Harbor安装基本配置镜像管理

使用harbor构造本地私人仓库harbor是一个用于存储和分发docker镜像的企业级Registry服务器安装前提docker和docker compose默认已经安装好一、harbor安装包下载安装包下载v1.10.14https://github.com/goharbor/harbor/releases?page15harbor-offline-installer-v1.10.14.tgz二、安装1.1 硬件要求Harbor 安装对硬件资源CPU、内存和硬盘的要求如下表资源最小要求推荐配置CPU2核4核内存4G8G1.2 解压目录下会生成harbor文件夹tar-zxvfharbor-offline-installer-v1.10.14.tgz-C/optlsharbor#目录结构common.sh harbor.v1.10.14.tar.gz harbor.yml install.sh LICENSE prepareharbor.yml是harbor的配置文件harbor.v1.10.14.tar.gz是habor的离线docker image文件install.sh 是安装脚本1.3 修改harbor的配置文件harbor.yml是harbor的安装配置文件进入修改默认的IP和端口默认管理员密码如192.168.234.41#原配置hostname: reg.mydomain.com http: port:80harbor_admin_password: Harbor12345#修改为hostname:192.168.234.41 http: port:85harbor_admin_password:123456关闭https配置不用https的话这段配置要注释掉不然系统会默认选择https# https related confighttps:# https port for harbor, default is 443port:443# The path of cert and key files for nginxcertificate: /your/certificate/path private_key: /your/private/key/path1.4 prepare执行前需确保docker服务已启动然后加载本地安装包解压出来的harbor image不做这一步prepare会报错systemctl startdockerdockerload-iharbor.v1.10.14.tar.gz ./prepareprepare执行成功结果[rootlocalhost harbor]# ./prepareprepare basedirissetto /root/harbor /usr/src/app/utils/configs.py:100: YAMLLoadWarning: calling yaml.load()withoutLoader... is deprecated, as the default Loader is unsafe. Pleasereadhttps://msg.pyyaml.org/loadforfull details. configsyaml.load(f)WARNING:root:WARNING: HTTP protocol is insecure. Harbor will deprecate http protocolinthe future. Pleasemakesure to upgrade to https /usr/src/app/utils/configs.py:90: YAMLLoadWarning: calling yaml.load()withoutLoader... is deprecated, as the default Loader is unsafe. Pleasereadhttps://msg.pyyaml.org/loadforfull details. versionsyaml.load(f)Generated configuration file: /config/log/logrotate.conf Generated configuration file: /config/log/rsyslog_docker.conf Generated configuration file: /config/nginx/nginx.conf Generated configuration file: /config/core/env Generated configuration file: /config/core/app.conf Generated configuration file: /config/registry/config.yml Generated configuration file: /config/registryctl/env Generated configuration file: /config/db/env Generated configuration file: /config/jobservice/env Generated configuration file: /config/jobservice/config.yml Generated and saved secret to file: /secret/keys/secretkey Generated certificate, key file: /secret/core/private_key.pem, cert file: /secret/registry/root.crt Generated configuration file: /compose_location/docker-compose.yml Clean up the inputdirload后的镜像dockerload-iharbor.v1.10.14.tar.gz[rootlocalhost harbor]# docker imagesREPOSITORY TAG IMAGE ID CREATED SIZE goharbor/chartmuseum-photon v1.10.14 4bd5af67c8093years ago 164MB goharbor/redis-photon v1.10.14 72329f69f0283years ago 157MB goharbor/clair-adapter-photon v1.10.14 95b457e189493years ago66.1MB goharbor/clair-photon v1.10.14 2e25ca22f1f33years ago 178MB goharbor/notary-server-photon v1.10.14 9741d7ede75e3years ago 105MB goharbor/notary-signer-photon v1.10.14 f49dfac284853years ago 102MB goharbor/harbor-registryctl v1.10.14 01223531d5143years ago93.4MB goharbor/registry-photon v1.10.14 e65e79c875e13years ago78.6MB goharbor/nginx-photon v1.10.14 5b7344c6670f3years ago 45MB goharbor/harbor-log v1.10.14 10de6233a5633years ago 108MB goharbor/harbor-jobservice v1.10.14 fdd739adb9b93years ago84.7MB goharbor/h1.5 执行安装./install.sh#执行后等待执行完毕#出现✔ ----Harbor has been installed and started successfully.----则为安装成功1.6 访问管理界面浏览器打开192.168.234.41:85默认用户名为admin密码为你在harbor.yml中配置的harbor_admin_password三、harbor管理配置Harbor的项目分为两种公开项目和私有项目公开项目所有用户都可以访问通常存放公共的镜像默认有一个library项目私有项目只允许指定用户访问存放私有镜像2.1 新建项目访问级别不勾选公开就默认是私有存储数量和存储容量默认是-1不限制2.2 创建新用户默认只有admin这一个管理员用户可以在系统管理-用户管理创建其他用户密码复杂度要求密码长度8-20之间至少一个大写字符、一个小写字符、一个数字如创建用户名alice密码Alice1234562.3 项目给用户授权访问在项目配置页面例如将之前创建的testproject给alice用户授权使其可以访问项目管理员有最大权限维护人员基本上可以进行所有操作开发人员可以上传下载镜像但不能删除镜像访客只允许下载镜像四、 harbor镜像操作3.1 将本地镜像上传到harbor1) 在本地给本地镜像打上标签准备上传#比如本地有nginx这个镜像dockerimages[rootlocalhost ~]# docker imagesREPOSITORY TAG IMAGE ID CREATED SIZE nginx latest 5253dc86cc932weeks ago 161MB#给本地镜像打标签dockertag 本地镜像名:镜像tag harborIP:端口/harboor项目名/镜像名:镜像tag可以更改为的名称dockertag nginx:latest192.168.234.41:85/testproject/nginx:latest#打完标签后会出现标签后的镜像2上传镜像dockerpush192.168.234.41:85/testproject/nginx:latest会有如下报错原因是这边的docker客户端没有信任harbor需要配置信任[rootlocalhost network-scripts]# docker push 192.168.234.41:85/testproject/nginx:latestThe push refers to repository[192.168.234.41:85/testproject/nginx]Gethttps://192.168.234.41:85/v2/:http: server gave HTTP response to HTTPS client在/etc/docker/daemon.json里面添加一条{insecure-registries:[192.168.234.41:85],......}重启docker服务systemctl restartdocker再次尝试推送发现权限不足原因是因为还没有登录先使用alice账户登录harbordockerlogin-ualice-pAlice123456192.168.234.41:85登陆后再次尝试执行发现可以成功推送同时harbor项目仓库里出现新的镜像仓库里对应镜像可以点pull按钮会出来pull的命令可以方便拉取3在别的机器从habor仓库中拉取镜像首先同样需要在docker的daemon.json文件中配置信任然后登录再docker pulldockerpull192.168.234.41:85/testproject/nginx:latest