用harbor搭建自己的镜像库

节点一：Ubuntu 20.04.4 harbor+docker 节点二：Ubuntu 20.04.4 kerbernetes集群的master节点

harbor版本包：harbor-offline-installer-v2.5.0.tgz

1、解压harbor包，cd harbor目录

2、harbor默认配置文件示例是这个harbor.yml.tmpl，复制一份修改

cp harbor.yml.tmpl harbor.yml；vim harbor.yml

 1 hostname: reg.k8smaster.org  2  3 http:  4 port: 80  5  6 https:  7 port: 443  8 certificate: /data/certs/k8smaster.org.crt  9 private_key: /data/certs/k8smaster.org.key 10 11 harbor_admin_password: yesterday 12 13 database: 14  password: root123 15 max_idle_conns: 100 16 max_open_conns: 900 17 18 data_volume: /data 19 20 trivy: 21 ignore_unfixed: false 22 skip_update: false 23 offline_scan: false 24 insecure: false 25 26 jobservice: 27 max_job_workers: 10 28 29 notification: 30 webhook_job_max_retry: 10 31 32 chart: 33  absolute_url: disabled 34 log: 35  level: info 36  local: 37 rotate_count: 50 38  rotate_size: 200M 39 location: /var/log/harbor 40 41 _version: 2.5.0 42 43 proxy: 44  http_proxy: 45  https_proxy: 46  no_proxy: 47  components: 48 - core 49 - jobservice 50 - trivy 51 52 upload_purging: 53 enabled: true 54  age: 168h 55  interval: 24h 56 dryrun: false

3、生成自签名证书

openssl req -newkey rsa:4096 -nodes -sha256 -keyout /data/certs/k8smaster.org.key -addext “subjectAltName = DNS:reg.k8smaster.org” -x509 -days 365 -out /data/certs/k8smaster.org.crt

root@kubemaster:/data/certs# ll
total 32
drwxr-xr-x 2 root root 4096 Jun 16 22:12 ./
drwxr-xr-x 9 root root 4096 May 5 22:39 ../
-rw-r–r– 1 root root 2082 Jun 16 22:12 harbor.org.crt
-rw——- 1 root root 3272 Jun 16 22:08 harbor.org.key
-rw-r–r– 1 root root 2175 May 5 22:39 k8smaster.org.crt
-rw——- 1 root root 3272 May 5 22:37 k8smaster.org.key
-rw-r–r– 1 root root 2191 May 5 22:23 mydomain.com.crt
-rw——- 1 root root 3272 May 5 22:21 mydomain.com.key

4、安装harbor

cd harbor目录

./install.sh –with-notary –with-trivy –with-chartmuseum

成功就这样：

5、添加域名到hosts文件

6、web测试 harbor服务器ip，登录进来就这样吧

6、使用docker上传镜像时需要配置证书

mkdir -p /etc/docker/certs.d/reg.k8smaster.org

cp /data/certs/k8smaster.org.crt /etc/docker/certs.d/reg.k8smaster.org

docker login reg.k8smaster.org #命令行上传之前西安登录harbor

7、harbor镜像的上传zabbix为例

docker search zabbix

docker pull zabbix/zabbix-agent

docker tag zabbix/zabbix-agent:latest reg.k8smaster.org/library/zabbix/zabbix-agent:latest

docker push reg.k8smaster.org/library/zabbix/zabbix-agent:latest

传完仓库就这样

7，k8s的容器访问harbor配置

k8s节点上操作，使用containerd容器

# mkdir -p /etc/containerd/certs.d/reg.k8smaster.org

# scp harbor服务器ip:/data/certs/k8smaster.org.crt /etc/containerd/certs.d/reg.k8smaster.org

# vim /etc/containerd/config.toml [plugins.”io.containerd.grpc.v1.cri”.registry] config_path = “/etc/containerd/certs.d” #指定证书路径

# systemctl restart containerd

# crictl pull reg.k8smaster.org/library/nginx:latest #测试拉取镜像

8、

报错一截图；原因：docker没有login

报错二截图；原因：docker没有导证书

问题三：K8s节点上拉取镜像不加前缀，直接拉取镜像名称（设置默认仓库）的配置

# mkdir -p /etc/containerd/certs.d/docker.io

# vim /etc/containerd/certs.d/docker.io/hosts.toml server = “https://registry-1.docker.io” [host.”https://reg.westos.org”] capabilities = [“pull”, “resolve”, “push”] skip_verify = true