1. 개요

이 문서는 쿠버네티스(K8S) 클러스터에 Docker 이미지 레지스트리인 Harbor(버전 1.9.3)를 통합하고, 보안 통신을 위한 HTTPS를 설정하는 과정을 다룹니다. Harbor는 엔터프라이즈급 컨테이너 이미지 저장소로, 역할 기반 접근 제어, 취약점 스캔, 이미지 복제 등의 기능을 제공합니다.

2. 설치 환경 및 요구 사항

테스트 환경

OS: CentOS Linux release 7.3.1611 (Core)
커널: 3.10.0-862
메모리: 4GB
Python: 2.7.5
패키지 저장소: aliyun (Base & EPEL)

Harbor 구성 요소 및 버전

하드웨어 요구 사항

소프트웨어 요구 사항

네트워크 포트

3. Harbor 설치 및 설정

3.1 Docker 설치

[root@nginx-keepalived-155-227 ~]# wget https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo -P /etc/yum.repos.d/
[root@nginx-keepalived-155-227 ~]# yum clean all && yum makecache fast
[root@nginx-keepalived-155-227 ~]# yum install docker-ce -y
[root@nginx-keepalived-155-227 ~]# systemctl enable docker && systemctl restart docker

3.2 Docker Compose 설치

[root@nginx-keepalived-155-227 ~]# curl -L https://github.com/docker/compose/releases/download/1.25.0/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose
[root@nginx-keepalived-155-227 ~]# chmod +x /usr/local/bin/docker-compose
[root@nginx-keepalived-155-227 ~]# docker-compose --version
docker-compose version 1.25.0, build 0a186604

3.3 Harbor 설치 (오프라인 버전)

[root@nginx-keepalived-155-227 ~]# wget https://github.com/goharbor/harbor/releases/download/v1.9.3/harbor-offline-installer-v1.9.3.tgz
[root@nginx-keepalived-155-227 ~]# tar xf harbor-offline-installer-v1.9.3.tgz -C /usr/local/
[root@nginx-keepalived-155-227 ~]# cd /usr/local/harbor/

3.4 Harbor 설정

harbor.yml 파일을 편집합니다. 주요 설정 항목은 다음과 같습니다.

[root@nginx-keepalived-155-227 harbor]# egrep -v '#|^$' harbor.yml
hostname: mydocker.register.com   # 접근 호스트명 또는 IP, HTTPS 사용 시 도메인 권장
http:
  port: 80
harbor_admin_password: Harbor12345  # 관리자 비밀번호 (기본 계정: admin)
database:
  password: root123
  max_idle_conns: 50
  max_open_conns: 100
data_volume: /data  # 이미지 데이터 저장 경로
clair:
  updaters_interval: 12  # 취약점 DB 업데이트 주기 (시간)
jobservice:
  max_job_workers: 10  # 최대 작업자 수
notification:
  webhook_job_max_retry: 10  # Webhook 재시도 횟수
chart:
  absolute_url: disabled  # Helm Chart URL 설정
log:
  level: info
  local:
    rotate_count: 50
    rotate_size: 200M
    location: /var/log/harbor
_version: 1.9.0
proxy:
  http_proxy:
  https_proxy:
  no_proxy: 127.0.0.1,localhost,.local,.internal,log,db,redis,nginx,core,portal,postgresql,jobservice,registry,registryctl,clair
  components:
    - core
    - jobservice
    - clair

최초 설치 시 hostname만 수정하고, ./install.sh 스크립트를 실행합니다.

[root@nginx-keepalived-155-227 harbor]# ./install.sh
[Step 0]: checking installation environment ...
Note: docker version: 19.03.5
Note: docker-compose version: 1.25.0
...
[Step 3]: starting Harbor ...
Creating network "harbor_harbor" with the default driver
Creating harbor-log ... done
Creating registryctl ... done
...
Creating nginx ... done

✔ ----Harbor has been installed and started successfully.----
Now you should be able to visit the admin portal at http://mydocker.register.com.

설치 후 docker-compose ps 명령으로 모든 서비스 상태를 확인합니다.

[root@nginx-keepalived-155-227 harbor]# docker-compose ps
      Name                     Command                  State                 Ports
---------------------------------------------------------------------------------------------
harbor-core         /harbor/harbor_core              Up (healthy)
harbor-db           /docker-entrypoint.sh            Up (healthy)   5432/tcp
harbor-jobservice   /harbor/harbor_jobservice  ...   Up (healthy)
harbor-log          /bin/sh -c /usr/local/bin/ ...   Up (healthy)   127.0.0.1:1514->10514/tcp
harbor-portal       nginx -g daemon off;             Up (healthy)   8080/tcp
nginx               nginx -g daemon off;             Up (healthy)   0.0.0.0:80->8080/tcp
redis               redis-server /etc/redis.conf     Up (healthy)   6379/tcp
registry            /entrypoint.sh /etc/regist ...   Up (healthy)   5000/tcp
registryctl         /harbor/start.sh                 Up (healthy)

웹 브라우저에서 http://mydocker.register.com (호스트 파일에 IP 매핑 필요)에 접속하고, admin / Harbor12345로 로그인합니다.

4. Harbor에 HTTPS 설정

4.1 인증서 서명 요청(CSR) 생성

쿠버네티스 마스터 노드에서 CSR을 생성합니다. (예시 IP는 환경에 맞게 변경)

[root@k8s-master-155-221 cert]# cat > harbor-csr.json <<EOF
{
  "CN": "harbor",
  "hosts": [
    "127.0.0.1",
    "172.16.155.227",
    "172.16.155.228",
    "mydocker.register.com"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "ST": "BeiJing",
      "L": "BeiJing",
      "O": "k8s",
      "OU": "4Paradigm"
    }
  ]
}
EOF
</code>

[root@k8s-master-155-221 cert]# cfssl gencert -ca=/mnt/k8s/cert/ca.pem -ca-key=/mnt/k8s/cert/ca-key.pem -config=/mnt/k8s/cert/ca-config.json -profile=kubernetes harbor-csr.json | cfssljson -bare harbor
[root@k8s-master-155-221 cert]# ls harbor*
harbor.csr harbor-csr.json harbor-key.pem harbor.pem
[root@k8s-master-155-221 cert]# scp harbor*.pem 172.16.155.227:/usr/local/harbor/

[root@nginx-keepalived-155-227 harbor]# docker-compose down -v
[root@nginx-keepalived-155-227 harbor]# mkdir ssl
[root@nginx-keepalived-155-227 harbor]# mv harbor-key.pem harbor.pem ssl/
[root@nginx-keepalived-155-227 harbor]# vim harbor.yml
# http 섹션 주석 처리 (#)
# https 설정 추가
https:
  port: 443
  certificate: /usr/local/harbor/ssl/harbor.pem
  private_key: /usr/local/harbor/ssl/harbor-key.pem
[root@nginx-keepalived-155-227 harbor]# ./prepare
[root@nginx-keepalived-155-227 harbor]# docker-compose up -d
[root@nginx-keepalived-155-227 harbor]# docker-compose ps

mkdir /etc/docker/certs.d/mydocker.register.com

scp ca.pem ca-key.pem 172.16.155.xxx:/etc/docker/certs.d/mydocker.register.com/

{
    "registry-mirrors": ["https://rljaavx7.mirror.aliyuncs.com","https://docker.mirrors.ustc.edu.cn"],
    "insecure-registries": ["mydocker.register.com"],
    "max-concurrent-downloads": 20,
    "live-restore": true,
    "max-concurrent-uploads": 10,
    "debug": true,
    "data-root": "/Data/k8s/docker/data",
    "exec-root": "/Data/k8s/docker/exec",
    "log-opts": {
      "max-size": "100m",
      "max-file": "5"
    }
}

systemctl daemon-reload && systemctl enable docker && systemctl restart docker

echo "172.16.155.227  mydocker.register.com" >> /etc/hosts

[root@k8s-master-155-221 cert]# docker  login  -u  admin  -p  Harbor12345 mydocker.register.com
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Login Succeeded

[root@k8s-master-155-221 ~]# docker pull busybox
[root@k8s-master-155-221 ~]# docker tag busybox:latest mydocker.register.com/library/busybox:v1
[root@k8s-master-155-221 ~]# docker push mydocker.register.com/library/busybox:v1
The push refers to repository [mydocker.register.com/library/busybox]
be8b8b42328a: Pushed
v1: digest: sha256:2ca5e69e244d2da7368f7088ea3ad0653c3ce7aaccd0b8823d11b0d5de956002 size: 527