Harbor镜像仓库的装置与配置
一、装置Harbor
1.环境筹备：
1.一台Centos7服务器(docker已装置, ip : 192.168.1.105),此服务器筹备装置镜像仓库;
2.一台Centos7服务器(docker已装置, ip : 192.168.1.106),此服务器测试从Harbor镜像仓库push和pull镜像用。
2.下载Harbor装置
下载安装包：https://github.com/goharbor/h...
1.解压压缩包
tar zxvf harbor-online-installer-v1.8.1.tgz2.配置harbor.yml文件
hostname: 192.168.1.105http:port will redirect to https port port: 80https: port: 443 certificate: /data/cert/192.168.1.105.crt private_key: /data/cert/192.168.1.105.keyharbor_admin_password: Harbor12345database: password: root123 data_volume: /data3.运行prepare文件
./prepare4.装置
服务器必须先装置Docker Compose
./install.sh装置实现,能够在浏览器中登录;然而应用另一台主机从镜像仓库中拉取镜像时将报错:
http: server gave HTTP response to HTTPS client起因是docker作为客户端,发送的是https申请,仓库未配置https.
二、配置Harbor的HTTPS拜访
可参考: https://goharbor.io/docs/2.0....
以下ip批改为Harbor服务器的ip
1.创立CA证书
生成CA证书私钥
openssl genrsa -out ca.key 4096生成CA证书
openssl req -x509 -new -nodes -sha512 -days 3650 \ -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=192.168.1.105"\ -key ca.key \ -out ca.crt2.生成服务器证书
生成服务器证书私钥
openssl genrsa -out 192.168.1.105.key 4096生成服务器证书
openssl req -sha512 -new \ -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=192.168.1.105" \ -key 92.168.1.105.key \ -out 92.168.1.105.csr3.生成 x509 v3扩大文件
这里不能依照官网的装置,官网应用的是域名.
cat > v3.ext <<-EOFauthorityKeyIdentifier=keyid,issuerbasicConstraints=CA:FALSEkeyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEnciphermentextendedKeyUsage = serverAuthsubjectAltName = 192.168.1.1054.向Harbor和Docker提供证书
1.向Harbor提供证书
harbor.yml配置文件中,certificate和private_key文件门路在/data/cert/下,所以要把生成的服务器证书放在这个目录下
mkdir /data/cert/cp 192.168.1.105.crt /data/cert/cp 192.168.1.105.key /data/cert/2.向docker提供证书
将.crt文件转换为.cert文件,供docker应用
openssl x509 -inform PEM -in yourdomain.com.crt -out yourdomain.com.certmkdir -p /etc/docker/certs.d/192.168.1.105/cp 192.168.1.105.cert /etc/docker/certs.d/192.168.1.105/cp 192.168.1.105.key /etc/docker/certs.d/192.168.1.105/cp ca.crt /etc/docker/certs.d/192.168.1.105/3.重启docker
systemctl restart docker三、验证,测试
1.浏览器应用https登录
将192.168.1.105.crt拷贝至本机装置,浏览器就能用https失常拜访.
2.测试docker是否失常登录
1.应用192.168.1.106服务器登录Harbor
docker login 192.168.1.105将报错:
Error response from daemon: Get https://192.168.1.105/v2/: x509: certificate signed by unknown authority2.制作的ca证书增加到信赖（因为是自签名证书):
将ca.crt拷贝至192.168.1.106主机
mkdir –p /etc/docker/certs.d/192.168.1.105cp ca.crt /etc/docker/certs.d/192.168.1.105/ca.crtsystemctl restart docker呈现:Login Succeeded,示意登录胜利
四、推送和拉取镜像
1.标记镜像
docker tag SOURCE_IMAGE[:TAG] 192.168.1.105/我的项目名/IMAGE[:TAG]2.推送镜像到Harbor
docker push 10.82.13.105/我的项目名/IMAGE[:TAG]3.从Harbor中拉取镜像
docker pull 10.82.13.105/我的项目名/IMAGE[:TAG]