（转）docker-harbor安装与部署
原文：https://www.cnblogs.com/scajy/p/13846721.html
harbor安装与部署
1. harbor服务器安装docker和docker compose
1.1 安装docker
1.1.1 安装docker依赖包
[root@harbor ~]# yum install -y yum-utils device-mapper-persistent-data lvm2
1.1.2 安装docker镜像源
[root@harbor ~]# yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
1.1.3 安装docker
[root@harbor ~]# yum install -y docker-ce
1.1.4 启动docker，并设置开机启动
[root@harbor ~]# /bin/systemctl start docker
[root@harbor ~]# /bin/systemctl enable docker #设置开机启动
Created symlink from /etc/systemd/system/multi-user.target.wants/docker.service to /usr/lib/systemd/system/docker.service.
1.1.5 安装docker的tab补全功能
1.1.5.1 安装补全包
[root@harbor ~]# yum install -y bash-completion
[root@harbor ~]# sh /usr/share/bash-completion/bash_completion
显然，该脚本是用于bash自动补全的，但是，不幸的是，直接 source 执行该脚本后，docker命令后敲tab，有如下错误：
docker -bash: _get_comp_words_by_ref: command not found
-bash: [: 1: unary operator expected
-bash: [: 1: unary operator expected
-bash: [: -eq: unary operator expected
-bash: _get_comp_words_by_ref: command not found
-bash: [: 1: unary operator expected
-bash: [: 1: unary operator expected
-bash: [: -eq: unary operator expected
难道docker的bash自动补全还能有问题？
- 解决办法如下：
- 我们这里虽然安装了bash-completion，但是没有执行其中的一个文件/usr/share/bash-completion/bash_completion 该文件中有上面缺少的命令，执行该文件，重新开一个shell终端，就解决了
1.2 安装docker compose
1.2.1 下载并安装docker compose
[root@harbor ~]# sudo curl -L "https://github.com/docker/compose/releases/download/1.23.1/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
1.2.2 赋予docker compose执行权限
[root@harbor ~]# chmod +x /usr/local/bin/docker-compose
1.3 配置第三方镜像加速器
可以配置阿里云等国内的其他镜像仓库，这里配置阿里云镜像仓库
sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json <<-'EOF'
{
"registry-mirrors": ["https://sv1txjq6.mirror.aliyuncs.com"]
}
EOF
1.4 配置完成了，需要重启docker
[root@docker ~]# systemctl daemon-reload
[root@docker ~]# systemctl restart docker
2. 安装harbor
2.1 下载harbor
[root@harbor ~]# wget https://github.com/goharbor/harbor/releases/download/v2.1.0/harbor-offline-installer-v2.1.0.tgz
[root@harbor ~]# ll
total 543100
-rw-------. 1 root root 1363 Jul 25 2019 anaconda-ks.cfg
-rw-r--r-- 1 root root 556130191 Oct 18 02:11 harbor-offline-installer-v2.1.0.tgz
-
注释：
这里直接用wget下载，可能会因为网络问题下载比较慢，这里可以自行使用迅雷下载，下载完成后上传到相应的服务器上
2.2 解压harbor压缩包
[root@harbor ~]# tar zxvf harbor-offline-installer-v2.1.0.tgz
harbor/harbor.v2.1.0.tar.gz
harbor/prepare
harbor/LICENSE
harbor/install.sh
harbor/common.sh
harbor/harbor.yml.tmpl
2.3 拷贝配置文件
[root@harbor ~]# cd harbor/
[root@harbor harbor]# cp harbor.yml.tmpl harbor.yml
2.4 修改harbor.yml
-
需要修改内容
hostname = 本机IP地址 # 修改连接地址，可以是域名，ip harbor_admin_password = 123456 # 配置密码 -
修改配置文件
[root@harbor harbor]# vim harbor.yml [root@harbor harbor]# cat harbor.yml # Configuration file of Harbor # The IP address or hostname to access admin UI and registry service. # DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients. hostname: harbor.scajy.cn # http related config http: # port for http, default is 80. If https enabled, this port will redirect to https port port: 80 # https related config #https: # https port for harbor, default is 443 #port: 443 # The path of cert and key files for nginx #certificate: /your/certificate/path #private_key: /your/private/key/path # # Uncomment following will enable tls communication between all harbor components # internal_tls: # # set enabled to true means internal tls is enabled # enabled: true # # put your cert and key files on dir # dir: /etc/harbor/tls/internal # Uncomment external_url if you want to enable external proxy # And when it enabled the hostname will no longer used # external_url: https://reg.mydomain.com:8433 # The initial password of Harbor admin # It only works in first time to install harbor # Remember Change the admin password from UI after launching Harbor. harbor_admin_password: Aa123456 # Harbor DB configuration database: # The password for the root user of Harbor DB. Change this before any production use. password: root123 # The maximum number of connections in the idle connection pool. If it <=0, no idle connections are retained. max_idle_conns: 50 # The maximum number of open connections to the database. If it <= 0, then there is no limit on the number of open connections. # Note: the default number of connections is 1024 for postgres of harbor. max_open_conns: 1000 # The default data volume data_volume: /data # Harbor Storage settings by default is using /data dir on local filesystem # Uncomment storage_service setting If you want to using external storage # storage_service: # # ca_bundle is the path to the custom root ca certificate, which will be injected into the truststore # # of registry's and chart repository's containers. This is usually needed when the user hosts a internal storage with self signed certificate. # ca_bundle: # # storage backend, default is filesystem, options include filesystem, azure, gcs, s3, swift and oss # # for more info about this configuration please refer https://docs.docker.com/registry/configuration/ # filesystem: # maxthreads: 100 # # set disable to true when you want to disable registry redirect # redirect: # disabled: false # Clair configuration clair: # The interval of clair updaters, the unit is hour, set to 0 to disable the updaters. updaters_interval: 12 # Trivy configuration # # Trivy DB contains vulnerability information from NVD, Red Hat, and many other upstream vulnerability databases. # It is downloaded by Trivy from the GitHub release page https://github.com/aquasecurity/trivy-db/releases and cached # in the local file system. In addition, the database contains the update timestamp so Trivy can detect whether it # should download a newer version from the Internet or use the cached one. Currently, the database is updated every # 12 hours and published as a new release to GitHub. trivy: # ignoreUnfixed The flag to display only fixed vulnerabilities ignore_unfixed: false # skipUpdate The flag to enable or disable Trivy DB downloads from GitHub # # You might want to enable this flag in test or CI/CD environments to avoid GitHub rate limiting issues. # If the flag is enabled you have to download the `trivy-offline.tar.gz` archive manually, extract `trivy.db` and # `metadata.json` files and mount them in the `/home/scanner/.cache/trivy/db` path. skip_update: false # # insecure The flag to skip verifying registry certificate insecure: false # github_token The GitHub access token to download Trivy DB # # Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough # for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000 # requests per hour by specifying the GitHub access token. For more details on GitHub rate limiting please consult # https://developer.github.com/v3/#rate-limiting # # You can create a GitHub token by following the instructions in # https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line # # github_token: xxx jobservice: # Maximum number of job workers in job service max_job_workers: 10 notification: # Maximum retry count for webhook job webhook_job_max_retry: 10 chart: # Change the value of absolute_url to enabled can enable absolute url in chart absolute_url: disabled # Log configurations log: # options are debug, info, warning, error, fatal level: info # configs for logs in local storage local: # Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated. rotate_count: 50 # Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes. # If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G # are all valid. rotate_size: 200M # The directory on your host that store log location: /var/log/harbor # Uncomment following lines to enable external syslog endpoint. # external_endpoint: # # protocol used to transmit log to external endpoint, options is tcp or udp # protocol: tcp # # The host of external endpoint # host: localhost # # Port of external endpoint # port: 5140 #This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY! _version: 2.0.0 # Uncomment external_database if using external database. # external_database: # harbor: # host: harbor_db_host # port: harbor_db_port # db_name: harbor_db_name # username: harbor_db_username #