linux-部署harbor的https认证

一、安装docker

1.下载docker的rpm包

[root@harbor.yuanlinux.com ~]# ll
-rw-r--r--  1 root root 101239922 Apr 12 15:29 docker-rpm-20_10_24.tar.gz

2.解压并安装软件包

[root@harbor.yuanlinux.com ~]# tar xf docker-rpm-20_10_24.tar.gz
[root@harbor.yuanlinux.com ~]# cd  docker-rpm-20.10/
[root@harbor.yuanlinux.com ~/docker-rpm-20.10]# yum -y localinstall *.rpm

3.添加自动补全功能

[root@harbor.yuanliunx.com ~]# yum -y install bash-completion
[root@harbor.yuanliunx.com ~]# source /usr/share/bash-completion/bash_completion

4.配置镜像加速

[root@harbor.yuanliunx.com ~/docker-rpm-20.10]# mkdir -p /etc/docker
[root@harbor.yuanliunx.com ~/docker-rpm-20.10]# tee /etc/docker/daemon.json <<-'EOF'
> {
>   "registry-mirrors": ["自己的加速地址"]
> }
> EOF
[root@harbor.yuanliunx.com ~/docker-rpm-20.10]# systemctl daemon-reload
[root@harbor.yuanliunx.com ~/docker-rpm-20.10]# systemctl restart docker
 

5.验证镜像加速是否成功

[root@harbor.yuanliunx.com ~]# docker info | grep "Registry Mirrors" -A 1
WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled
 Registry Mirrors:
  https://tuv7rqqq.mirror.aliyuncs.com/

6.将docker设置为开机自启动

[root@harbor.yuanliunx.com ~]# systemctl enable --now docker

二、安装docker compose

1.添加epel源

[root@harbor.yuanliunx.com ~]# curl  -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo

2.安装docker-compose

[root@harbor.yuanliunx.com ~]# yum -y install docker-compose

3.查看docker-compose版本

[root@harbor.yuanliunx.com ~]# docker-compose version
docker-compose version 1.18.0, build 8dd22a9
docker-py version: 2.6.1
CPython version: 3.6.8
OpenSSL version: OpenSSL 1.0.2k-fips  26 Jan 2017

三、安装harbor

1.下载harbor软件包

[root@harbor.yuanlinux.com ~]# ll
-rw-r--r--  1 root root 610192663 Apr 12 09:23 harbor-offline-installer-v1.10.10.tgz

2.创建工作目录

[root@harbor.yuanlinux.com ~]# mkdir -pv /data/softwares

3.解压harbor软件包

[root@harbor.yuanlinux.com ~]# tar xf harbor-offline-installer-v1.10.10.tgz -C /data/softwares/

4.创建证书的工作目录

[root@harbor.yuanlinux.com ~]# mkdir -pv /data/softwares/harbor/certs/{ca,server,client}

5.生成自建CA证书

5.1 进入证书目录

[root@harbor.yuanlinux.com ~]# cd /data/softwares/harbor/certs/

5.2 生成CA私钥

[root@harbor.yuanlinux.com /data/softwares/harbor/certs]# openssl genrsa -out ca/ca.key 4096

5.3 生成ca的自签名证书

[root@harbor.yuanlinux.com /data/softwares/harbor/certs]# openssl req -x509 -new -nodes -sha512 -days 3650 \
>  -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=yuanlinux.com" \
>  -key ca/ca.key \
>  -out ca/ca.crt

6.生成harbor服务器的证书文件及客户端证书

6.1 生成harbor主机的私钥

[root@harbor.yuanlinux.com /data/softwares/harbor/certs]# openssl genrsa -out server/harbor.yuanlinux.com.key 4096
Generating RSA private key, 4096 bit long modulus

6.2 生成harbor主机的证书申请

[root@harbor.yuanlinux.com /data/softwares/harbor/certs]# openssl req -sha512 -new \
-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor.yuanlinux.com" \
-key server/harbor.yuanlinux.com.key \
-out server/harbor.yuanlinux.com.csr

6.3 生成x509 v3扩展文件

[root@harbor.yuanlinux.com /data/softwares/harbor/certs]# cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
 
[alt_names]
DNS.1=yuanlinux.com
DNS.2=yuanlinux
DNS.3=harbor.yuanlinux.com
EOF

6.4 使用"v3.ext"给harbor主机签发证书

[root@harbor.yuanlinux.com /data/softwares/harbor/certs]# openssl x509 -req -sha512 -days 3650 \
-extfile v3.ext \
-CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial \
-in server/harbor.yuanlinux.com.csr \
-out server/harbor.yuanlinux.com.crt

6.5 将crt文件转换为cert客户端证书文件

[root@harbor.yuanlinux.com /data/softwares/harbor/certs]#  openssl x509 -inform PEM -in server/harbor.yuanlinux.com.crt -out server/harbor.yuanlinux.com.cert

6.6 准备docker客户端证书

[root@harbor.yuanlinux.com /data/softwares/harbor/certs]# cp server/harbor.yuanlinux.com.{cert,key} client/
[root@harbor.yuanlinux.cn /data/softwares/harbor/certs]# cp ca/ca.crt client/
[root@harbor.yuanlinux.cn /data/softwares/harbor/certs]# ll client/
total 12
-rw-r--r-- 1 root root 2029 Apr 12 20:21 ca.crt
-rw-r--r-- 1 root root 2118 Apr 12 20:21 harbor.yuanlinux.com.cert
-rw-r--r-- 1 root root 3243 Apr 12 20:21 harbor.yuanlinux.com.key

6.7 查看所有证书文件结果

[root@harbor.yuanlinux.com /data/softwares/harbor/certs]# ll -R
.:
total 4
drwxr-xr-x 2 root root  48 Apr 12 20:20 ca
drwxr-xr-x 2 root root  83 Apr 12 20:21 client
drwxr-xr-x 2 root root 131 Apr 12 20:21 server
-rw-r--r-- 1 root root 272 Apr 12 20:19 v3.ext
 
./ca:
total 12
-rw-r--r-- 1 root root 2029 Apr 12 20:18 ca.crt
-rw-r--r-- 1 root root 3243 Apr 12 20:16 ca.key
-rw-r--r-- 1 root root   17 Apr 12 20:20 ca.srl
 
./client:
total 12
-rw-r--r-- 1 root root 2029 Apr 12 20:21 ca.crt
-rw-r--r-- 1 root root 2118 Apr 12 20:21 harbor.yuanlinux.com.cert
-rw-r--r-- 1 root root 3243 Apr 12 20:21 harbor.yuanlinux.com.key
 
./server:
total 16
-rw-r--r-- 1 root root 2118 Apr 12 20:21 harbor.yuanlinux.com.cert
-rw-r--r-- 1 root root 2118 Apr 12 20:20 harbor.yuanlinux.com.crt
-rw-r--r-- 1 root root 1716 Apr 12 20:19 harbor.yuanlinux.com.csr
-rw-r--r-- 1 root root 3243 Apr 12 20:18 harbor.yuanlinux.com.key

7.配置harbor服务器使用证书

7.1 切换工作目录

[root@harbor.yuanlinux.com /data/softwares/harbor/certs]# cd ..
[root@harbor.yuanlinux.com /data/softwares/harbor]#

7.2 修改配置文件

[root@harbor.yuanlinux.com /data/softwares/harbor]# cat -n harbor.yml
#修改这几行
     5	hostname: harbor.yuanlinux.com
    17	  certificate: /data/softwares/harbor/certs/server/harbor.yuanlinux.com.crt
    18	  private_key: /data/softwares/harbor/certs/server/harbor.yuanlinux.com.key
    27	harbor_admin_password: 1

8. 安装harbor服务

[root@harbor.yuanlinux.com /data/softwares/harbor]# ./install.sh

9.验证

9.1 Windows验证harbor的https

# C:\Windows\System32\drivers\etc\hosts
10.0.0.250 harbor.yuanlinux.com

https://harbor.yuanlinux.com/

9.2 Linux验证harbor的https

9.2.1 配置地址解析

[root@harbor.yuanlinux.com ~]#  echo 10.0.0.250 harbor.yuanlinux.com >> /etc/hosts

9.2.2 在docker客户端节点创建自签证书域名存放路径

[root@harbor.yuanlinux.com ~]# mkdir -pv /etc/docker/certs.d/harbor.yuanlinux.com

9.2.3 服务端将证书文件拷贝到客户端docker节点，若不执行该操作，则会报错"x509: certificate signed by unknown authority"

[root@harbor.yuanlinux.com ~]# cp /data/softwares/harbor/certs/client/* /etc/docker/certs.d/harbor.yuanlinux.com/
[root@harbor.yuanlinux.com ~]# ll /etc/docker/certs.d/harbor.yuanlinux.com/
total 12
-rw-r--r-- 1 root root 2029 Apr 12 20:35 ca.crt
-rw-r--r-- 1 root root 2118 Apr 12 20:35 harbor.linuxyuan.com.cert
-rw-r--r-- 1 root root 3243 Apr 12 20:35 harbor.linuxyuan.com.key

9.2.4 登录验证

[root@harbor.yuanliunx.com /data/softwares/harbor]# docker login -u admin -p 1 harbor.yuanlinux.com
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
 
Login Succeeded

9.2.5退出登录

[root@harbor.yuanlinux.com ~]# more /root/.docker/config.json
{
	"auths": {
		"harbor.yuanlinux.com": {
			"auth": "YWRtaW46MQ=="
		}
	}
}
 
#改文件存储harbor密码，要及时退出
 
 
[root@harbor.yuanlinux.com ~]# docker logout harbor.yuanlinux.com
Removing login credentials for harbor.yuanlinux.com
 
[root@harbor.yuanlinux.com ~]# more /root/.docker/config.json
{
	"auths": {}
}
 
echo YWRtaW46MQ== | base64 -d | more

补充

harbor有时重启机器会有服务起不来，要查看一下
#进入harbor目录
[root@harbor.yuanliunx.com /data/softwares/harbor]# docker-compose ps
#没起来的话，可以先卸载，然后重新加载
[root@harbor.yuanliunx.com /data/softwares/harbor]# docker-compose down -v -t 1  
[root@harbor.yuanliunx.com /data/softwares/harbor]# docker-compose up -d