harbor開啟https
- 生成證書
mkdir -p /data/cert
cd /data/cert
#生成CA的key
openssl genrsa -out ca.key 4096
#生成CA的crt
openssl req -x509 -new -nodes -sha512 -days 3650 \
-subj "/C=CN/ST=Shanghai/L=Shanghai/O=greenshore/OU=devops/CN=harbor" \
-key ca.key \
-out ca.crt
#生成自己域名的key
openssl genrsa -out 101.71.88.53.key 4096
#生成自己域名的csr
openssl req -sha512 -new \
-subj "/C=CN/ST=Shanghai/L=Shanghai/O=greenshore/OU=devops/CN=harbor" \
-key 101.71.88.53.key \
-out 101.71.88.53.csr
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
IP=101.71.88.53
EOF
#通過之前準(zhǔn)備好的v3.ext和csr生成crt
openssl x509 -req -sha512 -days 3650 \
-extfile v3.ext \
-CA ca.crt -CAkey ca.key -CAcreateserial \
-in 101.71.88.53.csr \
-out 101.71.88.53.crt
#生成客戶端
openssl x509 -inform PEM -in 101.71.88.53.crt -out 101.71.88.53.cert
- 給harbor配置證書
修改harbor.yml文件
# https related config
https:
# https port for harbor, default is 443
port: 443
# The path of cert and key files for nginx
certificate: /data/cert/101.71.88.53.crt
private_key: /data/cert/101.71.88.53.key
讓配置重新生效
./install.sh
- 給客戶端配置公鑰
centos7配置方法
#復(fù)制證書文件
cp 101.71.88.53.cert /etc/pki/ca-trust/source/anchors
cp 101.71.88.53.key /etc/pki/ca-trust/source/anchors
cp ca.crt /etc/pki/ca-trust/source/anchors
#更新證書
update-ca-trust
#重啟docker
service docker restart
windows配置方法
- 通過證書管理工具（mmc），導(dǎo)入ca.crt和101.71.88.53.crt兩個證書到受信任的根證書頒發(fā)機(jī)構(gòu)里面。
- 然后重啟docker desktop
構(gòu)建并推送鏡像到私有倉庫
docker login -u dev -p dev 101.71.88.53
docker build --target production-register -t cowork-reg:0.1 .
docker tag cowork-reg:0.1 101.71.88.53/cowork/reg:0.1
docker push 101.71.88.53/cowork/reg:0.1
harbor部署-ldap-開啟https
centos安裝指定版本docker或軟件
Docker私有倉庫Harbor部署與使用
