生产环境搭建高可用Harbor（包括恢复演练实操）

生产环境搭建高可用Harbor（包括恢复演练实操）

前言

因资源成本问题，本Harbor高可用架构为最小开销方案，如果资源充足，可以将PG、Redis全部使用使用云厂商集群模式。

同时为了配置简单，并没用使用keepalived与heartbeat等高可用开源组件。

准备工作

阿里云SLB	阿里云ECS	共享存储	Redis
最小实例SLB	2c4g 俩台	阿里云NFS	阿里云Redis

操作系统为Ubuntu18.04，在俩台ECS上搭建主从PG，如果不想用阿里云redis，也可以使用ECS搭建Redis。

安装Harbor，用于导出基础harbor数据，恢复到PG集群中.

1. 安装docker-compose

   curl -L "https://github.com/docker/compose/releases/download/1.24.0/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
   sudo chmod +x /usr/local/bin/docker-compose
   sudo add-apt-repository "deb [arch=amd64] http://mirrors.aliyun.com/docker-ce/linux/ubuntu $(lsb_release -cs) stable"
   # 添加国内阿里云
   curl -fsSL http://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg | sudo apt-key add -
   #更新
   sudo apt-get update
   [[查看docker]]版本
   apt-cache madison docker-ce
   #安装最新版
   sudo apt-get install -y docker-ce
   [[安装5]]:19.03.6~3-0~ubuntu-bionic版
   sudo apt-get install -y docker-ce=5:19.03.6~3-0~ubuntu-bionic
   

2. Docker配置镜像加速与国内docker-cn源

   sudo tee /etc/docker/daemon.json <<-'EOF'
   {
     "registry-mirrors": ["https://8sab4djv.mirror.aliyuncs.com"],
       "registry-mirrors": ["https://registry.docker-cn.com"],
     "insecure-registries": ["https://harbor.unixsre.com"]
   }
   EOF
   sudo systemctl daemon-reload
   sudo systemctl restart docker
   
   
   

   

3. 安装Harbor2.3

   # 下载Harbor
   wget -P /usr/local wget https://github.com/goharbor/harbor/releases/download/v2.3.2/harbor-online-installer-v2.3.2.tgz
   
   tar zxf /usr/local/harbor-online-installer-v2.3.2.tgz -C /data/harbor
   
   # 修改配置文件，根据自己的需求进行修改
   cd /var/www/dream/harbor
   cp harbor.yml.tmpl harbor.yml
   # harbor.yml中按需修改或添加如下内容
   # Configuration file of Harbor
   
   # The IP address or hostname to access admin UI and registry service.
   # DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
   hostname: harbor.unixsre.com
   
   # http related config
   http:
     # port for http, default is 80. If https enabled, this port will redirect to https port
     port: 80
   
   # https related config
   https:
     # https port for harbor, default is 443
     port: 443
     # The path of cert and key files for nginx
     certificate: /data/harbor/ssl/unixsre.com.cer
     private_key: /data/harbor/ssl/unixsre.com.key
   
   # # Uncomment following will enable tls communication between all harbor components
   # internal_tls:
   #   # set enabled to true means internal tls is enabled
   #   enabled: true