|
在创建证书之前，为了方面验证，需要将前面在客户端机器上/etc/docker/daemon.json文件里添加"insecure-registries"配置删除
[root@docker-client ~]# vim /etc/docker/daemon.json
{}
[root@docker-client ~]# rm -rf /root/.docker
重启docker服务
[root@docker-client ~]# systemctl restart docker
将harbor部署机自身的/etc/docker/daemon.json文件里添加"insecure-registries"配置也删除
[root@harbor-node ~]# vim /etc/docker/daemon.json
{
"registry-mirrors": ["https://v5d7kh0f.mirror.aliyuncs.com"]
}
[root@harbor-node ~]# rm -rf /root/.docker
然后重启docker和docker-compose
[root@harbor-node ~]# systemctl restart docker
[root@harbor-node ~]# docker-compose down -t
[root@harbor-node ~]# docker-compose up -d
1）创建CA
[root@harbor-node harbor]# pwd
/root/harbor
[root@harbor-node harbor]# mkdir ssl
[root@harbor-node harbor]# cd ssl/
[root@harbor-node ssl]# pwd
/root/harbor/ssl
[root@harbor-node ssl]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout ca.key -x509 -days 365 -out ca.crt
Generating a 4096 bit RSA private key
......................................++
...................................................................................................................................................................................................................................................................++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:DevOps
Organizational Unit Name (eg, section) []:Tec
Common Name (eg, your name or your server's hostname) []:172.16.60.213
Email Address []:wangshibo@kevin.com
2) 创建证书请求文件csr
[root@harbor-node ssl]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout 172.16.60.213.key -out 172.16.60.213.csr
Generating a 4096 bit RSA private key
.++
..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................++
writing new private key to '172.16.60.213.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:beijing
Locality Name (eg, city) [Default City]:beijing
Organization Name (eg, company) [Default Company Ltd]:DevOps
Organizational Unit Name (eg, section) []:Tec
Common Name (eg, your name or your server's hostname) []:172.16.60.213
Email Address []:wangshibo@kevin.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:DevOps
3) 创建证书
[root@harbor-node ssl]# echo subjectAltName = IP:172.16.60.213 > extfile.cnf
[root@harbor-node ssl]# openssl x509 -req -days 365 -in 172.16.60.213.csr -CA ca.crt -CAkey ca.key -CAcreateserial -extfile extfile.cnf -out 172.16.60.213.crt
Signature ok
subject=/C=CN/ST=beijing/L=beijing/O=DevOps/OU=Tec/CN=172.16.60.213/emailAddress=wangshibo@kevin.com
Getting CA Private Key
4) 设定证书 & 修改
查看证书所在路径, 后面将harbor.yaml文件中的路径也同样设定
[root@harbor-node ssl]# pwd
/root/harbor/ssl
[root@harbor-node ssl]# ll
total 28
-rw-r--r-- 1 root root 2033 May 28 01:16 172.16.60.213.crt
-rw-r--r-- 1 root root 1809 May 28 01:15 172.16.60.213.csr
-rw-r--r-- 1 root root 3272 May 28 01:15 172.16.60.213.key
-rw-r--r-- 1 root root 2114 May 28 01:13 ca.crt
-rw-r--r-- 1 root root 3268 May 28 01:13 ca.key
-rw-r--r-- 1 root root 17 May 28 01:16 ca.srl
-rw-r--r-- 1 root root 34 May 28 01:16 extfile.cnf
5) 修改harbor.yaml文件
先关闭docker-compose
[root@harbor-node harbor]# pwd
/root/harbor
[root@harbor-node harbor]# docker-compose down -v
Stopping nginx ... done
Stopping harbor-jobservice ... done
Stopping harbor-portal ... done
Stopping harbor-core ... done
Stopping harbor-db ... done
Stopping registryctl ... done
Stopping redis ... done
Stopping registry ... done
Stopping harbor-log ... done
Removing nginx ... done
Removing harbor-jobservice ... done
Removing harbor-portal ... done
Removing harbor-core ... done
Removing harbor-db ... done
Removing registryctl ... done
Removing redis ... done
Removing registry ... done
Removing harbor-log ... done
Removing network harbor_harbor
[root@harbor-node harbor]# docker-compose ps
Name Command State Ports
------------------------------
[root@harbor-node harbor]# vim harbor.yml （可以将80端口的配置注释了，直接使用443端口配置。docker login https://ip 登录即可）
.................
.................
# http related config
http:
# port for http, default is 80. If https enabled, this port will redirect to https port
port: 80
# https related config
https:
# # https port for harbor, default is 443
port: 443
# # The path of cert and key files for nginx
certificate: /root/harbor/ssl/172.16.60.213.crt
private_key: /root/harbor/ssl/172.16.60.213.key
.................
.................
================================================================================================================
特别注意：
上面harbor.yaml文件中修改的配置格式一定要正确！"https"要顶格写，"port:443" 和 "certificate"、"private_key"保持缩进一致！
否则在下面执行"./prepare"更新命令时，会报错：
[root@harbor-node harbor]# ./prepare
..........
File "/usr/lib/python3.6/site-packages/yaml/composer.py", line 84, in compose_node
node = self.compose_mapping_node(anchor)
File "/usr/lib/python3.6/site-packages/yaml/composer.py", line 127, in compose_mapping_node
while not self.check_event(MappingEndEvent):
File "/usr/lib/python3.6/site-packages/yaml/parser.py", line 98, in check_event
self.current_event = self.state()
File "/usr/lib/python3.6/site-packages/yaml/parser.py", line 439, in parse_block_mapping_key
"expected , but found %r" % token.id, token.start_mark)
yaml.parser.ParserError: while parsing a block mapping
in "/input/harbor.yml", line 15, column 4
expected , but found ''
in "/input/harbor.yml", line 17, column 5
上面的报错，就是由于harbor.yaml文件配置格式不正确导致的！！！！
================================================================================================================
接着执行prepare脚本，将harbor修改的配置更新到 docker-compose.yml 文件
[root@harbor-node harbor]# ./prepare
prepare base dir is set to /root/harbor
Clearing the configuration file: /config/log/logrotate.conf
Clearing the configuration file: /config/nginx/nginx.conf
Clearing the configuration file: /config/core/env
Clearing the configuration file: /config/core/app.conf
Clearing the configuration file: /config/registry/config.yml
Clearing the configuration file: /config/registry/root.crt
Clearing the configuration file: /config/registryctl/env
Clearing the configuration file: /config/registryctl/config.yml
Clearing the configuration file: /config/db/env
Clearing the configuration file: /config/jobservice/env
Clearing the configuration file: /config/jobservice/config.yml
Generated configuration file: /config/log/logrotate.conf
Generated configuration file: /config/nginx/nginx.conf
Generated configuration file: /config/core/env
Generated configuration file: /config/core/app.conf
Generated configuration file: /config/registry/config.yml
Generated configuration file: /config/registryctl/env
Generated configuration file: /config/db/env
Generated configuration file: /config/jobservice/env
Generated configuration file: /config/jobservice/config.yml
loaded secret from file: /secret/keys/secretkey
Generated configuration file: /compose_location/docker-compose.yml
Clean up the input dir
查看一下docker-compose.yml文件，发现已经将新配置的443端口的https信息更新到docker-compose.yml文件里了
如下80端口和443端口都配置了，所以harbor访问时是http强转到https的
[root@harbor-node harbor]# cat docker-compose.yml |grep 443 -C3
dns_search: .
ports:
- 80:80
- 443:443
depends_on:
- postgresql
- registry
重启docker-compose
[root@harbor-node harbor]# docker-compose up -d
Creating network "harbor_harbor" with the default driver
Creating harbor-log ... done
Creating registry ... done
Creating harbor-db ... done
Creating registryctl ... done
Creating redis ... done
Creating harbor-core ... done
Creating harbor-jobservice ... done
Creating harbor-portal ... done
Creating nginx ... done
[root@harbor-node harbor]# docker-compose ps
Name Command State Ports
------------------------------------------------------------------------------------------------------------
harbor-core /harbor/start.sh Up (healthy)
harbor-db /entrypoint.sh postgres Up (healthy) 5432/tcp
harbor-jobservice /harbor/start.sh Up
harbor-log /bin/sh -c /usr/local/bin/ ... Up (healthy) 127.0.0.1:1514->10514/tcp
harbor-portal nginx -g daemon off; Up (healthy) 80/tcp
nginx nginx -g daemon off; Up (healthy) 0.0.0.0:443->443/tcp, 0.0.0.0:80->80/tcp
redis docker-entrypoint.sh redis ... Up 6379/tcp
registry /entrypoint.sh /etc/regist ... Up (healthy) 5000/tcp
registryctl /harbor/start.sh Up (healthy)
在harbor部署机本机确认login登陆 (使用80端口或443端口都可以，自动跳转的)
[root@harbor-node harbor]# docker login -u admin -p kevin@Bo1987 172.16.60.213
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Error response from daemon: Get https://172.16.60.213/v2/: x509: certificate signed by unknown authority
[root@harbor-node harbor]# docker login -u admin -p kevin@Bo1987 172.16.60.213:443
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Error response from daemon: Get https://172.16.60.213:443/v2/: x509: certificate signed by unknown authority
以上出现报错，解决办法：
此种情况多发生在自签名的证书，报错含义是签发证书机构未经认证，无法识别。
解决办法：
[root@harbor-node harbor]# chmod 644 /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
[root@harbor-node harbor]# cat /root/harbor/ssl/172.16.60.213.crt >> /etc/pki/tls/certs/ca-bundle.crt
[root@harbor-node harbor]# chmod 444 /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
由于证书是docker的daemon需要用到的，所以需要重启docker服务，进而也要重启docker-compose
[root@harbor-node harbor]# systemctl restart docker
[root@harbor-node harbor]# docker-compose down -v
[root@harbor-node harbor]# docker-compose up -d
然后再次尝试在harbor本机登陆, 发现就可以正常登陆了！！
[root@harbor-node harbor]# docker login -u admin -p kevin@Bo1987 172.16.60.213
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
登陆的权限信息保存到/root/.docker/config.json 文件里了，只要这个文件不删除，下次就可以不需要输入用户名和密码直接登陆了！
[root@harbor-node harbor]# cat /root/.docker/config.json
{
"auths": {
"172.16.60.213": {
"auth": "YWRtaW46a2V2aW5AQk9CTzEyMw=="
}
},
"HttpHeaders": {
"User-Agent": "Docker-Client/18.09.6 (linux)"
}
}
[root@harbor-node harbor]# docker login 172.16.60.213
Authenticating with existing credentials...
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
上面是使用80端口登陆的，后面加上443端口也是可以登陆的
[root@harbor-node harbor]# docker login 172.16.60.213:443
Username: admin
Password:
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
[root@harbor-node harbor]# docker login 172.16.60.213:443
Authenticating with existing credentials...
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
[root@harbor-node ssl]# docker login -u admin -p kevin@Bo1987 172.16.60.213:443
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
==========================================================================================
上面是在harbor本机尝试的登陆，现在在远程客户机上(这里客户机为172.16.60.214)测试harbor登陆：
首先很重要的一步,这一步极其关键！一定不要忘记操作！！
就是需要将harbor服务端生成的CA证书拷贝到每个远程客户机的"/etc/docker/certs.d/harbor服务器的域名或ip/" 目录下
[root@client ~]# mkdir /etc/docker/certs.d/172.16.60.213/
接着在harbor服务器将CA证书拷贝过来
[root@harbor-node ssl]# rsync -e "ssh -p22" -avpgolr ./* root@172.16.60.214:/etc/docker/certs.d/172.16.60.213/
然后在客户机上查看是否拷贝过来了harbor服务端的CA证书
[root@client 172.16.60.213]# pwd
/etc/docker/certs.d/172.16.60.213
[root@client 172.16.60.213]# ls
172.16.60.213.crt 172.16.60.213.csr 172.16.60.213.key ca.crt ca.key ca.srl extfile.cnf
进行同样的授权操作，
[root@client 172.16.60.213]# chmod 644 /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
[root@client 172.16.60.213]# cat /etc/docker/certs.d/172.16.60.213/172.16.60.213.crt >> /etc/pki/tls/certs/ca-bundle.crt
[root@client 172.16.60.213]# chmod 444 /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
重启docker服务
[root@client 172.16.60.213]# systemctl restart docker
最后进行harbor登陆，就可以正常登陆了！
[root@client 172.16.60.213]# docker login -u admin -p kevin@Bo1987 172.16.60.213:443
Login Succeeded
[root@client 172.16.60.213]# cat /root/.docker/config.json
{
"auths": {
"172.16.60.213:443": {
"auth": "YWRtaW46a2V2aW5AQk9CTzEyMw=="
}
}
}
上面是使用443端口登陆harbor仓库是正常的，如果此时使用80端口登陆，则出现如下报错：
[root@client 172.16.60.213]# docker login -u admin -p kevin@Bo1987 172.16.60.213
Error response from daemon: Missing client certificate 172.16.60.213.cert for key 172.16.60.213.key
所以在客户端就使用443端口来登陆harbor仓库了！
|
