20 使用Harbor Image Registry

实验环境安装Harbor

[root@clientvm ~]# cd /resources/helm/

kubectl create ns harbor

环境中已经配置好value.yaml文件的更改：

   commonName: 'core.harbor.example.com'
 ......
 service:
  type: LoadBalancer
  ......
 ingress:
  enabled: false
 
 externalURL: https://core.harbor.example.com
 ......
 Loglevel: info

开始安装：

helm install harbor harbor/ --set global.imageRegistry=quay.io --set global.storageClass=managed-nfs-storage --set harborAdminPassword=admin -n harbor

验证：

[root@clientvm helm]# kubectl get svc --namespace harbor -w harbor
NAME     TYPE           CLUSTER-IP     EXTERNAL-IP      PORT(S)                                     AGE
harbor   LoadBalancer   10.111.99.12   192.168.126.41   80:31084/TCP,443:30558/TCP,4443:30338/TCP   72s
[root@clientvm helm]# kubectl get pod --namespace harbor
NAME                                    READY   STATUS    RESTARTS   AGE
harbor-chartmuseum-5cf76fbcf5-msx45     1/1     Running   0          77s
harbor-core-7667994b5c-4h6vd            1/1     Running   0          77s
harbor-jobservice-79875b9fd7-lpn8h      1/1     Running   0          77s
harbor-nginx-64985cbb7-vm2rv            1/1     Running   0          77s
harbor-notary-server-59966d95d8-cncz2   1/1     Running   0          77s
harbor-notary-signer-7886df8fc9-jhs2d   1/1     Running   0          77s
harbor-portal-84bd44b7fc-tzjwq          1/1     Running   0          77s
harbor-postgresql-0                     1/1     Running   0          77s
harbor-redis-master-0                   1/1     Running   0          77s
harbor-registry-84c565f65b-5trzb        2/2     Running   0          76s
harbor-trivy-0                          1/1     Running   0          77s

使用service harbor的external IP访问，或者使用之前在value文件中定义的域名访问（需要配置域名的DNS指向harbor这个service 的external IP），用户名：admin，密码：admin

注意：以上安装方式禁用了Ingress，如果在你的环境中没有MetalLB，需要使用Ingress来访问，需要如下步骤：

1. 安装前在配置文件中启用Ingress
2. 安装后默认的ingress无法生效，需要修改harbor-ingress这个ingress，添加如下内容：

spec:
  ingressClassName: nginx

其他环境安装Harbor

参考：https://artifacthub.io/packages/helm/bitnami/harbor

1. 添加helm repo

[root@clientvm ~]# helm repo add bitnami https://charts.bitnami.com/bitnami

2. 下载chart

[root@clientvm ~]# helm pull bitnami/harbor --untar

3. 修改value.yaml文件，指定hostname和external URL，并且指定service类型为LB

   commonName: 'core.harbor.example.com'
 ......
 service:
  type: LoadBalancer
  ......
 ingress:
  enabled: false
 
 externalURL: https://core.harbor.example.com
 ......
 Loglevel: info

4. 设置Image registry，临时admin密码，安装harbor
   其他支持的参数参考： https://artifacthub.io/packages/helm/bitnami/harbor

kubectl create ns harbor

helm install harbor harbor/ --set global.imageRegistry=quay.io --set global.storageClass=managed-nfs-storage --set harborAdminPassword=admin -n harbor

5. 访问
   使用service harbor的external IP访问，或者使用之前定义的域名访问（需要配置域名的DNS指向harbor这个service 的external IP），用户名：admin，密码：admin

[root@clientvm ~]# kubectl get svc --namespace harbor -w harbor
NAME     TYPE           CLUSTER-IP      EXTERNAL-IP      PORT(S)                                     AGE
harbor   LoadBalancer   10.100.50.101   192.168.126.41   80:30301/TCP,443:32428/TCP,4443:32333/TCP   28s

使用Harbor Image Registry

配置本地域名映射

/etc/hosts， IP指向harbor这个service的LB IP。

192.168.126.41 core.harbor.example.com

创建新Project

登录Harbor，创建新的Project，命名为public

上传镜像

配置Docker /etc/docker/daemon.json，增加以下内容，并重新载入服务

"insecure-registries" : ["core.harbor.example.com"],

systemctl reload docker.service

命令行登录Harbor

[root@master ~]# docker login core.harbor.example.com -u admin
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

Tag镜像

docker tag nginx:1.9.1 core.harbor.example.com/public/nginx:1.9.1

上传镜像

[root@master ~]# docker push core.harbor.example.com/public/nginx:1.9.1
The push refers to repository [core.harbor.example.com/public/nginx]
5f70bf18a086: Pushed
23923d6d8fc4: Pushed
2471231f3381: Pushed
21d3d9e179b7: Pushed
7dc0e946afc6: Pushed
a622086a695f: Pushed
d55f823e63e3: Pushed
1.9.1: digest: sha256:a42a428525996f3a84d466ee628a074cac568e0e8c99b5d6f7398be342337039 size: 2805

在K8S中部署Harbor中的镜像

创建Secret

kubectl create secret docker-registry myharbor --docker-username=admin --docker-password=admin --docker-server=core.harbor.example.com

修改默认SA，指定ImagePullSecret

kubectl edit sa default

apiVersion: v1
imagePullSecrets:
- name: myharbor

部署Pod

apiVersion: v1
kind: Pod
metadata:
  name: test-pod-harbor
  labels:
    env: dev
    app: web
spec:
  containers:
  - name: nginx
    image: core.harbor.example.com/public/nginx:1.9.1

[root@clientvm ~]# kubectl apply -f pod.yaml
pod/test-pod-harbor created
[root@clientvm ~]#
[root@clientvm ~]# kubectl get pod
NAME              READY   STATUS             RESTARTS          AGE
test-pod-harbor   1/1     Running            0                 8s