Harbor 설치 방법

사전 작업(hosts 파일 수정)

사용할 domain으로 hosts를 세팅
서버ip harbor.ks.is harbor
ex) 172.19.110.11 harbor.ks.io harbor

 

=========root 계정으로 아래 작업 진행===========

Docker 설치

#repository 설정
sudo apt-get update
#GPG Key 등록
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
#stable repository 등록
echo \
"deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu \
$(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
#docker 설치
sudo apt-get update
sudo apt-get install docker-ce docker-ce-cli

Docker compose 설치

curl -L "https://github.com/docker/compose/releases/download/v2.3.3/docker-compose-linux-x86_64" -o /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose
docker-compose --version

Harbor 사용을 위한 인증 세팅

CA 인증서 생성

#폴더 생성
mkdir -p ~/certs
cd ~/certs

#CA private key 생성
openssl genrsa -out ca.key 4096

#CA의 public key 생성
#CN은 domain or ip 입력
openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=CN/ST=seoul/L=seoul/O=test/OU=tester/CN=172.19.40.230" \
 -key ca.key \
 -out ca.crt

 

Server 인증서 생성

#Server private key 생성
openssl genrsa -out harbor.ks.io.key 4096

#Server public key 생성
#CN은 domain or ip 입력
openssl req -sha512 -new \
    -subj "/C=CN/ST=seoul/L=seoul/O=test/OU=tester/CN=172.19.40.230" \
    -key harbor.ks.io.key \
    -out harbor.ks.io.csr

 

X509 V3 인증서 확장 구성 형식

cat > v3ext.cnf <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=172.19.40.230
DNS.2=harbor.ks.io
DNS.3=harbor
EOF

 

v3ext를 사용해 harbor 호스트에 대한 인증서 생성

openssl x509 -req -sha512 -days 3650 \
    -extfile v3ext.cnf \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in harbor.ks.io.csr \
    -out harbor.ks.io.crt

 

인증서 복사

sudo mkdir -p /data/cert
cp harbor.ks.io.crt /data/cert/
cp harbor.ks.io.key /data/cert/

 

crt 파일을 cert로 변환

(Docker는 crt 파일을 CA 인증서로 해석하고 .cert 파일을 클라이언트 인증서로 해석한다고 함)

openssl x509 -inform PEM -in harbor.ks.io.crt -out harbor.ks.io.cert

Harbor 인증서 Docker로 복사

sudo mkdir -p /etc/docker/certs.d/harbor.ks.io
cp harbor.ks.io.cert /etc/docker/certs.d/harbor.ks.io/
cp harbor.ks.io.key /etc/docker/certs.d/harbor.ks.io/
cp ca.crt /etc/docker/certs.d/harbor.ks.io/
#docker 재시작
systemctl restart docker
systemctl enable docker

 

Harbor 설치

#harbor download
wget "https://github.com/goharbor/harbor/releases/download/v2.1.3/harbor-offline-installer-v2.1.3.tgz"
tar xfvz harbor-offline-installer-v2.1.3.tgz
cd harbor
cp harbor.yml.tmpl harbor.yml

#yml 수정
sudo vi harbor.yml
hostname: harbor

  # The path of cert and key files for nginx
  certificate: /data/cert/harbor.ks.io.crt
  private_key: /data/cert/harbor.ks.io.key
  
#설치 스크립트 실행
./prepare
./install.sh

ui화면 접속(해당 ip로 접속)

admin/Harbor12345