Harbor搭建私有仓库(基于https)：

Harbor搭建私有仓库(基于https)

1、环境清理

# 如果没有安装过harbor的可以跳过这一步
# 如果执行过harbor目录下的./install.sh，就会在docker中存在一些镜像和容器，需要删除掉
[root@localhost ~]# docker-compose stop

[root@localhost ~]# docker rm `docker ps -a | grep harbor | awk '{print $1}'`

[root@localhost ~]# docker rmi `docker images | grep harbor | awk '{print $3}'`

2、下载Harbor

# harbor部署需要先安装docker-compose（优先国内下载地址）
[root@localhost ~]# curl -L https://get.daocloud.io/docker/compose/releases/download/1.25.1/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose

# harbor部署需要先安装docker-compose（国外下载地址）
[root@localhost ~]# curl -L https://github.com/docker/compose/releases/download/1.16.1/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose

# 下载harbor
[root@localhost ~]# wget https://github.com/goharbor/harbor/releases/download/v2.5.3/harbor-offline-installer-v2.5.3.tgz

[root@localhost ~]# chmod +x /usr/local/bin/docker-compose

[root@localhost ~]# docker-compose -v
docker-compose version 1.25.1, build a82fef07

[root@localhost ~]# cd /root/harbor/harbor/

[root@localhost harbor]# cp harbor.yml.tmpl harbor.yml

3、使用cfssl创建自签证书

[root@localhost ~]# mkdir /root/ssl

[root@localhost ~]# cd /root/ssl

# 创建两个CA的json
cat > ca-config.json <{
  "signing": {
    "default": {
      "expiry": "99999h"
    },
    "profiles": {
      "kubernetes": {
         "expiry": "99999h",
         "usages": [
            "signing",
            "key encipherment",
            "server auth",
            "client auth"
        ]
      }
    }
  }
}
EOF

cat > ca-csr.json <{
    "CN": "kubernetes",
    "key": {
        "algo": "rsa",
        "size": 2048
    },
    "names": [
        {
            "C": "CN",
            "L": "ShenZhen",
            "ST": "ShenZhen"
        }
    ]
}
EOF

# 初始化CA
cfssl gencert -initca ca-csr.json | cfssljson -bare ca -

# 创建服务端证书的请求文件
cat > reg.harbor.com-csr.json <{
  "CN": "reg.harbor.com",
  "hosts": [],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "ShenZhen",
      "ST": "ShenZhen"
    }
  ]
}
EOF

# 生成域名证书（一个私钥证书：带key 一个数字证书：不带key的）
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes reg.harbor.com-csr.json | cfssljson -bare reg.harbor.com

4、使用https连接harbor

[root@localhost harbor]# systemctl restart docker

[root@reg harbor]# ./prepare

[root@reg harbor]# ./install.sh --with-chartmuseum
#如在启动过程中出现了如下错误，重启docker在安装
# ERROR: error while removing network: network harbor_harbor id d1e176fe77a9fb33b4a4562d60a37807427105708ff4faeef5ead6a631f79457 has active endpoints

# 在服务端新增IP和域名
[root@localhost harbor]# vim /etc/hosts
192.168.211.150 reg.harbor.com	

[root@localhost harbor]# docker login reg.harbor.com
Username: admin
Password: 
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
# 本机可以正常访问Harbor

5、其他机器访问Harbor

# 将数字证书拷贝到其他需要登陆的机器上
[root@localhost ssl]# scp reg.harbor.com.pem [email protected]:/root/

[root@k8s-master1 ~]# mkdir /etc/docker/certs.d/reg.harbor.com -p

[root@k8s-master1 reg.harbor.com]# mv /root/reg.harbor.com.pem ./

[root@k8s-master1 reg.harbor.com]# mv reg.harbor.com.pem reg.harbor.com.crt

[root@k8s-master1 reg.harbor.com]# vim /etc/hosts
192.168.211.150 reg.harbor.com

[root@k8s-master1 reg.harbor.com]# vim /etc/docker/daemon.json 
{
  "registry-mirrors": ["https://b9pmyelo.mirror.aliyuncs.com"],
  "exec-opts": ["native.cgroupdriver=systemd"],
  "insecure-registries": ["reg.harbor.com"]
}

[root@k8s-master1 reg.harbor.com]# docker login reg.harbor.com
Username: admin
Password: 
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
# 至此，其他机器也可访问Harbor

遇到的错误

1、端口冲突

• 执行命令：./install.sh --with-chartmuseum
• 报错信息：ERROR: for proxy Cannot start service proxy: driver failed programming external connectivity on endpoint nginx (530ff64abe848c4b9f4d7ec8f214e4034476da0612f5800dc24677e4e977fb55): Error starting userland proxy: listen tcp4 0.0.0.0:443: bind: address already in use
• 报错原因：443端口被占用

解决方案1、：找到被占用443端口的进程，kill后在执行安装命令
解决方案2、：在配置文件中更改默认端口

http:
  # port for http, default is 80. If https enabled, this port will redirect to https port
  port: 88				# 替换

# https related config
https:
  # https port for harbor, default is 443
  port: 444				# 将443端口替换成没有使用的端口，在重新执行安装命令

2、https认证

• 执行命令：docker login reg.harbor.com:88
• 报错信息：Error response from daemon: Get “https://reg.harbor.com:88/v2/”: http: server gave HTTP response to HTTPS client
• 报错原因：docker1.3.x版本后docker registry交互默认使用的时https，镜像仓库默认使用的是http

解决方案：在docker daemon.json配置文件中新增如下配置

"insecure-registries": ["reg.harbor.com:88"]

重启docker

3、登录超时

• 执行代码：docker login reg.harbor.com:88
• 报错信息：Error response from daemon: Get “http://reg.harbor.com:88/v2/”: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
• 报错原因：可能安装完成之后没有重启harbor，导致缺少了一些启动项

解决方案： 执行 docker-compose restart 重启harbor