在Kubernetes之上部署Harbor
Harbor is an open source registry that secures artifacts with policies and role-based access control, ensures images are scanned and free from vulnerabilities, and signs images as trusted. Harbor, a CNCF Graduated project, delivers compliance, performance, and interoperability to help you consistently and securely manage artifacts across cloud native compute platforms like Kubernetes and Docker.
在企业级Registry的行列,竟然没有Harbor的竞品…
Helm Charts 1 2 3 4 5 6 7 8 9 10 ~/k8s/charts helm repo add harbor https://helm.goharbor.io helm list helm install --name harbor -f values.yaml . --namespace harbor helm upgrade -f values.yaml harbor . --namespace harbor helm delete --purge harbor kubectl -n harbor delete pvc $(kubectl -n harbor get pvc | grep harbor | awk '{print $1}' ) helm status harbor helm fetch harbor/harbor --version 1.3.2 tar -zxf harbor-1.3.2.tgz
Harbor Helm Values配置 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 expose: type: ingress tls: enabled: true ingress: hosts: core: registry.boer.xyz notary: notary.boer.xyz controller: default annotations: kubernetes.io/ingress.class: "nginx" ingress.kubernetes.io/ssl-redirect: "true" ingress.kubernetes.io/proxy-body-size: "0" nginx.ingress.kubernetes.io/ssl-redirect: "true" nginx.ingress.kubernetes.io/proxy-body-size: "0" externalURL: https://registry.boer.xyz persistence: enabled: true resourcePolicy: "keep" persistentVolumeClaim: registry: storageClass: "openebs-hostpath" chartmuseum: storageClass: "openebs-hostpath" jobservice: storageClass: "openebs-hostpath" database: storageClass: "openebs-hostpath" redis: storageClass: "openebs-hostpath" harborAdminPassword: "<your-secret-password>"
Registry证书分发 1 2 3 4 5 6 7 8 9 10 11 12 kubectl -n harbor get secret harbor-harbor-ingress -o yamlmkdir -p /etc/docker/certs.d/registry.boer.xyzcp harbor.crt /etc/docker/certs.d/registry.boer.xyz
Registry域名
如果你的环境没有自己的DNS服务器
1 2 3 4 5 ansible k8s -m lineinfile -a "dest=/etc/hosts line='10.10.253.17 registry.boer.xyz'" ansible k8s -m lineinfile -a "dest=/etc/hosts line='10.10.253.17 registry.boer.xyz' state=absent"
创建Registry secret
思路分享:Harbor建一个账号(比如: deployer),作为K8S的公用镜像拉取账号。 注意将公用账户加入每一个项目 的成员,并赋予项目管理员 以上权限。
1 kubectl create secret docker-registry regcred --docker-server=registry.boer.xyz --docker-username=deployer --docker-password=<your-password> --docker-email=boer0924@gmail.com --namespace=boer-public
用法Demo 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 apiVersion: apps/v1 kind: Deployment template: spec: containers: - name: theapp image: registry.boer.xyz/public/theapp:0.0.1 imagePullPolicy: Always ports: - containerPort: 5000 imagePullSecrets: - name: regcred
Ref