Harbor 是一个企业级 Registry 服务。它对开源的 Docker Registry 服务进行了扩展，添加了更多企业用户需要的功能。Harbor 被设计用于部署一套组织内部使用的私有环境，这个私有 Registry 服务对于非常关心安全的组织来说是十分重要的。另外，私有 Registry 服务可以通过避免从公域网下载镜 像而提高企业生产力。这对于没有良好的 Internet 连接状态，使用 Docker Container 的用户是一个福音。
基于角色的访问控制：用户与 Docker 镜像仓库通过“项目”进行组织管理，一个用户可以对多个镜像仓库在同一命名空间(project)里有不同的权限。
图形化用户界面：用户可以通过浏览器来浏览，检索当前 Docker 镜像仓库，管理项目和命名空间。
审计管理：所有针对镜像仓库的操作都可以被记录追溯，用于审计管理。
国际化：基于英文与中文语言进行了本地化。可以增加更多的语言支持。
RESTful API - RESTful API：提供给管理员对于 Harbor 更多的操控, 使得与其它管理软件集成变得更容易。
环境
OS:ubuntu server 16.04
python2.7
docker 1.10.0+
docker-compose 1.7.1+
服务器端配置
下载安装包
wget https://github.com/vmware/harbor/releases/download/0.5.0/harbor-online-installer-0.5.0.tgz
harbor 主要的安装文件harbor.cfg、install.sh、prepare
harbor.cfg用于配置安装安装选项
install.sh主要用于环境检查并根据harbor.cfg调用prepare生成harbor相关组件的配置文件及docker-compose.yml
创建字签名ssl证书
openssl req \
-newkey rsa:4096 -nodes -sha256 -keyout harbor.xxx.com.key \
-x509 -days 3650 -out harbor.xxx.com.crt
Generating a 4096 bit RSA private key
.................................++
............................++
unable to write 'random state'
writing new private key to 'harbor.xxx.com.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Beijing
Locality Name (eg, city) []:Beijing
Organization Name (eg, company) [Internet Widgits Pty Ltd]:xxx
Organizational Unit Name (eg, section) []:xxx
Common Name (e.g. server FQDN or YOUR name) []:harbor.xxx.com
Email Address []:
配置harbor.cfg文件
## Configuration file of Harbor
#The IP address or hostname to access admin UI and registry service.
#DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
hostname = harbor.xxx.com
#The protocol for accessing the UI and token/notification service, by default it is http.
#It can be set to https if ssl is enabled on nginx.
ui_url_protocol = https
#Email account settings for sending out password resetting emails.
#Email server uses the given username and password to authenticate on TLS connections to host and act as identity.
#Identity left blank to act as username.
email_identity = true
email_server = smtp.xxx.com
email_server_port = 25
email_username = xxx@xxx.com
email_password = xxxx
email_from = admin <xxx@xxx.com>
email_ssl = false
##The initial password of Harbor admin, only works for the first time when Harbor starts.
#It has no effect after the first launch of Harbor.
#Change the admin password from UI after launching Harbor.
harbor_admin_password = Harbor12345
##By default the auth mode is db_auth, i.e. the credentials are stored in a local database.
#Set it to ldap_auth if you want to verify a user's credentials against an LDAP server.
auth_mode = db_auth
#The url for an ldap endpoint.
ldap_url = ldaps://ldap.mydomain.com
#A user's DN who has the permission to search the LDAP/AD server.
#If your LDAP/AD server does not support anonymous search, you should configure this DN and ldap_search_pwd.
#ldap_searchdn = uid=searchuser,ou=people,dc=mydomain,dc=com
#the password of the ldap_searchdn
#ldap_search_pwd = password
#The base DN from which to look up a user in LDAP/AD
ldap_basedn = ou=people,dc=mydomain,dc=com
#Search filter for LDAP/AD, make sure the syntax of the filter is correct.
#ldap_filter = (objectClass=person)
# The attribute used in a search to match a user, it could be uid, cn, email, sAMAccountName or other attributes depending on your LDAP/AD
ldap_uid = uid
#the scope to search for users, 1-LDAP_SCOPE_BASE, 2-LDAP_SCOPE_ONELEVEL, 3-LDAP_SCOPE_SUBTREE
ldap_scope = 3
#The password for the root user of mysql db, change this before any production use.
db_password = root123
#Turn on or off the self-registration feature
self_registration = on
#Determine whether the UI should use compressed js files.
#For production, set it to on. For development, set it to off.
use_compressed_js = on
#Maximum number of job workers in job service
max_job_workers = 3
#The expiration time (in minute) of token created by token service, default is 30 minutes
token_expiration = 30
#Determine whether the job service should verify the ssl cert when it connects to a remote registry.
#Set this flag to off when the remote registry uses a self-signed or untrusted certificate.
verify_remote_cert = on
#Determine whether or not to generate certificate for the registry's token.
#If the value is on, the prepare script creates new root cert and private key
#for generating token to access the registry. If the value is off, a key/certificate must
#be supplied for token generation.
customize_crt = on
#Information of your organization for certificate
crt_country = CN
crt_state = State
crt_location = CN
crt_organization = organization
crt_organizationalunit = organizational unit
crt_commonname = example.com
crt_email = example@example.com
#The flag to control what users have permission to create projects
#Be default everyone can create a project, set to "adminonly" such that only admin can create project.
project_creation_restriction = everyone
#The path of cert and key files for nginx, they are applied only the protocol is set to https
ssl_cert = /data/cert/harbor.leju.com.crt
ssl_cert_key = /data/cert/harbor.leju.com.key
主要配置项
hostname=harbor.xxx.com 用于配置ui以及registry访问主机名，必须与dns或hlsts一致
ui_url_protocol= https 如果想通过https访问registry此项需要注意
复制签名到ssl_cert、ssl_cert_key配置项相应位置
cp harbor.xxx.com.crt harbor.xxx.com.key /data/cert/
执行install.sh完成安装
sudo ./install.sh
客户端配置
修改/etc/hosts，添加如下内容
#resistry_server_ip registry_domain_name
10.207.2.27 harbor.xxx.com
操作系统层面信任证书
ubuntu
scp develop@10.207.2.27:/home/develop/harbor/harbor.xxx.com.crt /usr/local/share/ca-certificates/
update-ca-certificates
centos
scp develop@10.207.2.27:/home/develop/harbor/harbor.leju.com.crt /etc/pki/ca-trust/source/anchors/
update-ca-trust
重新启动docker service
systemctl restart docker
首次使用需要登陆registry
docker login registry.xxx.com
Username: youruser
Password: yourpassword
Email: