1、harbor介紹
Docker容器應用的開發和運行離不開可靠的鏡像管理，雖然docker官方提供了公共的鏡像倉庫（Docker Hub），但是從安全和效率等方面考慮，部署我們私有環境內的Registry也是非常必要的。Harbor是由VMware公司開源的企業級的Docker Registry管理項目，它包括權限管理（RBAC）、LDAP、日志審核、界面管理、自我注冊、鏡像復制和中文支持等功能。
2、安裝配置
環境配置：
docker: 19.03.12
docker-compose: 1.26.2
Harbor: v1.8.0
注意：Harbor的所有服務組件都是在Docker中部署，所以官方安裝使用Docker-compose快速部署，所以我們需要安裝Docker、Docker-compose。由於Harbor是基於Docker Registry V2版本，所以就要求Docker版本不小於1.10.0，Docker-compose版本不小於1.6.0。
3、docker安裝
1、安裝一些必要的系統工具
yum install -y yum-utils device-mapper-persistent-data lvm2
2、添加docker鏡像源
yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
3、安裝docker-ce
yum -y install docker-ce
4、啟動docker服務
systemctl start docker.server
補充：
# 守護進程重啟
> sudo systemctl daemon-reload
# 重啟docker服務
> sudo systemctl restart docker
# 關閉docker
> sudo systemctl stop docker
4、docker-compose安裝
> curl -L https://github.com/docker/compose/releases/download/1.26.2/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose
> chmod +x /usr/local/bin/docker-compose
> docker-compose version
5、Harbor私有倉庫安裝
1、下載Harbor安裝文件
從 github harbor 官網 release 頁面下載指定版本的安裝包。
# 在線安裝包
> wget https://github.com/vmware/harbor/releases/download/v1.8.0/harbor-online-installer-v1.8.0.tgz
> tar xvf harbor-online-installer-v1.8.0.tgz
# 離線安裝包
> wget https://github.com/vmware/harbor/releases/download/v1.8.0/harbor-offline-installer-v1.8.0.tgz
> tar xvf harbor-offline-installer-v1.8.0.tgz
如果服務器的網絡帶寬不行的話，建議使用離線安裝，提前下載完上傳到服務器
2、配置Harbor
進入harbor目錄，打開harbor.yml進行配置
# Configuration file of Harbor
# The IP address or hostname to access admin UI and registry service.
# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
# hostname設置訪問地址，可以使用ip、域名，不可以設置為127.0.0.1或localhost
hostname: xx.xx.xx.xx
# http related config
http:
# port for http, default is 80. If https enabled, this port will redirect to https port
port: 80
# https related config
#https:
# # https port for harbor, default is 443
# port: 443
# # The path of cert and key files for nginx
# certificate: /root/harbor/data/yaduo.pem
# private_key: /root/harbor/data/yaduo.key
# Uncomment external_url if you want to enable external proxy
# And when it enabled the hostname will no longer used
# external_url: https://reg.mydomain.com:8433
# The initial password of Harbor admin
# It only works in first time to install harbor
# Remember Change the admin password from UI after launching Harbor.
harbor_admin_password: Harbor12345
# Harbor DB configuration
database:
# The password for the root user of Harbor DB. Change this before any production use.
password: only1234
# The default data volume
data_volume: /data
# Harbor Storage settings by default is using /data dir on local filesystem
# Uncomment storage_service setting If you want to using external storage
# storage_service:
# # ca_bundle is the path to the custom root ca certificate, which will be injected into the truststore
# # of registry's and chart repository's containers. This is usually needed when the user hosts a internal storage with self signed certificate.
# ca_bundle:
# # storage backend, default is filesystem, options include filesystem, azure, gcs, s3, swift and oss
# # for more info about this configuration please refer https://docs.docker.com/registry/configuration/
# filesystem:
# maxthreads: 100
# # set disable to true when you want to disable registry redirect
# redirect:
# disabled: false
# Clair configuration
clair:
# The interval of clair updaters, the unit is hour, set to 0 to disable the updaters.
updaters_interval: 12
# Config http proxy for Clair, e.g. http://my.proxy.com:3128
# Clair doesn't need to connect to harbor internal components via http proxy.
http_proxy:
https_proxy:
no_proxy: 127.0.0.1,localhost,core,registry
jobservice:
# Maximum number of job workers in job service
max_job_workers: 10
chart:
# Change the value of absolute_url to enabled can enable absolute url in chart
absolute_url: disabled
# Log configurations
log:
# options are debug, info, warning, error, fatal
level: info
# Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.
rotate_count: 50
# Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes.
# If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G
# are all valid.
rotate_size: 200M
# The directory on your host that store log
location: /var/log/harbor
#This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY!
_version: 1.8.0
# Uncomment external_database if using external database. Currently only support POSTGRES.
# Four databases are needed to be create first by users for Harbor core, Clair, Notary server
# and Notary signer. And the tables will be generated automatically when Harbor starting up.
# NOTE: external_database is unable to custom attributes individually, you must do them in block.
# external_database:
# harbor:
# host: harbor_db_host
# port: harbor_db_port
# db_name: harbor_db_name
# username: harbor_db_username
# password: harbor_db_password
# ssl_mode: disable
# clair:
# host: clair_db_host
# port: clair_db_port
# db_name: clair_db_name
# username: clair_db_username
# password: clair_db_password
# ssl_mode: disable
# notary_signer:
# host: notary_signer_db_host
# port: notary_signer_db_port
# db_name: notary_signer_db_name
# username: notary_signer_db_username
# password: notary_signer_db_password
# ssl_mode: disable
# notary_server:
# host: notary_server_db_host
# port: notary_server_db_port
# db_name: notary_server_db_name
# username: notary_server_db_username
# password: notary_server_db_password
# ssl_mode: disable
# Uncomment external_redis if using external Redis server
# external_redis:
# host: redis
# port: 6379
# password:
# # db_index 0 is for core, it's unchangeable
# registry_db_index: 1
# jobservice_db_index: 2
# chartmuseum_db_index: 3
# Uncomment uaa for trusting the certificate of uaa instance that is hosted via self-signed cert.
# uaa:
# ca_file: /path/to/ca
3、啟動Harbor
- 啟動
修改完配置文件后，在的當前目錄執行./install.sh，Harbor服務就會根據當期目錄下的docker-compose.yml開始下載依賴的鏡像，檢測並按照順序依次啟動各鏡像
- Harbor依賴的鏡像及啟動服務如下：
############################################## docker images ###################################
goharbor/chartmuseum-photon v0.8.1-v1.8.0 60a4caf66227 14 months ago 113MB
goharbor/harbor-migrator v1.8.0 765880263e76 14 months ago 361MB
goharbor/redis-photon v1.8.0 66d7402d2770 14 months ago 103MB
goharbor/clair-photon v2.0.8-v1.8.0 7570a336afd5 14 months ago 164MB
goharbor/notary-server-photon v0.6.1-v1.8.0 e8552306a936 14 months ago 135MB
goharbor/notary-signer-photon v0.6.1-v1.8.0 9736ac6c508e 14 months ago 132MB
goharbor/harbor-registryctl v1.8.0 0ca3e2b624f5 14 months ago 96.2MB
goharbor/registry-photon v2.7.1-patch-2819-v1.8.0 1e7d99ccba24 14 months ago 81.3MB
goharbor/nginx-photon v1.8.0 4a4b48b32ae4 14 months ago 36MB
goharbor/harbor-log v1.8.0 e718bdc405a3 14 months ago 81.5MB
goharbor/harbor-jobservice v1.8.0 d47940dd883f 14 months ago 118MB
goharbor/harbor-core v1.8.0 b07a1a4be17f 14 months ago 135MB
goharbor/harbor-portal v1.8.0 76298a1ef089 14 months ago 42.9MB
goharbor/harbor-db v1.8.0 d1e0b3df3e95 14 months ago 140MB
goharbor/prepare v1.8.0 769ca785dab0 14 months ago 139MB
############################################### docker-compose ps####################################
Name Command State Ports
---------------------------------------------------------------------------------------------
harbor-core /harbor/start.sh Up (healthy)
harbor-db /entrypoint.sh postgres Up (healthy) 5432/tcp
harbor-jobservice /harbor/start.sh Up
harbor-log /bin/sh -c /usr/local/bin/ ... Up (healthy) 127.0.0.1:1514->10514/tcp
harbor-portal nginx -g daemon off; Up (healthy) 80/tcp
nginx nginx -g daemon off; Up (healthy) 0.0.0.0:80->80/tcp
redis docker-entrypoint.sh redis ... Up 6379/tcp
registry /entrypoint.sh /etc/regist ... Up (healthy) 5000/tcp
registryctl /harbor/start.sh Up (healthy)
啟動完成后就可以訪問剛剛在配置文件中設置的hostname。默認是80端口，如果端口占用，我們可以去修改harbor.yml文件中，對應服務的端口映射。
默認賬號密碼：admin，Harbor12345
