centos7 离线安装自签名harbor

tanggang1740

安装docker,git
yum install docker  docker-logrotate git -y安装docker-compose

yum install python-virtualenv -y
virtualenv ven_harbor
source ven_harbor/bin/activate
pip install --upgrade pip
pip install docker-compose下载harbor

wget https://github.com/vmware/harbor/releases/download/0.4.1/harbor-offline-installer-0.4.1.tgz
tar xvzf harbor-offline-installer-0.4.1.tgz生成自签名证书


mkdir ca
cd ca
openssl req \
    -newkey rsa:4096 -nodes -sha256 -keyout ca.key \
    -x509 -days 365 -out ca.crt
openssl req \
    -newkey rsa:4096 -nodes -sha256 -keyout yourdomain.com.key \
    -out yourdomain.com.csr
touch  /etc/pki/CA/index.txt
echo '01' > /etc/pki/CA/serial
openssl ca -in yourdomain.com.csr -out yourdomain.com.crt -cert ca.crt -keyfile ca.key -outdir .
# 如果打算使用IP方式访问registry，请将上面命令替换为如下命令，your_ip，为harbor所在的服务器的IP，
# 默认情况下，https仅支持域名访问，若使用上面的命令进行签名，执行docker login your_ip，会有如下报错
# Failed to tls handshake with x.x.x.x x509: cannot validate certificate for x.x.x.x because it doesn't contain any IP SANs
echo subjectAltName = IP:your_ip > extfile.cnf
openssl ca -in your_ip.csr -out your_ip.crt -cert ca.crt -keyfile ca.key -extfile extfile.cnf -outdir .安装harbor
cd harbor/config/nginx
cp ~/ca/yourdomain.com.crt cert/
cp ~/ca/yourdomain.com.key cert/
mv nginx.conf nginx.conf.bak
cp nginx.https.conf nginx.conf
sed -i s/harbordomain.com/yourdomain.com/g nginx.conf
sed -i s/harbordomain/yourdomain.com/g nginx.conf
# 编辑 ~/harbor/harbor.cfg
hostname = yourdomain.com
ui_url_protocol = https
harbor_admin_password = Harbor12345
auth_mode = db_auth
db_password = root123
# 安装harbor
./install.sh配置client

• 　　将-insecure-registry从docker配置文件中移除，重启docker
  
• 　　复制ca.crt到client
  

mkdir -p /etc/docker/certs.d/yourdomain.com
cp ca.crt /etc/docker/certs.d/yourdomain.com　　创建项目

• 　　使用http://yourdomain.com 登录 harbor，会自动重定向到 https://yourdomain.com
  
• 　　创建项目test
  

　　将镜像推送到harbor中
docker login yourdomain.com
docker tag centos:7 yourdomain.com/test/centos:7
docker push yourdomain.com/test/centos:7　　参考链接：
　　http://blog.csdn.net/gqtcgq/article/details/51163558

　　https://docs.docker.com/engine/security/https/