安裝harbor有兩種模式：
harbor-online-installer-0.5.0.tgz: for
host that can connect directly to Internet.
harbor-offline-installer-0.5.0.tgz:
for host that does not have connectivity to Internet.
本文選用offline安裝。
l安裝前準備工作：
1.Python should be version 2.7 orhigher. Note that you may have to install Python on Linux distributions(Gentoo, Arch) that do not come with a Python interpreter installed by default
2.Docker engine should be version1.10 or higher. For installation instructions, please refer to:https://docs.docker.com/engine/installation/
3.Docker Compose needs to beversion 1.6.0 or higher. For installation instructions, please refer to:https://docs.docker.com/compose/install/
l安裝harbor步驟：
1、下載最新安裝包
wgethttps://github.com/vmware/harbor/releases/download/0.5.0/harbor-offline-installer-0.5.0.tgz
解壓安裝包：
$ tar xvf
harbor-offline-installer-.tgz
2、配置harbor
需要仔細查看配置，配成自己需要的模式?？蓞⒖既缦屡渲茫?/p>
3、進入harbor文件目錄，執(zhí)行./install.sh
4、打開http://10.142.21.113網(wǎng)址即可登錄harbor界面
l配置harbor作為k8s私有鏡像倉庫
1.在harbor上創(chuàng)建用戶，項目，將用戶添加到對應項目中，并賦予用戶項目管理者或者開發(fā)人員權(quán)限，使其對鏡像倉庫有讀寫權(quán)限。
本次部署創(chuàng)建用戶cm-test，密碼Dcos1234，郵箱chenmiao@cmss.chinamobile.com，項目library
2.創(chuàng)建secret
使用命令行：
kubectl create secret docker-registryharbortest--namespace=kube-system\
--docker-server=10.142.21.113--docker-username=cm-test\
--docker-password=Dcos1234--docker-email=chenmiao@cmss.chinamobile.com
注意：
此處關(guān)鍵信息為標紅，用戶信息為對應haobor中創(chuàng)建的用戶信息。
3.查看secret內(nèi)容
kubectl get secret harbortest--namespace=kube-system -o yaml
輸出：
apiVersion: v1
data:
.dockercfg: eyIxMC4xNDIuMjEuMTEzIjp7InVzZXJuYW1lIjoiY20tdGVzdCIsInBhc3N3b3JkIjoiRGNvczEyMzQiLCJlbWFpbCI6ImNoZW5taWFvQGNtc3MuY2hpbmFtb2JpbGUuY29tIiwiYXV0aCI6IlkyMHRkR1Z6ZERwRVkyOXpNVEl6TkE9PSJ9fQ==
kind: Secret
metadata:
creationTimestamp: 2017-02-07T03:30:59Z
name: harbortest
namespace: kube-system
resourceVersion: "682020"
selfLink: /api/v1/namespaces/kube-system/secrets/harbortest
uid: d82774f6-ece5-11e6-b231-005056943bc9
type: kubernetes.io/dockercfg
4.關(guān)聯(lián)serviceAccount
4.1使用kubectl get
serviceaccounts defult –o yaml查看默認serviceaccount信息。
4.2kubectl get serviceaccounts defult –o yaml > service.yaml
4.3 vim service.yaml修改如下信息，主要將imagePullSecrets:字段加入配置文件，使得前面創(chuàng)建的secret生效，從而能從harbor上面對應權(quán)限用戶的項目中pull鏡像創(chuàng)建pod
修改為如下：
apiVersion: v1
kind: ServiceAccount
metadata:
creationTimestamp: 2017-01-18T05:02:19Z
name: default
namespace: default
selfLink: /api/v1/namespaces/default/serviceaccounts/default
uid: 49eb802c-dd3b-11e6-b735-005056943bc9
secrets:
- name: default-token-wl2bb
imagePullSecrets:
- name: harbortest
注意：要去掉resourcesVersion：那一行
4.4kubectl replace serviceaccount default -f ./sa.yaml
新的serviceaccount創(chuàng)建成功
l是否可用，部署一個k8s-dashboard的pod
在pod的yaml文件中增加如下字段即可完成harbor作為k8s私有鏡像倉庫。
spec:
imagePullSecrets:
- name:harbortest
containers:
- name: kubernetes-dashboard
image:
10.142.21.113/library/kubernetes-dashboard-amd64
詳細yaml文件如下：
kind:Deployment
apiVersion:extensions/v1beta1
metadata:
labels:
app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kube-system
spec:
replicas: 1
selector:
matchLabels:
app: kubernetes-dashboard
template:
metadata:
labels:
app: kubernetes-dashboard
# Comment the following annotation ifDashboard must not be deployed on master
annotations:
scheduler.alpha.kubernetes.io/tolerations: |
[
{
"key":"dedicated",
"operator":"Equal",
"value":"master",
"effect":"NoSchedule"
}
]
spec:
imagePullSecrets:
- name:harbortest
containers:
- name: kubernetes-dashboard
image:
10.142.21.113/library/kubernetes-dashboard-amd64#gcr.io/google_containers/kubernetes-dashboard-amd64:v1.5.1
imagePullPolicy: Always
ports:
- containerPort: 9090
protocol: TCP
args:
# Uncomment the following line tomanually specify Kubernetes API server Host
# If not specified, Dashboard will attemptto auto discover the API server and connect
# to it. Uncomment only if thedefault does not work.
---apiserver-host=http://10.142.21.110:8080
livenessProbe:
httpGet:
path: /
port: 9090
initialDelaySeconds: 30
timeoutSeconds: 30
---
kind:Service
apiVersion:v1
metadata:
labels:
app: kubernetes-dashboard
name: kubernetes-dashboard
namespace: kube-system
spec:
type: NodePort
ports:
- port: 80
targetPort: 9090
selector:
app: kubernetes-dashboard
l部署過程中可能遇到的問題：
私有鏡像倉庫信任問題：
vi?/usr/lib/systemd/system/docker.service
以上是直接修改每個節(jié)點上deamon啟動配置
docker -d --insecure-registry 10.142.21.113-H fd:// $OPTIONS $DOCKER_STORAGE_OPTIONS
LimitNOFILE=1048576
LimitNPROC=1048576
?j???v
