Kubernetes Harbor

Posted by Vito on February 1, 2024

官网

add repo

1
2
3
4
[root@k8s-master1 ~]# helm repo add harbor https://helm.goharbor.io
"harbor" has been added to your repositories

[root@k8s-master1 ~]# helm repo update

install

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
# secret 'zhch.lan' 在上一章节安装 Gitlab 时已创建

[root@k8s-master1 ~]# helm install harbor harbor/harbor -n devops \
                      --set expose.type=ingress \
                      --set expose.tls.certSource='secret' \
                      --set expose.tls.secret.secretName='zhch.lan' \
                      --set expose.ingress.hosts.core='harbor.zhch.lan' \
                      --set expose.ingress.className='nginx' \
                      --set externalURL='https://harbor.zhch.lan' \
                      --set harborAdminPassword='Harbor12345' \
                      --set persistence.enabled='true' \
                      --set persistence.resourcePolicy='keep' \
                      --set persistence.imageChartStorage.type='filesystem' \
                      --set persistence.persistentVolumeClaim.registry.storageClass='managed-nfs-storage' \
                      --set persistence.persistentVolumeClaim.jobservice.jobLog.storageClass='managed-nfs-storage' \
                      --set persistence.persistentVolumeClaim.database.storageClass='managed-nfs-storage' \
                      --set persistence.persistentVolumeClaim.redis.storageClass='managed-nfs-storage' \
                      --set persistence.persistentVolumeClaim.trivy.storageClass='managed-nfs-storage' \
                      --set persistence.persistentVolumeClaim.trivy.storageClass='managed-nfs-storage'
NAME: harbor
LAST DEPLOYED: Sun Dec 31 00:29:25 2023
NAMESPACE: devops
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Please wait for several minutes for Harbor deployment to complete.
Then you should be able to visit the Harbor portal at https://harbor.zhch.lan
For more details, please visit https://github.com/goharbor/harbor

访问

  • https://harbor.zhch.lan
    • admin / Harbor12345

自签证书问题

  • 客户端要使用 tls 与 Harbor 通信,使用的还是自签证书,那么客户端必须建立一个目录:/etc/docker/certs.d
  • 然后在这个目录下创建与 Harbor 域名同名的子目录(本例中子目录名为harbor.zhch.lan),并把证书拷贝到这个目录中