5.生成harbor服务器的证书文件及客户端证书

#1.生成harbor主机的私钥
openssl genrsa -out server/harbor.cn.key 4096
#2.生成harbor主机的证书申请
openssl req -sha512 -new \
    -subj "/C=CN/ST=Shanghai/L=Shanghai/O=example/OU=Personal/CN=harbor.cn" \
    -key server/harbor.cn.key \
    -out server/harbor.cn.csr
#3.生成x509 v3扩展文件
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=harbor.cn
DNS.2=harbor
EOF
#4.使用"v3.ext"给harbor主机签发证书
openssl x509 -req -sha512 -days 36500 \
    -extfile v3.ext \
    -CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial \
    -in server/harbor.cn.csr \
    -out server/harbor.cn.crt
#5.将crt文件转换为cert客户端证书文件
openssl x509 -inform PEM -in server/harbor.cn.crt -out server/harbor.cn.cert
#6.准备docker客户端证书
cp server/harbor.cn.{cert,key} client/
cp ca/ca.crt client/
ll client/
#7.查看所有证书文件结果
ll -R

6.配置harbor服务器使用证书

#1.切换工作目录
cd /app/softwares/harbor
#2.修改配置文件
cp harbor.yml.tmpl harbor.yml
cat harbor.yml

hostname: harbor.cn
...
https:
  port: 443
  certificate: /app/softwares/harbor/certs/server/harbor.cn.crt
  private_key: /app/softwares/harbor/certs/server/harbor.cn.key
harbor_admin_password: Harbor12345
...

7.安装harbor服务

./install.sh

8.windows验证hatbor的https

#windows配置主机解析
# C:\Windows\System32\drivers\etc\hosts
...
10.0.0.22 harbor.cn

#浏览器访问
https://harbor.cn

9.Linux验证harbor的https

#1.配置地址解析
echo 10.0.0.22 harbor.cn >> /etc/hosts


#2.在docker客户端节点创建自签证书域名存放路径
mkdir -pv /etc/docker/certs.d/harbor.cn

#3.服务端将证书文件拷贝到客户端docker节点
cp /app/softwares/harbor/certs/client/* /etc/docker/certs.d/harbor.cn/

#4.登录验证
docker login -u admin -p Harbor12345 harbor.cn

#5.退出登录
docker logout harbor.cn

#6.#这里是密码，登陆时出现，登出时消失，所以不用时一定要登出
cat /root/.docker/config.json
{
	"auths": {
		"harbor.cn": {
			"auth": "YWRtaW46SGFyYm9yMTIzNDU="
		}
	}
}

四、常见问题-关机之后无法启动harbor

[root@harbor /app/softwares/harbor]# docker ps
CONTAINER ID   IMAGE                         COMMAND                   CREATED          STATUS                    PORTS                       NAMES
39c907f3a7f4   goharbor/harbor-log:v2.10.3   "/bin/sh -c /usr/loc…"   11 minutes ago   Up 36 seconds (healthy)   127.0.0.1:1514->10514/tcp   harbor-log

这时发现，只有一个容器起来了，其它容器都没有启动,有两种解决办法

方法一、手动起容器

docker start `docker ps -aq`
#缺点也很明显，每次开机都要手动启动，并且每次都要启动所有的容器才可以，当然也可以指定容器名字或者容器id，但是比较麻烦

方法二、使用docker-compose重启

cd /oldboyedu/softwares/harbor
docker-compose down
docker-compose up -d
#缺点和方法一一样，也是每次都要手动操作

将方法一或二写入开机自启动

#方法一
echo 'sudo docker start harbor-core harbor-portal registryctl harbor-jobservice nginx redis harbor-db registry harbor-log &>/dev/null '>> /etc/rc.d/rc.local

#方法二
cat >> /etc/rc.d/rc.local <<EOF
sudo docker-compose -f /app/softwares/harbor/docker-compose.yml down &> /dev/null
sudo docker-compose -f /app/softwares/harbor/docker-compose.yml up -d &> /dev/null
EOF
#注意，写入一个就可以

脚本授权

chmod +x /etc/rc.d/rc.local

五、配置其它主机使用https访问harbor

1.发送自签证书到目标主机

#这里以10.0.0.11为例,在目标主机创建文件夹
mkdir -p /etc/docker/certs.d/harbor.cn
#回到harbor主机，复制证书文件到目标主机
scp cp /app/softwares/harbor/certs/client/* root@10.0.0.11:/etc/docker/certs.d/harbor.cn

2.添加host域名解析

echo 10.0.0.22 harbor.cn >> /etc/hosts

3.到目标主机上进行登录操作

docker login -uadmin -pHarbor12345 harbor.cn

WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded