k8s-harbor安裝

使用官方安裝 自動安裝（僅適用於公網環境）

curl -fsSL | bash -s docker --mirror Aliyun

sudo curl -L "(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose
root@k8s-master1:/usr/local/bin# docker-compose --version
docker-compose version 1.23.1, build b02f1306

apt-get install python2.7  -y 
ln -s /usr/bin/python2.7 /usr/bin/python

openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -sha512 -days 3650 \
-subj "/C=TW/ST=Taipei/L=Taipei/O=example/OU=Personal/CN=harbor.gesila.com" \
-key ca.key \
-out ca.crt
root@ubuntu:/usr/local/src/harbor/certs# ls
ca.crt  ca.key

--------------------------------------------------
遇到問題：Can't load /root/.rnd into RNG
解決辦法：

cd /root
openssl rand -writerand .rnd

--------------------------------------------------

openssl genrsa -out harbor.gesila.com.key 4096
openssl req -sha512 -new \
-subj "/C=TW/ST=Taipei/L=Taipei/O=example/OU=Personal/CN=harbor.gesila.com" \
-key harbor.gesila.com.key \
-out harbor.gesila.com.csr
root@ubuntu:/usr/local/src/harbor/certs# ls
ca.crt  ca.key  harbor.gesila.com.csr  harbor.gesila.com.key
------------------------------------------------------

cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth 
subjectAltName = @alt_names
[alt_names]
DNS.1=harbor.gesila.com
DNS.2=harbor.gesila
DNS.3=hostname
EOF
root@ubuntu:/usr/local/src/harbor/certs# ls
ca.crt  ca.key  harbor.gesila.com.csr  harbor.gesila.com.key  v3.ext
------------------------------------------------------
openssl x509 -req -sha512 -days 3650 \
-extfile v3.ext \
-CA ca.crt -CAkey ca.key -CAcreateserial \
-in harbor.gesila.com.csr \
-out harbor.gesila.com.crt
---------------------------------------------------------------------------------
root@ubuntu:/usr/local/src/harbor/certs# ls
ca.crt  ca.key  ca.srl  harbor.gesila.com.crt  harbor.gesila.com.csr  harbor.gesila.com.key  v3.ext

cd  /usr/local/src
tar xf harbor-offline-installer-v1.2.2.tgz
cd harbor/
vim harbor.cfg
------------------------------------
hostname = harbor.gesila.com
ui_url_protocol = https
ssl_cert = /usr/local/src/harbor/certs/harbor.gesila.com.crt 
ssl_cert_key = /usr/local/src/harbor/certs/harbor.gesila.com.key
harbor_admin_password = 123456
------------------------------------
./prepare
./install.sh

預設安裝不包括Notary或Clair服務，這些服務用於漏洞掃描;要包括公證服務，你必須在harbor.yml中啟用和配置

https sudo ./install.sh -with-notary --with-clair --with-chartmuseum

#凡事要登入到habor都要建該檔案
mkdir -p /etc/docker/certs.d/harbor.gesila.com
#把證照檔案複製到/etc/docker/certs.d/harbor.gesila.com目錄

cp /usr/local/src/harbor/certs/harbor.gesila.com.crt  /etc/docker/certs.d/harbor.gesila.com

#需要連線到harbor的機器都需要修改，加上引數：--insecure-registry

vim /lib/systemd/system/docker.service 
-------------------------------------------------------------------------------------------------------------------
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --insecure-registry harborip地址
-------------------------------------------------------------------------------------------------------------------
systemctl daemon-reload && systemctl restart docker

root@k8s-master1:/usr/local/src/harbor# docker login harbor.gesila.com
Authenticating with existing credentials...
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
Login Succeeded

網頁建一個k8s專案
root@k8s-master1:/usr/local/src/harbor# docker pull alpine
Using default tag: latest
latest: Pulling from library/alpine
59bf1c3509f3: Pull complete 
Digest: sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300
Status: Downloaded newer image for alpine:latest
docker.io/library/alpine:latest
root@k8s-master1:/usr/local/src/harbor# docker tag alpine harbor.gesila.com/k8s/alpine && docker push  harbor.gesila.com/k8s/alpine
Using default tag: latest
The push refers to repository [harbor.gesila.com/k8s/alpine]
8d3ac3489996: Pushed 
latest: digest: sha256:e7d88de73db3d3fd9b2d63aa7f447a10fd0220b7cbf39803c803f2af9ba256b3 size: 528

問題解決

./prepare 
Fail to generate key file: ./common/config/ui/private_key.pem, cert file: ./common/config/registry/root.crt

#解決辦法：

vim +308  prepare 
---------------------------------------------------------------------------------------------------------------------------------
empty_subj = "/C=/ST=/L=/O=/CN=/" 替換為：empty_subj = "/C=US/ST=California/L=Palo Alto/O=VMware, Inc./OU=Harbor/CN=notarysigner"
---------------------------------------------------------------------------------------------------------------------------------
./install.sh
./prepare: /usr/bin/python: bad interpreter: No such file or directory

#解決辦法：
prepare 是用python寫的；但是prepare不相容3.5版本，需降級還原使用2.7

apt-get install python2.7  -y 
ln -s /usr/bin/python2.7 /usr/bin/python

➜ Please set hostname and other necessary attributes in harbor.cfg first. DO NOT use localhost or 127.0.0.1 for hostname, because Harbor needs to be accessed by external clients.
Please set --with-notary if needs enable Notary in Harbor, and set ui_url_protocol/ssl_cert/ssl_cert_key in harbor.cfg bacause notary must run under https. 
Please set --with-clair if needs enable Clair in Harbor

#解決辦法：
修改hostname

vim /usr/local/src/harbor/harbor.cfg
#hostname = reg.mydomain.com  預設的是這個，這個必須要刪除，註釋的話也提示問題上述問題

原文來自：