环境准备
需要安装docker，docker-compose
下载harbor文件
[root@master2 harbor]# wget https://github.com/goharbor/harbor/releases/download/v2.8.2/harbor-offline-installer-v2.8.2.tgz
# 解压文件
[root@master2 harbor]# tar -xf harbor-offline-installer-v2.8.2.tgz
生成harbor使用的ssl证书
生成ca私钥
# 生成ca私钥
[root@master2 ca]# openssl genrsa -out ca.key 4096
Generating RSA private key, 4096 bit long modulus (2 primes)
.....................................++++
...........................................................................................................................++++
e is 65537 (0x010001)
### 生成CA证书
```sh
[root@master2 ca]# openssl req -x509 -new -nodes -sha512 -days 3650 \
-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=yourdomain.com" \
-key ca.key \
-out ca.crt
生成域名的证书
# 生成域名的key
[root@master2 ca]# openssl genrsa -out harbor.key 4096
# 生成域名的证书请求文件
[root@master2 ca]#
openssl req -sha512 -new \
-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=yourdomain.com" \
-key harbor.key \
-out harbor.csr
创建x509 v3 扩展文件
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1=yourdomain.com
DNS.2=yourdomain
DNS.3=hostname
EOF
进行证书签发
[root@master2 ca]#
openssl x509 -req -sha512 -days 3650 \
-extfile v3.ext \
-CA ca.crt -CAkey ca.key -CAcreateserial \
-in harbor.csr \
-out harbor.crt
将生成的证书文件拷贝到指定目录
[root@master2 harbor]# mkdir /harbor/ca -p
[root@master2 harbor]# cp harbor.key /harbor/ca/
[root@master2 harbor]# cp harbor.crt /harbor/ca/
修改Harbor配置文件
[root@master2 harbor]# cp harbor.yml.tmpl harbor.yml
修改key文件位置
# 修改harbor.yml文件，该文件中的其他配置可以根据自己的需要进行更改
hostname: my.domain.com
https:
# https port for harbor, default is 443
port: 443
# The path of cert and key files for nginx
certificate: /harbor/ca/harbor.crt
private_key: /harbor/ca/harbor.key
开始安装
# 根据修改的harbor.ym文件初始化生成docker-compose.yml文件
[root@master2 harbor]# ./prepare
# 启动容器
[root@master2 harbor]# docker-compose up -d
卸载安装的Harbor
停止Harbor服务
卸载之前停止所有harbor的服务
[root@master2 harbor]# docker-compose down -v
[+] Running 10/10
✔ Container harbor-jobservice Removed 0.2s
✔ Container registryctl Removed 10.1s
✔ Container nginx Removed 0.1s
✔ Container harbor-portal Removed 0.3s
✔ Container harbor-core Removed 0.1s
✔ Container registry Removed 0.3s
✔ Container redis Removed 0.3s
✔ Container harbor-db Removed 0.3s
✔ Container harbor-log Removed 10.2s
✔ Network harbor_harbor Removed
客户端docker登录测试
由于是自签名证书，因此需要在docker目录下创建一个文件夹保存域名相关的证书文件，待登录时候才能通过认证
Convert `yourdomain.com.crt` to `yourdomain.com.cert`, for use by Docker
# 将harbor.crt文件转换为harbor.cert文件，转换后的文件给docker使用
openssl x509 -inform PEM -in harbor.crt -out harbor.cert
客户端创建目录，将证书复制到这个目录
# 注意创建目录时候最后一级的目录名要与域名一致
cp harbor.cert /etc/docker/certs.d/yourdomain.com/
cp harbor.key /etc/docker/certs.d/yourdomain.com/
cp ca.crt /etc/docker/certs.d/yourdomain.com/
登录验证
➜ Downloads sudo docker login yourdomain.com
Username: admin
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
删除相关目录
# 根据harbor的目录文件里面写的数据存在/data目录
[root@master2 harbor]# rm -rf /data
