harbor容器仓库

linuxtoolharbor

仓库安装

安装

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
<details>
  <summary>折叠代码块</summary>
  <pre><code> 
     System.out.println("虽然可以折叠代码块");
     System.out.println("但是代码无法高亮");
  </code></pre>
</details>

<details>
  <summary>折叠代码块</summary>
  <pre><xmp> 
     System.out.println("不渲染");
     <input />
  </xmp></pre>
</details>

containerd

/etc/containerd/config.toml

config.toml 
/etc/containerd/config.toml
  disabled_plugins = []
imports = []
oom_score = 0
plugin_dir = ""
required_plugins = []
root = "/var/lib/containerd"
state = "/run/containerd"
temp = ""
version = 2


[cgroup]
  path = ""


[debug]
  address = ""
  format = ""
  gid = 0
  level = ""
  uid = 0


[grpc]
  address = "/run/containerd/containerd.sock"
  gid = 0
  max_recv_message_size = 16777216
  max_send_message_size = 16777216
  uid = 0


[metrics]
  address = ""
  grpc_histogram = false


[plugins]


  [plugins."io.containerd.gc.v1.scheduler"]
    deletion_threshold = 0
    mutation_threshold = 100
    pause_threshold = 0.02
    schedule_delay = "0s"
    startup_delay = "100ms"


  [plugins."io.containerd.grpc.v1.cri"]
    device_ownership_from_security_context = false
    disable_apparmor = false
    disable_cgroup = false
    disable_hugetlb_controller = true
    disable_proc_mount = false
    disable_tcp_service = true
    enable_selinux = false
    enable_tls_streaming = false
    enable_unprivileged_icmp = false
    enable_unprivileged_ports = false
    ignore_image_defined_volumes = false
    max_concurrent_downloads = 3
    max_container_log_line_size = 16384
    netns_mounts_under_state_dir = false
    restrict_oom_score_adj = false
    sandbox_image = "k8s.org/k8s/pause:3.9"
    selinux_category_range = 1024
    stats_collect_period = 10
    stream_idle_timeout = "4h0m0s"
    stream_server_address = "127.0.0.1"
    stream_server_port = "0"
    systemd_cgroup = false
    tolerate_missing_hugetlb_controller = true
    unset_seccomp_profile = ""


    [plugins."io.containerd.grpc.v1.cri".cni]
      bin_dir = "/opt/cni/bin"
      conf_dir = "/etc/cni/net.d"
      conf_template = ""
      ip_pref = ""
      max_conf_num = 1


    [plugins."io.containerd.grpc.v1.cri".containerd]
      default_runtime_name = "runc"
      disable_snapshot_annotations = true
      discard_unpacked_layers = false
      ignore_rdt_not_enabled_errors = false
      no_pivot = false
      snapshotter = "overlayfs"


      [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime]
        base_runtime_spec = ""
        cni_conf_dir = ""
        cni_max_conf_num = 0
        container_annotations = []
        pod_annotations = []
        privileged_without_host_devices = false
        runtime_engine = ""
        runtime_path = ""
        runtime_root = ""
        runtime_type = "io.containerd.runtime.v1.linux"


        [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime.options]


      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]


        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
          base_runtime_spec = ""
          cni_conf_dir = ""
          cni_max_conf_num = 0
          container_annotations = []
          pod_annotations = []
          privileged_without_host_devices = false
          runtime_engine = ""
          runtime_path = ""
          runtime_root = ""
          runtime_type = "io.containerd.runc.v2"


          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
            BinaryName = ""
            CriuImagePath = ""
            CriuPath = ""
            CriuWorkPath = ""
            IoGid = 0
            IoUid = 0
            NoNewKeyring = false
            NoPivotRoot = false
            Root = ""
            ShimCgroup = ""
            SystemdCgroup = true


      [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime]
        base_runtime_spec = ""
        cni_conf_dir = ""
        cni_max_conf_num = 0
        container_annotations = []
        pod_annotations = []
        privileged_without_host_devices = false
        runtime_engine = ""
        runtime_path = ""
        runtime_root = ""
        runtime_type = ""


        [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime.options]


    [plugins."io.containerd.grpc.v1.cri".image_decryption]
      key_model = "node"


    [plugins."io.containerd.grpc.v1.cri".registry]
      config_path = ""


      [plugins."io.containerd.grpc.v1.cri".registry.auths]


      [plugins."io.containerd.grpc.v1.cri".registry.configs]
         [plugins."io.containerd.grpc.v1.cri".registry.configs."k8s.org".tls]
           insecure_skip_verify = true
           ca_file = "/opt/k8s.org/ca.crt"   # CA 证书
           cert_file = "/opt/k8s.org/k8s.org.cert"    # harbor 证书
           key_file  = "/opt/k8s.org/k8s.org.key"  # harbor 私钥
         [plugins."io.containerd.grpc.v1.cri".registry.configs."k8s.org".auth]
           username = "admin"
           password = "cs123456"
      [plugins."io.containerd.grpc.v1.cri".registry.headers]


      [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
         [plugins."io.containerd.grpc.v1.cri".registry.mirrors."k8s.org"]
            endpoint = ["https://k8s.org"]


  [plugins."io.containerd.internal.v1.opt"]
    path = "/opt/containerd"


  [plugins."io.containerd.internal.v1.restart"]
    interval = "10s"


  [plugins."io.containerd.internal.v1.tracing"]
    sampling_ratio = 1.0
    service_name = "containerd"


  [plugins."io.containerd.metadata.v1.bolt"]
    content_sharing_policy = "shared"


  [plugins."io.containerd.monitor.v1.cgroups"]
    no_prometheus = false


  [plugins."io.containerd.runtime.v1.linux"]
    no_shim = false
    runtime = "runc"
    runtime_root = ""
    shim = "containerd-shim"
    shim_debug = false


  [plugins."io.containerd.runtime.v2.task"]
    platforms = ["linux/amd64"]
    sched_core = false


  [plugins."io.containerd.service.v1.diff-service"]
    default = ["walking"]


  [plugins."io.containerd.service.v1.tasks-service"]
    rdt_config_file = ""


  [plugins."io.containerd.snapshotter.v1.aufs"]
    root_path = ""


  [plugins."io.containerd.snapshotter.v1.btrfs"]
    root_path = ""


  [plugins."io.containerd.snapshotter.v1.devmapper"]
    async_remove = false
    base_image_size = ""
    discard_blocks = false
    fs_options = ""
    fs_type = ""
    pool_name = ""
    root_path = ""


  [plugins."io.containerd.snapshotter.v1.native"]
    root_path = ""


  [plugins."io.containerd.snapshotter.v1.overlayfs"]
    root_path = ""
    upperdir_label = false


  [plugins."io.containerd.snapshotter.v1.zfs"]
    root_path = ""


  [plugins."io.containerd.tracing.processor.v1.otlp"]
    endpoint = ""
    insecure = false
    protocol = ""


[proxy_plugins]


[stream_processors]


  [stream_processors."io.containerd.ocicrypt.decoder.v1.tar"]
    accepts = ["application/vnd.oci.image.layer.v1.tar+encrypted"]
    args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
    env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
    path = "ctd-decoder"
    returns = "application/vnd.oci.image.layer.v1.tar"


  [stream_processors."io.containerd.ocicrypt.decoder.v1.tar.gzip"]
    accepts = ["application/vnd.oci.image.layer.v1.tar+gzip+encrypted"]
    args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
    env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
    path = "ctd-decoder"
    returns = "application/vnd.oci.image.layer.v1.tar+gzip"


[timeouts]
  "io.containerd.timeout.bolt.open" = "0s"
  "io.containerd.timeout.shim.cleanup" = "5s"
  "io.containerd.timeout.shim.load" = "5s"
  "io.containerd.timeout.shim.shutdown" = "3s"
  "io.containerd.timeout.task.state" = "2s"


[ttrpc]
  address = ""
  gid = 0
  uid = 0

替换pause镜像，Cgroup及添加密钥文件

1
2
3
4
sed -n '/sandbox_image/s/= .*/= "k8s.org\/k8s\/pause:3.6"/'p /etc/containerd/config.toml	
#替换 sed -i '/sandbox_image/s/= .*/= "k8s.org\/k8s\/pause:3.9"/' /etc/containerd/config.toml

sed -n '/SystemdCgroup/s/= .*/= true/'p /etc/containerd/config.toml

sandbox_image = “k8s.org/k8s/pause:3.9”

SystemdCgroup = true

密钥配置

1
2
3
4
5
6
7
8
9
10
11
12
13
[plugins."io.containerd.grpc.v1.cri".registry.configs]
        [plugins."io.containerd.grpc.v1.cri".registry.configs."k8s.org".tls]
          insecure_skip_verify = true
          ca_file = "/opt/k8s.org/ca.crt"   # CA 证书
          cert_file = "/opt/k8s.org/k8s.org.cert"    # harbor 证书
          key_file  = "/opt/k8s.org/k8s.org.key"  # harbor 私钥
        [plugins."io.containerd.grpc.v1.cri".registry.configs."k8s.org".auth]
          username = "admin"
          password = "cs123456"
 
 [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
        [plugins."io.containerd.grpc.v1.cri".registry.mirrors."k8s.org"]
           endpoint = ["https://k8s.org"]

配置私库域名k8s.org，及配置证书

insecure_skip_verify 设置true,ctr拉取一样x509,使用-k ctr i pull k8s.org/k8s/pause:3.6 -k

备份

进入容器

1
2
3
❯ sudo cat /opt/kubernetes/harbor/common/config/db/env
POSTGRES_PASSWORD=root123%                                                                                               
❯ docker exec -it harbor-db  bash

postgres [ / ]$ psql
psql (14.9)
Type “help” for help.
postgres=# \l
notaryserver | postgres | UTF8 | en_US.UTF-8 | en_US.UTF-8 | =Tc/postgres +
| | | | | postgres=CTc/postgres+
| | | | | server=CTc/postgres
notarysigner | postgres | UTF8 | en_US.UTF-8 | en_US.UTF-8 | =Tc/postgres +
| | | | | postgres=CTc/postgres+
| | | | | signer=CTc/postgres
postgres | postgres | UTF8 | en_US.UTF-8 | en_US.UTF-8 |
registry | postgres | UTF8 | en_US.UTF-8 | en_US.UTF-8 |
template0 | postgres | UTF8 | en_US.UTF-8 | en_US.UTF-8 | =c/postgres +
| | | | | postgres=CTc/postgres
template1 | postgres | UTF8 | en_US.UTF-8 | en_US.UTF-8 | postgres=CTc/postgres+
| | | | | =c/postgres

postgres [ / ]$ pg_dump -U postgres -Ft registry >/home/postgres/back.tar
postgres [ / ]$

宿主机

1
2
3
4
❯ docker cp harbor-db:/home/postgres/back.tar   ./ 

❯ pg_restore -U postgres -h local.org -p 5433  -d registry  back.tar

CREATE DATABASE registry WITH TEMPLATE = template0 ENCODING = ‘UTF8’ LOCALE_PROVIDER = libc LOCALE = ‘zh_CN.UTF-8’;

创建用户
CREATE USER harbor WITH PASSWORD ‘harbor123’;
#赋予用户数据库内的权限
GRANT ALL PRIVILEGES ON DATABASE registry TO harbor;
#授予 harbor 用户对 public 模式下所有现有表的所有权限
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO harbor;

#对于序列 execution_id_seq ,blob_id_seq, 权限

GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO harbor;

#GRANT ALL PRIVILEGES ON SEQUENCE execution_id_seq TO harbor;

1
2
3
4
5
6
7
8
registry=#  update harbor_user set salt='kFcxqb7cCx2RDMD7r9ZFQwJCyS8LrYnq', password='ff2dd84e20ace34d38717d71d33cc775' where username='admin';
UPDATE 1
registry=# select username,password,salt from harbor_user  where username='admin';
 username |             password             |               salt               
----------+----------------------------------+----------------------------------
 admin    | ff2dd84e20ace34d38717d71d33cc775 | kFcxqb7cCx2RDMD7r9ZFQwJCyS8LrYnq
(1 行记录)
#admin/cs123456

本文标题:harbor容器仓库

文章作者: 阿帅

发布时间:2023年02月28日 - 21时29分

最后更新:2024年08月27日 - 19时41分

原始链接:https://chengshea.github.io/linux/tool/harbor/

许可协议: "署名-非商用-相同方式共享 3.0" 转载请保留原文链接及作者。

点击打赏
文章目录
  1. 1. 仓库安装
  2. 2. containerd
    1. 2.1. 密钥配置
  3. 3. 备份
载入天数...载入时分秒... ,