在Ubuntu中部署JFrog Container Registry作为私有镜像仓库
安装环境
cat /etc/lsb -release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE =22.04
DISTRIB_CODENAME=jammy
DISTRIB_DESCRIPTION="Ubuntu 22.04.1 LTS"
java -version
java version "1.8.0 _371"
Java(TM) SE Runtime Environment (build 1.8.0_371 -b11)
Java HotSpot(TM) 64-Bit Server VM (build 25.371-b11 , mixed mode)
gcc --version
gcc (Ubuntu 11.3.0-1 ubuntu1 ~22.04.1) 11.3.0
Copyright (C) 2021 Free Software Foundation , Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
g++ --version
g++ (Ubuntu 11.3.0-1 ubuntu1 ~22.04.1) 11.3.0
Copyright (C) 2021 Free Software Foundation , Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
make --version
GNU Make 4.3
Built for x86_64 -pc-linux -gnu
Copyright (C) 1988 -2020 Free Software Foundation , Inc.
License GPLv3+: GNU GPL version 3 or later
This is free software: you are free to change and redistribute it.
There is NO WARRANTY , to the extent permitted by law.
openssl version
OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)
ufw status
Status: inactive
安装步骤
-
访问如下链接下载安装包：
https://jfrog.com/download-jfrog-container-registry/ -
参考官方指导进行安装：
https://jfrog.com/help/r/jfrog-installation-setup-documentation/installing-artifactory-edge?section=UUID-299554f8-c1f7-8541-8f25-a2c712ef6cf3_UUID-53c92cb3-032a-5549-9cfe-9aad8238fe1e -
创建一个JFrog 主目录并将下载的安装程序存档移动到该目录中。
例如：
mkdir jfrog
mv jfrog -artifactory -jcr --linux.tar.gz jfrog
cd jfrog
- 设置JFrog Home 环境变量。
export JFROG_HOME= - 提取压缩存档的内容并将其移动到artifactory 目录。
tar -xvf jfrog -artifactory -jcr --linux.tar.gz
mv artifactory -jcr - artifactory
- 自定义生产配置（可选），包括数据库、Java Opt 和文件存储。
- 将Artifactory 作为前台或守护进程运行，或作为服务运行。
将Artifactory 作为一个进程运行
您可以将Artifactory 作为前台或守护进程运行。作为前台进程运行时，控
制台处于锁定状态，您可以随时停止该进程。
To run as a foreground process
$JFROG_HOME/artifactory/app/bin/artifactoryctl
To run as a daemon process
$JFROG_HOME/artifactory/app/bin/artifactoryctl start
To manage the process
$JFROG_HOME/artifactory/app/bin/artifactoryctl check|stop
将Artifactory 作为服务运行
Artifactory 打包为带有捆绑的Tomcat 的存档文件，以及一个完整的安装脚
本，您可以使用该脚本将其安装为在自定义用户下运行的服务。这目前在
Linux 和Solaris 系统上受支持。
将Artifactory 作为服务运行时，安装脚本会创建一个名为artifactory，必须
对安装目录具有运行和执行权限。建议将Artifactory 下载文件解压缩到向
所有用户授予运行和执行权限的目录中，例如
/opt
要将Artifactory 安装为服务，请到$JFROG_HOME/artifactory/app/bin 目录，
并以root 身份执行以下命令。
# USER (optional) - the user you want application to run as (default =
artifactory)
# GROUP (optional) - the group with which the application will run as. (default
= artifactory)
$JFROG_HOME/artifactory/app/bin/installService.sh [USER [GROUP]]
管理服务
用systemd 或init.d 命令，具体取决于您的系统。
Using systemd
systemctl artifactory.service
Using init.d
service artifactory
- 从您的浏览器访问Artifactory：
http://SERVER_HOSTNAME:8082/ui/ 例如，在本地计算机上：http://localhost:8082/ui/ - 从如下目录检查Artifactory 日志。
$JFROG_HOME/artifactory/var/log
为jfrog 配置TLS 认证
安装Nginx 并启动
wget http://nginx.org/download/nginx-1.25.1.tar.gz
tar -zxvf nginx-1.25.1.tar.gz nginx-1.25.1/
sudo apt install -y libpcre++-dev libssl-dev zlib1g zlib1g-dev
sudo useradd -M -s /sbin/nologin nginx
Sudo su
./configure --prefix=/usr/local/nginx --user=nginx --group=nginx --with-http_stub_status_module --with-http_ssl_module && make && make install
echo $?
cd /usr/local/nginx/
生成证书
参考如下链接：
https://devopscube.com/create-self-signed-certificates-openssl/
如下 {{SERVER_IP}}和 {{Hostname}}需要替换成Jfrog服务器的IP和Hostname
openssl req -x509 \
-sha256 -days 356 \
-nodes \
-newkey rsa:2048 \
-subj "/CN= {{SERVER_IP}}/C=US/L=San Fransisco" \
-keyout rootCA.key -out rootCA.crt
openssl genrsa -out server.key 2048
cat > csr.conf < cert.conf < 将上述server.crt和server.key配置到nginx
参考如下链接修改nginx.conf文件
https://docs.docker.com/registry/recipes/nginx/
https://jfrog.com/help/r/artifactory-configuring-nginx-and-docker-to-work-with-multiple-artifactory-repositories/artifactory-configuring-nginx-and-docker-to-work-with-multiple-artifactory-repositories
vim conf/nginx.conf
user nginx;
worker_processes 1;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
ssl_certificate server.crt;
ssl_certificate_key server.key;
ssl_session_cache shared:SSL:1m;
ssl_prefer_server_ciphers on;
server {
listen 9443 ssl;
server_name artprod2.company.com;
proxy_read_timeout 900;
chunked_transfer_encoding on;
client_max_body_size 0; #disable any limits to avoid HTTP 413 for large image uploads
location /v2 {
proxy_pass http://{{SERVER_IP}}:8082/artifactory/api/docker/docker-remote/v2;
}
}
}
将上述rootCA.crt证书拷贝到远程要连接该私有镜像库的客户机上
cp rootCA.crt /usr/local/share/ca-certificates/keystore.crt
update-ca-certificates
启动nginx
./sbin/nginx
访问:https://SERVER_IP:9443
配置repository
验证使用JCR 中的镜像发布pod
前提：已经使用Rancher2 部署kubernetes 集群
通过Rancher 给对应cluster 配置私有镜像库
上图中，container registery和mirror endpoints设置为SERVER_IP:9443，配置用户名和密码，并勾选Skip TLS Verifications。
发布一个pod 进行测试
参考链接：
https://blog.csdn.net/Uwentaway/article/details/105507746
报错记录：
按照官方文档Run Artifactory as a service时报错：
![systemctl status artifactory.service
○ artifactory.service - Artifactory service
Loaded: loaded (/lib/systemd/system/artifactory.service; enabled; vendor preset: enabled)
Active: inactive (dead)
Aug 16 14:27:22 amax artifactoryManage.sh[3638087]: bash: line 1: _createConsoleLog: command not found
Aug 16 14:27:22 amax artifactoryManage.sh[3638088]: bash: line 1: /home/aihpc/jfrog/artifactory/var/log/console.log: Permission denied
Aug 16 14:27:22 amax su[3638075]: pam_unix(su:session): session closed for user artifactory
Aug 16 14:27:22 amax artifactoryManage.sh[3634770]: ** ERROR: Artifactory Tomcat server did not start. Please check the logs
Aug 16 14:27:22 amax systemd[1]: artifactory.service: Control process exited, code=exited, status=1/FAILURE
Aug 16 14:27:22 amax systemd[1]: artifactory.service: Failed with result 'exit-code'.
Aug 16 14:27:22 amax systemd[1]: Failed to start Artifactory service.
Aug 16 14:27:22 amax systemd[1]: artifactory.service: Consumed 3.528s CPU time.
Aug 16 14:28:07 amax systemd[1]: Stopped Artifactory service.
Aug 16 14:28:07 amax systemd[1]: artifactory.service: Consumed 3.528s CPU time.
报错日志：
Aug 16 14:27:22 amax crontab[3638040]: (root) REPLACE (artifactory)
Aug 16 14:27:22 amax su[3638075]: (to artifactory) root on none
Aug 16 14:27:22 amax su[3638075]: pam_unix(su:session): session opened for user artifactory(uid=998) by (uid=0)
Aug 16 14:27:22 amax artifactoryManage.sh[3638086]: bash: line 1: setupTomcatRedirection: command not found
Aug 16 14:27:22 amax artifactoryManage.sh[3638087]: bash: line 1: _createConsoleLog: command not found
Aug 16 14:27:22 amax artifactoryManage.sh[3638088]: bash: line 1: /home/aihpc/jfrog/artifactory/var/log/console.log: Permission denied
Aug 16 14:27:22 amax su[3638075]: pam_unix(su:session): session closed for user artifactory
Aug 16 14:27:22 amax artifactoryManage.sh[3634770]: ** ERROR: Artifactory Tomcat server did not start. Please check the logs
Aug 16 14:27:22 amax systemd[1]: artifactory.service: Control process exited, code=exited, status=1/FAILURE
尝试更换tar包，依旧报错：
jfrog-artifactory-jcr-7.63.12-linux.tar.gz
jfrog-artifactory-jcr-7.59.16-linux.tar.gz
jfrog-artifactory-jcr-7.46.20-linux.tar.gz
尝试直接使用debian包安装，依然报错：
jfrog-artifactory-jcr-7.63.12.deb
尝试从用户目录换到/opt目录执行installService.sh发现一样报错。
尝试更换操作系统从ubuntu至redhat，执行installService.sh发现一样报错
经测试使用如下方法安装ok
echo "deb https://jfrog.bintray.com/artifactory-debs bionic main" | tee /etc/apt/sources.list.d/jfrog.list
wget -qO - https://releases.jfrog.io/artifactory/api/gpg/key/public | apt-key add -
apt update
apt install jfrog-artifactory-jcr
systemctl status artifactory.service
systemctl start artifactory.service
参考：https://blog.csdn.net/qq_35002542/article/details/124856540