一、部署docker-compose
#安装pip CentOS: yum install epel-release -y yum install python-pip -y Ubuntu: apt-get install python-pip -y
2、安装docker-compose
# curl -L https://mirrors.aliyun.com/docker-toolbox/linux/compose/1.21.2/docker-compose-Linux-x86_64 -o /usr/local/bin/docker-compose # chmod a+x /usr/local/bin/docker-compose
3、配置阿里云镜像加速器
sudo mkdir -p /etc/docker sudo tee /etc/docker/daemon.json <<-'EOF' { "registry-mirrors": ["https://f9dk003m.mirror.aliyuncs.com"] } EOF sudo systemctl daemon-reload sudo systemctl restart docker
二、部署harbor
harbor提供在线安装和离线安装两种方式,官方提供的安装包地址在https://github.com/goharbor/harbor/releases,在线安装包下载Harbor online installer,离线安装下载Harbor offline installer。
1、解压
tar zxvf harbor-offline-installer-v1.7.1.tgz
2、修改的地方,https部分注销
hostname: 192.168.48.250 //harbor机器的ip地址 # https related config #https: # https port for harbor, default is 443 # port: 443 # The path of cert and key files for nginx # certificate: /your/certificate/path # private_key: /your/private/key/path harbor_admin_password: Wu0201 //harbor镜像仓库密码
3、一些其他参数的设置
#访问协议,默认是http,也可以设置https,如果设置https ui_url_protocol = http #证书相关配置 customize_crt = on ssl_cert = /data/cert/server.crt ssl_cert_key = /data/cert/server.key secretkey_path = /data admiral_url = NA # 认证方式,这里支持多种认证方式,如LADP、数据库认证,也可以在web控制台修改 auth_mode = db_auth # 是否开启自注册 self_registration = on # Token有效时间,默认30分钟 token_expiration = 30 # 用户创建项目权限控制,默认是everyone(所有人),也可以设置为adminonly(只能管理员) project_creation_restriction = everyone #更多参考:https://github.com/goharbor/harbor/blob/master/docs/installation_guide.md
4、./install.sh安装
[root@master harbor]# ./install.sh [Step 0]: checking installation environment ... Note: docker version: 18.09.1 /usr/lib/python2.7/site-packages/requests/__init__.py:91: RequestsDependencyWarning: urllib3 (1.24.1) or chardet (2.2.1) doesn't match a supported version! RequestsDependencyWarning) Note: docker-compose version: 1.23.2
5、如果出现如下错误,则再执行./install.sh一遍
Docker下搭建Harbor。容器内登陆报错:Error response from daemon: Get https://192.168.2.101/v2/: dial tcp 192.168.
6、查看其他组件
[root@master harbor]# docker-compose ps Name Command State Ports ------------------------------------------------------------------------------------------------------------------------------------- harbor-adminserver /harbor/start.sh Up (healthy) harbor-core /harbor/start.sh Up (healthy) harbor-db /entrypoint.sh postgres Up (healthy) 5432/tcp harbor-jobservice /harbor/start.sh Up harbor-log /bin/sh -c /usr/local/bin/ ... Up (healthy) 127.0.0.1:1514->10514/tcp harbor-portal nginx -g daemon off; Up (healthy) 80/tcp nginx nginx -g daemon off; Up (healthy) 0.0.0.0:443->443/tcp, 0.0.0.0:4443->4443/tcp, 0.0.0.0:80->80/tcp redis docker-entrypoint.sh redis ... Up 6379/tcp registry /entrypoint.sh /etc/regist ... Up (healthy) 5000/tcp registryctl /harbor/start.sh Up (healthy)三
三、上传镜像
1、docker1.3.2版本开始默认docker registry使用的是https,我们设置Harbor默认http方式,所以当执行用docker login、pull、push等命令操作非https的docker regsitry的都会报错
修改daemon.json [root@localhost ~]# cat /etc/docker/daemon.json {"registry-mirrors": ["http://a58c8480.m.daocloud.io"], "insecure-registries": ["192.168.48.250"]}
systemctl restart docker
2、新建项目,
3、上传镜像 ,上传镜像之前需要登陆认证,使用docker login
[root@localhost harbor]# docker login 192.168.48.250 Username: admin //输入账号 Password: //密码是配置的 WARNING! Your password will be stored unencrypted in /root/.docker/config.json. Configure a credential helper to remove this warning. See https://docs.docker.com/engine/reference/commandline/login/#credentials-store
4、给镜像打标签,并且push上传
[root@localhost harbor]# docker pull nginx Using default tag: latest latest: Pulling from library/nginx 852e50cd189d: Pull complete 571d7e852307: Pull complete addb10abd9cb: Pull complete d20aa7ccdb77: Pull complete 8b03f1e11359: Pull complete Digest: sha256:6b1daa9462046581ac15be20277a7c75476283f969cb3a61c8725ec38d3b01c3 Status: Downloaded newer image for nginx:latest
[root@localhost harbor]# docker tag nginx:latest 192.168.48.250/project1/nginx:latest
[root@localhost harbor]# docker push 192.168.48.250/project1/nginx:latest The push refers to repository [192.168.48.250/project1/nginx] 7e914612e366: Pushed f790aed835ee: Pushed 850c2400ea4d: Pushed 7ccabd267c9f: Pushed f5600c6330da: Pushed latest: digest: sha256:99d0a53e3718cef59443558607d1e100b325d6a2b678cd2a48b05e5e22ffeb49 size: 1362
5、查看镜像仓库,成功
四、在k8s中使用harbor仓库
1、修改每个node上的docker认证仓库
vi /etc/docker/daemon.json [root@k8s-node1 containers]# vim /etc/docker/daemon.json {"registry-mirrors": ["http://a58c8480.m.daocloud.io"], "insecure-registries": ["192.168.48.250"]}
2、创建认证secret
由于harbor采用了用户名密码认证,所以在镜像下载时需要配置sercet,在master机器上创建secrets
kubectl create secret docker-registry registry-secret --namespace=default --docker-server=192.168.48.250 --docker-username=admin --docker-password=Wu0201 [root@k8s-master Python-3.7.2]# kubectl get secret NAME TYPE DATA AGE default-token-xhz2c kubernetes.io/service-account-token 3 47h registry-secret kubernetes.io/dockerconfigjson 1 41s
3、测试挂载nginx
apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment labels: appname: nginx spec: replicas: 3 selector: matchLabels: appname: nginx template: metadata: labels: appname: nginx spec: containers: - name: nginx image: 192.168.48.250/project1/nginx:latest #镜像地址 ports: - containerPort: 80 imagePullSecrets: #使用的secret - name: registry-secret
kubectl create deploy.yaml