部署 harbor 私有仓库

本文档介绍使用 docker-compose 部署 harbor 私有仓库的步骤，你也可以使用 docker 官方的 registry 镜像部署私有仓库(部署 Docker Registry)。

使用的变量

本文档用到的变量定义如下：

  1. $ export NODE_IP=10.64.3.7 # 当前部署 harbor 的节点 IP
  2. $

下载文件

从 docker compose 发布页面下载最新的 docker-compose 二进制文件

  1. $ wget https://github.com/docker/compose/releases/download/1.12.0/docker-compose-Linux-x86_64
  2. $ mv ~/docker-compose-Linux-x86_64 /root/local/bin/docker-compose
  3. $ chmod a+x  /root/local/bin/docker-compose
  4. $ export PATH=/root/local/bin:$PATH
  5. $

从 harbor 发布页面下载最新的 harbor 离线安装包

  1. $ wget  --continue https://github.com/vmware/harbor/releases/download/v1.1.0/harbor-offline-installer-v1.1.0.tgz
  2. $ tar -xzvf harbor-offline-installer-v1.1.0.tgz
  3. $ cd harbor
  4. $

导入 docker images

导入离线安装包中 harbor 相关的 docker images：

  1. $ docker load -i harbor.v1.1.0.tar.gz
  2. $

创建 harbor nginx 服务器使用的 TLS 证书

创建 harbor 证书签名请求：

  1. $ cat > harbor-csr.json <<EOF
  2. {
  3.   "CN": "harbor",
  4.   "hosts": [
  5.     "127.0.0.1",
  6.     "$NODE_IP"
  7.   ],
  8.   "key": {
  9.     "algo": "rsa",
  10.     "size": 2048
  11.   },
  12.   "names": [
  13.     {
  14.       "C": "CN",
  15.       "ST": "BeiJing",
  16.       "L": "BeiJing",
  17.       "O": "k8s",
  18.       "OU": "System"
  19.     }
  20.   ]
  21. }
  22. EOF
  • hosts 字段指定授权使用该证书的当前部署节点 IP，如果后续使用域名访问 harbor则还需要添加域名；

生成 harbor 证书和私钥：

  1. $ cfssl gencert -ca=/etc/kubernetes/ssl/ca.pem \
  2.   -ca-key=/etc/kubernetes/ssl/ca-key.pem \
  3.   -config=/etc/kubernetes/ssl/ca-config.json \
  4.   -profile=kubernetes harbor-csr.json | cfssljson -bare harbor
  5. $ ls harbor*
  6. harbor.csr  harbor-csr.json  harbor-key.pem harbor.pem
  7. $ sudo mkdir -p /etc/harbor/ssl
  8. $ sudo mv harbor*.pem /etc/harbor/ssl
  9. $ rm harbor.csr  harbor-csr.json

修改 harbor.cfg 文件

  1. $ diff harbor.cfg.orig harbor.cfg
  2. 5c5
  3. < hostname = reg.mydomain.com
  4. ---
  5. > hostname = 10.64.3.7
  6. 9c9
  7. < ui_url_protocol = http
  8. ---
  9. > ui_url_protocol = https
  10. 24,25c24,25
  11. < ssl_cert = /data/cert/server.crt
  12. < ssl_cert_key = /data/cert/server.key
  13. ---
  14. > ssl_cert = /etc/harbor/ssl/harbor.pem
  15. > ssl_cert_key = /etc/harbor/ssl/harbor-key.pem

加载和启动 harbor 镜像

  1. $ ./install.sh
  2. [Step 0]: checking installation environment ...
  4. Note: docker version: 17.04.0
  6. Note: docker-compose version: 1.12.0
  8. [Step 1]: loading Harbor images ...
  9. Loaded image: vmware/harbor-adminserver:v1.1.0
  10. Loaded image: vmware/harbor-ui:v1.1.0
  11. Loaded image: vmware/harbor-log:v1.1.0
  12. Loaded image: vmware/harbor-jobservice:v1.1.0
  13. Loaded image: vmware/registry:photon-2.6.0
  14. Loaded image: vmware/harbor-notary-db:mariadb-10.1.10
  15. Loaded image: vmware/harbor-db:v1.1.0
  16. Loaded image: vmware/nginx:1.11.5-patched
  17. Loaded image: photon:1.0
  18. Loaded image: vmware/notary-photon:server-0.5.0
  19. Loaded image: vmware/notary-photon:signer-0.5.0
  22. [Step 2]: preparing environment ...
  23. Generated and saved secret to file: /data/secretkey
  24. Generated configuration file: ./common/config/nginx/nginx.conf
  25. Generated configuration file: ./common/config/adminserver/env
  26. Generated configuration file: ./common/config/ui/env
  27. Generated configuration file: ./common/config/registry/config.yml
  28. Generated configuration file: ./common/config/db/env
  29. Generated configuration file: ./common/config/jobservice/env
  30. Generated configuration file: ./common/config/jobservice/app.conf
  31. Generated configuration file: ./common/config/ui/app.conf
  32. Generated certificate, key file: ./common/config/ui/private_key.pem, cert file: ./common/config/registry/root.crt
  33. The configuration files are ready, please use docker-compose to start the service.
  36. [Step 3]: checking existing instance of Harbor ...
  39. [Step 4]: starting Harbor ...
  40. Creating network "harbor_harbor" with the default driver
  41. Creating harbor-log
  42. Creating registry
  43. Creating harbor-adminserver
  44. Creating harbor-db
  45. Creating harbor-ui
  46. Creating harbor-jobservice
  47. Creating nginx
  49. ✔ ----Harbor has been installed and started successfully.----
  51. Now you should be able to visit the admin portal at https://10.64.3.7.
  52. For more details, please visit https://github.com/vmware/harbor .

访问管理界面

浏览器访问 https://${NODE_IP}，示例的是 https://10.64.3.7

用账号 admin 和 harbor.cfg 配置文件中的默认密码 Harbor12345 登陆系统：

harbor

harbor 运行时产生的文件、目录

  1. $ # 日志目录
  2. $ ls /var/log/harbor/2017-04-19/
  3. adminserver.log  jobservice.log  mysql.log  proxy.log  registry.log  ui.log
  4. $ # 数据目录，包括数据库、镜像仓库
  5. $ ls /data/
  6. ca_download  config  database  job_logs registry  secretkey

docker 客户端登陆

将签署 harbor 证书的 CA 证书拷贝到 /etc/docker/certs.d/10.64.3.7 目录下

  1. $ sudo mkdir -p /etc/docker/certs.d/10.64.3.7
  2. $ sudo cp /etc/kubernetes/ssl/ca.pem /etc/docker/certs.d/10.64.3.7/ca.crt
  3. $

登陆 harbor

  1. $ docker login 10.64.3.7
  2. Username: admin
  3. Password:

认证信息自动保存到 ~/.docker/config.json 文件。

其它操作

下列操作的工作目录均为 解压离线安装文件后 生成的 harbor 目录。

  1. $ # 停止 harbor
  2. $ docker-compose down -v
  3. $ # 修改配置
  4. $ vim harbor.cfg
  5. $ # 更修改的配置更新到 docker-compose.yml 文件
  6. [root@tjwq01-sys-bs003007 harbor]# ./prepare
  7. Clearing the configuration file: ./common/config/ui/app.conf
  8. Clearing the configuration file: ./common/config/ui/env
  9. Clearing the configuration file: ./common/config/ui/private_key.pem
  10. Clearing the configuration file: ./common/config/db/env
  11. Clearing the configuration file: ./common/config/registry/root.crt
  12. Clearing the configuration file: ./common/config/registry/config.yml
  13. Clearing the configuration file: ./common/config/jobservice/app.conf
  14. Clearing the configuration file: ./common/config/jobservice/env
  15. Clearing the configuration file: ./common/config/nginx/cert/admin.pem
  16. Clearing the configuration file: ./common/config/nginx/cert/admin-key.pem
  17. Clearing the configuration file: ./common/config/nginx/nginx.conf
  18. Clearing the configuration file: ./common/config/adminserver/env
  19. loaded secret from file: /data/secretkey
  20. Generated configuration file: ./common/config/nginx/nginx.conf
  21. Generated configuration file: ./common/config/adminserver/env
  22. Generated configuration file: ./common/config/ui/env
  23. Generated configuration file: ./common/config/registry/config.yml
  24. Generated configuration file: ./common/config/db/env
  25. Generated configuration file: ./common/config/jobservice/env
  26. Generated configuration file: ./common/config/jobservice/app.conf
  27. Generated configuration file: ./common/config/ui/app.conf
  28. Generated certificate, key file: ./common/config/ui/private_key.pem, cert file: ./common/config/registry/root.crt
  29. The configuration files are ready, please use docker-compose to start the service.
  30. $ # 启动 harbor
  31. [root@tjwq01-sys-bs003007 harbor]# docker-compose up -d