当前位置: 代码迷 >> 综合 >> Docker-Harbor:配置证书,添加https认证
  详细解决方案

Docker-Harbor:配置证书,添加https认证

热度:70   发布时间:2023-12-18 11:44:39.0

harbor配置证书,添加https认证

上一篇文章分享了如何跳过仓库的安全认证,除此之外,我们也是可以通过自己生成证书来使用https的,当然也可以购买权威认证的证书,下面分享一下harbor如何配置证书,添加https认证。
如果之前已经登录了,先退出来并先停止harbor。

[root@kube-node-1 harbor]# docker logout reg.harbor.com:80
Removing login credentials for reg.harbor.com:80
[root@kube-node-1 harbor]# docker-compose stop
Stopping nginx             ... done
Stopping harbor-jobservice ... done
Stopping harbor-core       ... done
Stopping registry          ... done
Stopping harbor-portal     ... done
Stopping redis             ... done
Stopping registryctl       ... done
Stopping harbor-db         ... done
Stopping harbor-log        ... done

创建证书

[root@kube-node-1 harbor]# mkdir harbor-cert
[root@kube-node-1 harbor]# cd harbor-cert/
[root@kube-node-1 harbor-cert]# pwd
/opt/harbor/harbor-cert
[root@kube-node-1 harbor-cert]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout test-harbor.com.key -x509 -days 365 -out test-harbor.com.crt
Generating a 4096 bit RSA private key
................................................................................................................................................................................++
...........................................................................................................++
writing new private key to 'test-harbor.com.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:xx
Locality Name (eg, city) [Default City]:yy
Organization Name (eg, company) [Default Company Ltd]:SMART
Organizational Unit Name (eg, section) []:OPERATION
Common Name (eg, your name or your server's hostname) []:reg.harbor.com
Email Address []:123@qq.com

修改harbor.yml文件
在这里插入图片描述
重新执行脚本

[root@kube-node-1 harbor]# ./prepare
[root@kube-node-1 harbor]# ./install.sh

启动成功后,谷歌浏览器访问就会弹出风险提示
在这里插入图片描述
docker重新登录

[root@kube-node-2 reg.test.com]# docker login reg.harbor.com
Username: admin
Password:
Error response from daemon: Get https://reg.harbor.com/v2/: x509: certificate signed by unknown authority

提示证书不是权威机构发布
此时我们还是要修改docker的启动参数
在这里插入图片描述
注意:如果有看我上一篇文章的朋友,配置这里时注意不要用=号

重启docker后登录成功

[root@kube-node-1 harbor]# systemctl daemon-reload
[root@kube-node-1 harbor]# systemctl restart docker
[root@kube-node-1 harbor]# docker login reg.harbor.com
Authenticating with existing credentials...
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-storeLogin Succeeded

提示:如果其他节点的docker要登录harbor,也需要在启动项添加以上参数。

  相关解决方案