---
title: 'Harbor 安裝'
disqus: hackmd
---

Harbor安裝
===

## Table of Contents

[TOC]

憑證準備
---

openssl genrsa -out ca.key 4096

openssl req -x509 -new -nodes -sha512 -days 3650 \
 -subj "/C=TW/ST=Taiwan/L=Taipei/O=example/OU=Personal/CN=microservice.tw" \
 -key ca.key \
 -out ca.crt


 openssl genrsa -out microservice.tw.key 4096

 openssl req -sha512 -new \
    -subj "/C=TW/ST=Taiwan/L=Taipei/O=example/OU=Personal/CN=microservice.tw" \
    -key microservice.tw.key \
    -out microservice.tw.csr

cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=*.microservice.tw
DNS.2=reg.microservice.tw
DNS.3=microservice.tw
DNS.4=reg
EOF

openssl x509 -req -sha512 -days 3650 \
    -extfile v3.ext \
    -CA ca.crt -CAkey ca.key -CAcreateserial \
    -in microservice.tw.csr \
    -out microservice.tw.crt

sudo mkdir -p /data/cert
sudo cp microservice.tw.crt /data/cert/
sudo cp microservice.tw.key /data/cert/   

openssl x509 -inform PEM -in microservice.tw.crt -out microservice.tw.cert

sudo mkdir -p /etc/docker/certs.d/microservice.tw/
sudo cp microservice.tw.cert /etc/docker/certs.d/microservice.tw/
sudo cp microservice.tw.key /etc/docker/certs.d/microservice.tw/
sudo cp ca.crt /etc/docker/certs.d/microservice.tw/

讓 Linux/Docker 接受自簽憑證
---

sudo cp microservice.tw.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates
sudo systemctl restart docker.service
ls /etc/ssl/certs | awk /microservice.tw/

讓 Mac/Docker 接受自簽憑證
---

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain reg.microservice.tw.crt

harbor下載與設定
---
> 從 https://github.com/goharbor/harbor/releases 下載

cp harbor.yml.template harbor.yml

> 修改

hostname: reg.microservice.tw
certificate: /data/cert/microservice.tw.crt
private_key: /data/cert/microservice.tw.key
harbor_admin_password: VMware1!

> 執行 ./prepare & ./install

> 登入建好的 Harbor，驗證正確性

docker login reg.microservice.tw

讓 minikube 接受自簽憑證
---

minikube start --insecure-registry="reg.microservice.tw"

> 驗證
> 先在 Harbor 建立一個repo

docker pull nginx
docker tag nginx reg.microservice.tw/repo/nginx
docker push reg.microservice.tw/repo/nginx

kubectl create deploy nginx --image=reg.microservice.tw/repo/nginx
kubectl get deploy nginx

讓 kapp-controller 接受自簽憑證(自行安裝 kapp-controller 為例)
---
> 修改

k edit cm kapp-controller-config -n kapp-controller

> 將 microservice.tw.crt 內容寫入caCerts段，範例如下

apiVersion: v1
data:
  caCerts: |
    -----BEGIN CERTIFICATE-----
    MIIDWzCCAkOgAwIBAgIRAMODWpLzIWy3JocU4JBtIrIwDQYJKoZIhvcNAQELBQAw
    LTEXMBUGA1UEChMOUHJvamVjdCBIYXJib3IxEjAQBgNVBAMTCUhhcmJvciBDQTAe
    Fw0yMjAxMTExMDEwMDlaFw0zMjAxMDkxMDEwMDlaMC0xFzAVBgNVBAoTDlByb2pl
    Y3QgSGFyYm9yMRIwEAYDVQQDEwlIYXJib3IgQ0EwggEiMA0GCSqGSIb3DQEBAQUA

    [...]
    -----END CERTIFICATE-----    
  dangerousSkipTLSVerify: ""
  httpProxy: ""
  httpsProxy: ""
  noProxy: ""

> 刪除 kapp-controller-xxx pod，讓系統重新生成

k delete pod kapp-controller-xxxxxx -n kapp-controller 

export INSTALL_REGISTRY_USERNAME=admin
export INSTALL_REGISTRY_PASSWORD=VMware1!
export INSTALL_REGISTRY_HOSTNAME=harbor.microservice.tw
export TAP_VERSION=1.3.3
export INSTALL_REPO=tap133

docker login registry.tanzu.vmware.com 

imgpkg tag list -i registry.tanzu.vmware.com/tanzu-application-platform/tap-packages | grep -v sha | sort -V

docker login $INSTALL_REGISTRY_HOSTNAME

imgpkg copy -b registry.tanzu.vmware.com/tanzu-application-platform/tap-packages:${TAP_VERSION} --to-repo ${INSTALL_REGISTRY_HOSTNAME}/${INSTALL_REPO}/tap-packages

minikube start --kubernetes-version='1.22.8' --cpus='10' --memory='60g' --insecure-registry="harbor.microservice.tw"

minikube tunnel

參考
---

https://rguske.github.io/post/deploy-tanzu-packages-from-a-private-registry/

https://itq.eu/knowledge/trusting-harbors-corporate-ca-in-tanzu-kubernetes-grid-with-carvel-tools/

## Appendix and FAQ

:::info
**Find this document incomplete?** Leave a comment!
:::

###### tags: `Harbor` `Documentation`