欢迎光临,赤鹿小组
记录过程,分享经验

CentOS7搭建Harbor镜像仓库及https处理

前言

笔者在规划服务容器化的过程中,对镜像管理有一些思考,最终决定使用Harbor管理镜像;

在局域网搭建Harbor私有仓库,在构建镜像的服务器中构建好服务镜像,并且将镜像传上harbor中,那么测试及开发环境只需要拉取镜像运行,即完成服务的更新:

部署过程

修改hosts文件

笔者以下使用的域名hub.domain.com,并不是实际注册的域名,而是通过修改Hosts文件指向了这个Harbor服务器的地址,你可以修改为自己需要的域名。

[[email protected] ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.1.43 hub.domain.com

创建为Harbor使用Https的CA证书

1、创建证书存放目录

shell
[[email protected] ~]# mkdir -p /data/cert
[[email protected] ~]# cd /data/cert/

2、获得证书授权

shell
[[email protected] cert]# openssl genrsa -out ca.key 4096
[[email protected] cert]# openssl req -x509 -new -nodes -sha512 -days 3650 \
-subj "/C=CN/ST=Guangzhou/L=Guangzhou/O=example/CN=hub.domain.com" \
-key ca.key \
-out ca.crt

3、获得证书服务器

“`shell
# 创建私钥
[[email protected] cert]# openssl genrsa -out hub.domain.com.key 4096
# 生成证书签名
[[email protected] cert]# openssl req -sha512 -new \
-subj "/C=CN/ST=Guangzhou/L=Guangzhou/O=example/CN=hub.domain.com" \
-key hub.domain.com.key \
-out hub.domain.com.csr
# 生成注册表主机的证书
[[email protected] cert]# cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=hub.domain.com
DNS.2=hub.domain
EOF
[[email protected] cert]# openssl x509 -req -sha512 -days 3650 \
-extfile v3.ext \
-CA ca.crt -CAkey ca.key -CAcreateserial \
-in hub.domain.com.csr \
-out hub.domain.com.crt
# 转换证书
[[email protected] cert]# openssl x509 -inform PEM -in hub.domain.com.crt -out hub.domain.com.cert
“`

4、生成完之后的证书目录结构

“`shell
[[email protected] cert]# tree .
.
├── ca.crt
├── ca.key
├── ca.srl
├── hub.domain.com.cert
├── hub.domain.com.crt
├── hub.domain.com.csr
├── hub.domain.com.key
└── v3.ext

0 directories, 8 files
“`

安装及配置Harbor私有仓库

1、下载加解压离线安装版Harbor安装文件

shell
[[email protected] cert]# cd ..
[[email protected] data]# wget https://storage.googleapis.com/harbor-releases/release-1.7.0/harbor-offline-installer-v1.7.1.tgz
[[email protected] data]# tar -xf harbor-offline-installer-v1.7.1.tgz
[[email protected] data]# ls
cert harbor harbor-offline-installer-v1.7.1.tgz

2、编辑harbor.cfg配置文件

shell
[[email protected] data]# cd harbor
[[email protected] harbor]# vim harbor.cfg
# 主要配置下面几项
hostname = hub.domain.com
ui_url_protocol = https
......
ssl_cert = /data/cert/hub.domain.com.crt
ssl_cert_key = /data/cert/hub.domain.com.key

3、为Harbor生成配置文件

shell
[[email protected] harbor]# ./prepare

4、为Docker配置服务器证书,密钥和CA

“`shell
[[email protected] harbor]# mkdir -p /etc/docker/certs.d/hub.demian.com
[[email protected] harbor]# cp hub.domain.com.cert /etc/docker/certs.d/hub.domain.com/
[[email protected] harbor]# cp hub.domain.com.key /etc/docker/certs.d/hub.domain.com/
[[email protected] harbor]# cp ca.crt /etc/docker/certs.d/hub.domain.com/

“`

5、启动Harbor

shell
[[email protected] harbor]# docker-compose up -d

启动完成之后,可以通过以下步骤进行验证:

  • 打开浏览器并输入地址:https://hub.domain.com,它会显示Harbor的用户界面。

    默认账号为admin,密码为Harbor12345

  • 运行Docker命令认证:

    [[email protected] ~]# docker login hub.domain.com
    Username: admin
    Password: 
    WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
    Configure a credential helper to remove this warning. See
    https://docs.docker.com/engine/reference/commandline/login/#credentials-store
    
    Login Succeeded
    

客户端配置CA证书

这里笔者用一台test机(192.168.1.58)配置证书测试可用性,其他服务器的配置也是一样配置,但是一定是要在与Harbor主机同一个局域网中。

1、将Harbor主机中Docker证书目录的证书,拷贝到test机的Docker证书目录(没有该目录先创建)。

shell
[[email protected] ~]# scp /etc/docker/certs.d/hub.domain.com/ca.crt [email protected]:/etc/docker/certs.d/hub.domain.com/
[[email protected] ~]# scp /etc/docker/certs.d/hub.domain.com/ca.crt [email protected]:/etc/docker/certs.d/hub.domain.com/
[[email protected] ~]# scp /etc/docker/certs.d/hub.domain.com/ca.crt [email protected]:/etc/docker/certs.d/hub.domain.com/

2、修改test主机的hosts文件

shell
[[email protected] ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.1.43 hub.domain.com

3、在test主机中,Docker命令登录测试

“`shell
[[email protected] ~]#docker login hub.domain.com
Username: admin
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
“`

Harbor项目配置及镜像上传下载

1、在HarborWeb中建立项目

2、上传操作

修改镜像tag,在test主机使用apline做上传测试。

shell
[[email protected] /root]#docker tag docker.io/alpine hub.domain.com/example/alpine:latest

push镜像到Harbor仓库

shell
[[email protected] /root]#docker push hub.domain.com/example/alpine
The push refers to a repository [hub.domain.com/example/alpine]
503e53e365f3: Pushed
latest: digest: sha256:25b4d910f4b76a63a3b45d0f69a57c3415750021c62d214 size: 528

3、下载操作,在Harbor主机上做下载测试

shell
[[email protected] ~]# docker pull hub.domain.com/example/alpine:latest
latest: Pulling from example/alpine
6c40cc604d8e: Pull complete
Digest: sha256:25b4d910f4b76a63a3b45d0f69a57c3415750021c62d214
Status: Downloaded newer image for hub.domain.com/example/alpine:latest

赞(0)

评论 抢沙发

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址