构建Harbor私有镜像库（详细版）
项目背景知识
项目需求
-
由于国外由于docker镜像源无法使用，科学上网隐患太大，各大开源厂商的镜像加速器都又都进行收费使用，为了保证docker今后能顺利拉取镜像，k8s集群顺利拉取镜像，现企业内部需要部署一台私有的docker镜像源服务器
-
要求使用开源镜像库构建软件Harbor来搭建
-
通过Web页管理镜像库
Harbor概述
-
官网：Harbor
-
Harbor是VMware公司开源的企业级DockerRegistry项目，其目标是帮助用户迅速搭建一个企业级的Docker registry服务。
-
它以Docker公司开源的registry为基础，提供了管理UI，基于角色的访问控制(Role Based Access Control)，AD/LDAP集成、以及审计日志(Auditlogging) 等企业用户需求的功能，同时还原生支持中文。
-
简单说来，Harbor封装了Docker的registry v2，帮用户提供了许多便捷管理的特性，方便用户操作。
项目环境
项目拓扑结构
-
使用单节点实现
软硬件环境清单
任务清单
项目环境搭建
-
安装OpenEuler22.03 SP4系统
-
按照规划，最小化部署系统，关闭防火墙，禁用SELinux，确保能够联网。
Harbor服务器部署
docker部署
-
设置docker源。
-
安装docker-ce
-
配置镜像加速器
-
安装docker-compose
Harbor部署
-
下载Harbor2.12.2 latest版本软件
-
配置软件
-
安装软件
-
Web测试
k8s集群所需镜像上传
-
导入镜像
-
重新标记镜像
-
上传镜像
实施步骤
环境搭建
部署Euler22.0系统，连接xshell，过程略
关闭防火墙和selinux，设置主机名
[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# systemctl disable firewalld
[root@localhost ~]# vi /etc/selinux/config
SELINUX=disabled
[root@localhost ~]# hostnamectl set-hostname harbor
[root@localhost ~]# reboot
设置静态IP
[root@harbor ~]# vi /etc/sysconfig/network-scripts/ifcfg-ens33TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=dhcp
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
NAME=ens33
UUID=79cc7145-ef0a-4526-af8e-82de4e1ed9d9
DEVICE=ens33
ONBOOT=yes
IPADDR=192.168.194.100
PREFIX=24
GATEWAY=192.168.194.2
DNS1=223.5.5.5
~
[root@harbor ~]# systemctl restart network 
安装并升级所需软件
[root@harbor ~]# yum install vim tree tar net-tools -y
[root@harbor ~]# yum update -y制作快照
安装docker
添加docker-ce 源信息
[root@harbor ~]# yum-config-manager --add-repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo修改docker-ce源
[root@harbor ~]# sed -i 's+download.docker.com+mirrors.aliyun.com/docker-ce+' /etc/yum.repos.d/docker-ce.repo
# 更换为阿里开源镜像站源[root@server ~]# sed -i 's/$releasever/7/g' /etc/yum.repos.d/docker-ce.repo
# 由于阿里开源中没有Euler系统版本，但其源自Centos则改为7即可
更新源
[root@harbor ~]# yum makecache
安装docker-ce：默认安装docker-ce是最新版本
[root@harbor ~]# yum install docker-ce -y
启动服务，查看信息
[root@harbor ~]# systemctl enable --now docker # 启动服务
[root@harbor ~]# systemctl status docker # 查看状态
查看版本信息
[root@harbor ~]# docker version # 查看版本详细信息
配置镜像加速器
在华为云里登录找到容器镜像管理，找到镜像加速器，把自己的粘过来
[root@harbor ~]# vim /etc/docker/daemon.json
{"registry-mirrors": [ "https://09e875b18c194781aed5c5b7b32c7255.mirror.swr.myhuaweicloud.com", "https://docker.1ms.run","https://docker.1panel.live/"]
}后面两个是第三方服务器（可用）
[root@harbor ~]# systemctl daemon-reload
[root@harbor ~]# systemctl restart docker
[root@harbor ~]# docker info 
部署Harbor服务
下载Harbor
[root@harbor ~]# cd /
[root@harbor /]# wget https://github.com/goharbor/harbor/releases/download/v2.12.2/harbor-offline-installer-v2.12.2.tgz# 注意：若超时，可以将链接粘贴到迅雷中下载之后使用xftp上传到/目录这里我用xftp上传的
[root@harbor /]# tar -xvf harbor-offline-installer-v2.12.2.tgz # 解压缩
安装编排工具
[root@harbor ~]# yum install docker-compose -y配置Harbor
[root@harbor /]# cd harbor
[root@harbor harbor]# ls
common.sh harbor.yml.tmpl LICENSE
harbor.v2.12.2.tar.gz install.sh prepare# 修改配置文件
[root@harbor harbor]# mv harbor.yml.tmpl harbor.yml
[root@harbor harbor]# vim harbor.yml # Configuration file of Harbor# The IP address or hostname to access admin UI and registry service.
# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
hostname: 192.168.194.100 # 修改本机IP，若改为主机名需要做映射# http related config
http:# port for http, default is 80. If https enabled, this port will redirect to https portport: 1021 # 改为其它端口，防止80端口占用# https related config # https的内容全部注释掉
# https:# https port for harbor, default is 443# port: 443# The path of cert and key files for nginx# certificate: /your/certificate/path# private_key: /your/private/key/path# enable strong ssl ciphers (default: false)# strong_ssl_ciphers: false
……………………………………
# The initial password of Harbor admin
# It only works in first time to install harbor
# Remember Change the admin password from UI after launching Harbor.
harbor_admin_password: 123456 # 登录密码
安装Harbor
# 安装并启动
[root@harbor harbor]# ./install.sh [root@harbor harbor]# docker ps # 共9个容器
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
b1c4b4b2d385 goharbor/harbor-jobservice:v2.12.2 "/harbor/entrypoint.…" About a minute ago Up About a minute (healthy) harbor-jobservice
8d2107701867 goharbor/nginx-photon:v2.12.2 "nginx -g 'daemon of…" About a minute ago Up About a minute (healthy) 0.0.0.0:1021->8080/tcp, :::1021->8080/tcp nginx
f5af4ac06700 goharbor/harbor-core:v2.12.2 "/harbor/entrypoint.…" About a minute ago Up About a minute (healthy) harbor-core
5621b59ca2da goharbor/harbor-registryctl:v2.12.2 "/home/harbor/start.…" About a minute ago Up About a minute (healthy) registryctl
c185943df12b goharbor/registry-photon:v2.12.2 "/home/harbor/entryp…" About a minute ago Up About a minute (healthy) registry
05cfce3b7446 goharbor/harbor-db:v2.12.2 "/docker-entrypoint.…" About a minute ago Up About a minute (healthy) harbor-db
a42c9fbbe0c4 goharbor/redis-photon:v2.12.2 "redis-server /etc/r…" About a minute ago Up About a minute (healthy) redis
15c41ce5b744 goharbor/harbor-portal:v2.12.2 "nginx -g 'daemon of…" About a minute ago Up About a minute (healthy) harbor-portal
f2900420b3ff goharbor/harbor-log:v2.12.2 "/bin/sh -c /usr/loc…" About a minute ago Up About a minute (healthy) 127.0.0.1:1514->10514/tcp harbor-log
[root@harbor harbor]#
测试
-
windows浏览器中输入服务端IP：192.168.88.100:1021 来访问管理页面
-
用户面：admin
-
密码：123456
-
进行实战
目的
将k8s集群所需的镜像上传到Harbor仓库中
学习docker镜像下拉、导出、上传镜像
为之后k8s集群项目打下基础
Harbor新建项目
镜像处理
k8s集群默认下需要10个镜像另加可视化面板镜像共11个
常用语法
docker save -o 新镜像文件名.tar 镜像名 # 导出
docker load -i 镜像包名.tar # 导入
docker tag 源镜像名:版本 新标签名:版本 # 镜像重新打标签
将下载好的镜像导入
[root@harbor ~]# mkdir /images
[root@harbor /]# cd /images通过xftp将11个镜像传过来
再进行导入
[root@harbor images]# docker load -i cni.tar
[root@harbor images]# docker load -i coredns.tar
[root@harbor images]# docker load -i etcd.tar
[root@harbor images]# docker load -i kube-apiserver.tar
[root@harbor images]# docker load -i kube-controller-manager.tar
[root@harbor images]# docker load -i kube-controllers.tar
[root@harbor images]# docker load -i kube-proxy.tar
[root@harbor images]# docker load -i kube-scheduler.tar
[root@harbor images]# docker load -i kuboard.tar
[root@harbor images]# docker load -i node.tar
[root@harbor images]# docker load -i pause.tar[root@harbor images]# docker images
镜像重新打标签
[root@harbor images]# docker tag eipwork/kuboard:v3 192.168.194.100:1021/k8s/kuboard:v3
[root@harbor images]# docker tag registry.aliyuncs.com/google_containers/kube-apiserver:v1.28.0 192.168.194.100:1021/k8s/kube-apiserver:v1.28.0
[root@harbor images]# docker tag registry.aliyuncs.com/google_containers/kube-controller-manager:v1.28.0 192.168.194.100:1021/k8s/kube-controller-manager:v1.28.0
[root@harbor images]# docker tag registry.aliyuncs.com/google_containers/kube-scheduler:v1.28.0 192.168.194.100:1021/k8s/kube-scheduler:v1.28.0
[root@harbor images]# docker tag registry.aliyuncs.com/google_containers/kube-proxy:v1.28.0 192.168.194.100:1021/k8s/kube-proxy:v1.28.0
[root@harbor images]# docker tag registry.aliyuncs.com/google_containers/etcd:3.5.9-0 192.168.194.100:1021/k8s/etcd:3.5.9-0
[root@harbor images]# docker tag registry.aliyuncs.com/google_containers/coredns:v1.10.1 192.168.194.100:1021/k8s/coredns:v1.10.1
[root@harbor images]# docker tag calico/kube-controllers:v3.25.0 192.168.194.100:1021/k8s/calico/kube-controllers:v3.25.0
[root@harbor images]# docker tag calico/cni:v3.25.0 192.168.194.100:1021/k8s/calico/cni:v3.25.0
[root@harbor images]# docker tag calico/node:v3.25.0 192.168.194.100:1021/k8s/calico/node:v3.25.0
[root@harbor images]# docker tag registry.aliyuncs.com/google_containers/pause:3.9 192.168.194.100:1021/k8s/pause:3.9
#再看一下
[root@harbor images]# docker images
镜像推送到Harbor
查看配置是否支持私服
[root@harbor images]# vim /etc/docker/daemon.json{"registry-mirrors": [ "https://09e875b18c194781aed5c5b7b32c7255.mirror.swr.myhuaweicloud.com", "https://docker.1ms.run","https://docker.1panel.live/"],"insecure-registries": ["http://192.168.194.100:1021"]
}[root@harbor images]# systemctl start docker
对harbor进行启动
# 进入harbor目录
[root@harbor ~]# cd /harbor
[root@harbor harbor]# docker compose restart # 重启服务 
登录Harbor
[root@harbor harbor]# docker login http://192.168.194.100:1021
Username: admin
Password: #密码123456
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-storeLogin Succeeded
[root@harbor harbor]#
推送镜像到Harbor
[root@harbor iamges]# docker push 192.168.194.100:1021/k8s/kuboard:v3[root@harbor iamges]# docker push 192.168.194.100:1021/k8s/kube-apiserver:v1.28.0[root@harbor iamges]# docker push 192.168.194.100:1021/k8s/kube-controller-manager:v1.28.0[root@harbor iamges]# docker push 192.168.194.100:1021/k8s/kube-scheduler:v1.28.0[root@harbor iamges]# docker push 192.168.194.100:1021/k8s/kube-proxy:v1.28.0[root@harbor iamges]# docker push 192.168.194.100:1021/k8s/etcd:3.5.9-0[root@harbor iamges]# docker push 192.168.194.100:1021/k8s/coredns:v1.10.1[root@harbor iamges]# docker push 192.168.194.100:1021/k8s/calico/kube-controllers:v3.25.0[root@harbor iamges]# docker push 192.168.194.100:1021/k8s/calico/cni:v3.25.0 [root@harbor iamges]# docker push 192.168.194.100:1021/k8s/calico/node:v3.25.0[root@harbor iamges]# docker push 192.168.194.100:1021/k8s/pause:3.9Web管理页面查看结果
注意：机器重启后需要执行下列操作，harbor才会就绪
[root@harbor ~]# cd /harbor[root@harbor harbor]# systemc restart docker[root@harbor harbor]# docker compose restart
项目完成！！！
出现的问题以及解决办法
问题：
通常意味着 Docker 客户端尝试使用 HTTPS 协议连接到 Harbor，但 Harbor 服务器的端口（1021）可能是通过 HTTP 提供服务的，而不是 HTTPS。
解决办法：
1、确保 Harbor 的端口 1021
2、在 /etc/docker/daemon.json 文件看"insecure-registries"是否写对
3、最后重启 Docker 服务：systemctl restart docker