准备工作：
- 设置主机名
hostnamectl set-hostname yuanbao.com
- 设置时间同步
yum install chrony -y
systemctl enable --now chronyd
- 关闭防火墙
systemctl stop firewalld && systemctl disable firewalld
- 关闭SELINUX
setenforce 0 sed -i '/^SELINUX=/c SELINUX=disabled' /etc/selinux/config
1. 安装并启动依赖
yum install docker-ce docker-compose
systemctl enable --now docker
2. 下载harbor并解压
wget https://github.com/goharbor/harbor/releases/download/v2.5.5/harbor-offline-installer-v2.5.5.tgz tar -zxf harbor-offline-installer-v2.5.5.tgz -C /usr/local
3. 编缉harbor配置文件，修改主机名，注释掉https及相关端口、证书选项
cp /etc/local/harbor/{harbor.yml.tmpl,harbor.yml} vim /etc/local/harbor.yml
…… hostname = 192.168.2.210
……
3. 执行harbor安装脚本
/usr/local/harbor/install.sh
4. 设置环境变量并启动
echo "export PATH=$PATH:/usr/local/harbor/" docker-compose up -v
5. 为客户端添加受信任地址
vim /etc/docker/daemon.json { "insecure-registries" : ["192.168.2.210"] }
6. 为harbor添加https安全认证
生成CA机构私钥
openssl genrsa -out ca.key 4096
7. 利用CA私钥生成CA机构证书
openssl req -x509 -new -nodes -sha512 -days 3650 -subj "/CN=yuanbao.com" -key ca.key -out ca.crt
8. 生成服务器私钥
openssl genrsa -out yuanbao.key 4096
9. 生成服务器证书签名请求
openssl req -sha512 -new -subj "/CN=yuanbao.com" -key yuanbao.key -out yuanbao.csr
10. 生成证书配置文件
cat > v3.ext << EOF authorityKeyIdentifier=keyid,issuer basicConstraints=CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth subjectAltName = @alt_names [alt_names] DNS.1=yuanbao.com DNS.2=yuanbao EOF
11. 根据配置生成证书
openssl x509 -req -sha512 -days 3650 -exfile v3.ext -CA ca.key -CAcreateserial -in yuanbao.csr -out yuanbao.crt
12. 证书转换为cert供docker使用
openssl x509 -inform PEM -in yuanbao.crt -out yuanbao.cert
13. 保证证书存在于/etc/docker/certs.d以及/data/certs目录下
mkdir /etc/docker/certs.d/yuanbao.com -p cp {ca.key,yuanbao.cert,yuanbal.key} /etc/docker/certs.d/yuanbao.com/ cp {ca.key,yuanbao.cert,yuanbal.key} /data/certs/
14. 编缉harbor配置文件，启用https选项，并打开443端口，配置证书文件路径
vim /usr/local/harbor/harbor.yml …… https port:443 certificate: /data/certs/yuanbao.crt private_key: /data/certs/yuanbao.key ……
15. 重新生成配置
/usr/local/harbor/peare
16. 重新启动docker以及harbor服务
systemctl restart docker docker-compose down -v docker-ccompose up -d
17. 为客户端添加本地解析
echo "192.168.2.210 yuanbao.com" >> /etc/hosts