harbor 镜像仓库搭建

  • harbor 镜像仓库搭建
    • harbor 单机仓库搭建
    • harbor 高可用搭建
    • registry 镜像仓库

1.0 harbor 单机镜像仓库搭建

1.1 harbor 离线包下载

1
2
3
4
5
// harbor镜像仓库搭建依赖 docker、docker-compose ,需提前安装好!

// 官方地址: https://github.com/goharbor/harbor/releases
// 下载离线包
# wget https://github.com/goharbor/harbor/releases/download/v2.3.5/harbor-offline-installer-v2.3.5.tgz

1.2 harbor https 配置和启动

1
2
3
4
5
6
7
8
9
# tar -xf harbor-offline-installer-v2.3.5.tgz -C /usr/local/
# cd /usr/local/harbor/
# mv harbor.yml.tmpl harbor.yml
# vim harbor.yml 
    5 hostname: harbor.ink8s.com				# 已配置过内网解析
    17   certificate: /usr/local/harbor/cert/harbor.ink8s.com.pem
    18   private_key: /usr/local/harbor/cert/harbor.ink8s.com.key
    34 harbor_admin_password: ink8s.com
# ./install.sh

1.3 访问 harbor

1.4 harbor镜像 pull和push

docker 客户端执行
1
2
3
4
5
6
7
8
9
10
// docker 客户端拉取 harbor 仓库镜像需要先授权才能 push
# docker login harbor.ink8s.com				# 客户端授权

// 演示推(pull)和拉(pull)
# docker pull centos:7					# 获取镜像到本地客户端
# docker tag centos:7 harbor.ink8s.com/os/centos:7	# 打 tag
    // harbor.ink8s.com 是仓库地址
    // os 是项目目录
    // centos:7 是镜像名称和版本号
# docker push harbor.ink8s.com/os/centos:7		# 推送到harbor仓库

1.5 harbor 信任

1
2
3
4
5
6
7
8
9
// 如果 harbor 不是 https 则需要配置可信任,否则pull和push会报错

# cat /etc/docker/daemon.json
{
    "registry-mirrors": ["https://pkidimmv.mirror.aliyuncs.com"],
    "insecure-registries": ["harbor.ink8s.com"]		# 可以信任多个地址,以","分割 ["a.b.c,d","w.x.y.z"]
}

# systemctl daemon-reload && systemctl restart docker

2.0 harbor 高可用搭建

2.1 部署配置

  • docker_version: 20.10.22
  • docker-compose_version: v2.1.1
  • harbor: v2.5.1
系统版本 IP地址 主机名 最小配置
centos 7.9 10.10.10.117 harbor01 2C/4G/100G
centos 7.9 10.10.10.118 harbor02 2C/4G/100G
centos 7.9 10.10.10.119 haproxy 1C/4C/100G

2.2 harbor 部署

2.2.1 harbor01 安装

1
2
3
4
5
6
7
8
9
10
11
12
# tar -xf harbor-offline-installer-v2.5.1.tgz -C /usr/local/
# mkdir -p /var/log/harbor
# cd /usr/local/harbor/
# mv harbor.yml.tmpl harbor.yml
# vim harbor.yml 
    5 hostname: 10.10.10.117
    34 harbor_admin_password: ink8s.com
# ./install.sh

// 登录: http://10.10.10.117
username: admin
password: ink8s.com

upload successful

2.2.2 harbor02 安装

1
2
3
4
5
6
7
8
9
10
11
12
# tar -xf harbor-offline-installer-v2.5.1.tgz -C /usr/local/
# mkdir -p /var/log/harbor
# cd /usr/local/harbor/
# mv harbor.yml.tmpl harbor.yml
# vim harbor.yml 
    5 hostname: 10.10.10.118
    34 harbor_admin_password: ink8s.com
# ./install.sh

// 登录: http://10.10.10.118
username: admin
password: ink8s.com

upload successful

2.3 harbor 仓库管理 配置

2.3.1 harbor01 复制配置

upload successful

2.3.2 harbor02 复制配置

upload successful

2.4 harbor 复制管理 配置

2.4.1 harbor01 复制配置

upload successful

2.4.2 harbor02 复制配置

upload successful

2.5 haproxy 安装和配置

2.5.1 haproxy 安装

1
# yum -y install haproxy

2.5.2 harbor https 证书配置

1
2
3
4
5
6
// 将 nginx 证书 pem、key 文件合并为一个文件
# mkdir -p /etc/haproxy/cert

// 证书必须真实有效
# cat harbor.ink8s.com.pem > harbor.pem
# cat harbor.ink8s.com.key > harbor.pem

2.5.3 haproxy 配置文件配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
# cat /etc/haproxy/haproxy.cfg
global
    log         127.0.0.1 local2
    chroot      /var/lib/haproxy
    pidfile     /var/run/haproxy.pid
    maxconn     4000
    user        haproxy
    group       haproxy
    daemon
    stats socket /var/lib/haproxy/stats

defaults
    mode                    http
    log                     global
    option                  httplog
    option                  dontlognull
    option http-server-close
    option forwardfor       except 127.0.0.0/8
    option                  redispatch
    retries                 3
    timeout http-request    10s
    timeout queue           1m
    timeout connect         10s
    timeout client          1m
    timeout server          1m
    timeout http-keep-alive 10s
    timeout check           10s
    maxconn                 3000

frontend harbor
    bind *:80
    bind *:443 ssl crt /usr/local/haproxy/cert/harbor.pem
    mode http
    use_backend harbor_cluster
    redirect scheme https if !{ ssl_fc }
    
    http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
    http-request set-header X-Forwarded-Proto https if { ssl_fc }

backend harbor_cluster
    balance source
    server harbor01 10.10.10.117:80 check port 80
    server harbor02 10.10.10.118:80 check port 80

# systemctl start haproxy && # systemctl enable haproxy

2.6 验证

2.6.1 创建项目名称

  • harbor01 和 harbor02 分别创建一样的项目名称
  • 此高可用唯一不足点是,2 台 harbor 项目名称必须手动创建为一样才能保持同步

upload successful

2.6.2 客户端登录

1
2
3
4
// 请提前将 haproxy 的 IP 做好域名解析: 10.10.10.119	harbor.ink8s.com
# docker login harbor.ink8s.com
Username: admin
Password: ink8s.com

2.6.3 pull 和 push

1
2
3
4
5
# docker pull nginx							# 拉取外网镜像
# docker tag nginx:latest harbor.ink8s.com/ops/nginx:latest		# 打 tag
# docker push harbor.ink8s.com/ops/nginx:latest				# 推到私有 harbor 仓库
// 然后登录 2 台 harbor 查看是否有上传的镜像
// 除了创建目录时需要单独登录各节点创建外,其它情况使用 harbor.ink8s.com 登录即可

3.0 registry 镜像仓库

3.1 部署 registry

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
// 依赖的软件包
# yum -y install jq httpd-tools

// 配置认证
# mkdir -p /opt/registry-auth
# htpasswd -Bbn admin ink8s.com > /opt/registry-auth/htpasswd
  -B  使用bcrypt算法加密密码
  -b  指定用户名和密码
  -n  在标准输出中显示内容,便于重定向到文件中

// 容器部署
# docker run -d -p 5000:5000 \
       -v /opt/myregistry:/var/lib/registry \
       -v /opt/registry-auth/:/auth \
       -e "REGISTRY_AUTH=htpasswd" \
       -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
       -e "REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd" \
       --restart=always \
       --name registry \
       registry

# docker ps

3.2 配置节点信任

1
2
3
4
5
6
7
# cat /etc/docker/daemon.json
{
    "registry-mirrors": ["https://pkidimmv.mirror.aliyuncs.com"],
    "insecure-registries": ["registry.ink8s.com:5000"]
}

# systemctl restart docker

3.3 推送/查看

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
// 客户端登录
# docker login registry.ink8s.com:5000
Username: admin
Password: ink8s.com


// 镜像推送
# docker tag registry:latest registry.ink8s.com:5000/base/registry:latest
# docker push registry.ink8s.com:5000/base/registry:latest

// 查看仓库镜像名
# curl -uadmin:ink8s.com -s http://registry.ink8s.com:5000/v2/_catalog | jq -r 
{
  "repositories": [
    "base/registry"
  ]
}

// 查看对应镜像tag
# curl -uadmin:ink8s.com -s http://registry.ink8s.com:5000/v2/base/registry/tags/list | jq 
{
  "name": "base/registry",
  "tags": [
    "latest"
  ]
}

微信

加微信,入技术群

微信

扫一扫，分享到微信

tag:

    缺失模块。
    1、请确保node版本大于6.2
    2、在博客根目录（注意不是yilia-plus根目录）执行以下命令：
    npm i hexo-generator-json-content --save

    3、在根目录_config.yml里添加配置： 

      jsonContent:
    meta: false
    pages: false
    posts:
      title: true
      date: true
      path: true
      text: false
      raw: false
      content: false
      slug: false
      updated: false
      comments: false
      link: false
      permalink: false
      excerpt: false
      categories: false
      tags: true

运维技术面：
1. Linux 基础、脚本、服务部署、虚拟化
2. Linux 自动化、服务器硬件
3. Kubernetes、kube 服务部署
4. Windows 客户端,服务端的便捷应用

微信： wnn_chat

写博客的动力,源自于个人爱好!