Centos7部署harbor

1.升级系统

cd /etc/yum.repos.d/

wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo

yum update -y

[root@harbor ~]# cat /etc/redhat-release

CentOS Linux release 7.6.1810 (Core)

2.配置DNS域名并测试

vi /etc/hosts

10.100.13.77 hctest.cn

下载yum源：wget https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo

安装docker-ce

yum -y install docker-ce

启动docker

systemctl start docker

配置docker国内镜像：

vi /etc/docker/daemon.json

{

"registry-mirrors": ["https://registry.docker-cn.com"]

}

重启

systemctl restart docker

安装docker-compose

curl -L https://github.com/docker/compose/releases/download/1.23.1/docker-compose-`uname -s-uname -m` -o /usr/local/bin/docker-compose

授权

chmod +x /usr/local/bin/docker-compose

软连接：

ln -sv /usr/local/bin/docker-compose /usr/sbin/docker-compose

[root@test ~]# docker-compose --version

docker-compose version 1.23.1, build b02f1306

安装harbor

wget https://storage.googleapis.com/harbor-releases/release-1.6.0/harbor-online-installer-v1.6.2.tgz

tar -zxf harbor-online-installer-v1.6.2.tgz

mkdir /data

mv harbor /data/harbor

创建CA证书：

mkdir /data/cert;

cd /data/cert

openssl req -nodes -subj "/CN=hchctest.cn" -newkey rsa:4096 -keyout hchctest.cn.key -out hchctest.cn.csr

openssl x509 -req -days 3650 -in hchctest.cn.csr -signkey hchctest.cn.key -out hchctest.cn.crt

openssl x509 -req -in hchctest.cn.csr -CA hchctest.cn.crt -CAkey hchctest.cn.key -CAcreateserial -out hchctest.cn.crt -days 10000

配置harbor:

vim /data/harbor/ harbor.cfg

修改如下内容：

hostname = hctest.cn

ui_url_protocol = https

ssl_cert = /data/cert/hchctest.cn.crt

ssl_cert_key = /data/cert/hchctest.cn.key

harbor_admin_password = Harbor12345 #修改登录密码

启动harbor

./install.sh

修改docker.service

vim /usr/lib/systemd/system/docker.service

ExecStart=/usr/bin/dockerd --graph=/data/docker -H unix:// --insecure-registry hchctest.cn

注：--graph=/data/docker docker镜像存储路径

测试：

[root@test harbor]# docker login hctest.cn

Username: admin

Password:

WARNING! Your password will be stored unencrypted in /root/.docker/config.json.

Configure a credential helper to remove this warning. See

https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

备注:因为harbor是基于docker-compose服务编排的，可以直接使用docker-compose命令启动。

不修改配置文件重启： docker-compose start|stop|restart

1.停止harbor docker-compose down -v

2.启动harbor docker-compose up -d

客户端使用

注：因为https协议，所以客户端需要crt 从服务端把hchctest.cn.crt拷贝过来

mkdir /etc/docker/certs.d/hchctest.cn/

scp /data/cert/hchctest.cn.crt root@master:/etc/docker/certs.d/hchctest.cn/

客户端测试：

错误排查：

docker login时提示x509: certificate signed by unknown authority

解决方法: 自签名的证书不被系统信任,需要把/hchctest.cn.crt拷贝到/etc/docker/certs.d/hchctest.cn/, 无需重启docker

具体操作如下

mdkir /etc/docker/certs.d/hchctest.cn/;

cp /data/cert/hchctest.cn.crt /etc/docker/certs.d/hchctest.cn/

再次登录解决问题!