【Harbor运维秘籍】打造稳定Harbor，生产环境的高可用解决方案

Bryan Ding

于 2025-03-27 06:24:10 发布

阅读量313

点赞数 5

文章标签：运维

本文链接：https://blog.youkuaiyun.com/zzjlhlcd/article/details/146546728

版权

在当今快速发展的云计算和容器化技术领域，容器镜像的安全和稳定性管理变得至关重要。Harbor作为业界领先的容器镜像仓库，其高可用性部署是保障企业级应用安全运行的关键。本文将带您深入了解如何使用Helm这一强大的工具，部署一个生产级的高可用Harbor环境。

先决条件与架构图

1、Kubernetes 集群 1.10+

2、Helm 2.8.0+

3、高可用入口控制器（Harbor 不管理外部端点）

4、高可用 PostgreSQL（Harbor 不处理数据库 HA 的部署）

5、高可用 Redis（Harbor 不处理 Redis HA 的部署）

6、可跨节点或外部对象存储共享的 PVC

Harbor架构图

部署Harbor

Tip：Redis可以使用容器化部署。因为redis丢数据并不会影响harbor正常运行，反而用容器化部署可以自愈服务

1、下载chart

$ helm repo add harbor https://helm.goharbor.io
$ helm fetch harbor/harbor --untar
$ sudo mv harbor /etc/kubernetes/addons/

2、部署harbor的配置文件

cat <<EOF | sudo tee /etc/kubernetes/addons/harbor-value.yml > /dev/null
# 暴露方式
expose:
  type: ingress
  tls:
    enabled: true
    secret:
      secretName: "harbor-tls"
  ingress:
    hosts:
      core: core.jiaxzeng.com

# 访问harbor URL地址
externalURL: https://core.jiaxzeng.com

# 定义pvc容量
persistence:
  enabled: true
  persistentVolumeClaim:
    registry:
      storageClass: "nfs-storage"
      accessMode: ReadWriteMany
      size: 100Gi
    jobservice:
      jobLog:
        storageClass: "nfs-storage"
        accessMode: ReadWriteMany
        size: 5Gi
    redis:
      storageClass: "nfs-storage"
      accessMode: ReadWriteMany
      size: 2Gi
    trivy:
      storageClass: "nfs-storage"
      accessMode: ReadWriteMany
      size: 5Gi

# harbor密码
harborAdminPassword: "Harbor12345"

# harbor暴露metrics数据
metrics:
  enabled: true

# 配置相关服务参数
nginx:
  replicas: 2
  image:
    repository: 172.139.20.170:5000/library/nginx-photon
    tag: v2.11.0
portal:
  replicas: 2
  image:
    repository: 172.139.20.170:5000/library/harbor-portal
    tag: v2.11.0
core:
  replicas: 2
  image:
    repository: 172.139.20.170:5000/library/harbor-core
    tag: v2.11.0
jobservice:
  replicas: 2
  image:
    repository: 172.139.20.170:5000/library/harbor-jobservice
    tag: v2.11.0
registry:
  replicas: 2
  image:
    repository: 172.139.20.170:5000/library/registry-photon
    tag: v2.11.0
registry:
  replicas: 2
  registry: 
    image:
      repository: 172.139.20.170:5000/library/registry-photon
      tag: v2.11.0
  controller:
    image:
      repository: 172.139.20.170:5000/library/harbor-registryctl
      tag: v2.11.0
database:
  type: external
  external:
    host: "172.139.20.188"
    port: "9999"
    username: "postgres"
    password: "123456"
    coreDatabase: "registry"
redis:
  type: internal
  internal:
    image:
      repository: 172.139.20.170:5000/library/redis-photon
      tag: v2.11.0
exporter:
  replicas: 2
  image:
    repository: 172.139.20.170:5000/library/harbor-exporter
    tag: v2.11.0
EOF

3、生成证书

# ca证书
openssl genrsa -out ca.key 4096

openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=CN/ST=ShangDong/L=GuangZhou/O=Personal/OU=Personal/CN=jiaxzeng.com" \
 -key ca.key \
 -out ca.crt

# 服务证书
$ openssl genrsa -out jiaxzeng.com.key 4096

$ openssl req -sha512 -new \
    -subj "/C=CN/ST=ShangDong/L=GuangZhou/O=Personal/OU=Personal/CN=jiaxzeng.com" \
    -key jiaxzeng.com.key \
    -out jiaxzeng.com.csr

$ cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=core.jiaxzeng.com
DNS.2=jiaxzeng.com
EOF

$ openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in jiaxzeng.com.csr \
    -out jiaxzeng.com.crt

4、harbor证书存放secret

$ kubectl create namespace harbor
namespace/harbor created

$ kubectl -n harbor create secret tls harbor-tls --cert jiaxzeng.com.crt --key jiaxzeng.com.key 
secret/harbor-tls created

5、postgresql创建数据库

$ psql -h 172.139.20.188 -p 9999
postgres=# CREATE DATABASE registry;
CREATE DATABASE

6、部署harbor

$ helm install harbor -n harbor -f /etc/kubernetes/addons/harbor-value.yml /etc/kubernetes/addons/harbor
NAME: harbor
LAST DEPLOYED: Thu Aug 22 18:17:10 2024
NAMESPACE: harbor
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Please wait for several minutes for Harbor deployment to complete.
Then you should be able to visit the Harbor portal at https://core.jiaxzeng.com
For more details, please visit https://github.com/goharbor/harbor

验证

1、查看Pod的状态

$ kubectl -n harbor get pod 
NAME                                READY   STATUS    RESTARTS   AGE
harbor-core-6c9c79469b-6khzb        1/1     Running   0          3m33s
harbor-core-6c9c79469b-hlvsg        1/1     Running   0          3m54s
harbor-exporter-5c599f54d4-sjdxt    1/1     Running   0          12m
harbor-exporter-5c599f54d4-t5vfc    1/1     Running   0          12m
harbor-jobservice-74cb96479-cv26t   1/1     Running   0          3m33s
harbor-jobservice-74cb96479-rgkgc   1/1     Running   0          3m54s
harbor-portal-f7f7956cd-h6f5f       1/1     Running   0          12m
harbor-portal-f7f7956cd-t6jcn       1/1     Running   0          12m
harbor-redis-0                      1/1     Running   0          12m
harbor-registry-7bdfd8f5c-g474c     2/2     Running   0          3m52s
harbor-registry-7bdfd8f5c-sll4z     2/2     Running   0          3m54s

2、浏览器打开验证