一、配置https
#1、获得认证权限
openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -sha512 -days 3650 \
-subj "/C=CN/ST=Henan/L=Zhengzhou/O=Inspur/OU=Inspur/CN=10.151.11.52" \
-key ca.key \
-out ca.crt
#2、生成私钥
openssl genrsa -out 10.151.11.52.key 4096
#3、生成证书签名请求
openssl req -sha512 -new \
-subj "/C=CN/ST=Henan/L=Zhengzhou/O=Inspur/OU=Inspur/CN=10.151.11.52" \
-key 10.151.11.52.key \
-out 10.151.11.52.csr
#4、生成注册主机的证书
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1=10.151.11.52（或者yourdoamin.com）
DNS.2=hostname
IP=10.151.11.52
EOF
openssl x509 -req -sha512 -days 3650 \
-extfile v3.ext \
-CA ca.crt -CAkey ca.key -CAcreateserial \
-in 10.151.11.52.csr \
-out 10.151.11.52.crt
#5、将10.151.11.52.crt转换为10.151.11.52.cert
openssl x509 -inform PEM -in 10.151.11.52.crt -out 10.151.11.52.cert#证书生成结果
二、配置和安装harbor和notary
2.1 配置harbor
#配置服务器证书和harbor密钥
#将10.151.11.52.crt和10.151.11.52.key 放入harbor data目录
mkdir -p /data/certs
cp 10.151.11.52.crt /data/certs/
cp 10.151.11.52.key /data/certs/
#为docker配置服务器证书、密钥和CA
mkdir -p /etc/docker/certs.d/10.151.11.52
cp 10.151.11.52.crt 10.151.11.52.key ca.crt /etc/docker/certs.d/10.151.11.52
#配置操作系统级别的信任证书
#（1）ubuntu系统
cp 10.151.11.52.crt /usr/local/share/ca-certificates/yourdomain.com.crt
update-ca-certificates
#（2）centos系统
cp 10.151.11.52.crt /etc/pki/ca-trust/source/anchors
update-ca-trust2.2 安装notary
1、下载notary二进制文件notary-Linux-amd64
https://github.com/theupdateframework/notary/releases/tag/v0.6.1
2、mv notary-Linux-amd64 notary
3、安装go，notary二进制文件需要go来运行
# 安装wget
yun install -y wget
# 下载
wget https://dl.google.com/go/go1.14.6.linux-amd64.tar.gz
# 解压压缩包到/usr/local/golang目录
mkdir -p /usr/local/golang
tar -C /usr/local/golang -xzf go1.14.6.linux-amd64.tar.gz --strip-components 1
# 将/usr/local/golang/bin 目录添加至/etc/profile PATH环境变量
export PATH=$PATH:/usr/local/golang/bin
# 重新读取环境变量
source /etc/profile
# 查看版本
go version
go version go1.14.6 linux/amd64
4、将notary复制到/usr/local/golang/bin目录下，然后直接可以在linux终端使用notary命令
2.3 配置notary
mkdir -p ~/.docker/tls/10.151.11.52:4443
cp ca.crt ~/.docker/tls/10.151.11.52:4443
#设置别名，执行notary命令时不需要输入-s和-d
alias notary="notary -s https://10.151.11.52:4443 -d ~/.docker/trust --tlscacert /etc/docker/certs.d/10.151.11.52/ca.crt"
#使用镜像签名时，在终端输入
export DOCKER_CONTENT_TRUST=1
export DOCKER_CONTENT_TRUST_SERVER=https://10.151.11.52:4443
#使用notary签名的镜像，必须移除签名后，才可以删除，不能直接删除签名镜像，移除签名时，需要输入登录harbor的用户名（admin）和密码，然后输入签名密码
notary remove -p 10.151.11.52:5000/notary/centos v4
#如果使用新建的用户取消签名，则删除信息数据，然后再使用harbor的admin移除签名
#找到对应的信息用户的key
notary key list
#删除该用户的key
notary key remove 1091060d7bfd938dfa5be703fa057974f9322a4faef6f580334f3d6df44c02d1
#删除所有信息数据
notary delete registry.example.com/admin/demo --remote
notary其它使用方式参考如下链接
https://docs.docker.com/notary/getting_started/三、安装harbor
3.1 配置harbor.yml文件
## Configuration file of Harbor
#The IP address or hostname to access admin UI and registry service.
#DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
hostname: 10.151.11.52
# http related config
http:
# port for http, default is 80. If https enabled, this port will redirect to https port
port: 5001
# https related config
https:
# # https port for harbor, default is 443
port: 5000
# # The path of cert and key files for nginx
certificate: /data/certs/10.151.11.52.crt
private_key: /data/certs/10.151.11.52.key
# Uncomment external_url if you want to enable external proxy
# And when it enabled the hostname will no longer used
# external_url: https://reg.mydomain.com:8433
# The initial password of Harbor admin
# It only works in first time to install harbor
# Remember Change the admin password from UI after launching Harbor.
harbor_admin_password: Harbor12345
## Harbor DB configuration
database:
#The password for the root user of Harbor DB. Change this before any production use.
password: root123
# The default data volume
data_volume: /data
# Harbor Storage settings by default is using /data dir on local filesystem
# Uncomment storage_service setting If you want to using external storage
# storage_service:
# # ca_bundle is the path to the custom root ca certificate, which will be injected into the truststore
# # of registry's and chart repository's containers. This is usually needed when the user hosts a internal storage with self signed certificate.
# ca_bundle:
# # storage backend, default is filesystem, options include filesystem, azure, gcs, s3, swift and oss
# # for more info about this configuration please refer https://docs.docker.com/registry/configuration/
# filesystem:
# maxthreads: 100
# # set disable to true when you want to disable registry redirect
# redirect:
# disabled: false
# Clair configuration
clair:
# The interval of clair updaters, the unit is hour, set to 0 to disable the updaters.
updaters_interval: 12
# Config http proxy for Clair, e.g. http://my.proxy.com:3128
# Clair doesn't need to connect to harbor internal components via http proxy.
http_proxy:
https_proxy:
no_proxy: 127.0.0.1,localhost,core,registry
jobservice:
# Maximum number of job workers in job service
max_job_workers: 10
# Log configurations
log:
# options are debug, info, warn, error
level: info
# Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.
rotate_count: 50
# Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes.
# If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G
# are all valid.
rotate_size: 200M
# The directory on your host that store log
location: /var/log/harbor
#This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY!
_version: 1.8.0
# Uncomment external_database if using external database. Currently only support POSTGRES.
# Four databases are needed to be create first by users for Harbor core, Clair, Notary server
# and Notary signer. And the tables will be generated automatically when Harbor starting up.
# NOTE: external_database is unable to custom attributes individually, you must do them in block.
# external_database:
# harbor:
# host: harbor_db_host
# port: harbor_db_port
# db_name: harbor_db_name
# username: harbor_db_username
# password: harbor_db_password
# ssl_mode: disable
# clair:
# host: clair_db_host
# port: clair_db_port
# db_name: clair_db_name
# username: clair_db_username
# password: clair_db_password
# ssl_mode: disable
# notary_signer:
# host: notary_signer_db_host
# port: notary_signer_db_port
# db_name: notary_signer_db_name
# username: notary_signer_db_username
# password: notary_signer_db_password
# ssl_mode: disable
# notary_server:
# host: notary_server_db_host
# port: notary_server_db_port
# db_name: notary_server_db_name
# username: notary_server_db_username
# password: notary_server_db_password
# ssl_mode: disable
# Uncomment external_redis if using external Redis server
# external_redis:
# host: redis
# port: 6379
# password:
# # db_index 0 is for core, it's unchangeable
# registry_db_index: 1
# jobservice_db_index: 2
# chartmuseum_db_index: 3
# Uncomment uaa for trusting the certificate of uaa instance that is hosted via self-signed cert.
# uaa:
# ca_file: /path/to/ca3.2 在解压的harbor目录下，执行安装命令
./install.sh --with-notary
出现以下提示，表示安装成功
✔ ----Harbor has been installed and started successfully.----
Now you should be able to visit the admin portal at https://10.151.11.52.
For more details, please visit https://github.com/goharbor/harbor .
#查看harbor容器状态
#cd harbor 安装目录
docker-compose ps
# 停止容器
docker-compose stop
# 后台启动容器
docker-compose up -d
访问页面
使用默认的账号:admin,密码:Harbor12345登录验证
登录成功之后，效果如下：
3.3 push签名镜像
#使用镜像签名时，在终端输入
export DOCKER_CONTENT_TRUST=1
export DOCKER_CONTENT_TRUST_SERVER=https://10.151.11.52:4443
然后使用docker push镜像，输入签名密码，push完成后，可以在harbor仓库中查看镜像签名状态
docker push 10.151.11.52:5000/library/centos:latest3.4 删除签名镜像
#移除签名时，需要输入登录harbor的用户名（admin）和密码，然后输入签名密码
notary remove -p 10.151.11.52:5000/notary/centos latest
#然后在harbor页面删除该镜像
本文章为转载内容，我们尊重原作者对文章享有的著作权。如有内容错误或侵权问题，欢迎原作者联系我们进行内容更正或删除文章。
