1.一台Centos7服务器(docker已安装, ip : 192.168.1.105),此服务器准备安装镜像仓库;
2.一台Centos7服务器(docker已安装, ip : 192.168.1.106),此服务器测试从Harbor镜像仓库push和pull镜像用。
下载安装包:https://github.com/goharbor/harbor/releases
tar zxvf harbor-online-installer-v1.8.1.tgz
hostname: 192.168.1.105
http:
port will redirect to https port
port: 80
https:
port: 443
certificate: /data/cert/192.168.1.105.crt
private_key: /data/cert/192.168.1.105.key
harbor_admin_password: Harbor12345
database:
password: root123
data_volume: /data
./prepare
服务器必须先安装Docker Compose
./install.sh
安装完成,可以在浏览器中登录;但是使用另一台主机从镜像仓库中拉取镜像时将报错:
http: server gave HTTP response to HTTPS client
原因是docker作为客户端,发送的是https请求,仓库未配置https.
可参考: https://goharbor.io/docs/2.0.0/install-config/configure-https/
以下ip修改为Harbor服务器的ip
生成CA证书私钥
openssl genrsa -out ca.key 4096
生成CA证书
openssl req -x509 -new -nodes -sha512 -days 3650 \
-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=192.168.1.105"\
-key ca.key \
-out ca.crt
生成服务器证书私钥
openssl genrsa -out 192.168.1.105.key 4096
生成服务器证书
openssl req -sha512 -new \
-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=192.168.1.105" \
-key 92.168.1.105.key \
-out 92.168.1.105.csr
这里不能按照官网的安装,官网使用的是域名.
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = 192.168.1.105
harbor.yml配置文件中,certificate和private_key文件路径在/data/cert/下,所以要把生成的服务器证书放在这个目录下
mkdir /data/cert/
cp 192.168.1.105.crt /data/cert/
cp 192.168.1.105.key /data/cert/
将.crt文件转换为.cert文件,供docker使用
openssl x509 -inform PEM -in yourdomain.com.crt -out yourdomain.com.cert
mkdir -p /etc/docker/certs.d/192.168.1.105/
cp 192.168.1.105.cert /etc/docker/certs.d/192.168.1.105/
cp 192.168.1.105.key /etc/docker/certs.d/192.168.1.105/
cp ca.crt /etc/docker/certs.d/192.168.1.105/
systemctl restart docker
将192.168.1.105.crt拷贝至本机安装,浏览器就能用https正常访问.
docker login 192.168.1.105
将报错:
Error response from daemon: Get https://192.168.1.105/v2/: x509: certificate signed by unknown authority
将ca.crt拷贝至192.168.1.106主机
mkdir –p /etc/docker/certs.d/192.168.1.105
cp ca.crt /etc/docker/certs.d/192.168.1.105/ca.crt
systemctl restart docker
出现:Login Succeeded,表示登录成功
docker tag SOURCE_IMAGE[:TAG] 192.168.1.105/项目名/IMAGE[:TAG]
docker push 10.82.13.105/项目名/IMAGE[:TAG]
docker pull 10.82.13.105/项目名/IMAGE[:TAG]