一、安装docker
1.下载docker的rpm包
[[email protected] ~]# ll
-rw-r--r-- 1 root root 101239922 Apr 12 15:29 docker-rpm-20_10_24.tar.gz
2.解压并安装软件包
[[email protected] ~]# tar xf docker-rpm-20_10_24.tar.gz
[[email protected] ~]# cd docker-rpm-20.10/
[[email protected] ~/docker-rpm-20.10]# yum -y localinstall *.rpm
3.添加自动补全功能
[[email protected] ~]# yum -y install bash-completion
[[email protected] ~]# source /usr/share/bash-completion/bash_completion
4.配置镜像加速
[[email protected] ~/docker-rpm-20.10]# mkdir -p /etc/docker
[[email protected] ~/docker-rpm-20.10]# tee /etc/docker/daemon.json <<-'EOF'
> {
> "registry-mirrors": ["自己的加速地址"]
> }
> EOF
[[email protected] ~/docker-rpm-20.10]# systemctl daemon-reload
[[email protected] ~/docker-rpm-20.10]# systemctl restart docker
5.验证镜像加速是否成功
[[email protected] ~]# docker info | grep "Registry Mirrors" -A 1
WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled
Registry Mirrors:
https://tuv7rqqq.mirror.aliyuncs.com/
6.将docker设置为开机自启动
[[email protected] ~]# systemctl enable --now docker
二、安装docker compose
1.添加epel源
[[email protected] ~]# curl -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
2.安装docker-compose
[[email protected] ~]# yum -y install docker-compose
3.查看docker-compose版本
[[email protected] ~]# docker-compose version
docker-compose version 1.18.0, build 8dd22a9
docker-py version: 2.6.1
CPython version: 3.6.8
OpenSSL version: OpenSSL 1.0.2k-fips 26 Jan 2017
三、安装harbor
1.下载harbor软件包
[[email protected] ~]# ll
-rw-r--r-- 1 root root 610192663 Apr 12 09:23 harbor-offline-installer-v1.10.10.tgz
2.创建工作目录
[[email protected] ~]# mkdir -pv /data/softwares
3.解压harbor软件包
[[email protected] ~]# tar xf harbor-offline-installer-v1.10.10.tgz -C /data/softwares/
4.创建证书的工作目录
[[email protected] ~]# mkdir -pv /data/softwares/harbor/certs/{ca,server,client}
5.生成自建CA证书
5.1 进入证书目录
[[email protected] ~]# cd /data/softwares/harbor/certs/
5.2 生成CA私钥
[[email protected] /data/softwares/harbor/certs]# openssl genrsa -out ca/ca.key 4096
5.3 生成ca的自签名证书
[[email protected] /data/softwares/harbor/certs]# openssl req -x509 -new -nodes -sha512 -days 3650 \
> -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=yuanlinux.com" \
> -key ca/ca.key \
> -out ca/ca.crt
6.生成harbor服务器的证书文件及客户端证书
6.1 生成harbor主机的私钥
[[email protected] /data/softwares/harbor/certs]# openssl genrsa -out server/harbor.yuanlinux.com.key 4096
Generating RSA private key, 4096 bit long modulus
6.2 生成harbor主机的证书申请
[[email protected] /data/softwares/harbor/certs]# openssl req -sha512 -new \
-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor.yuanlinux.com" \
-key server/harbor.yuanlinux.com.key \
-out server/harbor.yuanlinux.com.csr
6.3 生成x509 v3扩展文件
[[email protected] /data/softwares/harbor/certs]# cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1=yuanlinux.com
DNS.2=yuanlinux
DNS.3=harbor.yuanlinux.com
EOF
6.4 使用"v3.ext"给harbor主机签发证书
[[email protected] /data/softwares/harbor/certs]# openssl x509 -req -sha512 -days 3650 \
-extfile v3.ext \
-CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial \
-in server/harbor.yuanlinux.com.csr \
-out server/harbor.yuanlinux.com.crt
6.5 将crt文件转换为cert客户端证书文件
[[email protected] /data/softwares/harbor/certs]# openssl x509 -inform PEM -in server/harbor.yuanlinux.com.crt -out server/harbor.yuanlinux.com.cert
6.6 准备docker客户端证书
[[email protected] /data/softwares/harbor/certs]# cp server/harbor.yuanlinux.com.{cert,key} client/
[[email protected] /data/softwares/harbor/certs]# cp ca/ca.crt client/
[[email protected] /data/softwares/harbor/certs]# ll client/
total 12
-rw-r--r-- 1 root root 2029 Apr 12 20:21 ca.crt
-rw-r--r-- 1 root root 2118 Apr 12 20:21 harbor.yuanlinux.com.cert
-rw-r--r-- 1 root root 3243 Apr 12 20:21 harbor.yuanlinux.com.key
6.7 查看所有证书文件结果
[[email protected] /data/softwares/harbor/certs]# ll -R
.:
total 4
drwxr-xr-x 2 root root 48 Apr 12 20:20 ca
drwxr-xr-x 2 root root 83 Apr 12 20:21 client
drwxr-xr-x 2 root root 131 Apr 12 20:21 server
-rw-r--r-- 1 root root 272 Apr 12 20:19 v3.ext
./ca:
total 12
-rw-r--r-- 1 root root 2029 Apr 12 20:18 ca.crt
-rw-r--r-- 1 root root 3243 Apr 12 20:16 ca.key
-rw-r--r-- 1 root root 17 Apr 12 20:20 ca.srl
./client:
total 12
-rw-r--r-- 1 root root 2029 Apr 12 20:21 ca.crt
-rw-r--r-- 1 root root 2118 Apr 12 20:21 harbor.yuanlinux.com.cert
-rw-r--r-- 1 root root 3243 Apr 12 20:21 harbor.yuanlinux.com.key
./server:
total 16
-rw-r--r-- 1 root root 2118 Apr 12 20:21 harbor.yuanlinux.com.cert
-rw-r--r-- 1 root root 2118 Apr 12 20:20 harbor.yuanlinux.com.crt
-rw-r--r-- 1 root root 1716 Apr 12 20:19 harbor.yuanlinux.com.csr
-rw-r--r-- 1 root root 3243 Apr 12 20:18 harbor.yuanlinux.com.key
7.配置harbor服务器使用证书
7.1 切换工作目录
[[email protected] /data/softwares/harbor/certs]# cd ..
[[email protected] /data/softwares/harbor]#
7.2 修改配置文件
[[email protected] /data/softwares/harbor]# cat -n harbor.yml
#修改这几行
5 hostname: harbor.yuanlinux.com
17 certificate: /data/softwares/harbor/certs/server/harbor.yuanlinux.com.crt
18 private_key: /data/softwares/harbor/certs/server/harbor.yuanlinux.com.key
27 harbor_admin_password: 1
8. 安装harbor服务
[[email protected] /data/softwares/harbor]# ./install.sh
9.验证
9.1 Windows验证harbor的https
# C:\Windows\System32\drivers\etc\hosts
10.0.0.250 harbor.yuanlinux.com
9.2 Linux验证harbor的https
9.2.1 配置地址解析
[[email protected] ~]# echo 10.0.0.250 harbor.yuanlinux.com >> /etc/hosts
9.2.2 在docker客户端节点创建自签证书域名存放路径
[[email protected] ~]# mkdir -pv /etc/docker/certs.d/harbor.yuanlinux.com
9.2.3 服务端将证书文件拷贝到客户端docker节点，若不执行该操作，则会报错"x509: certificate signed by unknown authority"
[[email protected] ~]# cp /data/softwares/harbor/certs/client/* /etc/docker/certs.d/harbor.yuanlinux.com/
[[email protected] ~]# ll /etc/docker/certs.d/harbor.yuanlinux.com/
total 12
-rw-r--r-- 1 root root 2029 Apr 12 20:35 ca.crt
-rw-r--r-- 1 root root 2118 Apr 12 20:35 harbor.linuxyuan.com.cert
-rw-r--r-- 1 root root 3243 Apr 12 20:35 harbor.linuxyuan.com.key
9.2.4 登录验证
[[email protected] /data/softwares/harbor]# docker login -u admin -p 1 harbor.yuanlinux.com
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
9.2.5退出登录
[[email protected] ~]# more /root/.docker/config.json
{
"auths": {
"harbor.yuanlinux.com": {
"auth": "YWRtaW46MQ=="
}
}
}
#改文件存储harbor密码，要及时退出
[[email protected] ~]# docker logout harbor.yuanlinux.com
Removing login credentials for harbor.yuanlinux.com
[[email protected] ~]# more /root/.docker/config.json
{
"auths": {}
}
echo YWRtaW46MQ== | base64 -d | more
标签：harbor,root,yuanlinux,--,https,linux,docker,com From： https://www.cnblogs.com/world-of-yuan/p/17369696.html补充
harbor有时重启机器会有服务起不来，要查看一下 #进入harbor目录 [[email protected] /data/softwares/harbor]# docker-compose ps #没起来的话，可以先卸载，然后重新加载 [[email protected] /data/softwares/harbor]# docker-compose down -v -t 1 [[email protected] /data/softwares/harbor]# docker-compose up -d