背景：
始终应用的腾讯云的集体仓库做镜像仓库。早些时候腾讯云有了tcr容器镜像服务：
瞄了一眼感觉略贵。集体也就50个之内的image。就想用一下镜像平安，破绽扫描。也没有那么强硬的需要。600多块一个月还是感觉略贵！还是老老实实搭建一下harbor吧！
kubernetes1.21搭建harbor
注：开始在tke下面尝试的是kubernetes1.20.6两个版本差距不大就疏忽吧。最初是在我的腾讯云自建的kubernetes1.21集群上。参考了早些时候集体写的博客：https://duiniwukenaihe.github.io/2019/10/29/k8s-helm-install-hrbor/
1. 下载harbor-helm仓库
git clone形式
git clone https://github.com/goharbor/harbor-helmhelm必备
当然了这里曾经装置了helm3,helm环境是必备的
wget https://get.helm.sh/helm-v3.6.3-linux-amd64.tar.gztar zxvf helm-v3.6.3-linux-amd64.tar.gcd linux-amd64cp helm /usr/local/bin/helm fetch
这里也能够间接helm增加仓库的形式,算是温习一下helm命令吧。我是间接用了git clone的形式
[root@k8s-master-01 harbor-helm]# helm repo add harbor https://helm.goharbor.io"harbor" has been added to your repositories[root@k8s-master-01 harbor-helm]# cd /data/[root@k8s-master-01 data]# helm search repo harborNAME CHART VERSION APP VERSION DESCRIPTION harbor/harbor 1.7.2 2.3.2 An open source trusted cloud native registry th...[root@k8s-master-01 data]# helm fetch harbor/harbor --version 1.7.2批改配置文件
批改value.yaml配置文件：
集群应用traefik代理内部拜访。expose type设置了clusterIP.设置了externalURL，storageclass。如下：
type:
externalURL:
storageclass:
注：因为cbs最小单位容许为10g切步长为10g.故除了registry外其余的存储都应用了10G.当然了应用其余存储可集体正当设置！
helm install装置
helm install harbor -f values.yaml . --namespace kube-opskubectl get pods -n kube-ops -w
注：此图后补的
helm upgrade
如前面更改了values.yaml 更新利用能够应用一下命令降级利用：
helm upgrade harbor -f values.yaml . --namespace kube-ops如删除harbor利用，则：
helm uninstall harbor -n kube-opstraefik代理harbor对外裸露利用:
ingressroute:
cat ingress-harbor.yml
apiVersion: traefik.containo.us/v1alpha1kind: IngressRoutemetadata: namespace: kube-ops name: harbor-httpspec: entryPoints: - web routes: - match: Host(`harbor.xxx.com`) && PathPrefix(`/`) kind: Rule services: - name: harbor-portal port: 80---apiVersion: traefik.containo.us/v1alpha1kind: IngressRoutemetadata: namespace: kube-ops name: harbor-apispec: entryPoints: - web routes: - match: Host(`harbor.xxx.com`) && PathPrefix(`/api`) kind: Rule services: - name: harbor-core port: 80---apiVersion: traefik.containo.us/v1alpha1kind: IngressRoutemetadata: namespace: kube-ops name: harbor-servicespec: entryPoints: - web routes: - match: Host(`harbor.xxx.com`) && PathPrefix(`/service`) kind: Rule services: - name: harbor-core port: 80---apiVersion: traefik.containo.us/v1alpha1kind: IngressRoutemetadata: namespace: kube-ops name: harbor-v2spec: entryPoints: - web routes: - match: Host(`harbor.xxx.com`) && PathPrefix(`/v2`) kind: Rule services: - name: harbor-core port: 80---apiVersion: traefik.containo.us/v1alpha1kind: IngressRoutemetadata: namespace: kube-ops name: harbor-chartrepospec: entryPoints: - web routes: - match: Host(`harbor.xxx.com`) && PathPrefix(`/chartrepo`) kind: Rule services: - name: harbor-core port: 80---apiVersion: traefik.containo.us/v1alpha1kind: IngressRoutemetadata: namespace: kube-ops name: harbor-cspec: entryPoints: - web routes: - match: Host(`harbor.xxx.com`) && PathPrefix(`/c`) kind: Rule services: - name: harbor-core port: 80kubectl apply -f ingress-harbor.yaml
默认登陆密码Harbor12345。当然也能够在value.yaml中进行提前替换批改！
traefik ingress
试一下ingress的形式
helm upgrade harbor -f values.yaml . --namespace kube-ops
留神：这里绑定了 另外一个域名！
web拜访也是失常的！
-----------------------------分隔符------------------------------------------------------------------------------
呈现的其余问题：
web拜访失常 docker login登陆也失常 然而docker push 呈现unkonwn blob？
这样的起因预计是我的slb下面做了http主动跳转https。docker push的时候就呈现了异样。网上看了很多解决的办法无从下手。基本上是说这样的？
最初偷懒用了一个简略的办法：
新建一个slb 。将次要的slb下面摘下个server放在新的slb下面。间接tcp代理。不做http强跳https。
kubectl create secret tls all-xxxx-com --key=2_xxxx.com.key --cert=1_xxxx.com_bundle.crt -n kube-ops
ingress.yaml
apiVersion: traefik.containo.us/v1alpha1kind: IngressRoutemetadata: namespace: kube-ops name: harbor-httpspec: entryPoints: - websecure tls: secretName: all-xxxx-com routes: - match: Host(`harbor.xxxx.com`) && PathPrefix(`/`) kind: Rule services: - name: harbor-portal port: 80---apiVersion: traefik.containo.us/v1alpha1kind: IngressRoutemetadata: namespace: kube-ops name: harbor-apispec: entryPoints: - websecure tls: secretName: all-xxxx-com routes: - match: Host(`harbor.xxxx.com`) && PathPrefix(`/api/`) kind: Rule services: - name: harbor-core port: 80---apiVersion: traefik.containo.us/v1alpha1kind: IngressRoutemetadata: namespace: kube-ops name: harbor-servicespec: entryPoints: - websecure tls: secretName: all-xxxx-com routes: - match: Host(`harbor.xxxx.com`) && PathPrefix(`/service/`) kind: Rule services: - name: harbor-core port: 80---apiVersion: traefik.containo.us/v1alpha1kind: IngressRoutemetadata: namespace: kube-ops name: harbor-v2spec: entryPoints: - websecure tls: secretName: all-xxxx-com routes: - match: Host(`harbor.xxxx.com`) && PathPrefix(`/v2`) kind: Rule services: - name: harbor-core port: 80---apiVersion: traefik.containo.us/v1alpha1kind: IngressRoutemetadata: namespace: kube-ops name: harbor-chartrepospec: entryPoints: - websecure tls: secretName: all-xxxx-com routes: - match: Host(`harbor.xxxx.com`) && PathPrefix(`/chartrepo/`) kind: Rule services: - name: harbor-core port: 80---apiVersion: traefik.containo.us/v1alpha1kind: IngressRoutemetadata: namespace: kube-ops name: harbor-cspec: entryPoints: - websecure tls: secretName: all-xxxx-com routes: - match: Host(`harbor.xxxx.com`) && PathPrefix(`/c/`) kind: Rule services: - name: harbor-core port: 80kubectl apply -f ingress.yaml还发现一个好玩的；
我最终是在我的自建集群搭建的harbor。而后呢存储是cbs！参见：Kuberentes集群增加腾讯云CBS为默认存储。然而我的work节点有ap-shanghai2还有ap-shanghai-3区的主机。尽管3区的节点我设置了不可调度。然而还有有快存储建在了三区而后这样的后果就是pod不能失常running调度。毕竟云硬盘是不能跨区挂载的。解决形式就是新建一个storageclass ap-shanghai-2，更改了harbor中的存储类！
kind: StorageClassapiVersion: storage.k8s.io/v1metadata: name: cbs-shanghai-2provisioner: com.tencent.cloud.csi.cbsparameters: diskZone: ap-shanghai-2当然了 最终我还是换成了nfs......因为我不想给redis database调配10g的硬盘啊 浪费资源。nfs的存储这里更要留神一下selfLink 了，能够参照Kubernetes 1.19.12降级到1.20.9（强调一下selfLink）中selfLink的配置。
体验一下审查服务
嗯呢要更新一下依赖了....
后记：
其实就是想体验一下harbor的审查服务.然而这页面感觉还是不太成熟。扫描实现能不能给我出一个破绽分布图呢？高危破绽比重？每个images的破绽比重？同一个镜像不同tag的破绽趋势？