一楣铁、安裝docker-ce

docker-ce二進制包下載地址
二進制包下載地址：https://download.docker.com/linux/static/stable/x86_64/

#解壓
tar xf docker-20.10.15.tgz 
#拷貝二進制文件
cp docker/* /usr/bin/
#創(chuàng)建containerd的service文件,并且啟動
cat >/etc/systemd/system/containerd.service <<EOF
[Unit]
Description=containerd container runtime
Documentation=https://containerd.io
After=network.target local-fs.target

[Service]
ExecStartPre=-/sbin/modprobe overlay
ExecStart=/usr/bin/containerd
Type=notify
Delegate=yes
KillMode=process
Restart=always
RestartSec=5
LimitNPROC=infinity
LimitCORE=infinity
LimitNOFILE=1048576
TasksMax=infinity
OOMScoreAdjust=-999

[Install]
WantedBy=multi-user.target
EOF
systemctl enable --now containerd.service
#準備docker的service文件
cat > /etc/systemd/system/docker.service <<EOF
[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
After=network-online.target firewalld.service containerd.service
Wants=network-online.target
Requires=docker.socket containerd.service

[Service]
Type=notify
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=2
Restart=always
StartLimitBurst=3
StartLimitInterval=60s
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity
TasksMax=infinity
Delegate=yes
KillMode=process
OOMScoreAdjust=-500

[Install]
WantedBy=multi-user.target
EOF
#準備docker的socket文件
cat > /etc/systemd/system/docker.socket <<EOF
[Unit]
Description=Docker Socket for the API

[Socket]
ListenStream=/var/run/docker.sock
SocketMode=0660
SocketUser=root
SocketGroup=docker

[Install]
WantedBy=sockets.target
EOF
#創(chuàng)建docker組
groupadd docker
#啟動docker
systemctl enable --now docker.socket  && systemctl enable --now docker.service
#驗證
docker info

二椎瘟、部署harbor

下載鏈接：https://github.com/goharbor/harbor/releases/download/v2.6.2/harbor-offline-installer-v2.6.2.tgz
生成證書：

# 生成ca私鑰
root@harbor:~/apps/harbor/certs# openssl genrsa -out ca.key 4096
Generating RSA private key, 4096 bit long modulus (2 primes)
..................................................++++
.....................................................................++++
e is 65537 (0x010001)
#生成ca證書
root@harbor:~/apps/harbor/certs# ls
ca.key
root@harbor:~/apps/harbor/certs# openssl req -x509 -new -nodes -sha512 -days 3650 -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor.whyxx.net" -key ca.key -out ca.crt
root@harbor:~/apps/harbor/certs# ls
ca.crt  ca.key
# 生成服務(wù)端key
root@harbor:~/apps/harbor/certs# openssl genrsa -out harbor.whyxx.net.key 4096
Generating RSA private key, 4096 bit long modulus (2 primes)
.....................................................................++++
............................................................................................................................................................................................................................................................++++
e is 65537 (0x010001)
root@harbor:~/apps/harbor/certs# ls
ca.crt  ca.key  harbor.whyxx.net.key
# 生成證書簽署請求文件
root@harbor:~/apps/harbor/certs# openssl req -sha512 -new -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=harbor.whyxx.net" -key harbor.whyxx.net.key -out harbor.whyxx.net.csr
root@harbor:~/apps/harbor/certs# ls
ca.crt  ca.key  harbor.whyxx.net.csr  harbor.whyxx.net.key
# 新建擴展文件
root@harbor:~/apps/harbor/certs# cat v3.ext 
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=harbor.whyxx.net
DNS.2=harbor
DNS.3=ks-allinone
# 使用根證書盗棵、根私鑰簽署服務(wù)器證書
root@harbor:~/apps/harbor/certs# openssl x509 -req -sha512 -days 3650 -extfile v3.ext -CA ca.crt -CAkey ca.key -CAcreateserial -in harbor.whyxx.net.csr -out harbor.whyxx.net.crt
Signature ok
subject=C = CN, ST = Beijing, L = Beijing, O = example, OU = Personal, CN = harbor.whyxx.net
Getting CA Private Key
root@harbor:~/apps/harbor/certs# ls
ca.crt  ca.srl                harbor.whyxx.net.csr  v3.ext
ca.key  harbor.whyxx.net.crt  harbor.whyxx.net.key
# 更新部署證書
root@harbor:/usr/local/share/ca-certificates# cp /root/apps/harbor/certs/harbor.whyxx.net.crt .
root@harbor:/usr/local/share/ca-certificates# ls
harbor.whyxx.net.crt
root@harbor:/usr/local/share/ca-certificates# update-ca-certificates 
Updating certificates in /etc/ssl/certs...
rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

將csr轉(zhuǎn)換成cert，給予docker使用

openssl x509 -inform PEM -in harbor.whyxx.net.crt -out harbor.whyxx.net.cert

修改harbor配置文件：

cp harbor.yml.tmpl harbor.yml

image.png

安裝harbor:

root@harbor:~/apps/harbor# ls
LICENSE  common.sh             harbor.yml       install.sh
certs    harbor.v2.6.2.tar.gz  harbor.yml.tmpl  prepare
root@harbor:~/apps/harbor# ./install.sh --help

Note: Please set hostname and other necessary attributes in harbor.yml first. DO NOT use localhost or 127.0.0.1 for hostname, because Harbor needs to be accessed by external clients.
Please set --with-notary if needs enable Notary in Harbor, and set ui_url_protocol/ssl_cert/ssl_cert_key in harbor.yml bacause notary must run under https. 
Please set --with-trivy if needs enable Trivy in Harbor
Please set --with-chartmuseum if needs enable Chartmuseum in Harbor
# 安裝
root@harbor:~/apps/harbor# ./install.sh --with-notary --with-chartmuseum --with-trivy

[Step 0]: checking if docker is installed ...

Note: docker version: 20.10.12

[Step 1]: checking docker-compose is installed ...

Note: docker-compose version: 1.25.0

[Step 2]: loading Harbor images ...
93d5db33d7f0: Loading layer  37.72MB/3
................

同步證書：

root@harbor:/etc/docker# mkdir certs.d/harbor.whyxx.net -p
root@harbor:~/apps/harbor/certs# cp ca.crt harbor.whyxx.net.crt harbor.whyxx.net.key /etc/docker/certs.d/harbor.whyxx.net/

添加hosts解析：

root@harbor:~/apps/harbor/certs# cat /etc/hosts
127.0.0.1 localhost
192.168.50.10 master01
192.168.50.11 master02
192.168.50.12 master03
192.168.50.13 etcd01
192.168.50.14 etcd02
192.168.50.15 etcd03
192.168.50.16 node01
192.168.50.17 node02
192.168.50.18 node03
192.168.50.19 harbor.whyxx.net

重啟docker

root@harbor:~/apps/harbor/certs# systemctl daemon-reload
root@harbor:~/apps/harbor/certs# systemctl restart docker

訪問：
https://192.168.50.19

三掖肋、使用harbor存儲docker鏡像

四辱志、使用harbor存儲helm chat

4.1比庄、安裝 helm

下載地址：https://get.helm.sh/helm-v3.10.2-linux-amd64.tar.gz
cp helm /usr/bin/

4.2、在harbor ui 界面上創(chuàng)建倉庫
4.3研乒、helm增加repo

root@master01:/etc/docker/certs/harbor.whyxx.net# helm repo add --ca-file /etc/docker/certs/harbor.whyxx.net/ca.crt --cert-file /etc/docker/certs/harbor.whyxx.net/harbor.whyxx.net.cert --key-file /etc/docker/certs/harbor.whyxx.net/harbor.whyxx.net.key --username admin --password 123456 chartrepo https://harbor.whyxx.net/chartrepo/chartrepo
"chartrepo" has been added to your repositories
root@master01:/etc/docker/certs/harbor.whyxx.net# helm repo update
Hang tight while we grab the latest from your chart repositories...
...Successfully got an update from the "chartrepo" chart repository
Update Complete. ?Happy Helming!?
root@master01:/etc/docker/certs/harbor.whyxx.net# helm repo list
NAME        URL                                         
chartrepo   https://harbor.whyxx.net/chartrepo/chartrepo

4.4汹忠、向harbor倉庫push一個應(yīng)用

root@master01:~/apps/helm/chat# helm create wh-helm
Creating wh-helm
root@master01:~/apps/helm/chat/wh-helm/templates# cat <<EOF > configmap.yaml
> apiVersion: v1
> kind: ConfigMap
> metadata:
>   name: helm-configmap
> data:
>   myvalue: "Hello World"
> EOF
root@master01:~/apps/helm/chat# helm package wh-helm/
Successfully packaged chart and saved it to: /root/apps/helm/chat/wh-helm-0.1.0.tgz
root@master01:~/apps/helm/chat# ls
wh-helm  wh-helm-0.1.0.tgz
# 安裝 push 插件
root@master01:~/apps/helm/chat# helm plugin install https://github.com/chartmuseum/helm-push
Downloading and installing helm-push v0.10.3 ...
https://github.com/chartmuseum/helm-push/releases/download/v0.10.3/helm-push_0.10.3_linux_amd64.tar.gz
Installed plugin: cm-push
# 推送
root@master01:~/apps/helm/chat# helm cm-push --ca-file /etc/docker/certs/harbor.whyxx.net/ca.crt --cert-file /etc/docker/certs/harbor.whyxx.net/harbor.whyxx.net.cert --key-file /etc/docker/certs/harbor.whyxx.net/harbor.whyxx.net.key --username admin --password 123456 wh-helm-0.1.0.tgz chartrepo 
Pushing wh-helm-0.1.0.tgz to chartrepo...
Done.

4.5、安裝與更新

root@master01:~# helm install wh-test chartrepo/wh-test  # 這還可以這樣寫 helm install chartrepo/wh-test --generate-name
NAME: wh-test
LAST DEPLOYED: Tue Dec 13 21:15:49 2022
NAMESPACE: default
STATUS: deployed
REVISION: 1
NOTES:
1. Get the application URL by running these commands:
  export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=wh-test,app.kubernetes.io/instance=wh-test" -o jsonpath="{.items[0].metadata.name}")
  export CONTAINER_PORT=$(kubectl get pod --namespace default $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
  echo "Visit http://127.0.0.1:8080 to use your application"
  kubectl --namespace default port-forward $POD_NAME 8080:$CONTAINER_PORT
root@master01:~# kubectl get cm 
NAME                DATA   AGE
kube-root-ca.crt    1      28h
wh-helm-configmap   1      6s
root@master01:~# helm list
NAME    NAMESPACE   REVISION    UPDATED                                 STATUS      CHART           APP VERSION
wh-test default     1           2022-12-13 21:15:49.104792438 +0800 CST deployed    wh-test-0.1.0   1.16.0 
# 刪除
root@master01:~# helm uninstall wh-test
release "wh-test" uninstalled
root@master01:~# kubectl get cm
NAME               DATA   AGE
kube-root-ca.crt   1      28h

參考：
https://zhuanlan.zhihu.com/p/461455968
https://zhuanlan.zhihu.com/p/565478061