一,Harbor简介
- VMware的开源项目https://github.com/vmware/harbor
- Harbor可帮助用户迅速搭建企业级的注册服务。它提供了管理图形界面,基于角色的访问控制(Role Based Access Control),镜像远程复制(同步),AD/LDAP集成,以及审计日志等企业用户需求的功能,同时还原生支持中文,深受中国用户的喜爱。
- 该项目自推出以来,在GitHub获得了超过3300多个star和900多个forks。
1.1 基于角色的访问控制
用户与Docker镜像仓库通过“项目”进行组织管理,一个用户可以对多个镜像仓库在同一命名空间(project)里有不同的权限。
1.2 图形化用户界面
用户可以通过浏览器来浏览,检索当前Docker镜像仓库,管理项目和命名空间
1.3 审计管理
所有针对镜像仓库的操作都可以被记录追溯,用于审计管理。
1.4 国际化
基于英文与中文语言进行了本地化。可以增加更多的语言支持。
1.5 RESTful API:
提供给管理员对于Harbor更多的操控,使得与其他管理软件集成变得更容易。
1.6 LDAP认证
1.7 镜像复制
基于策略的Docker镜像复制功能,可在不同的数据中心,不同的运行环境之间同步镜像,并提供友好的管理界面,大大简化了实际运维中的镜像管理工作。
1.8 与Clair集成
与Clair集成,添加漏洞扫描功能。Clair是coreos开源的容器漏洞扫描工具,在容器逐渐普及的今天,容器镜像安全问题日益严重。Clair是目前少数的开源安全扫描工具。
1.9 Notary签名工具
Notary是Docker镜像的签名工具,用来保证镜像在pull,push和传输工程中的一致性和完整性,避免中间人攻击,避免非法的镜像更新和运行。
二,为Harbor签发域名证书
openssl是目前最流行的SSL密码库工具,提供了一个通用,功能完备的工具套件,用以支持SSL/TLS协议的实现。
官网:https://www.openssl.org/source/
环境准备
主机名 | IP | 用途 | 最小资源配比 | 最佳资源配比 |
---|---|---|---|---|
harbor | 192.168.200.145 | harbor私有镜像仓库 | 2CPU | 4CPU |
4GBMEM | 8GB |
[root@Harbor ~]# hostname -I
192.168.200.145
[root@Harbor ~]# cat /etc/redhat-release
CentOS Linux release 7.5.1804 (Core)
[root@Harbor ~]# uname -r
3.10.0-862.3.3.el7.x86_64
官方文档:https://github.com/vmware/harbor/blob/master/docs/configure_https.md
#创建自己的CA证书
[[root@harbor ~]# mkdir -p /data/ssl
[root@harbor ~]# cd /data/ssl
[root@harbor ssl]# which openssl
/usr/bin/openssl
[root@harbor ssl]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout ca.key -x509 -days 365 -out ca.crt
Generating a 4096 bit RSA private key
...............................................++
...........................................................................................................................................................................................................................................................................................................++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:yunjisuan
Organizational Unit Name (eg, section) []:yunjisuan
Common Name (eg, your name or your server's hostname) []:www.yunjisuan.com
Email Address []:
#生成证书签名请求
[root@harbor ssl]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout www.yunjisuan.com.key -out www.yunjisuan.com.csr
Generating a 4096 bit RSA private key
.........................................................................................................................................................................................++
.................................................++
writing new private key to 'www.yunjisuan.com.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:yunjisuan
Organizational Unit Name (eg, section) []:yunjisuan
Common Name (eg, your name or your server's hostname) []:www.yunjisuan.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
#生成注册表主机的证书
[root@harbor ssl]# openssl x509 -req -days 365 -in www.yunjisuan.com.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out www.yunjisuan.com.crt
Signature ok
subject=/C=CN/ST=Beijing/L=Beijing/O=yunjisuan/OU=yunjisuan/CN=www.yunjisuan.com
Getting CA Private Key
#查看证书情况
[root@harbor ssl]# ll
总用量 24
-rw-r--r-- 1 root root 2049 7月 18 01:16 ca.crt
-rw-r--r-- 1 root root 3272 7月 18 01:16 ca.key
-rw-r--r-- 1 root root 17 7月 18 01:19 ca.srl
-rw-r--r-- 1 root root 1931 7月 18 01:19 www.yunjisuan.com.crt
-rw-r--r-- 1 root root 1716 7月 18 01:17 www.yunjisuan.com.csr
-rw-r--r-- 1 root root 3272 7月 18 01:17 www.yunjisuan.com.key
三,信任自签发的域名证书
由于CA证书是我们自己签发的Linux操作系统是不信任的,因此我们需要把证书加入到系统的信任证书里
#将自签ca证书添加到系统信任
[root@harbor ssl]# pwd
/data/ssl
[root@harbor ssl]# cp www.yunjisuan.com.crt /etc/pki/ca-trust/source/anchors/
#让系统ca信任设置立刻生效
[root@harbor ssl]# update-ca-trust enable
[root@harbor ssl]# update-ca-trust extract
四,Harbor 1.4 版本配置与安装
4.1 安装docker-ce社区版
[root@docker ssl]# sestatus
SELinux status: disabled
[root@Harbor ~]# yum -y install yum-utils device-mapper-persistent-data lvm2
[root@Harbor yum.repos.d]# curl https://download.docker.com/linux/centos/docker-ce.repo -o /etc/yum.repos.d/docker-ce.repo
[root@Harbor ~]# yum -y install docker-ce
[root@Harbor ~]# systemctl start docker
[root@Harbor ~]# systemctl enable docker
Created symlink from /etc/systemd/system/multi-user.target.wants/docker.service to /usr/lib/systemd/system/docker.service.
[root@Harbor ~]# docker version
Client:
Version: 18.03.1-ce
API version: 1.37
Go version: go1.9.5
Git commit: 9ee9f40
Built: Thu Apr 26 07:20:16 2018
OS/Arch: linux/amd64
Experimental: false
Orchestrator: swarm
Server:
Engine:
Version: 18.03.1-ce
API version: 1.37 (minimum version 1.12)
Go version: go1.9.5
Git commit: 9ee9f40
Built: Thu Apr 26 07:23:58 2018
OS/Arch: linux/amd64
Experimental: false
4.2 下载并安装harbor私有仓库
#创建harbor的证书目录,并复制
[root@harbor ssl]# mkdir -p /etc/ssl/harbor
[root@harbor ssl]# cp /data/ssl/www.yunjisuan.com.key /etc/ssl/harbor/
[root@harbor ssl]# cp /data/ssl/www.yunjisuan.com.crt /etc/ssl/harbor/
[root@harbor ssl]# ll /etc/ssl/harbor/
总用量 8
-rw-r--r-- 1 root root 1931 7月 18 01:28 www.yunjisuan.com.crt
-rw-r--r-- 1 root root 3272 7月 18 01:28 www.yunjisuan.com.key
#创建harbor下载目录并下载harbor-offline-installer-v1.5.0.tgz
[root@harbor ssl]# mkdir -p /data/install
[root@harbor ssl]# cd /data/install
[root@harbor install]# pwd
/data/install
[root@Harbor install]# wget http://harbor.orientsoft.cn/harbor-v1.5.0/harbor-offline-installer-v1.5.0.tgz
[root@Harbor install]# ls
harbor-offline-installer-v1.5.0.tgz
[root@Harbor install]# tar xf harbor-offline-installer-v1.5.0.tgz
[root@Harbor install]# ls
harbor harbor-offline-installer-v1.5.0.tgz
[root@Harbor install]# cd harbor
[root@Harbor harbor]# ll
总用量 854960
drwxr-xr-x 3 root root 23 7月 16 22:29 common #模板目录
-rw-r--r-- 1 root root 1185 5月 2 23:34 docker-compose.clair.yml
-rw-r--r-- 1 root root 1725 5月 2 23:34 docker-compose.notary.yml
-rw-r--r-- 1 root root 3596 5月 2 23:34 docker-compose.yml
drwxr-xr-x 3 root root 156 5月 2 23:34 ha #harbor高可用配置
-rw-r--r-- 1 root root 6687 5月 2 23:34 harbor.cfg #harbor配置文件
-rw-r--r-- 1 root root 875401338 5月 2 23:36 harbor.v1.5.0.tar.gz
-rwxr-xr-x 1 root root 5773 5月 2 23:34 install.sh
-rw-r--r-- 1 root root 10771 5月 2 23:34 LICENSE
-rw-r--r-- 1 root root 482 5月 2 23:34 NOTICE
-rwxr-xr-x 1 root root 27379 5月 2 23:34 prepare
[root@Harbor harbor]# cp harbor.cfg{,.bak}
#修改harbor.cfg配置文件
[root@Harbor harbor]# cat -n harbor.cfg.bak | sed -n '7p;11p;23p;24p;68p'
7 hostname = reg.mydomain.com #要修改成我们证书的域名
11 ui_url_protocol = http #启用加密传输协议https
23 ssl_cert = /data/cert/server.crt #证书的位置
24 ssl_cert_key = /data/cert/server.key #证书密钥位置
68 harbor_admin_password = Harbor12345 #默认管理员及密码
#修改成如下配置
[root@Harbor harbor]# cat -n harbor.cfg | sed -n '7p;11p;23p;24p;68p'
7 hostname = www.yunjisuan.com
11 ui_url_protocol = https
23 ssl_cert = /etc/ssl/harbor/www.yunjisuan.com.crt
24 ssl_cert_key = /etc/ssl/harbor/www.yunjisuan.com.key
68 harbor_admin_password = Harbor12345
#安装命令docker-compose(需要1.21版本)
[root@Harbor ~]# curl -L https://github.com/docker/compose/releases/download/1.21.2/docker-compose-$(uname -s)-$(uname -m) -o /usr/local/bin/docker-compose
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 617 0 617 0 0 136 0 --:--:-- 0:00:04 --:--:-- 176
100 10.3M 100 10.3M 0 0 161k 0 0:01:05 0:01:05 --:--:-- 181k
[root@Harbor ~]# ll /usr/local/bin/docker-compose
-rw-r--r-- 1 root root 10858808 7月 16 23:08 /usr/local/bin/docker-compose
[root@Harbor ~]# chmod +x /usr/local/bin/docker-compose
[root@Harbor ~]# which docker-compose
/usr/local/bin/docker-compose
[root@Harbor ~]# docker-compose --version
docker-compose version 1.21.2, build a133471
#安装harbor私有镜像仓库
[root@Harbor harbor]# ./install.sh --with-notary --with-clair #--with-notary启用镜像签名;--with-clair启用漏洞扫描
#查看harbor启动的镜像
[root@Harbor harbor]# docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
5c6fa83f89d8 vmware/nginx-photon:v1.5.0 "nginx -g 'daemon of…" About a minute ago Up About a minute (healthy) 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp, 0.0.0.0:4443->4443/tcp nginx
c6b5c26bbbb9 vmware/harbor-jobservice:v1.5.0 "/harbor/start.sh" About a minute ago Up About a minute harbor-jobservice
bcfdd6c2ef34 vmware/notary-server-photon:v0.5.1-v1.5.0 "/bin/server-start.sh" About a minute ago Up About a minute notary-server
43c6ecfa7c89 vmware/harbor-ui:v1.5.0 "/harbor/start.sh" About a minute ago Up About a minute (healthy) harbor-ui
b66330fdc3a3 vmware/clair-photon:v2.0.1-v1.5.0 "/docker-entrypoint.…" About a minute ago Up About a minute (healthy) 6060-6061/tcp clair
57ec2b07dc55 vmware/notary-signer-photon:v0.5.1-v1.5.0 "/bin/signer-start.sh" About a minute ago Up About a minute notary-signer
1ba4893733ef vmware/registry-photon:v2.6.2-v1.5.0 "/entrypoint.sh serv…" About a minute ago Up About a minute (healthy) 5000/tcp registry
4822f0ca1ea8 vmware/postgresql-photon:v1.5.0 "/entrypoint.sh post…" About a minute ago Up About a minute (healthy) 5432/tcp clair-db
36761f96e8fd vmware/harbor-adminserver:v1.5.0 "/harbor/start.sh" About a minute ago Up About a minute (healthy) harbor-adminserver
eb250cb9b378 vmware/mariadb-photon:v1.5.0 "/usr/local/bin/dock…" About a minute ago Up About a minute 3306/tcp notary-db
122a2e8b7296 vmware/redis-photon:v1.5.0 "docker-entrypoint.s…" About a minute ago Up About a minute 6379/tcp redis
7a0df0e8bb35 vmware/harbor-db:v1.5.0 "/usr/local/bin/dock…" About a minute ago Up About a minute (healthy) 3306/tcp harbor-db
4e4734f8acfa vmware/harbor-log:v1.5.0 "/bin/sh -c /usr/loc…" About a minute ago Up About a minute (healthy) 127.0.0.1:1514->10514/tcp harbor-log
通过浏览器进行访问测试
https://192.168.200.145
最后我还需要修改一下安全模式
项目创建:设定为仅管理
不允许自动注册
五,镜像管理与安全:漏洞扫描和镜像签名
5.1 添加docker国内公有镜像源
[root@harbor harbor]# cat /etc/docker/daemon.json
{
"registry-mirrors":[ "https://registry.docker-cn.com" ]
}
[root@harbor harbor]# systemctl daemon-reload
[root@harbor harbor]# systemctl restart docker
5.2 重新启动Harbor私有镜像仓库
#让harbor修改过的配置立刻生效
[root@harbor harbor]# ./prepare
Clearing the configuration file: ./common/config/adminserver/env
Clearing the configuration file: ./common/config/ui/env
Clearing the configuration file: ./common/config/ui/app.conf
Clearing the configuration file: ./common/config/ui/private_key.pem
Clearing the configuration file: ./common/config/db/env
Clearing the configuration file: ./common/config/jobservice/env
Clearing the configuration file: ./common/config/jobservice/config.yml
Clearing the configuration file: ./common/config/registry/config.yml
Clearing the configuration file: ./common/config/registry/root.crt
Clearing the configuration file: ./common/config/nginx/conf.d/notary.upstream.conf
Clearing the configuration file: ./common/config/nginx/conf.d/notary.server.conf
Clearing the configuration file: ./common/config/nginx/cert/www.yunjisuan.com.crt
Clearing the configuration file: ./common/config/nginx/cert/www.yunjisuan.com.key
Clearing the configuration file: ./common/config/nginx/nginx.conf
Clearing the configuration file: ./common/config/log/logrotate.conf
Clearing the configuration file:
#清理所有harbor容器进程
[root@harbor harbor]# docker-compose down
Stopping harbor-jobservice ... done
Stopping nginx ... done
Stopping harbor-ui ... done
Stopping harbor-adminserver ... done
Stopping redis ... done
Stopping registry ... done
Stopping harbor-log ... done
WARNING: Found orphan containers (notary-server, notary-signer, clair-db) for this project. If you removed or renamed this service in your compose file, you can run this command with the --remove-orphans flag to clean it up.
Removing harbor-jobservice ... done
Removing nginx ... done
Removing harbor-ui ... done
Removing harbor-db ... done
Removing harbor-adminserver ... done
Removing redis ... done
Removing registry ... done
Removing harbor-log ... done
Removing network harbor_harbor
#后台启动所有harbor容器进程
[root@harbor harbor]# docker-compose up -d
Creating network "harbor_harbor" with the default driver
WARNING: Found orphan containers (notary-server, notary-signer, clair-db) for this project. If you removed or renamed this service in your compose file, you can run this command with the --remove-orphans flag to clean it up.
Creating harbor-log ... done
Creating harbor-adminserver ... done
Creating registry ... done
Creating harbor-db ... done
Creating redis ... done
Creating harbor-ui ... done
Creating harbor-jobservice ... done
Creating nginx ... done
5.3 下载一个公有镜像并上传到harbor
#harbor本地下载一个公有仓库镜像centos:7
[root@harbor harbor]# docker pull centos:7
7: Pulling from library/centos
7dc0dca2b151: Pull complete
Digest: sha256:b67d21dfe609ddacf404589e04631d90a342921e81c40aeaf3391f6717fa5322
Status: Downloaded newer image for centos:7
#本地映射私有仓库域名
[root@harbor harbor]# tail -1 /etc/hosts
192.168.200.145 www.yunjisuan.com
#将centos:7镜像改名并上传私有镜像仓库
[root@harbor harbor]# docker tag centos:7 www.yunjisuan.com/library/centos:7
[root@harbor harbor]# docker images | grep centos
centos 7 49f7960eb7e4 6 weeks ago 200MB
www.yunjisuan.com/library/centos 7 49f7960eb7e4 6 weeks ago 200MB
[root@harbor harbor]# docker push www.yunjisuan.com/library/centos:7
The push refers to repository [www.yunjisuan.com/library/centos]
bcc97fbfc9e1: Preparing
denied: requested access to the resource is denied #我们发现与私有仓库的连接被拒绝,这是因为我们还没有登陆验证
#登陆验证harbor私有仓库,并上传镜像
[root@harbor harbor]# docker login www.yunjisuan.com
Username: admin
Password:
Login Succeeded
[root@harbor harbor]# docker push www.yunjisuan.com/library/centos:7
The push refers to repository [www.yunjisuan.com/library/centos]
bcc97fbfc9e1: Pushed
7: digest: sha256:eed5b251b615d1e70b10bcec578d64e8aa839d2785c2ffd5424e472818c42755 size: 529
5.4 登陆浏览器查看镜像上传结果,并扫描漏洞
5.5 设置镜像仓库安全等级
5.6 为docker客户端下发域名证书
主机名 | IP | 用途 | 最小资源配比 | 最佳资源配比 |
---|---|---|---|---|
docker-client | 192.168.200.142 | docker客户端 | ||
harbor | 192.168.200.145 | harbor私有镜像仓库 | 2CPU | 4CPU |
4GBMEM | 8GB | |||
40GBDISK | 160GB |
#映射harbor私有仓库域名
[root@docker-client ~]# cat /etc/redhat-release
CentOS Linux release 7.5.1804 (Core)
[root@docker-client ~]# uname -r
3.10.0-862.3.3.el7.x86_64
[root@docker-client ~]# hostname -I
192.168.200.142 172.17.0.1
[root@docker-client ~]# tail -1 /etc/hosts
192.168.200.145 www.yunjisuan.com
#安装docker-ce社区版
[root@docker-client ~]# sestatus
SELinux status: disabled
[root@docker-client ~]# systemctl stop firewalld
[root@docker-client ~]# systemctl disable firewalld
[root@docker-client ~]# yum -y install yum-utils device-mapper-persistent-data lvm2
[root@docker-client ~]# curl https://download.docker.com/linux/centos/docker-ce.repo -o /etc/yum.repos.d/docker-ce.repo
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2424 100 2424 0 0 437 0 0:00:05 0:00:05 --:--:-- 601
[root@docker-client ~]# yum -y install docker-ce
[root@docker-client ~]# systemctl start docker
[root@docker-client ~]# systemctl enable docker
Created symlink from /etc/systemd/system/multi-user.target.wants/docker.service to /usr/lib/systemd/system/docker.service.
[root@docker-client ~]# docker version
#配置国内公有镜像源
[root@docker-client ~]# cat /etc/docker/daemon.json
{
"registry-mirrors":[ "https://registry.docker-cn.com" ]
}
[root@docker-client ~]# systemctl daemon-reload
[root@docker-client ~]# systemctl restart docker
#下载mongo公有镜像
[root@docker-client ~]# docker pull mongo
Using default tag: latest
latest: Pulling from library/mongo
3620e2d282dc: Pull complete
ef22f5e4b3b2: Pull complete
99f229f854da: Pull complete
4fe433abe16a: Pull complete
c9b72a16d85e: Pull complete
f1757e0920c9: Pull complete
6ad61d16333c: Pull complete
1b55b55716bc: Pull complete
b9e1a31a5de8: Pull complete
a871e8da652e: Pull complete
0015ffced2ab: Pull complete
ee8e51b51b8e: Pull complete
210e26b24d82: Pull complete
a2f5ff21092f: Pull complete
Digest: sha256:2e5e54f94429839d4904c9962b6933ef631b1938b6223c1cf84a0442421f111d
Status: Downloaded newer image for mongo:latest
[root@docker-client ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
mongo latest af93d1bb9e2a 23 hours ago 379MB
#为docker客户端下发域名(在harbor本地执行操作)
#将harbor上自签发的域名证书www.yunjisuan.com.crt复制到docker客户端对应目录下
[root@harbor ssl]# scp www.yunjisuan.com.crt 192.168.200.142:/etc/pki/ca-trust/source/anchors/
root@192.168.200.142 s password:
www.yunjisuan.com.crt 100% 1931
#在docker客户端上执行操作,让证书立刻生效
[root@docker-client ~]# update-ca-trust enable
[root@docker-client ~]# update-ca-trust extract
#下发证书后必须重启动docker-client的docker服务
[root@docker-client anchors]# systemctl restart docker
#docker-client登陆harbor仓库进行登陆验证
[root@docker-client anchors]# docker login www.yunjisuan.com
Username: admin
Password:
Login Succeeded
#修改镜像的名字并上传harbor私有仓库
[root@docker-client ~]# docker tag mongo:latest www.yunjisuan.com/library/mongo
[root@docker-client ~]# docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
www.yunjisuan.com/library/mongo latest af93d1bb9e2a 23 hours ago 379MB
mongo latest af93d1bb9e2a 23 hours ago 379MB
[root@docker-client anchors]# docker push www.yunjisuan.com/library/mongo #上传镜像仓库
The push refers to repository [www.yunjisuan.com/library/mongo]
286bc1096109: Pushed
4a7d1d8fcfa6: Pushed
1dcddd0f87ed: Pushed
ca717ad13c2c: Pushed
5a025566f67e: Pushed
2cfea46080b7: Pushed
892f0d18231e: Pushed
1bf645743d38: Pushed
defd6b59a2f3: Pushed
709bdd00b1a4: Pushed
07b9c3c04cbd: Pushed
6eaddaf493f1: Pushed
a0e188d0e278: Pushed
711e4cb62f50: Pushed
latest: digest: sha256:810e499962b39a05131c5d25230fc92ba385f9353fc44ee8ed27a14ce49c8bac size: 3235
浏览器登陆harbor进行查看:
出现漏洞的镜像截图:
六,harbor镜像的复制与同步
harbor私有仓库的主从复制,类似于MySQL,属于1对多的复制
主机名 | IP | 用途 | 最小资源配比 | 最佳资源配比 |
---|---|---|---|---|
docker-client | 192.168.200.142 | docker客户端 | ||
harbor | 192.168.200.145 | harbor私有镜像仓库 | 2CPU | 4CPU |
4GBMEM | 8GB | |||
harbor-slave | 192.168.200.146 | harbor从库 | 2CPU | 4CPU |
4GBMEM | 8GB |
6.1 部署Habor-Slave
再安装一个harbor私有仓库作为harbor的从库,域名为www2.yunjisuan.com
请参考Harbor-Master搭建过程
在Harbor-Master和Harbor-Slave上做域名映射
#主Harbor
[root@harbor ~]# tail -2 /etc/hosts
192.168.200.145 www.yunjisuan.com
192.168.200.146 www2.yunjisuan.com
#从Harbor
[root@harbor-slave ~]# tail -2 /etc/hosts
192.168.200.145 www.yunjisuan.com
192.168.200.146 www2.yunjisuan.com
特别提示:
离线方式安装的Habor容器默认会从LDNS处获取对应的域名的IP解析,并不找本地的hosts文件
由于我们是自己是自己设定的域名,因此,需要搭建用于内网解析的LDNS域名解析服务器
6.2 搭建LDNS域名解析服务器
主机名 | IP | 用途 | 最小资源配比 | 最佳资源配比 |
---|---|---|---|---|
docker-client | 192.168.200.142 | docker客户端 | ||
harbor | 192.168.200.145 | harbor私有镜像仓库 | 2CPU | 4CPU |
4GBMEM | 8GB | |||
harbor-slave | 192.168.200.146 | harbor从库 | 2CPU | 4CPU |
4GBMEM | 8GB | |||
LDNS | 192.168.200.147 | 本地DNS |
[root@LDNS ~]# yum -y install bind bind-chroot bind-utils
[root@LDNS ~]# cd /etc
[root@LDNS etc]# cp named.conf{,.bak}
#配置文件修改成如下所示:
[root@LDNS named]# cat /etc/named.conf
options {
listen-on port 53 { 192.168.200.147; };
// listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
forwarders { 192.168.200.2; };
recursion yes;
dnssec-enable no;
dnssec-validation no;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
zone "yunjisuan.com" IN {
type master;
file "yunjisuan.com.zone";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
#检查配置文件是否有错
[root@LDNS named]# named-checkconf /etc/named.conf
#创建正向解析文件
[root@LDNS named]# cd /var/named
[root@LDNS named]# ls
chroot data dynamic named.ca named.empty named.localhost named.loopback slaves
[root@LDNS named]# cp -p named.empty yunjisuan.com.zone
[root@LDNS named]# vim yunjisuan.com.zone
[root@LDNS named]# cat yunjisuan.com.zone
$TTL 1D
@ IN SOA yunjisuan.com. root.ns1.yunjisuan.com. (
20180719 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS ns1.yunjisuan.com.
ns1 A 192.168.200.147
www A 192.168.200.145
www2 A 192.168.200.146
#测试正向解析文件是否有错
[root@LDNS named]# named-checkzone yunjisuan.com yunjisuan.com.zone
zone yunjisuan.com/IN: loaded serial 20180719
OK
#启动域名解析服务
[root@LDNS named]# systemctl start named
[root@LDNS named]# ss -antup | grep named
udp UNCONN 0 0 192.168.200.147:53 *:* users:(("named",pid=1576,fd=512))
tcp LISTEN 0 10 192.168.200.147:53 *:* users:(("named",pid=1576,fd=21))
tcp LISTEN 0 128 127.0.0.1:953 *:* users:(("named",pid=1576,fd=22))
tcp LISTEN 0 128 ::1:953 :::* users:(("named",pid=1576,fd=23))
#将本地DNS改成自己,进行解析测试
[root@LDNS named]# cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 192.168.200.147
[root@LDNS named]# nslookup www.baidu.com
Server: 192.168.200.147
Address: 192.168.200.147#53
Non-authoritative answer:
www.baidu.com canonical name = www.a.shifen.com.
Name: www.a.shifen.com
Address: 61.135.169.125
Name: www.a.shifen.com
Address: 61.135.169.121
[root@LDNS named]# nslookup www.yunjisuan.com
Server: 192.168.200.147
Address: 192.168.200.147#53
Name: www.yunjisuan.com
Address: 192.168.200.145
[root@LDNS named]# nslookup www2.yunjisuan.com
Server: 192.168.200.147
Address: 192.168.200.147#53
Name: www2.yunjisuan.com
Address: 192.168.200.146
6.3 构建Harbor主从同步
提示:如果Harbor不是已经绑定的公网域名,那么必须构建自己的本地LDNS
#修改Harbor-master上的域名解析DNS服务器为本地构建的LDNS
[root@harbor harbor]# cat /etc/resolv.conf
nameserver 192.168.200.147
[root@harbor harbor]# nslookup www2.yunjisuan.com
Server: 192.168.200.147
Address: 192.168.200.147#53
Name: www2.yunjisuan.com
Address: 192.168.200.146
至此,Harbor仓库主从复制已经构建完毕。
备注:如果勾选了阻止潜在漏洞的选项会影响harbor主从复制
特别提示:
如果是harbor经历过vmware虚拟机的暂停和恢复。那么很可能之前能够访问的harbor仓库,恢复后却不行了。此时,需要重启dorker进程并重新harbor容器进程。