harbor支持https

概要

• 由于docker login的地址必须是https才行，除非自己配置/etc/docker/deamon.json,需要重启docker，如果已经有很多docker在运行的情况下就比较麻烦了

安装harbor

• 下载harbor

mkdir -p /opt/src
cd /opt/src
wget https://github.com/goharbor/harbor/releases/download/v2.3.2/harbor-offline-installer-v2.3.2.tgz
tar xf harbor-offline-installer-v2.3.2.tgz -C  /opt
mv harbor harbor-v2.3.2
ln -s /opt/harbor-v2.3.2 /opt/harbor

• 配置harbor

[root@hdss-7-200 harbor]#  yum install -y docker-compose
[root@hdss-7-200 harbor]# cp harbor.yml.tmpl  harbor.yml
[root@hdss-7-200 harbor]# vim harbor.yml
hostname: harbor.home.com
http:
  port: 180
# https related config
https:
  # https port for harbor, default is 443
  port: 1443
  # The path of cert and key files for nginx
  certificate: /data/cert/harbor.home.com.crt
  private_key: /data/cert/harbor.home.com.key

data_volume: /data/harbor

生产证书文件

# 创建文件夹
mkdir -p /data/cert
cd /data/cert

# 生成证书文件
openssl genrsa -out ca.key 4096
# 生成证书文件
openssl req -x509 -new -nodes -sha512 -days 3650 -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor.home.com" -key ca.key -out ca.crt
# 生成证书文件
openssl genrsa -out harbor.home.com.key 4096
# 生成证书文件
openssl req -sha512 -new -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor.home.com" -key harbor.home.com.key -out harbor.home.com.csr

# 生成v3.ext文件
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1=harbor.home.com
DNS.2=harbor
DNS.3=ks-allinone
EOF
# 生成cert、crt文件
openssl x509 -req -sha512 -days 3650 -extfile v3.ext -CA ca.crt -CAkey ca.key -CAcreateserial -in harbor.home.com.csr -out harbor.home.com.crt
# 生成cert、crt文件
openssl x509 -inform PEM -in harbor.home.com.crt -out harbor.home.com.cert

cp harbor.home.com.crt /etc/pki/ca-trust/source/anchors/harbor.home.com.crt 
# 更新系统证书
update-ca-trust
# 把这三个复制到docke下
mkdir -p /etc/docker/certs.d/harbor.home.com/
cp harbor.home.com.cert harbor.home.com.key  ca.crt /etc/docker/certs.d/harbor.home.com/

配置harbor文件

[root@k8s-manage harbor]# cd /opt/harbor

# 安装
[root@localhost harbor]# ./install.sh 

# 重新生成配置文件（可选，上面成功了不需要执行）
[root@k8s-manage harbor]# ./prepare --with-notary --with-trivy --with-chartmuseum

# 启动
[root@k8s-manage harbor]# docker-compose up -d

配置nginx文件

[root@k8s-manage ~]# vim /etc/nginx/conf.d/harbor.home.com.conf

server {
    listen 80;
    listen 443 ssl http2;
    client_max_body_size 1000M;
    server_name harbor.home.com;

    ssl_certificate    /data/cert/harbor.home.com.crt;
    ssl_certificate_key   /data/cert/harbor.home.com.key;
    ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    add_header Strict-Transport-Security "max-age=31536000";
    error_page 497  https://$host$request_uri;

 

    location / {

        proxy_pass https://127.0.0.1:1443;
        proxy_connect_timeout 180;
        proxy_send_timeout 180;
        proxy_read_timeout 180;
        proxy_set_header Host $host;
        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
        access_log /var/log/nginx/harbor_access.log;
        error_log /var/log/nginx/harbor_error.log;
    }
}
 
[root@k8s-manage ~]# nginx -s reload

需要登录harbor的机器配置下ca证书

[root@homelab-0-13 ~]# mkdir -p /etc/docker/certs.d/harbor.home.com
[root@homelab-0-13 ~]# scp 192.168.0.20:/data/cert/harbor.home.com.crt  /etc/docker/certs.d/harbor.home.com/ca.crt
[root@homelab-0-13 ~]# docker login  harbor.home.com

错误：

已经解决了，记录一下：配置好了nginx，但是没有443端口，nginx-s reload也没用，可以参考下面的，先nginx -s stop，然后输入nginx，会出现错误，解决这个错误就行。当然也可以nginx -t

[root@k8s-manage ~]# nginx -s stop
[root@k8s-manage ~]# nginx
nginx: [emerg] zero size shared memory zone "perserver"

[root@k8s-manage ~]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

• 错误二：The plain HTTP request was sent to HTTPS port 400

这个错误是由于用http请求到https，把nginx 配置文件里面的proxy_pass http://127.0.0.1:1443;改为proxy_pass https://127.0.0.1:1443;