构建企业级私有仓库_harbor-offline-installer-v2.5.4.tgz-优快云博客

本文链接：https://blog.youkuaiyun.com/weixin_72104132/article/details/142877667

下载软件包地址

https://github.com/goharbor/harbor/releases

Harbor 是由vmware公司开源的企业级 Docker Registry 项目。

它提供了以下主要功能和特点：

1. 基于角色的访问控制（RBAC）：可以为不同的用户和用户组分配不同的权限，增强了安全性和管理的灵活性。

2. 镜像复制：支持在不同的 Harbor 实例之间复制镜像，方便在多个数据中心或环境中分发镜像。

3. 图形化用户界面(UI)：提供了直观的 Web 界面，便于管理镜像仓库、项目、用户等。

4. 审计日志：记录了对镜像仓库的各种操作，有助于追踪和审查活动。

5. 垃圾回收：可以清理不再使用的镜像，节省存储空间。

为仓库提供加密传输

生成认证key和证书

[root@docker-hub ~]# mkdir certs
[root@docker-hub ~]# touch lf.org.key

[root@docker-hub harbor]# openssl req -newkey rsa:4096 \
-nodes -sha256 -keyout certs/lf.org.key\ 
-addext "subjectAltName = DNS:www.lfhub.com"\   #指定备用名称
-x509 -days 365 -out certs/lf.org.crt
...+..+....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*......+...+..+.+.........+......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*....+.....+....+..........................+...+.+........+...+...+....+........+......................+.....+..........+......+...........+...+.+........................+...+..+................+...........+.............+..+...+......+....+............+..............+.......+........+.+.....+.+.........+...+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
....+..+....+...........+...+...+.......+.....+.+..+.......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..+.......+..............+.......+...+.....+..........+.....+......+......+...+....+..+.+..+............+.........+.......+.....+....+.....+...+.+............+........+.+........+.+............+..+.+..+....+........+.........................+......+......+...+..+....+..+.......+...........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*...+..........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Shaanxi
Locality Name (eg, city) [Default City]:Xi`an
Organization Name (eg, company) [Default Company Ltd]:lf
Organizational Unit Name (eg, section) []:docker
Common Name (eg, your name or your server's hostname) []:www.lfhub.com
Email Address []:admin@haha.org

# 填写认证信息

为仓库建立登陆认证

安装建立认证文件的工具包

[root@docker-hub ~]# yum install httpd-tools -y

建立认证文件

[root@docker-hub ~]# mkdir  auth
[root@docker-hub ~]# htpasswd -Bc auth/htpasswd lf
New password:
Re-type new password:
Adding password for user lf

#-B 强制使用最安全加密方式
# 默认用md5加密

部署Harbor

注：harbor-offline-installer-v2.5.4.tgz为harbor离线包，下好后可直接上传至需要部署的服务器上，也可使用在线包

对压缩包进行压缩

[root@docker-hub ~]# tar zxf harbor-offline-installer-v2.5.4.tgz
[root@docker-hub ~]# ls
公共  视频  文档  音乐  anaconda-ks.cfg  harbor-offline-installer-v2.5.4.tgz
模板  图片  下载  桌面  harbor           rhel9-vmset.sh

# 压缩后得到一个harbor的目录

[root@docker-hub ~]# cd harbor/
[root@docker-hub harbor]# ls
common.sh  harbor.v2.5.4.tar.gz  harbor.yml.tmpl  install.sh  LICENSE  prepare
[root@docker-hub harbor]# mv harbor.yml.tmpl harbor.yml
[root@docker-hub harbor]# ls
common.sh  harbor.v2.5.4.tar.gz  harbor.yml  install.sh  LICENSE  prepare

# 将harbor.yml.tmpl 重命名为yml文件

编辑harbor.yml文件

修改认证key和证书的路径，以及habor的登录账号密码

将证书文件拷贝到/data目录下

[root@docker-hub harbor]# ll /data/
总用量 0
drwxr-xr-x 3 root root 18 10月 12 15:32 secret
[root@docker-hub harbor]# cp /root/certs/ /data/
cp: 未指定 -r；略过目录'/root/certs/'
[root@docker-hub harbor]# cp /root/certs/ /data/  -r
[root@docker-hub harbor]# cd /data/
[root@docker-hub data]# ls
certs  secret
[root@docker-hub data]# ls certs/
lf.org.crt  lf.org.key

执行脚本

root@docker-hub]# ./install.sh --help
Please set --with-notary #证书签名
Please set --with-trivy #安全扫描
Please set --with-chartmuseum if needs enable Chartmuseum in Harbor
[root@docker-hub]# ./install.sh --with-chartmuseum

执行成功

[Step 5]: starting Harbor ...
WARN[0000] /root/harbor/docker-compose.yml: the attribute `version` is obsolete, it will be ignored, please remove it to avoid potential confusion
[+] Running 12/12
 ✔ Network harbor_harbor              Created                                0.1s
 ✔ Network harbor_harbor-chartmuseum  Created                                0.1s
 ✔ Container harbor-log               Started                                0.4s
 ✔ Container registryctl              Started                                1.3s
 ✔ Container redis                    Started                                1.5s
 ✔ Container registry                 Started                                1.5s
 ✔ Container harbor-portal            Started                                1.3s
 ✔ Container harbor-db                Started                                1.0s
 ✔ Container chartmuseum              Started                                1.5s
 ✔ Container harbor-core              Started                                1.9s
 ✔ Container harbor-jobservice        Start...                               2.5s
 ✔ Container nginx                    Started                                2.5s
✔ ----Harbor has been installed and started successfully.----