1、基本概念

  上节在k8s中部署了harbor和ldap,本节将部署harbor使用openLDAP验证,部署方式与之前相同,只是改了adminserver-cm.yaml的AUTH_MODE: "ldap_auth"。另外harbor配置ldap登录非必须,按需。

 

2、部署

  下载项目

git clone https://github.com/dotbalo/helm.git
[root@k8s-master01 ci]# cd harbor-helm-ldap/
[root@k8s-master01 harbor-helm-ldap]# ls
charts      CONTRIBUTING.md  README.md          requirements.yaml  values.yaml
Chart.yaml  LICENSE          requirements.lock  templates
[root@k8s-master01 harbor-helm-ldap]# pwd
/root/ci/harbor-helm-ldap

  具体配置可参考:k8s使用Helm安装harbor

  部署服务,步骤与之前大同小异

[root@k8s-master01 harbor-helm-ldap]# helm install --name hb-ldap .  --set externalDomain=harbor.xxx.net --wait --timeout 1500 --debug --namespace harbor
.....
==> v1beta1/Deployment
hb-ldap-redis                 <invalid>
hb-ldap-harbor-adminserver    <invalid>
hb-ldap-harbor-chartmuseum    <invalid>
hb-ldap-harbor-clair          <invalid>
hb-ldap-harbor-jobservice     <invalid>
hb-ldap-harbor-notary-server  <invalid>
hb-ldap-harbor-notary-signer  <invalid>
hb-ldap-harbor-registry       <invalid>
hb-ldap-harbor-ui             <invalid>

==> v1beta2/StatefulSet
hb-ldap-harbor-database  <invalid>


NOTES:
Please wait for several minutes for Harbor deployment to complete.
Then you should be able to visit the UI portal at https://harbor.xxx.net. 
For more details, please visit https://github.com/goharbor/harbor.

  查看pods

 

[root@k8s-master01 harbor-helm-ldap]# kubectl get po -n harbor | grep ldap
hb-ldap-harbor-adminserver-69cb46cf9b-ptlvb       1/1       Running   1          2h
hb-ldap-harbor-chartmuseum-88449c77f-dmxsk        1/1       Running   0          2h
hb-ldap-harbor-clair-bbc78b6df-n4c4l              1/1       Running   4          2h
hb-ldap-harbor-database-0                         1/1       Running   0          2h
hb-ldap-harbor-jobservice-86bb5b45c8-8ssc6        1/1       Running   3          2h
hb-ldap-harbor-notary-server-b659bb7f4-hr6lm      1/1       Running   1          2h
hb-ldap-harbor-notary-signer-7f8b5dfcf-7pvtk      1/1       Running   1          2h
hb-ldap-harbor-registry-77d5884f77-7lxcr          1/1       Running   0          2h
hb-ldap-harbor-ui-7c7cc6c474-554xb                1/1       Running   2          2h
hb-ldap-redis-d98d67f8b-wp6pm                     1/1       Running   0          2h

  将harbor.xxx.net添加解析至集群

  访问测试

 

 3、配置使用ldap登录

  注意:因为openLDAP部署在了public-service的namespace中,而harbor部署在了harbor的namespace中,此时两个ns的service是不同的,有两个解决方案

  使用nodeport或者使用service全地址,格式为ServiceName.NAMESPACE.svc。

  配置如下,注意harbor也使用mail进行认证,非cn:

  连接测试

 

4、创建用户和组  

  创建组

  用户无需自己创建,可以直接登录。注意我公司使用的是email地址进行登录。

  登录测试

 

5、创建项目

  push镜像及证书配置,详情请点击

 

赞助作者: