1. 环境准备
-
硬件配置
- 1C，2G+，50GB+
-
主机名和ip
- harbor250 10.0.0.250
2. docker和docker-compose的部署
3. harbor下载
- GitHub Releases (推荐)：github.com/goharbor/ha…
- 官方文档：goharbor.io/docs/2.10.0…
-
# 下载离线安装包（替换版本号） VERSION=2.12.2 wget https://github.com/goharbor/harbor/releases/download/v${VERSION}/harbor-offline-installer-v${VERSION}.tgz # 解压 tar xf harbor-offline-installer-v${VERSION}.tgz /usr/local/
4. CA证书配置
#4.1 进入到harbor程序的根目录
[root@harbor250 ~]# cd /usr/local/harbor/
[root@harbor250 harbor]#
[root@harbor250 harbor]# ll
total 636508
drwxr-xr-x 2 root root 4096 Jan 2 09:05 ./
drwxr-xr-x 11 root root 4096 Jan 2 09:05 ../
-rw-r--r-- 1 root root 3646 Dec 22 22:10 common.sh
-rw-r--r-- 1 root root 651727378 Dec 22 22:11 harbor.v2.12.2.tar.gz
-rw-r--r-- 1 root root 14288 Dec 22 22:10 harbor.yml.tmpl
-rwxr-xr-x 1 root root 1975 Dec 22 22:10 install.sh*
-rw-r--r-- 1 root root 11347 Dec 22 22:10 LICENSE
-rwxr-xr-x 1 root root 2211 Dec 22 22:10 prepare*
[root@harbor250 harbor]#
#4.2 创建证书存放目录
[root@harbor250 harbor]# mkdir -pv certs/{ca,harbor-server,docker-client}
mkdir: created directory 'certs'
mkdir: created directory 'certs/ca'
mkdir: created directory 'certs/harbor-server'
mkdir: created directory 'certs/docker-client'
[root@harbor250 harbor]#
[root@harbor250 harbor]# tree certs/
certs/
├── ca
├── docker-client
└── harbor-server
3 directories, 0 files
[root@harbor250 harbor]#
#4.3 创建CA的私钥
[root@harbor250 harbor]# cd certs/
[root@harbor250 certs]#
[root@harbor250 certs]# openssl genrsa -out ca/ca.key 4096
[root@harbor250 certs]#
[root@harbor250 certs]# tree
.
├── ca
│ └── ca.key
├── docker-client
└── harbor-server
3 directories, 1 file
[root@harbor250 certs]#
#4.4 基于自建的CA私钥创建CA证书(注意，证书签发的域名范围)
[root@harbor250 certs]# openssl req -x509 -new -nodes -sha512 -days 3650 \
-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=geniusc.com" \
-key ca/ca.key \
-out ca/ca.crt
[root@harbor250 certs]# tree
.
├── ca
│ ├── ca.crt
│ └── ca.key
├── docker-client
└── harbor-server
3 directories, 2 files
[root@harbor250 certs]#
#4.5 查看自建证书信息
[root@harbor250 certs]# openssl x509 -in ca/ca.crt -noout -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
02:ea:3b:33:6a:55:85:d9:0e:76:7f:cd:6c:67:1e:57:bf:0e:7f:f4
Signature Algorithm: sha512WithRSAEncryption
Issuer: C = CN, ST = Beijing, L = Beijing, O = example, OU = Personal, CN = geniusc.com
Validity
Not Before: Jan 2 01:07:50 2026 GMT
Not After : Jan 2 01:07:50 2036 GMT
Subject: C = CN, ST = Beijing, L = Beijing, O = example, OU = Personal, CN = geniusc.com
...
5. harbor服务端证书配置
#5.1 生成harbor服务器的私钥
[root@harbor250 certs]# openssl genrsa -out harbor-server/harbor250.geniusc.com.key 4096
[root@harbor250 certs]#
[root@harbor250 certs]# tree
.
├── ca
│ ├── ca.crt
│ └── ca.key
├── docker-client
└── harbor-server
└── harbor250.geniusc.com.key
3 directories, 3 files
[root@harbor250 certs]#
#5.2 harbor服务器基于私钥签发证书认证请求（csr文件），让自建CA认证
[root@harbor250 certs]# openssl req -sha512 -new \
-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor250.geniusc.com" \
-key harbor-server/harbor250.geniusc.com.key \
-out harbor-server/harbor250.geniusc.com.csr
[root@harbor250 certs]# tree
.
├── ca
│ ├── ca.crt
│ └── ca.key
├── docker-client
└── harbor-server
├── harbor250.geniusc.com.csr
└── harbor250.geniusc.com.key
3 directories, 4 files
[root@harbor250 certs]#
#5.3 生成 x509 v3 的扩展文件用于认证
[root@harbor250 certs]# cat > harbor-server/v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1=harbor250.geniusc.com
EOF
[root@harbor250 certs]# tree
.
├── ca
│ ├── ca.crt
│ └── ca.key
├── docker-client
└── harbor-server
├── harbor250.geniusc.com.csr
├── harbor250.geniusc.com.key
└── v3.ext
3 directories, 5 files
[root@harbor250 certs]#
#5.4 基于 x509 v3 的扩展文件认证签发harbor server证书
[root@harbor250 certs]# openssl x509 -req -sha512 -days 3650 \
-extfile harbor-server/v3.ext \
-CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial \
-in harbor-server/harbor250.geniusc.com.csr \
-out harbor-server/harbor250.geniusc.com.crt
[root@harbor250 certs]# tree
.
├── ca
│ ├── ca.crt
│ └── ca.key
├── docker-client
└── harbor-server
├── harbor250.geniusc.com.crt
├── harbor250.geniusc.com.csr
├── harbor250.geniusc.com.key
└── v3.ext
3 directories, 6 files
[root@harbor250 certs]#
#5.5 修改harbor的配置文件使用自建证书
[root@harbor250 certs]# cp ../harbor.yml{.tmpl,}
[root@harbor250 certs]#
[root@harbor250 certs]# vim ../harbor.yml
...
hostname: harbor250.geniusc.com
https:
...
certificate: /usr/local/harbor/certs/harbor-server/harbor250.geniusc.com.crt
private_key: /usr/local/harbor/certs/harbor-server/harbor250.geniusc.com.key
...
harbor_admin_password: 1
...
data_volume: /var/lib/harbor
...
6.harobr安装部署
#6.1 安装harbor服务
[root@harbor250 certs]# ../install.sh
[Step 0]: checking if docker is installed ...
Note: docker version: 20.10.24
[Step 1]: checking docker-compose is installed ...
Note: docker-compose version: 2.23.0
[Step 2]: loading Harbor images ...
...
[Step 5]: starting Harbor ...
[+] Building 0.0s (0/0) docker:default
[+] Running 10/10
✔ Network harbor_harbor Created 0.0s
✔ Container harbor-log Started 0.0s
✔ Container harbor-db Started 0.0s
✔ Container registryctl Started 0.1s
✔ Container harbor-portal Started 0.1s
✔ Container redis Started 0.1s
✔ Container registry Started 0.1s
✔ Container harbor-core Started 0.0s
✔ Container nginx Started 0.0s
✔ Container harbor-jobservice Started 0.0s
✔ ----Harbor has been installed and started successfully.----
[root@harbor250 certs]#
[root@harbor250 certs]# ss -ntl | grep 80
LISTEN 0 4096 0.0.0.0:80 0.0.0.0:*
LISTEN 0 4096 [::]:80 [::]:*
[root@harbor250 certs]#
7. 访问与测试
#在windows添加hosts文件解析如下:
10.0.0.250 harbor250.geniusc.com
#访问测试:
https://harbor250.geniusc.com/
