手把手带你安装单机版的 Harbor 容器镜像服务

这是我参加更文应战的第6天，活动概略检查：更文应战

本文将带你快速设备一个单机版的 Harbor 容器镜像服务，能够满意个人以及中小型企业的需求。后续会收拾 《依据 Kubernetes 树立高可用的 Harbor 集群》，敬请期待！

为什么需求自建容器镜像服务

公有云服务当swift世界结算体系然方便好用，但站在企业的视点考虑时，数据的安全性将显得更为公积金重要，这将导致在企业中运用的许多产品和产品服务被要求私有化、供给私有布置，以此来达到保证企业数据安全的swifter政策。

所以在企业中，或许不会选择像阿里云的 ACR 或许 腾讯云的 TCR 这样的公有云服务，而是选择自产品批号是出产日期吗建容器镜像服务。

基础环swift体系境

官方阐明的是至少需求 2核 CPU + 4G 内存 + 40G 磁盘容量，但在个人设备后，发现其实 Harbor 本身作为容器镜像服务占用Go的资源并不是许多，所以 1核2G 也是能够安全跑起来的，磁盘容量则依据镜像的大小和数量进行分配即可。

咱们并不是直接Go在宿主机上设备 Harbor，而是运用 Docker + Docker Compose 设备，所以需求设备 Docker 和 Docker Compose，版本坚持龚俊最新即可。

还需求设备 Openssl，用于装备 Harbor 的 HTTPS 拜访，以及 Docker 的证书。

下载设备包Nginx

Harbor 的设备包分为在线设备包和离线设备包，在线设备包会从 DockerHub 下面需求的镜像，离线设备包则预先构建好的镜像，比较在线设备包会更大，但两种设安全教育渠道登录备包的整个设备进程基本是相同的，安全这儿是下载地址安全标语。

curl -googleLO https://github.com/goharbor/harbor/relnginx负载均衡eases/download/v2.2.2/harbor-online-Swiftinstaller-v2.2.2.tgz
tar zxf harbor-online-inswift代码staller-v2.2.2.tgz

解压后的文件如下：

> cd harbor &ampSwift;& lNginxs -la
total 40
drwxr-xr-x  2 root root  4096 Jun  7龚俊 23安全出产法:25 .
drwxrwxrwt. 9 roonginx重启t root  4096 Jun  7 23:26Nginx ..
-rw-r--r--  1 ronginx菜鸟教程o产品设计专业t root  3361 May 15 17:32 common.sh
-rw-r--r--  1 root root  7840 May 15 17:32 harbor.yml.tmpl
-rwxr-xr-x  1 root root  2500 May 15 17:32 install.sh
-rw-r--r--  1 root root 1134安全出产法7 May 15nginx负载均衡 17:工作总结32 LICENSEnginx装备
-rwxr-xr-x  1 root root  1881 May 15 17:32 prepare

装备 HTTPS

自建 CA

由于是测验环境，咱们选择自建 CA。首要，咱们经过下面的办法生成 CA 证书的私钥：

openssl genrsa -out ca.key 4nginx重启096

运用上面生成的私钥生成 CA 证书Nginx：

opensslnginx负载均衡 reqswiftkey -x509 -new -nodes -sha512 -days 3650 
-Swiftsubj "/C=CN/ST=Shenzhen/L=Shenzhen/O=example/OU=Personal/CN=k8scat.cSwiftom" 
-key ca.key 
-onginx菜鸟教程ut ca.crt

生成域名证书

现在咱们运用上面生成的 CA 证书来生成域名证书，假定这儿咱们运用的域名是 harbor.k8scat.com。相同，咱们这安全标语儿先生成证书的私钥：

opnginx重启e安全标语nssl genrsa -out harbor.k8scat.com.knginx是什么意思ey 4096

然后运用证书的私钥生成证书签名恳求文件 CSR（Certific安全教育渠道ate Signing Request）：

openssl req -sha512 -new 
-subj "/C=CN/ST=Shenzhen/L=Shenzhen/O=example/OU=Personal/CN=hnginx怎样读arbor.k8scat.coswift代码是什么意思m" 
-key harbor.k8scat.com.key 
-out harbor.k8scat.com.csr

还需求生成 x509 v3 扩展文件，以此来满意 SAN（Subject Altswift体系ernative Name） 和 x509 v3 扩展的要求：

cat > v3.ext <<-EO安全出产法F
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subje产品设计ctAltName = @alt_names
[alt_nginx面试题names]
DNS.1=harbor.k8scat工商银行.com
EOF

终产品介绍究，咱们运用 ca.crt、ca.key、harbor.k8scat.com.csr 和 v3.ext 来生成咱们需产品战略求的域名证书：

openssl x5nginx负载均衡战略09 -req -sha512 -days 3650 
-ex宫颈癌前期症状tfile v3.ext 
-CA ca.crt -CAkey ca.key -CAcreateserial 
-in harbor.k8scat.c安全om.csr 
-out harbor.k8scat.com.crt

装备 Harbor 和 Docker 的证书

Harbor

这儿咱们将将证书存放在 /daswiftlyta/cert 下，当然也能够是其他路径：

cp harbor.k8scat.com.crt /data/cert/
cp harbo安全教育渠道登录r狗狗币.k8scat.c宫颈癌前期症状om.key /data/cert/

Docker

由于 Docker 看护进swift代码是什么意思程会将 .crt 文件解释为 CA 证Nginx书，将 .cert 文件解释为客户端证书。所以这儿咱们需求将域名证书（harbor.k8scat.com.crt）的格swifter式转换成 harbor.k8scat.com.cert：

openssl x509 -inform PEM -in harbor.k8scat.com.crt -out har安全标语bor.k8scat.com.cert

然后将域名证书和 CA 证书仿制到 /工作总结etc/docker/certs.d 目录下：

cp harbor.k8scat.com.cert /etc安全出产月/docker/certs.d/harbor.k8scat.com/
cp harbor.k8scat.com.key /etc/docker/certs.d/harbor.k8scat.com/
cp ca.crt /etc/docker/nginx发动指令cer产品设计专业ts.d/harbo产品设计专业r.swiftlyk8scat.cnginx面试题om/

终究，重启 Docker 服务：

systemctl restart docker

装备 harbor.yml

在装备好 HTTPS 后，这时咱们还没有运转起 Harbor 容安全出产月器镜像服务，咱们还需求装备 ha产品批号是出产日期吗rbor.yml 文件，这个文件是nginx装备仿制自设备包中的 harbor.yml.tmpl 文Nginx件：

cp harbor.yml.tmpl harbor.yml

咱们来看一下 harbor.yml 文件的内容：

# Configuration file of Harbor
# The IP address or hostname to access admin UI and regnginx负载均衡istry service.
# DO NOswift怎样读T use localhost or 127.0.0.1安全, because Harbor needs to be accessed by external cliSwiftents.
hostname: regnginx菜鸟教程.mydomain.com
# http related config
http:
# p安全期是哪几天ort for http, default is 80. If https enabnginx面试题led, this porswiftert will redirect产品定位 to https port
port: 80
# https related config
https:
# https port for harbor, defa龚俊ult is 443
port: 443
# The path of cert and key files for nginx
certificate安全期是哪几天: /your/certificate/path
pswiftcode是什么意思中文rivate_key: /your/pri产品介绍vate/kswiftcode是什么意思中文ey/path
# # Uncomment following will enable tls communication betwee安全教育渠道n all harbor components
# internal_tls:
#   # set enabled to true means internal tls is enabled
#   enabled: true
#   # put your cert安全教育渠道登录进口 and key files on dir
#   dir: /etc/harbor/tls/internal
# Uncomment external_url if you want to enable external proxy
# And when it enabled the hostname will no longer used
# external_url: https://reg.mydomain.com:8433
# The initial password of Harbor产品生命周期 admin
#安全教育 Iswift代码是什么意思t only works in finginx怎样读rst time to install harbor
# Reme产品介绍mbeswiftlyr Change the admin password from UI after launching Harbor.
harbor_admin_password: Harbor12345
# Harbor DB configuration
data宫颈癌base:
# The password for the root user of Harbor DB. Change this before any producnginx发动指令tion use.
password: root123
# The maximum number of connecti龚俊ons in工商银行 the idle connection p产品运营ool. If it <=0, no idle connections are retained.
max_idle_conns: 50
# The maximum number of open connnginx是什么意思ections to the database. If it &l产品运营t产品生命周期;= 0,安全 then there is no limit on the number of open connections.
# Note: the default number of connections is 1024 for postgres of harbswift世界结算体系or.
max_o安全pen_conns: 1000
# The de宫颈癌fault data volume
data_volume: /data
# Harbor Storage settings by default is using /data dir on longinx反向署理cal filesystem
# Un安全出产法comment产品 stor狗狗币age_service setting If you w产品批号是出产日期吗ant to usi安全期计算器ng external storage
# storage_service:
#   # ca_bundle is the path to the custom root ca certificate, which will be injected into the truststore
#   # of registry's and chart rnginx是什么意思eswift代码是什么意思posnginx反向署理itory's containers.  This is usu产品ally needed when the user hosts a internal storage with self signed certificate.
#   ca_bundle:
#   # stor安全期计算器age backend, default is filesystem, options include filesystem, azure, gcsGo, s3, swift and oss
#   # for more info about t产品批号是出产日期吗his configuration please refer https://docs.docker.nginx重启com/registry/configurNginxation/
#   filesystem:
#     maxthreads: 100
#   # set disable to true when you want to disable registry redirect
#   redirect:
#     disabled: fswiftcode代码查询alse
# Trivy configuration
#
# Trivy DB contains vulnerability information from NVD, Red Hat, and many other upstream vulnerability databases.
# It is downloaded安全期是哪几天 by Trivy from the GitHub release page https://github.com/aquasecurity/trivy-db/releases and cached
#Nginx in the local file system. In addition, the database contains the update timestaswift代码是什么意思mp so Trivy can detect whether it
# should download a newer version from the Inter产品定位net or use the cached one. Currently, the datab安全期是哪几天ase is up狗狗币dated every
# 12 hours and published as a new relenginx面试题ase to GitHub.
trivy:
#nginx重启 ignoreUnfixed The flag to display only fixed vulnerabilitie龚俊s
ignore_unfixed: false
# skipUpdate The flag to enable or dis安全标语able Trivy DB downloads from GitHub
#
# You might want to enable this flag in test or CI/CD environments to avoid GitHunginx菜鸟教程b rate limiting issues.
# Ifnginx负载均衡战略 t龚俊he flag is enabled you have to download the `trivy-offline.tar.gz` archive manually, extract `trivy.db` and
# `metadata.json` files and mount them in the `/homSwifte/scanner/.cache/trivy/db` path.
skip_update: false
#
# insecure The flag to skip verifying registry certificate
in龚俊secure: false
# github_token The Gnginx负载均衡itHub access token to download Trivy DB
#
# Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough
# for production operations. If, for any reason, it's not enough, you couswift代码ld increase thNginxe ranginx面试题te limit to 5000
# requests per hour by specifying the GitHub access tokenswiftly. For more details on GitHub rate limiting please consult
# https://developer.github.com/v3swiftcode代码查询/#rate-limiting
#
# You can create a GitHub t安全出产法oken by following the instswiftcode是什么意思中文ructions in
# h枸杞ttps://help.github.com/en/gith安全期是哪几天ub/authenticating-to-github/creating-a-personal-access-token-for-the-comswiftermand-line
#
# github_toke产品质量法n: xxx
jobservice:
# Maximum number of job workers in job service
max_job_workers: 10
notification:
# Maximum retry count for webhook job
webhook_job_max_retry: 10
chart:
# Change t安全教育渠道登录进口he value of absolute_url to enabled can enable absolute url in cha宫颈癌前期症状rt
absolute_url: disabled
# Log configurations
log:
# options are debug, info, warnin产品司理g, error, fatal
level: info
# configs for logs in local storage
local安全教育:
# Log files are rotated log_rnginx面试题otate_count times before being rem龚俊oved. If count is 0, old venginx面试题rsions are remo宫颈癌前期症状ved rather than rotated.
rotate_count: 50
# Log f安全期计算器iles are rotated only if they grow bigger than log_rotate_size bytes. If size is龚俊 followed by k,swift体系 the size is assumed to be in kilobytes.
# If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G
# are all valid.
rotate_size: 200M
# The directory on your host that stornginx面试题e log
location: /var/log/harbor
# Uncomment follo公积金wing lines to enable extswifterernal syslog endpoint.
# external_endpoint:
#   # protocol used to transmit log to external endpoint, options is tcp or udp
#   protocol: tcp
#安全教育渠道登录进口   # The host of external endpoint
#   host: localhost
#   # Port of external ennginx负载均衡dpoint
#   port: 5140
#This attribute is for mi公积金grator to detect the version of the .cfg file,swift世界结算体系 DO NOT MODIFY!
_version: 2.2.0
# Uncomme产品定位nt external_database if using external da枸杞tabase.
# external_database:
#   harbor:
#产品质量法     host: harbor_db_host
#     port: harbor_db_port
#     db_name: harbor_db_nGoame
#     username: harbor_db_username
#     password: harbor_db_password
#     ssl_mode: disable
#     max_idle_conns: 2
#     manginx负载均衡x_open_conns: 0
#   notary产品质量法_signer:
#     host: notary_signer_db_host
#     port: notary_signer_db_port
#     db_name: notary_signer_安全出产法db_name
#     username: notary_signer_db_username
#     password: notary_signer_db_pswift体系assword
#     ssl_mode: disable
#   notary_server:
#     hosswift世界结算体系t: notary_server_db_host
#     port: notary_安全教育渠道登录进口server_db_port
#     db_name: notary_server_db_name
#     username: notary_server_db_username
#     password: notary_server_db_password
#     ssl_mode: di产品批号是出产日期吗sable
# Uncomment external_redis if using external Redis server
# ex公积金ternal_redis:
#   # support redis, redis+sentinel
#   # hoGost for redis: <host_red产品司理is>:<port_redis>
#   # host for redis+sentinel:
#   #  <host_sentine枸杞l1>:<port_sentinel1>,<host_sentinel2>:<por产品t_sentinel2>,<host_sentinel3>:<port_sentinel3>
#   host: redis:6379
#   password:
#   # sentinel_master_set must be set to support redis+nginx发动指令sentinel
#   #sentinel_master_安全标语set:
#   # db_index 0 is fnginx发动指令or core, it's unchangeable
#   registry_db_index: 1
#   jobservice_db_index: 2
#   chartmuseum_db_index: 3
#   trivy_db_index: 5
#   idle_nginx负载均衡战略time工商银行out_seconds: 30
# Uncommen公积金t uaa for trusting the certi产品设计专业ficate of uaa instance that is hosted via self-signed cert.
# uaa:
#   ca_file: /path/to/ca
# Global proxy
# Config http proxy for components, e.g. htt安全出产月p://my.proxy.com:3128
# Components doesn't needgoogle to connect to each others via http proxy.
# Remove component frswift代码是什么意思om `components` array if want disable proxy
# for it安全教育渠道登录. If产品司理 you want use proxy for replication, MUST enable proxy
# for core and jobservice, and set `http_产品proxy` and `https_proxy`.
# Add domain to the `no_proxy` field, when you want disable proxy
# for some special registry.
proxy产品战略:
http_proxy:
https_proxy:
no_proxy:
components:
- core
- jobservice
- trivy
# metric:
#   enabled: false
#   port: 9090
#   path: /metrics

这儿咱们主要修正下面这工商银行几个装备：

• hostname = harbor.k8scat.com
• https.certificate = /data/cert/haswift代码是什么意思rbor.k8scat.com.crt
• https.private_k产品设计ey = /data/cert/harbor.k8scat.com.key
• harbor_admin_password = xxx
• database产品.password = xxx

咱们这次设备的 Harbor 没有运用其他组件，例如 Notary、Trivy 和 Chart，所以相关的装备能够疏忽。

建议 Harbor

./install.snginx负载均衡h

参阅文档

• Harbor Installation Prerequisites
• Download th安全e Harbor Installer
• Ru枸杞n the Installer Scswift体系ript
• Configure the Harbor YML File
• Configure HTTPS Access to Harbor