k8s（V1.20）基础环境搭建（二） - harbor镜像库

安装cfssl

wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
wget https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64

生成证书

cat > ca-config.json <<EOF
{
  "signing": {
    "default": {
      "expiry": "175200h"
    },
    "profiles": {
      "kubernetes": {
        "usages": ["signing", "key encipherment", "server auth", "client auth"],
        "expiry": "175200h"
      }
    }
  }
}
EOF

cat > ca-csr.json <<EOF
{
  "CN": "harbor",
  "hosts": [
  "127.0.0.1",
  "192.168.200.223",
  "192.168.200.224",
  "harbor.test.com"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "CN",
      "L": "China",
      "O": "Kubernetes",
      "OU": "CA",
      "ST": "ChongQing"
    }
  ]
}
EOF

cfssl gencert -initca ca-csr.json | cfssljson -bare harbor
cfssl gencert -ca=harbor.pem  -ca-key=harbor-key.pem  -config=ca-config.json -profile=kubernetes ca-csr.json | cfssljson -bare harbor

创建secret

kubectl create secret docker-registry registry-secret --namespace=default --docker-server=192.168.200.224:80 --docker-username=admin --docker-password=harbor --docker-email=your email address

echo "admin:harbor" | base64
 
cat > dockerconfig.json <<EOF
 {
 "auths": {
   "192.168.200.224:80": {
      "auth": "YWRtaW46aGFyYm9yCg==",
      "email": "your email address"
   }
 }
}
EOF
 cat  dockerconfig.json  | base64 -w 0
 ewogImF1dGhzIjogewogICAiMTkyLjE2OC4yMDAuMjI0OjgwIjogewogICAgICAiYXV0aCI6ICJZV1J0YVc0NmFHRnlZbTl5Q2c9PSIsCiAgICAgICJlbWFpbCI6ICI1MTEwOTg0MjVAcXEuY29tIgogICB9CiB9Cn0K

## 创建secret.yaml

cat > secret.yaml <<EOF
apiVersion: v1
kind: Secret
metadata:
 name: registry-secret
 namespace: default
data:
  .dockerconfigjson: ewogImF1dGhzIjogewogICAiMTkyLjE2OC4yMDAuMjI0OjgwIjogewogICAgICAiYXV0aCI6ICJZV1J0YVc0NmFHRnlZbTl5Q2c9PSIsCiAgICAgICJlbWFpbCI6ICI1MTEwOTg0MjVAcXEuY29tIgogICB9CiB9Cn0K
type: kubernetes.io/dockerconfigjson
EOF

cat > harbor-service-secret.yaml <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: harbor-service-account
imagePullSecrets:
- name: registry-secret
EOF

create -f harbor-service-secret.yaml

创建harbor-service-accout

cat > harbor-service-deployment.yaml <<EOF
apiVersion: v1
kind: Pod
metadata:
 name: harbor-pod
 namespace: default
spec:
 serviceAccountName: harbor-service-account
 containers:
   - name: centos
     image: harbor.test.com/myproject/centos:7.5.1804 #镜像名
     command: ['/usr/sbin/init']
 imagePullSecrets:
   - name: registry-secret
EOF

kubectl create -f harbor-service-deployment.yaml