前言

• 我的IP：192.168.0.252

部署具有https类型的harbor

生成证书

openssl req  -newkey rsa:4096 -nodes -sha256 -keyout ca.key -x509 -days 3650 -out ca.crt
openssl req  -newkey rsa:4096 -nodes -sha256 -keyout 192.168.0.252.key -out 192.168.0.252.csr
mkdir CA
cd CA
touch   index.txt
echo "01"  > serial
cd ..
echo "subjectAltName = IP:192.168.0.252" > extfile.cnf
# 42 行设置为刚刚创建CA目录，如下【不修改会报错】
vim /etc/pki/tls/openssl.cnf
 42 dir             = ./CA  

修改如图

生成证书

# 生成证书
openssl ca -in 192.168.0.252.csr -out 192.168.0.252.crt -cert ca.crt -keyfile ca.key -extfile extfile.cnf -outdir .

下载harbor

wget https://storage.googleapis.com/harbor-releases/release-1.9.0/harbor-offline-installer-v1.9.1.tgz

修改配置文件

# 解压
tar -xf harbor-offline-installer-v1.9.1.tgz
cd harbor
# 修改配置文件
vim harbor.yaml
  5 hostname: 192.168.0.252
 13 https:
 14 #   # https port for harbor, default is 443
 15   port: 443
 16 #   # The path of cert and key files for nginx
 17   certificate: /ENV/harbor/key/192.168.0.252.crt
 18   private_key: /ENV/harbor/key/192.168.0.252.key
# 密码根据自己情况修改

修改如图

启动

./install.sh

客户端登录

• 配置客户端信任证书

# 在客户端服务器上执行
[root@zhicheng ~]# mkdir -p /etc/docker/certs.d/192.168.0.252
# 服务端证书目录执行
scp  ca.crt root@客户端IP:/etc/docker/certs.d/192.168.0.252/
# 客户端执行【centos7】
update-ca-trust

• 登录

[root@zhicheng ~]# docker login 192.168.0.252
Username: admin
Password: 
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

如图，默认密码在配置文件中

其他操作

# 需要重新部署的时候
docker-compose down -v
./prepare
修改配置完成后
docker-compose up -d

参考

非常推荐文章