目录
一.安装harbor
1.安装docker
参考链接:
https://docs.docker.com/engine/install/
2.安装docker compose
参考链接:
https://docs.docker.com/compose/install/
3.解压harbor软件包
(1)创建harbor软件目录
# mkdir -p /yinzhengjie/softwares
(2)解压软件包
# tar xf harbor-offline-installer-v1.10.10.tgz -C /yinzhengjie/softwares
二.配置harbor服务器配置https证书
1.修改harbor配置文件
vim harbor.yml
...
hostname: www.yinzhengjie.com
...
https:
...
certificate: /oldboyedu/softwares/harbor/shengchan/www.yinzhengjie.com_nginx/www.yinzhengjie.com.crt
private_key: /oldboyedu/softwares/harbor/shengchan/www.yinzhengjie.com_nginx/www.yinzhengjie.com.key
2.使得配置生效
# ./prepare
# docker-compose down -t 1
# docker-compose up -d
3.测试服务
# echo 10.0.0.101 www.yinzhengjie.com >> /etc/hosts
# docker login www.yinzhengjie.com
三.配置harbor服务器配置https自签证书
官方文档:
https://goharbor.io/docs/1.10/install-config/configure-https/
1.生成harbor服务器证书
1.1 生成ca的证书
(1)创建证书目录并进入到证书目录
# mkdir /yinzhengjie/softwares/harbor/certs && cd /yinzhengjie/softwares/harbor/certs/
(2)生成ca的私钥
# openssl genrsa -out ca.key 4096
(3)生成ca的自签名证书
# openssl req -x509 -new -nodes -sha512 -days 3650 \
-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=yinzhengjie.com" \
-key ca.key \
-out ca.crt
1.2 生成harbor主机证书
(1)生成harbor主机的私钥
# openssl genrsa -out harbor.yinzhengjie.com.key 4096
(2)生成harbor主机的证书申请
# openssl req -sha512 -new \
-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor.yinzhengjie.com" \
-key harbor.yinzhengjie.com.key \
-out harbor.yinzhengjie.com.csr
(3)生成x509 v3扩展文件
# cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1=yinzhengjie.com
DNS.2=yinzhengjie
DNS.3=harbor.yinzhengjie.com
EOF
(4)使用"v3.ext"给harbor主机签发证书
# openssl x509 -req -sha512 -days 3650 \
-extfile v3.ext \
-CA ca.crt -CAkey ca.key -CAcreateserial \
-in harbor.yinzhengjie.com.csr \
-out harbor.yinzhengjie.com.crt
(5)将crt文件转换为cert客户端证书文件
# openssl x509 -inform PEM -in harbor.yinzhengjie.com.crt -out harbor.yinzhengjie.com.cert
温馨提示:
docker程序认为"*.crt"文件是CA证书文件,"*.cert"客户端证书文件,于是上面第五步需要转换一下,其实使用cp一下也是可以的,内容并没有变化。
2. 配置harbor服务器使用证书
(1)修改harbor的配置文件
# vim /yinzhengjie/softwares/harbor/certs/harbor.yml
...
hostname: harbor.yinzhengjie.com
...
https:
...
certificate: /yinzhengjie/softwares/harbor/certs/harbor.yinzhengjie.com.crt
private_key: /yinzhengjie/softwares/harbor/certs/harbor.yinzhengjie.com.key
...
harbor_admin_password: 1
(2)安装harbor服务
# cd /yinzhengjie/softwares/harbor && ./install.sh
温馨提示:
如果已经安装harbor服务的话,就不需要重复执行"./install.sh"脚本,仅需执行"./prepare"并搭配"docker-compose down"和"docker-compose up -d"即可。
3.验证证书
3.1 Windows验证
如上图所示,Windows成功访问啦。只不过证书是不安全的而已。
3.2 Linux验证
(1)配置地址解析
# echo 10.0.0.13 harbor.yinzhengjie.com >> /etc/hosts
(2)在docker客户端节点创建自签证书域名存放路径
# mkdir -pv /etc/docker/certs.d/harbor.yinzhengjie.com
(3)服务端将证书文件拷贝到客户端docker节点,若不执行该操作,则会报错如上图所示。
# scp /yinzhengjie/softwares/harbor/certs/{harbor.yinzhengjie.com.cert,harbor.yinzhengjie.com.key,ca.crt} 10.0.0.14:/etc/docker/certs.d/harbor.yinzhengjie.com
(3)登录验证,如下图所示。
# docker login -u admin -p 1 harbor.yinzhengjie.com