harbor搭建和证书生成

原创已于 2026-01-21 13:22:53 修改 · 395 阅读

0 ·

本内容遵循CC 4.0 BY-SA版权协议

GEO检测

于 2025-09-10 21:06:34 首次发布

搭建harbor步骤

1.提前搭建docker

2.导入 harbor 项目镜像

[root@harbor ~]# tar -zxf harbor-v2.9.2.tgz -C /usr/local/
[root@harbor ~]# cd /usr/local/harbor
[root@harbor harbor]# docker load -i harbor.v2.9.2.tar.gz

3.修改配置文件，最好都使用域名

如果是不要证书的，直接注释掉https，docker仓库里面加上

insecure-registries
把你仓库的「域名或 IP:端口」写进去，让 Docker 允许纯 HTTP 访问。

# 修改配置文件
[root@harbor harbor]# cp harbor.yml.tmpl harbor.yml
[root@harbor harbor]# vim harbor.yml
05:    hostname: harbor
08:    # http:
10:      # port: 80
17:    certificate: /usr/local/harbor/tls/harbor.crt
18:    private_key: /usr/local/harbor/tls/harbor.key
36:    harbor_admin_password: <登录密码>

       data_volume: /data/harbor_data
        # Log configurations
log:
  # options are debug, info, warning, error, fatal
  level: info
  # configs for logs in local storage
  local:
    # Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.
    rotate_count: 50
    # Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes.
    # If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G
    # are all valid.
    rotate_size: 200M
    # The directory on your host that store log
    location: /data/harbor

# 预安装环境检查，生成项目文件
[root@harbor harbor]# /usr/local/harbor/prepare
# 创建并启动项目
[root@harbor harbor]# docker compose -f docker-compose.yml up -d
# 添加开机自启动
[root@harbor harbor]# chmod 0755 /etc/rc.d/rc.local
[root@harbor harbor]# echo "/usr/bin/docker compose -p harbor start" >>/etc/rc.d/rc.local

4.证书生成，官方文档地址：https://goharbor.io/docs/2.9.0/install-config/configure-https/

生成证书授权证书

# ca密钥
openssl genrsa -out ca.key 4096


# ca证书
openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor" \
 -key ca.key \
 -out ca.crt
 

生成服务器证书
 
# 服务器私钥
 openssl genrsa -out harbor.key 4096
 
# 服务器证书 
 openssl req -sha512 -new \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor" \
    -key harbor.key \
    -out harbor.csr
	
# 生成 x509 v3 扩展文件
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=harbor
EOF

# 生成harbor证书
openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in harbor.csr \
    -out harbor.crt
	

# 向 Harbor 和 Docker 提供证书

# 这里的目录名
#certificate: /usr/local/harbor/tls/cert.crt（harbor.crt）
#private_key: /usr/local/harbor/tls/cert.key

cp harbor.crt /data/xx
cp harbor.key /data/xx


openssl x509 -inform PEM -in harbor.crt -out harbor.cert


# 需要加上域名和端口 harbor:443
mkdir -p /etc/docker/certs.d/harbor:443/
cp harbor.cert /etc/docker/certs.d/harbor:443/
cp harbor.key /etc/docker/certs.d/harbor:443/
cp ca.crt /etc/docker/certs.d/harbor:443/
（这里配置了证书）docker配置文件其实不需要配置了，保险也可以再配一遍ip地址


systemctl restart docker

# 刷新配置
./prepare


docker-compose down -v

docker-compose up -d


docker login harbor:443

habor搭建完整流程

1.所有服务器提前搭建好docker

2.所有服务器配置好域名

xx.xx.xx.xx harbor

3.解压harbor的包，并导入harbor相关镜像

harbor-v2.9.2.tgz下载地址：https://github.com/goharbor/harbor/releases

[root@harbor ~]# tar -zxf harbor-v2.9.2.tgz -C /data/harbor
[root@harbor ~]# cd /data/harbor
[root@harbor harbor]# docker load -i harbor.v2.9.2.tar.gz

4.拷贝配置文件并修改

cp harbor.yml.tmpl harbor.yml

vim harbor.yml

05:    hostname: harbor
08:    # http:
10:      # port: 80
17:    certificate: /data/harbor/tls/harbor.crt
18:    private_key: /data/harbor/tls/harbor.key
36:    harbor_admin_password: <登录密码>

       data_volume: /data/harbor_data 
       # The directory on your host that store log
       location: /data/harbor

5.证书生成，域名是harbor复制粘贴即可

#生成证书授权证书

# ca密钥
openssl genrsa -out ca.key 4096

# ca证书
openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor" \
 -key ca.key \
 -out ca.crt
 
 
# 服务器私钥
 openssl genrsa -out harbor.key 4096
 
# 服务器证书 
 openssl req -sha512 -new \
    -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor" \
    -key harbor.key \
    -out harbor.csr
	
# 生成 x509 v3 扩展文件
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=harbor
EOF

# 生成harbor证书
openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in harbor.csr \
    -out harbor.crt


6.向 Harbor 和 Docker 提供证书

cp harbor.crt /data/harbor/tls/harbor.crt
cp harbor.key /data/harbor/tls/harbor.key

7.生成harbor.cert给docker使用
openssl x509 -inform PEM -in harbor.crt -out harbor.cert

8.向 Docker 提供证书(每一台装有docker的服务器都需要操作）

mkdir -p /etc/docker/certs.d/harbor:443/
cp harbor.cert /etc/docker/certs.d/harbor:443/
cp harbor.key /etc/docker/certs.d/harbor:443/
cp ca.crt /etc/docker/certs.d/harbor:443/

systemctl restart docker

9.启动harbor服务

docker-compose down -v
docker-compose up -d

10.登录验证
docker login harbor:443

配置端口相关

hostname: harbor

# http related config
http:
  # port for http, default is 80. If https enabled, this port will redirect to https port
  port: 18080 # nginx外部端口

# https related config
https:
  # https port for harbor, default is 443
  port: 18443 # nginx外部端口
  # The path of cert and key files for nginx
  certificate: /data/harbor/tls/harbor.crt
  private_key: /data/harbor/tls/harbor.key

# # Uncomment following will enable tls communication between all harbor components
# internal_tls:
#   # set enabled to true means internal tls is enabled
#   enabled: true
#   # put your cert and key files on dir
#   dir: /etc/harbor/tls/internal
#   # enable strong ssl ciphers (default: false)
#   strong_ssl_ciphers: false

# Uncomment external_url if you want to enable external proxy
# And when it enabled the hostname will no longer used
external_url: https://harbor:18443 # nginx外部代理端口

标签