Cloud native environment construction-Harbor installation

Harbor installation

Docker installation

安装一些必要的系统工具：

sudo yum install -y yum-utils device-mapper-persistent-data lvm2
添加软件源信息：

sudo yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
更新 yum 缓存：

sudo yum makecache fast
安装 Docker-ce：（企业版  社区版）

sudo yum -y install docker-ce
启动 Docker 后台服务

sudo systemctl start docker
测试运行 hello-world

docker run hello-world

docker-compose

a.下载二进制文件
# curl -L https://github.com/docker/compose/releases/download/1.16.1/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose
如果需要安装其他版本的话，请修改上面命令中的版本号。

b.赋予二进制文件可执行权限
# chmod +x /usr/local/bin/docker-compose
c.根据自己的情况决定是否安装命令补全功能
# yum install bash-completion 
# curl -L https://raw.githubusercontent.com/docker/compose/1.16.1/contrib/completion/bash/docker-compose -o /etc/bash_completion.d/docker-compose
重新登陆后就生效了

# docker-compose 
build    config   down     exec     images   logs     port     pull     restart  run      start    top      up       
bundle   create   events   help     kill     pause    ps       push     rm       scale    stop     unpause  version  
d.测试是否安装成功
# docker-compose --version
docker-compose version 1.16.1, build 6d1ac21

pip yum installation

# yum install python-pip
# pip install  docker-compose
测试：

# docker-compose --version
卸载docker-compose
对应上面两种安装方法：
二进制：

# rm  /usr/local/bin/docker-compose
pip:

# pip uninstall  docker-compose

Uninstall

如果是二进制包方式安装的，删除二进制文件即可：
sudo rm /usr/local/bin/docker-compose
如果通过Python pip工具安装的，则执行如下命令删除：
sudo pip uninstall docker-compose

Harbor installation

Harbor software website: https://github.com/vmware/harbor/releases

　　This page provides source installation and binary installation download addresses, not recommended

　　Mirror URL: http://harbor.orientsoft.cn/

　　This page only provides offline download and installation package, this method is recommended.

#下载离线安装软件
wget http://harbor.orientsoft.cn/harbor-v1.3.0-rc4/harbor-offline-installer-v1.3.0-rc4.tgz
#解压文件
tar -zxf harbor-offline-installer-v1.3.0-rc4.tgz
#解压后的文件夹是harbor

After decompression is complete: modify the configuration file harbor.conf, if it is a test environment, there is basically no need to change the configuration, mainly hostname and port

http:

   port:80

The default port is 80, which can be changed.

harbor_admin_password

The admin login password is Harbor12345 by default

[root@c7test_master harbor]# vim harbor.cfg 

## Configuration file of Harbor

#The IP address or hostname to access admin UI and registry service.
#DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
#主机地址，不可以设置为127或者localhost

hostname = 10.10.90.105

#The protocol for accessing the UI and token/notification service, by default it is http.
#It can be set to https if ssl is enabled on nginx.
ui_url_protocol = http

#The password for the root user of mysql db, change this before any production use.
#mysql密码
db_password = root123

#Maximum number of job workers in job service  
max_job_workers = 3 

#Determine whether or not to generate certificate for the registry's token.
#If the value is on, the prepare script creates new root cert and private key 
#for generating token to access the registry. If the value is off the default key/cert will be used.
#This flag also controls the creation of the notary signer's cert.
customize_crt = on

#The path of cert and key files for nginx, they are applied only the protocol is set to https
ssl_cert = /data/cert/server.crt
ssl_cert_key = /data/cert/server.key

#The path of secretkey storage
secretkey_path = /data

#Admiral's url, comment this attribute, or set its value to NA when Harbor is standalone
admiral_url = NA

#The password of the Clair's postgres database, only effective when Harbor is deployed with Clair.
#Please update it before deployment, subsequent update will cause Clair's API server and Harbor unable to access Clair's database.
clair_db_password = password

#Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.
log_rotate_count = 50
#Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes. 
#If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G 
#are all valid.
log_rotate_size = 200M

#NOTES: The properties between BEGIN INITIAL PROPERTIES and END INITIAL PROPERTIES
#only take effect in the first boot, the subsequent changes of these properties 
#should be performed on web ui

#************************BEGIN INITIAL PROPERTIES************************

#Email account settings for sending out password resetting emails.

#Email server uses the given username and password to authenticate on TLS connections to host and act as identity.
#Identity left blank to act as username.
email_identity = 

email_server = smtp.mydomain.com
email_server_port = 25
email_username = [email protected]
email_password = abc
email_from = admin <[email protected]>
email_ssl = false
email_insecure = false

##The initial password of Harbor admin, only works for the first time when Harbor starts. 
#It has no effect after the first launch of Harbor.
#Change the admin password from UI after launching Harbor.
#这里是web登录页面的密码，可以更改
harbor_admin_password = Harbor12345

##By default the auth mode is db_auth, i.e. the credentials are stored in a local database.
#Set it to ldap_auth if you want to verify a user's credentials against an LDAP server.
auth_mode = db_auth

#The url for an ldap endpoint.
ldap_url = ldaps://ldap.mydomain.com

#A user's DN who has the permission to search the LDAP/AD server. 
#If your LDAP/AD server does not support anonymous search, you should configure this DN and ldap_search_pwd.
#ldap_searchdn = uid=searchuser,ou=people,dc=mydomain,dc=com

#the password of the ldap_searchdn
#ldap_search_pwd = password

#The base DN from which to look up a user in LDAP/AD
ldap_basedn = ou=people,dc=mydomain,dc=com

#Search filter for LDAP/AD, make sure the syntax of the filter is correct.
#ldap_filter = (objectClass=person)

# The attribute used in a search to match a user, it could be uid, cn, email, sAMAccountName or other attributes depending on your LDAP/AD  
ldap_uid = uid 

#the scope to search for users, 1-LDAP_SCOPE_BASE, 2-LDAP_SCOPE_ONELEVEL, 3-LDAP_SCOPE_SUBTREE
ldap_scope = 3 

#Timeout (in seconds)  when connecting to an LDAP Server. The default value (and most reasonable) is 5 seconds.
ldap_timeout = 5

#Turn on or off the self-registration feature
self_registration = on

#The expiration time (in minute) of token created by token service, default is 30 minutes
token_expiration = 30

#The flag to control what users have permission to create projects
#The default value "everyone" allows everyone to creates a project. 
#Set to "adminonly" so that only admin user can create project.
project_creation_restriction = everyone

#The follow configurations are for Harbor HA mode only

#the address of the mysql database.
db_host = mysql

#The port of mysql database host
db_port = 3306

#The user name of mysql database
db_user = root
#************************END INITIAL PROPERTIES************************
#The following attributes only need to be set when auth mode is uaa_auth
uaa_endpoint = uaa.mydomain.org
uaa_clientid= id
uaa_clientsecret= secret
uaa_ca_root= /path/to/uaa_ca.pem
#############

Harbor配置文件

## Configuration file of Harbor
    
    # hostname设置访问地址，可以使用ip、域名，不可以设置为127.0.0.1或localhost
    hostname = 10.0.86.193
    
    # 访问协议，默认是http，也可以设置https，如果设置https，则nginx ssl需要设置on
    ui_url_protocol = http
    
    # mysql数据库root用户默认密码root123，实际使用时修改下
    db_password = root123
    
    max_job_workers = 3 
    customize_crt = on
    ssl_cert = /data/cert/server.crt
    ssl_cert_key = /data/cert/server.key
    secretkey_path = /data
    admiral_url = NA
    
    # 邮件设置，发送重置密码邮件时使用
    email_identity = 
    email_server = smtp.mydomain.com
    email_server_port = 25
    email_username = [email protected]
    email_password = abc
    email_from = admin <[email protected]>
    email_ssl = false
    
    # 启动Harbor后，管理员UI登录的密码，默认是Harbor12345
    harbor_admin_password = Harbor12345
    
    # 认证方式，这里支持多种认证方式，如LADP、本次存储、数据库认证。默认是db_auth，mysql数据库认证
    auth_mode = db_auth
    
    # LDAP认证时配置项
    #ldap_url = ldaps://ldap.mydomain.com
    #ldap_searchdn = uid=searchuser,ou=people,dc=mydomain,dc=com
    #ldap_search_pwd = password
    #ldap_basedn = ou=people,dc=mydomain,dc=com
    #ldap_filter = (objectClass=person)
    #ldap_uid = uid 
    #ldap_scope = 3 
    #ldap_timeout = 5
    
    # 是否开启自注册
    self_registration = on
    
    # Token有效时间，默认30分钟
    token_expiration = 30
    
    # 用户创建项目权限控制，默认是everyone（所有人），也可以设置为adminonly（只能管理员）
    project_creation_restriction = everyone
    
    verify_remote_cert = on

  Start the harbor and execute the install.sh file in the directory after modifying the configuration file. The program will automatically start the relevant mirror, because the harbor is installed with your mirror.

[root@cent7test_master harbor]# ./install.sh