harbor 安装

下载软件包

wget https://github.com/goharbor/harbor/releases/download/v2.0.2/harbor-offline-installer-v2.0.2.tgz

生成自签名证书

• 自建CA

• 生成CA私钥

  # openssl genrsa -out ca.key 4096
  

• 生成CA证书

  # openssl req -x509 -new -nodes -sha512 -days 3650 -subj "/C=CN/ST=Beijing/L=Beijing/O=cloud/OU=cloud/CN=test.com/CN=harbor.test.com/CN=*.test.com" -key ca.key -out ca.crt
  

创建 Server 证书

• 生成私钥

  # openssl genrsa -out harbor.test.com.key 4096
  

• 创建自签名文件

  # openssl req -sha512 -new \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=cloud/OU=cloud/CN=harbor.test.com/CN=test.com/CN=*.test.com" \
    -key harbor.test.com.key \
    -out harbor.test.com.csr
  

• 创建 x509 v3延伸文件

  # cat > v3.ext <<-EOF
    authorityKeyIdentifier=keyid,issuer
    basicConstraints=CA:FALSE
    keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
    extendedKeyUsage = serverAuth
    subjectAltName = @alt_names
    DNS.1=harbor.test.com
    DNS.2=test.com
    DNS.3=*.test.com
  EOF
  

• 使用 v3.ext 文件创建证书

  # openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in harbor.test.com.csr \
    -out harbor.test.com.crt
  

安装docker

• 安装依赖软件

  # yum install -y yum-utils device-mapper-persistent-data lvm2
  

• 创建yum 源

  # yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
  

• 安装docker-ce

  # yum -y install docker-ce
  

安装harbor

- 解压文件
```bash
# tar -xf harbor-offline-installer-v2.0.2.tgz
# mv harbor /usr/local/
```


- 复制ssl证书
```bash
# cp ~/install_harbor/ssl/* /usr/local/harbor/ssl/
# cd /usr/local/harbor/ssl
# chmod 600 harbor.test.com.crt harbor.test.com.key
# chmod 600 ca.crt ca.key
```

• 执行安装脚本

  # cd /usr/local/harbor/
  # sudo ./install.sh --with-notary --with-clair --with-chartmuseum
  

• 创建开机启动脚本

  # vim  /usr/lib/systemd/system/harbor.service
  [Unit]
  Description=Harbor Service
  After=network.target
  After=network-online.target
  After=docker.service
  Requires=network.target
  Requires=network-online.target
  Requires=docker.service
  
  [Service]
  Type=simple
  ExecStart=/usr/local/harbor/harbor_startup.sh start
  ExecStop=/usr/local/harbor/harbor_startup.sh stop
  RemainAfterExit=yes
  
  [Install]
  WantedBy=multi-user.target
  
  # systemctl  daemon-loread
  # systemctl  enable  harbor 
  

• 创建执⾏脚本

  # cat /usr/local/harbor/harbor_startup.sh
  #!/bin/sh
  cd /usr/local/harbor
  action=$1
  if [[ $action = "start" ]];then
  docker-compose down -v
  docker-compose up -d
  elif [[ $action = "stop" ]];then
  docker-compose down -v
  fi
  
  # systemctl  start  harbor
  

• 更换 SSL 合法证书

  把证书⽂件拷贝到  /usr/local/harbor/ssl
  ls -l /usr/local/harbor/ssl/cloud.com.crt
  ls -l /usr/local/harbor/ssl/cloud.com.key
  ls -l /usr/local/harbor/ssl/gsrsaovsslca2018.crt # CA 根证书
  

• 修改配置⽂件

  设置证书文件
  # vim /usr/local/harbor/harbor.yml
  
  # https related config
  https:
    # https port for harbor, default is 443
    port: 443
    # The path of cert and key files for nginx
    certificate: /usr/local/harbor/ssl/cloud.com.crt
    private_key: /usr/local/harbor/ssl/cloud.com.key
  
  

• 重新安装harbor

  # cd /usr/loca/harbor/
  # sudo ./install.sh --with-notary --with-clair --with-chartmuseum
  # systemctl restart harbor