kubernetes之helm安装harbor

1. 概览

参考文章https://www.goufusheng.top/archives/277

2. 安装

2.1 安装helm

curl https://baltocdn.com/helm/signing.asc | sudo apt-key add -
sudo apt-get install apt-transport-https --yes
echo "deb https://baltocdn.com/helm/stable/debian/ all main" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list
sudo apt-get update
sudo apt-get install helm -y

 

 

 2.2 安装harbor

  • 下载 Harbor Chart 包到要安装的集群上
git clone https://github.com/goharbor/harbor-helm
  • 切换到我们需要安装的分支,比如我们这里使用 1.3.0分支

 

cd harbor-helm
git checkout 1.3.0
  •  Chart包列表

 

kyfq@master-1:~/devops/harbor/harbor-helm$ ll
total 164
drwxrwxr-x  8 kyfq kyfq  4096 3月   8 16:33 ./
drwxrwxr-x  3 kyfq kyfq  4096 3月   8 15:06 ../
drwxrwxr-x  2 kyfq kyfq  4096 3月   8 15:13 cert/
-rw-rw-r--  1 kyfq kyfq   518 3月   8 15:13 Chart.yaml
drwxrwxr-x  2 kyfq kyfq  4096 3月   8 15:13 conf/
-rw-rw-r--  1 kyfq kyfq   578 3月   8 15:13 CONTRIBUTING.md
drwxrwxr-x  3 kyfq kyfq  4096 3月   8 15:13 docs/
drwxrwxr-x  8 kyfq kyfq  4096 3月   8 15:13 .git/
-rw-rw-r--  1 kyfq kyfq    26 3月   8 15:08 .gitignore
-rw-rw-r--  1 kyfq kyfq  1652 3月   8 16:11 harbor.yaml
-rw-rw-r--  1 kyfq kyfq    60 3月   8 15:13 .helmignore
-rw-rw-r--  1 kyfq kyfq 11357 3月   8 15:08 LICENSE
-rw-rw-r--  1 kyfq kyfq 75515 3月   8 15:13 README.md
drwxrwxr-x 13 kyfq kyfq  4096 3月   8 15:13 templates/
drwxrwxr-x  2 kyfq kyfq  4096 3月   8 15:13 test/
-rw-rw-r--  1 kyfq kyfq   344 3月   8 15:13 .travis.yml
-rw-rw-r--  1 kyfq kyfq 17411 3月   8 15:13 values.yaml
  •  values.yaml模板展示

 

expose:
  # 设置暴露服务的方式。将类型设置为 ingress、clusterIP或nodePort并补充对应部分的信息。
  type: ingress
  tls:
    # 是否开启 tls,注意:如果类型是 ingress 并且tls被禁用,则在pull/push镜像时,则必须包含端口。详细查看文档:https://github.com/goharbor/harbor/issues/5291。
    enabled: true
    # 如果你想使用自己的 TLS 证书和私钥,请填写这个 secret 的名称,这个 secret 必须包含名为 tls.crt 和 tls.key 的证书和私钥文件,如果没有设置则会自动生成证书和私钥文件。
    secretName: ""
    # 默认 Notary 服务会使用上面相同的证书和私钥文件,如果你想用一个独立的则填充下面的字段,注意只有类型是 ingress 的时候才需要。
    notarySecretName: ""
    # common name 是用于生成证书的,当类型是 clusterIP 或者 nodePort 并且 secretName 为空的时候才需要
    commonName: ""
  ingress:
    hosts:
      core: core.harbor.domain
      notary: notary.harbor.domain
    annotations:
      ingress.kubernetes.io/ssl-redirect: "true"
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
      ingress.kubernetes.io/proxy-body-size: "0"
      nginx.ingress.kubernetes.io/proxy-body-size: "0"
  clusterIP:
    # ClusterIP 服务的名称
    name: harbor
    ports:
      httpPort: 80
      httpsPort: 443
      # Notary 服务监听端口,只有当 notary.enabled 设置为 true 的时候有效
      notaryPort: 4443
  nodePort:
    # NodePort 服务名称
    name: harbor
    ports:
      http:
        port: 80
        nodePort: 30002
      https:
        port: 443
        nodePort: 30003
      notary:
        port: 4443
        nodePort: 30004

# Harbor 核心服务外部访问 URL。主要用于:
# 1) 补全 portal 页面上面显示的 docker/helm 命令
# 2) 补全返回给 docker/notary 客户端的 token 服务 URL

# 格式:protocol://domain[:port]。
# 1) 如果 expose.type=ingress,"domain"的值就是 expose.ingress.hosts.core 的值
# 2) 如果 expose.type=clusterIP,"domain"的值就是 expose.clusterIP.name 的值
# 3) 如果 expose.type=nodePort,"domain"的值就是 k8s 节点的 IP 地址

# 如果在代理后面部署 Harbor,请将其设置为代理的 URL
externalURL: https://core.harbor.domain

# 默认情况下开启数据持久化,在k8s集群中需要动态的挂载卷默认需要一个StorageClass对象。
# 如果你有已经存在可以使用的持久卷,需要在"storageClass"中指定你的 storageClass 或者设置 "existingClaim"。
#
# 对于存储 docker 镜像和 Helm charts 包,你也可以用 "azure"、"gcs"、"s3"、"swift" 或者 "oss",直接在 "imageChartStorage" 区域设置即可
persistence:
  enabled: true
  # 设置成"keep"避免在执行 helm 删除操作期间移除 PVC,留空则在 chart 被删除后删除 PVC
  resourcePolicy: "keep"
  persistentVolumeClaim:
    registry:
      # 使用一个存在的 PVC(必须在绑定前先手动创建)
      existingClaim: ""
      # 指定"storageClass",或者使用默认的 StorageClass 对象,设置成"-"禁用动态分配挂载卷
      storageClass: ""
      subPath: ""
      accessMode: ReadWriteOnce
      size: 5Gi
    chartmuseum:
      existingClaim: ""
      storageClass: ""
      subPath: ""
      accessMode: ReadWriteOnce
      size: 5Gi
    jobservice:
      existingClaim: ""
      storageClass: ""
      subPath: ""
      accessMode: ReadWriteOnce
      size: 1Gi
    # 如果使用外部的数据库服务,下面的设置将会被忽略
    database:
      existingClaim: ""
      storageClass: ""
      subPath: ""
      accessMode: ReadWriteOnce
      size: 1Gi
    # 如果使用外部的 Redis 服务,下面的设置将会被忽略
    redis:
      existingClaim: ""
      storageClass: ""
      subPath: ""
      accessMode: ReadWriteOnce
      size: 1Gi
  # 定义使用什么存储后端来存储镜像和 charts 包,详细文档地址:https://github.com/docker/distribution/blob/master/docs/configuration.md#storage
  imageChartStorage:
    # 正对镜像和chart存储是否禁用跳转,对于一些不支持的后端(例如对于使用minio的`s3`存储),需要禁用它。为了禁止跳转,只需要设置`disableredirect=true`即可,详细文档地址:https://github.com/docker/distribution/blob/master/docs/configuration.md#redirect
    disableredirect: false
    # 指定存储类型:"filesystem", "azure", "gcs", "s3", "swift", "oss",在相应的区域填上对应的信息。
    # 如果你想使用 pv 则必须设置成"filesystem"类型
    type: filesystem
    filesystem:
      rootdirectory: /storage
      #maxthreads: 100
    azure:
      accountname: accountname
      accountkey: base64encodedaccountkey
      container: containername
      #realm: core.windows.net
    gcs:
      bucket: bucketname
      # The base64 encoded json file which contains the key
      encodedkey: base64-encoded-json-key-file
      #rootdirectory: /gcs/object/name/prefix
      #chunksize: "5242880"
    s3:
      region: us-west-1
      bucket: bucketname
      #accesskey: awsaccesskey
      #secretkey: awssecretkey
      #regionendpoint: http://myobjects.local
      #encrypt: false
      #keyid: mykeyid
      #secure: true
      #v4auth: true
      #chunksize: "5242880"
      #rootdirectory: /s3/object/name/prefix
      #storageclass: STANDARD
    swift:
      authurl: https://storage.myprovider.com/v3/auth
      username: username
      password: password
      container: containername
      #region: fr
      #tenant: tenantname
      #tenantid: tenantid
      #domain: domainname
      #domainid: domainid
      #trustid: trustid
      #insecureskipverify: false
      #chunksize: 5M
      #prefix:
      #secretkey: secretkey
      #accesskey: accesskey
      #authversion: 3
      #endpointtype: public
      #tempurlcontainerkey: false
      #tempurlmethods:
    oss:
      accesskeyid: accesskeyid
      accesskeysecret: accesskeysecret
      region: regionname
      bucket: bucketname
      #endpoint: endpoint
      #internal: false
      #encrypt: false
      #secure: true
      #chunksize: 10M
      #rootdirectory: rootdirectory

imagePullPolicy: IfNotPresent

logLevel: debug
# Harbor admin 初始密码,Harbor 启动后通过 Portal 修改该密码
harborAdminPassword: "Harbor12345"
# 用于加密的一个 secret key,必须是一个16位的字符串
secretKey: "not-a-secure-key"

# 如果你通过"ingress"保留服务,则下面的Nginx不会被使用
nginx:
  image:
    repository: goharbor/nginx-photon
    tag: v1.7.0
  replicas: 1
  # resources:
  #  requests:
  #    memory: 256Mi
  #    cpu: 100m
  nodeSelector: {}
  tolerations: []
  affinity: {}
  ## 额外的 Deployment 的一些 annotations
  podAnnotations: {}

portal:
  image:
    repository: goharbor/harbor-portal
    tag: v1.7.0
  replicas: 1
# resources:
#  requests:
#    memory: 256Mi
#    cpu: 100m
  nodeSelector: {}
  tolerations: []
  affinity: {}
  podAnnotations: {}

core:
  image:
    repository: goharbor/harbor-core
    tag: v1.7.0
  replicas: 1
# resources:
#  requests:
#    memory: 256Mi
#    cpu: 100m
  nodeSelector: {}
  tolerations: []
  affinity: {}
  podAnnotations: {}

adminserver:
  image:
    repository: goharbor/harbor-adminserver
    tag: v1.7.0
  replicas: 1
  # resources:
  #  requests:
  #    memory: 256Mi
  #    cpu: 100m
  nodeSelector: {}
  tolerations: []
  affinity: {}
  podAnnotations: {}

jobservice:
  image:
    repository: goharbor/harbor-jobservice
    tag: v1.7.0
  replicas: 1
  maxJobWorkers: 10
  # jobs 的日志收集器:"file", "database" or "stdout"
  jobLogger: file
# resources:
#   requests:
#     memory: 256Mi
#     cpu: 100m
  nodeSelector: {}
  tolerations: []
  affinity: {}
  podAnnotations: {}

registry:
  registry:
    image:
      repository: goharbor/registry-photon
      tag: v2.6.2-v1.7.0
  controller:
    image:
      repository: goharbor/harbor-registryctl
      tag: v1.7.0
  replicas: 1
  nodeSelector: {}
  tolerations: []
  affinity: {}
  podAnnotations: {}

chartmuseum:
  enabled: true
  image:
    repository: goharbor/chartmuseum-photon
    tag: v0.7.1-v1.7.0
  replicas: 1
  # resources:
  #  requests:
  #    memory: 256Mi
  #    cpu: 100m
  nodeSelector: {}
  tolerations: []
  affinity: {}
  podAnnotations: {}

clair:
  enabled: true
  image:
    repository: goharbor/clair-photon
    tag: v2.0.7-v1.7.0
  replicas: 1
  # 用于从 Internet 更新漏洞数据库的http(s)代理
  httpProxy:
  httpsProxy:
  # clair 更新程序的间隔,单位为小时,设置为0来禁用
  updatersInterval: 12
  # resources:
  #  requests:
  #    memory: 256Mi
  #    cpu: 100m
  nodeSelector: {}
  tolerations: []
  affinity: {}
  podAnnotations: {}

notary:
  enabled: true
  server:
    image:
      repository: goharbor/notary-server-photon
      tag: v0.6.1-v1.7.0
    replicas: 1
    # resources:
    #  requests:
    #    memory: 256Mi
    #    cpu: 100m
  signer:
    image:
      repository: goharbor/notary-signer-photon
      tag: v0.6.1-v1.7.0
    replicas: 1
    # resources:
    #  requests:
    #    memory: 256Mi
    #    cpu: 100m
  nodeSelector: {}
  tolerations: []
  affinity: {}
  podAnnotations: {}

database:
  # 如果使用外部的数据库,则设置 type=external,然后填写 external 区域的一些连接信息
  type: internal
  internal:
    image:
      repository: goharbor/harbor-db
      tag: v1.7.0
    # 内部的数据库的初始化超级用户的密码
    password: "changeit"
    # resources:
    #  requests:
    #    memory: 256Mi
    #    cpu: 100m
    nodeSelector: {}
    tolerations: []
    affinity: {}
  external:
    host: "192.168.0.1"
    port: "5432"
    username: "user"
    password: "password"
    coreDatabase: "registry"
    clairDatabase: "clair"
    notaryServerDatabase: "notary_server"
    notarySignerDatabase: "notary_signer"
    sslmode: "disable"
  podAnnotations: {}

redis:
  # 如果使用外部的 Redis 服务,设置 type=external,然后补充 external 部分的连接信息。
  type: internal
  internal:
    image:
      repository: goharbor/redis-photon
      tag: v1.7.0
    # resources:
    #  requests:
    #    memory: 256Mi
    #    cpu: 100m
    nodeSelector: {}
    tolerations: []
    affinity: {}
  external:
    host: "192.168.0.2"
    port: "6379"
    # coreDatabaseIndex 必须设置为0
    coreDatabaseIndex: "0"
    jobserviceDatabaseIndex: "1"
    registryDatabaseIndex: "2"
    chartmuseumDatabaseIndex: "3"
    password: ""
  podAnnotations: {}
  •  根据模板进行values.yaml的改造

 

expose:
  type: nodePort
  tls:
    enabled: false
  clusterIP:
    # The name of ClusterIP service
    name: harbor
    ports:
      # The service port Harbor listens on when serving with HTTP
      httpPort: 80
      # The service port Harbor listens on when serving with HTTPS
      httpsPort: 443
      # The service port Notary listens on. Only needed when notary.enabled
      # is set to true
      notaryPort: 4443
  nodePort:
    # The name of NodePort service
    name: harbor
    ports:
      http:
        # The service port Harbor listens on when serving with HTTP
        port: 80
        # The node port Harbor listens on when serving with HTTP
        nodePort: 30004
      https:
        # The service port Harbor listens on when serving with HTTPS
        port: 443
        # The node port Harbor listens on when serving with HTTPS
        nodePort: 30005
      # Only needed when notary.enabled is set to true
      notary:
        # The service port Notary listens on
        port: 4443
        # The node port Notary listens on
        nodePort: 30006

externalURL: http://192.168.2.130:30004

persistence:
  enabled: true
  resourcePolicy: "keep"
  persistentVolumeClaim:
    registry:
      storageClass: "nfs"
    chartmuseum:
      storageClass: "nfs"
    jobservice:
      storageClass: "nfs"
    database:
      storageClass: "nfs"
    redis:
      storageClass: "nfs"
  •  storageclass资源对象需要创建,本次使用nfs自动存储,参考文章https://www.goufusheng.top/archives/552
  • helm安装harbor
kyfq@master-1:~/devops/harbor/harbor-helm$ helm install  harbor -f harbor.yaml . --namespace devops
W0308 16:03:37.750893   27464 warnings.go:70] extensions/v1beta1 Ingress is deprecated in v1.14+, unavailable in v1.22+; use networking.k8s.io/v1 Ingress
W0308 16:03:41.153640   27464 warnings.go:70] extensions/v1beta1 Ingress is deprecated in v1.14+, unavailable in v1.22+; use networking.k8s.io/v1 Ingress
W0308 16:03:41.158195   27464 warnings.go:70] extensions/v1beta1 Ingress is deprecated in v1.14+, unavailable in v1.22+; use networking.k8s.io/v1 Ingress
NAME: harbor
LAST DEPLOYED: Tue Mar  8 16:03:35 2022
NAMESPACE: devops
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
Please wait for several minutes for Harbor deployment to complete.
Then you should be able to visit the Harbor portal at http://192.168.2.130:30004.
For more details, please visit https://github.com/goharbor/harbor.

等待一段时间完成启动后即可访问http://192.168.2.130:30004/

kyfq@master-1:~/devops/harbor/harbor-helm$ kubectl get pod -n devops -o wide
NAME                                           READY   STATUS    RESTARTS   AGE     IP             NODE      NOMINATED NODE   READINESS GATES
gitlab-dfc786cc4-s8qzb                         1/1     Running   0          5h52m   192.169.2.10   slave-2   <none>           <none>
harbor-harbor-chartmuseum-bbff7b58f-dqpqf      1/1     Running   0          60m     192.169.1.18   slave-1   <none>           <none>
harbor-harbor-clair-ddb94df56-lw4pf            2/2     Running   4          60m     192.169.2.20   slave-2   <none>           <none>
harbor-harbor-core-6f4788d666-mqdcz            1/1     Running   0          60m     192.169.1.17   slave-1   <none>           <none>
harbor-harbor-database-0                       1/1     Running   0          60m     192.169.1.23   slave-1   <none>           <none>
harbor-harbor-jobservice-f5f6bb96-9bjmj        1/1     Running   0          60m     192.169.2.22   slave-2   <none>           <none>
harbor-harbor-nginx-78f4447bcd-rgt52           1/1     Running   0          60m     192.169.1.19   slave-1   <none>           <none>
harbor-harbor-notary-server-5b867bc4fb-2hwb6   1/1     Running   1          60m     192.169.2.21   slave-2   <none>           <none>
harbor-harbor-notary-signer-558685dbdd-hkb2n   1/1     Running   1          60m     192.169.1.21   slave-1   <none>           <none>
harbor-harbor-portal-767d9746d8-gzhpp          1/1     Running   0          60m     192.169.1.20   slave-1   <none>           <none>
harbor-harbor-redis-0                          1/1     Running   0          60m     192.169.1.22   slave-1   <none>           <none>
harbor-harbor-registry-6bfd5cb9dc-vp8lb        2/2     Running   0          60m     192.169.2.23   slave-2   <none>           <none>
jenkins-6cd45f5686-njk84                       1/1     Running   0          7h11m   192.169.2.7    slave-2   <none>           <none>
kyfq@master-1:~/devops/harbor/harbor-helm$ kubectl get svc -n devops -o wide
NAME                          TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                                   AGE     SELECTOR
gitlab                        NodePort    10.102.218.243   <none>        443:31667/TCP,80:30003/TCP,22:31428/TCP   5h37m   app=gitlab
harbor                        NodePort    10.97.31.106     <none>        80:30004/TCP,4443:30006/TCP               60m     app=harbor,component=nginx,release=harbor
harbor-harbor-chartmuseum     ClusterIP   10.102.127.71    <none>        80/TCP                                    60m     app=harbor,component=chartmuseum,release=harbor
harbor-harbor-clair           ClusterIP   10.96.9.125      <none>        8080/TCP                                  60m     app=harbor,component=clair,release=harbor
harbor-harbor-core            ClusterIP   10.96.34.100     <none>        80/TCP                                    60m     app=harbor,component=core,release=harbor
harbor-harbor-database        ClusterIP   10.105.196.91    <none>        5432/TCP                                  60m     app=harbor,component=database,release=harbor
harbor-harbor-jobservice      ClusterIP   10.103.69.183    <none>        80/TCP                                    60m     app=harbor,component=jobservice,release=harbor
harbor-harbor-notary-server   ClusterIP   10.104.22.93     <none>        4443/TCP                                  60m     app=harbor,component=notary-server,release=harbor
harbor-harbor-notary-signer   ClusterIP   10.97.14.219     <none>        7899/TCP                                  60m     app=harbor,component=notary-signer,release=harbor
harbor-harbor-portal          ClusterIP   10.97.194.40     <none>        80/TCP                                    60m     app=harbor,component=portal,release=harbor
harbor-harbor-redis           ClusterIP   10.96.54.204     <none>        6379/TCP                                  60m     app=harbor,component=redis,release=harbor
harbor-harbor-registry        ClusterIP   10.109.31.35     <none>        5000/TCP,8080/TCP                         60m     app=harbor,component=registry,release=harbor
jenkins                       NodePort    10.103.229.105   <none>        8080:30002/TCP,50000:32581/TCP            7h11m   app=jenkins

 

 

 

版权声明:
作者:lee
链接:https://www.goufusheng.top/archives/760
来源:苟浮生的桃花扇
文章版权归作者所有,未经允许请勿转载。

THE END
分享
二维码
< <上一篇
下一篇>>
文章目录
关闭
目 录