Harbor配置https自建证书实战案例

目录

一.安装harbor

1.安装docker

参考链接:
	https://docs.docker.com/engine/install/

2.安装docker compose

参考链接:
	https://docs.docker.com/compose/install/

3.解压harbor软件包

	(1)创建harbor软件目录
# mkdir -p /yinzhengjie/softwares


	(2)解压软件包
# tar xf harbor-offline-installer-v1.10.10.tgz -C /yinzhengjie/softwares

二.配置harbor服务器配置https证书

1.修改harbor配置文件

vim harbor.yml 
...
hostname: www.yinzhengjie.com
...
https:
  ...
  certificate: /oldboyedu/softwares/harbor/shengchan/www.yinzhengjie.com_nginx/www.yinzhengjie.com.crt
  private_key: /oldboyedu/softwares/harbor/shengchan/www.yinzhengjie.com_nginx/www.yinzhengjie.com.key

2.使得配置生效

# ./prepare 

# docker-compose down -t 1

# docker-compose up -d

3.测试服务

# echo 10.0.0.101 www.yinzhengjie.com >> /etc/hosts

# docker login www.yinzhengjie.com

三.配置harbor服务器配置https自签证书

官方文档:
	https://goharbor.io/docs/1.10/install-config/configure-https/

1.生成harbor服务器证书

1.1 生成ca的证书

	(1)创建证书目录并进入到证书目录
# mkdir /yinzhengjie/softwares/harbor/certs && cd /yinzhengjie/softwares/harbor/certs/


	(2)生成ca的私钥
# openssl genrsa -out ca.key 4096


	(3)生成ca的自签名证书
# openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=yinzhengjie.com" \
 -key ca.key \
 -out ca.crt

1.2 生成harbor主机证书

	(1)生成harbor主机的私钥
# openssl genrsa -out harbor.yinzhengjie.com.key 4096


	(2)生成harbor主机的证书申请
# openssl req -sha512 -new \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor.yinzhengjie.com" \
    -key harbor.yinzhengjie.com.key \
    -out harbor.yinzhengjie.com.csr
    
    
    (3)生成x509 v3扩展文件
# cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=yinzhengjie.com
DNS.2=yinzhengjie
DNS.3=harbor.yinzhengjie.com
EOF


	(4)使用"v3.ext"给harbor主机签发证书
# openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in harbor.yinzhengjie.com.csr \
    -out harbor.yinzhengjie.com.crt
    
    
    (5)将crt文件转换为cert客户端证书文件
# openssl x509 -inform PEM -in harbor.yinzhengjie.com.crt -out harbor.yinzhengjie.com.cert


温馨提示:
	docker程序认为"*.crt"文件是CA证书文件，"*.cert"客户端证书文件，于是上面第五步需要转换一下，其实使用cp一下也是可以的，内容并没有变化。

2. 配置harbor服务器使用证书

	(1)修改harbor的配置文件
# vim /yinzhengjie/softwares/harbor/harbor.yml 	
...
hostname: harbor.yinzhengjie.com
...
https:
  ...
  certificate: /yinzhengjie/softwares/harbor/certs/harbor.yinzhengjie.com.crt
  private_key: /yinzhengjie/softwares/harbor/certs/harbor.yinzhengjie.com.key
...
harbor_admin_password: 1


	(2)安装harbor服务
# cd /yinzhengjie/softwares/harbor  && ./install.sh



温馨提示:
	如果已经安装harbor服务的话，就不需要重复执行"./install.sh"脚本，仅需执行"./prepare"并搭配"docker-compose down"和"docker-compose up -d"即可。

3.验证证书

3.1 Windows验证

如上图所示，Windows成功访问啦。只不过证书是不安全的而已。

3.2 Linux验证

	(1)配置地址解析
# echo 10.0.0.13 harbor.yinzhengjie.com >> /etc/hosts

	(2)在docker客户端节点创建自签证书域名存放路径
# mkdir -pv /etc/docker/certs.d/harbor.yinzhengjie.com

	(3)服务端将证书文件拷贝到客户端docker节点，若不执行该操作，则会报错如上图所示。
# scp /yinzhengjie/softwares/harbor/certs/{harbor.yinzhengjie.com.cert,harbor.yinzhengjie.com.key,ca.crt}  10.0.0.14:/etc/docker/certs.d/harbor.yinzhengjie.com

	(3)登录验证，如下图所示。
# docker login -u admin -p 1 harbor.yinzhengjie.com

posted @ 2023-02-25 03:10  尹正杰  阅读(968)  评论(0)  编辑  收藏  举报