Deploy Harbor on KubeSphere

Harbor is an open-source registry that secures artifacts with policies and role-based access control, ensures images are scanned and free from vulnerabilities, and signs images as trusted.

This tutorial walks you through an example of deploying Harbor from the App Store of KubeSphere.

Prerequisites

  • Please make sure you enable the OpenPitrix system.
  • You need to create a workspace, a project, and a user account for this tutorial. The account needs to be a platform regular user and to be invited as the project operator with the operator role. In this tutorial, you log in as project-regular and work in the project demo-project in the workspace demo-workspace. For more information, see Create Workspaces, Projects, Users and Roles.

Hands-on Lab

Step 1: Deploy Harbor from the App Store

  1. On the Overview page of the project demo-project, click App Store in the upper-left corner.

  2. Find Harbor and click Install on the App Information page.

  3. Set a name and select an app version. Make sure Harbor is deployed in demo-project and click Next.

  4. On the App Settings page, edit the configuration file of Harbor. Pay attention to the following fields.

    type: The method you use to access the Harbor Service. This example uses nodePort.

    tls: Specify whether you want to enable HTTPS. Set it to false for most cases.

    externalURL: The URL exposed to tenants.

    Note

    • Don’t forget to specify externalURL. This field can be very helpful if you have trouble accessing Harbor.

    • Make sure you use the HTTP protocol and its corresponding nodePort in this tutorial. For more information, see the example configuration in FAQ.

    When you finish editing the configuration, click Install to continue.

  5. Wait until Harbor is up and running.

Step 2: Access Harbor

  1. Based on the field expose.type you set in the configuration file, the access method may be different. As this example uses nodePort to access Harbor, visit http://<NodeIP>:30002 as set in the previous step.

    harbor-login

    Note

    You may need to open the port in your security groups and configure related port forwarding rules depending on your where your Kubernetes cluster is deployed.

  2. Log in to Harbor using the default account and password (admin/Harbor12345). The password is defined in the field harborAdminPassword in the configuration file.

    harbor-dashboard

FAQ

  1. How to enable HTTP login?

    Set tls.enabled to false in step 1 above. The protocol of externalURL must be the same as expose.nodePort.ports.

    If you use Docker login, set externalURL to one of insecure-registries in daemon.json, then reload Docker.

    Here is an example configuration file for your reference. Pay special attention to the comments.

    1. ## NOTICE 192.168.0.9 is the example IP address and you must use your own.
    2. expose:
    3.   type: nodePort
    4.   tls:
    5.     enabled: false
    6.     secretName: ""
    7.     notarySecretName: ""
    8.     commonName: "192.168.0.9"  # Change commonName to your own.
    9.   nodePort:
    10.     # The name of NodePort service
    11.     name: harbor
    12.     ports:
    13.       http:
    14.         # The service port Harbor listens on when serving with HTTP
    15.         port: 80
    16.         # The node port Harbor listens on when serving with HTTP
    17.         nodePort: 30002
    18.       https:
    19.         # The service port Harbor listens on when serving with HTTPS
    20.         port: 443
    21.         # The node port Harbor listens on when serving with HTTPS
    22.         nodePort: 30003
    23.       # Only needed when notary.enabled is set to true
    24.       notary:
    25.         # The service port Notary listens on
    26.         port: 4443
    27.         # The node port Notary listens on
    28.         nodePort: 30004
    30. externalURL: http://192.168.0.9:30002 # Use your own IP address.
    32. # The initial password of Harbor admin. Change it from portal after launching Harbor
    33. harborAdminPassword: "Harbor12345"
    34. # The secret key used for encryption. Must be a string of 16 chars.
    35. secretKey: "not-a-secure-key"

  2. How to enable HTTPS login?

    a. Use self-signed certificates.

    • Set tls.enabled to true in the configuration file in step 1, and edit externalURL accordingly.
    • Copy the CA certificates stored in the Pod harbor-core ‘s /etc/core/ca to your host.
    • Trust the CA certificates by your host first, then restart Docker.

    b. Use public SSL.

    • Add certificates as a Secret.
    • Set tls.enabled to true in the configuration file in step 1, and edit externalURL accordingly.
    • Edit tls.secretName.

For more information, see the documentation of Harbor.