部署私有harbor仓库（v2.15.2） https认证

1.准备工作

1.1 docker需要的版本

1.2安装docker

[root@10 ~]# mkdir -p docker
[root@10 ~]# cd  docker

[root@10 ~]# wget https://download.docker.com/linux/centos/7/x86_64/stable/Packages/containerd.io-1.6.33-3.1.el7.x86_64.rpm
[root@10 ~]# wget https://download.docker.com/linux/centos/7/x86_64/stable/Packages/docker-buildx-plugin-0.14.1-1.el7.x86_64.rpm
[root@10 ~] #wget https://download.docker.com/linux/centos/7/x86_64/stable/Packages/docker-ce-26.1.4-1.el7.x86_64.rpm
[root@10 ~]# wget https://download.docker.com/linux/centos/7/x86_64/stable/Packages/docker-ce-cli-26.1.4-1.el7.x86_64.rpm
[root@10 ~]# wget https://download.docker.com/linux/centos/7/x86_64/stable/Packages/docker-ce-rootless-extras-26.1.4-1.el7.x86_64.rpm          
[root@10 ~]# wget https://download.docker.com/linux/centos/7/x86_64/stable/Packages/docker-compose-plugin-2.6.0-3.el7.x86_64.rpm

[root@10 ~]#  yum -y localinstall ./*.rpm

[root@10 ~] # yum -y install bash-completion   #docker自动补全功能

1.3 配置配置镜像加速

[root@10 ~]# mkdir -p /etc/docker
tee /etc/docker/daemon.json <<-'EOF'
{
  "registry-mirrors": [
    "https://docker.m.daocloud.io",
    "https://dockerproxy.com",
    "https://docker.nju.edu.cn",
    "https://docker.mirrors.ustc.edu.cn"
  ]
}
EOF
[root@10 ~] # systemctl daemon-reload
[root@10 ~] #systemctl restart docker

1.4 验证镜像加速是否成功

[root@10 ~]# docker info | grep "Registry Mirrors" -A 4
 Registry Mirrors:
  https://docker.m.daocloud.io/
  https://dockerproxy.com/
  https://docker.nju.edu.cn/
  https://docker.mirrors.ustc.edu.cn/
[root@10 ~]# 

1.5将docker设置为开机自启动

[root@10 ~]# systemctl enable --now docker
Created symlink from /etc/systemd/system/multi-user.target.wants/docker.service to /usr/lib/systemd/system/docker.service.

1.6安装docker compose

[root@10 ~]# curl  -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo

[root@10 ~]# yum -y install docker-compose

[root@10 ~]# docker-compose version 
docker-compose version 1.18.0, build 8dd22a9
docker-py version: 2.6.1
CPython version: 3.6.8
OpenSSL version: OpenSSL 1.0.2k-fips  26 Jan 2017

2.安装harbor

2.1下载harbor软件包

[root@10 ~]# wget  https://github.com/goharbor/harbor/releases/download/v2.15.2/harbor-offline-installer-v2.15.2.tgz

2.2 解压软件包

[root@10 ~]#  mkdir -pv /harbor/softwares
[root@10 ~]# tar xf harbor-offline-installer-v2.15.2.tgz -C /harbor/softwares/

2.3 创建自签证书

[root@10 ~]# mkdir -pv /harbor/softwares/harbor/certs/{ca,server,client}
[root@10 ~]# cd /harbor/softwares/harbor/certs/
[root@10 certs]# openssl genrsa -out ca/ca.key 4096

[root@10 certs]# openssl req -x509 -new -nodes -sha512 -days 3650 \
	 -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=xiuer.com" \
	 -key ca/ca.key \
	 -out ca/ca.crt

2.4 生成harbor服务器的证书文件及客户端证书

[root@10 certs]# openssl genrsa -out server/harbor.xiu'er.com.key 4096
[root@10 certs]# openssl req -sha512 -new \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor.xiuer.com" \
    -key server/harbor.xiuer.com.key \    
    -out server/harbor.xiuer.com.csr
    
# 生成x509 v3扩展文件
[root@10 certs]# cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=xiuer.com
DNS.2=xiuer
DNS.3=harbor.xiuer.com
EOF

# 使用"v3.ext"给harbor主机签发证书
[root@10 certs]# openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca/ca.crt -CAkey ca/ca.key -CAcreateserial \
    -in server/harbor.xiuer.com.csr \
    -out server/harbor.xiuer.com.crt
    
# 将crt文件转换为cert客户端证书文件
[root@10 certs]# openssl x509 -inform PEM -in server/harbor.oldboyedu.com.crt -out server/harbor.oldboyedu.com.cert

2.5 存放客户端证书

[root@10 certs]# cp server/harbor.xiuer.com.{cert,key} client/
[root@10 certs]# cp ca/ca.crt client/

3.修改harbor配置文件

[root@10 certs]# cd /harbor/softwares/harbor
[root@10 certs]# yy harbor.yml 
hostname: harbor.xiuer.com
...
https:
  port: 443
  certificate: /harbor/softwares/harbor/certs/server/harbor.xiuer.com.crt
  private_key: /harbor/softwares/harbor/certs/server/harbor.xiuer.com.key
harbor_admin_password: 1
...

3.1 安装harbor服务

[root@10 certs]# ./install.sh 
[Step 0]: checking if docker is installed ...
Note: docker version: 26.1.4
[Step 1]: checking docker-compose is installed ...
Note: Docker Compose version v2.6.0
[Step 2]: loading Harbor images ...
Loaded image: goharbor/harbor-exporter:v2.15.2
Loaded image: goharbor/harbor-portal:v2.15.2
Loaded image: goharbor/harbor-db:v2.15.2
Loaded image: goharbor/harbor-registryctl:v2.15.2
Loaded image: goharbor/nginx-photon:v2.15.2
Loaded image: goharbor/registry-photon:v2.15.2
Loaded image: goharbor/harbor-core:v2.15.2
Loaded image: goharbor/harbor-jobservice:v2.15.2
Loaded image: goharbor/valkey-photon:v2.15.2
Loaded image: goharbor/prepare:v2.15.2
Loaded image: goharbor/harbor-log:v2.15.2
Loaded image: goharbor/trivy-adapter-photon:v2.15.2

3.2 浏览器验证

http://10.0.0.152
用户：admin
密码：Harbor12345