Helm 部署 Harbor镜像仓库最佳实践：SAN 匹配 + Docker 信任链零踩坑指南

刘云杰268

400人浏览 · 2026-01-29 23:13:15

刘云杰268 · 2026-01-29 23:13:15 发布

前置操作

1.创建helm存放目录

cd 
mkdir 11/1 -p #用于存放harbor镜像仓库

2.安装helm

#安装helm v3版
curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
chmod 700 get_helm.sh
./get_helm.sh
#初始化，安装完helm后，添加一个chart仓库
helm repo add bitnami https://charts.bitnami.com/bitnami
#当添加完成，您将可以看到可以被您安装的 charts 列表:
helm search repo bitnami

3.nfs-client-provisioner(用于pv的动态创建)的安装

3.1安装nfs服务器

yum install -y nfs-utils rpcbind #安装NFS服务端软件包。
mkdir /nfsdata   #创建共享目录/nfsdata
chmod 755 /nfsdata
echo '/nfsdata 192.168.175.0/24(rw,sync,root_squash,no_subtree_check)' > /etc/exports
# 4. 启动并设置开机自启（修正拼写）
systemctl enable --now rpcbind nfs-server

测试是否已经安装了nfs服务器

[root@k8s-node02 ~]# mkdir /nfstest
[root@k8s-node02 ~]# mount -t nfs 192.168.175.11:/nfsdata/1 /nfstest 挂载nfs文件类型的192.168.175.11:/nfsdata/1到node02机器的/nfstest
[root@k8s-node02 ~]# cd /nfstest/
[root@k8s-node02 nfstest]# ls
index.html
[root@k8s-node02 nfstest]# cat index.html   
1
xinxianghf
[root@k8s-node02 nfstest]# echo 123 >>index.html   把123追加到index.html文件中
[root@k8s-master01 1]# cat index.html
1
xinxianghf
123
[root@k8s-node02 ~]#  umount /nfstest     #测试完毕之后，解除挂载

3.2部署 nfs-client-provisioner

前置操作

[root@k8s-master01 ~]# vi /etc/exports
[root@k8s-master01 ~]# cat /etc/exports
/nfsdata/1 192.168.175.0/24(rw,sync,root_squash,no_subtree_check)
/nfsdata/2 192.168.175.0/24(rw,sync,root_squash,no_subtree_check)
/nfsdata/3 192.168.175.0/24(rw,sync,root_squash,no_subtree_check)
/nfsdata/share 192.168.175.0/24(rw,sync,root_squash,no_subtree_check)
[root@k8s-master01 ~]# mkdir -p /nfsdata/share
[root@k8s-master01 ~]# chown -R nobody /nfsdata/share/  #nobody,系统默认的匿名用户,一个低权限系统用户，通常UID=99
[root@k8s-master01 ~]# systemctl restart nfs-server

正式部署 nfs-client-provisioner

#基本元数据
kind: Deployment
apiVersion: apps/v1
metadata:
  name: nfs-client-provisioner      #Deployment名称
  namespace: nfs-storageclass       #部署的命名空间
spec:   #部署策略
  replicas: 1    #只运行1个副本（单节点即可）
  selector:
    matchLabels:
      app: nfs-client-provisioner   #标签选择器
  strategy:
    type: Recreate                  #更新策略：先删除旧的，再创建新的
  template:     #Pod模板-核心部分
    metadata:
      labels: 
        app: nfs-client-provisioner #Pod标签
    spec:
      serviceAccountName: nfs-client-provisioner #使用专用服务账户
      containers: #容器配置 - 核心中的核心
        - name: nfs-client-provisioner
          # image: registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.2
          image: easzlab/nfs-subdir-external-provisioner:v4.0.2
          volumeMounts: #卷挂载配置，将NFS共享挂载到容器的/persistentvolumes路径
            - name: nfs-client-root
              mountPath: /persistentvolumes
          env:
            - name: PROVISIONER_NAME #供应者名称，在StorageClass中引用
              value: k8s-sigs.io/nfs-subdir-external-provisioner
            - name: NFS_SERVER #NFS服务器IP
              # value: <YOUR NFS SERVER HOSTNAME>
              value: 192.168.175.11
            - name: NFS_PATH #NFS共享路径
              # value: /var/nfs
              value: /nfsdata/share
      volumes:  #卷定义，定义了一个NFS类型的卷，挂载NFS服务器的共享目录。
        - name: nfs-client-root
          nfs:
            # server: <YOUR NFS SERVER HOSTNAME>
            server: 192.168.175.11
            # share nfs path
            path: /nfsdata/share

创建SA

要完成当前nfs的动态提供或者是存储类的抽象，那必须要给当前的镜像，它在运行出来容器有一定的权限

apiVersion: v1
kind: ServiceAccount
metadata: 
  name: nfs-client-provisioner #服务账户名称
  namespace: nfs-storageclass  #部署provisioner的命名空间，命名空间，所有资源都在这个命名空间下
---
kind: ClusterRole #定义一组集群级别的权限（跨所有命名空间）
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: nfs-client-provisioner-runner
rules:
  - apiGroups: [""] #资源范围："" 表示核心API组（最基础的资源）,让provisioner知道集群有哪些服务器，但不让修改
    resources: ["nodes"] #能操作什么：resources: ["nodes"] = Kubernetes节点（服务器）
    verbs: ["get", "list", "watch"] #能做什么：verbs: ["get", "list", "watch"] =，get：查看单个节点详情，list：列出所有节点，watch：实时监控节点变化
  - apiGroups: [""] 
    resources: ["persistentvolumes"] #PV（持久卷）管理权
    verbs: ["get", "list", "watch", "create", "delete"]
  - apiGroups: [""] 
    resources: ["persistentvolumeclaims"] #PVC（持久卷声明）管理权
    verbs: ["get", "list", "watch", "update"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"] #存储类查看权
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["events"] #事件记录权
    verbs: ["create", "update", "patch"]
---
kind: ClusterRoleBinding #声明这是一个ClusterRoleBinding资源
apiVersion: rbac.authorization.k8s.io/v1 #使用Kubernetes RBAC API的v1版本
metadata:
  name: run-nfs-client-provisioner #ClusterRoleBinding的资源名称
subjects: #主体定义 (subjects)
  - kind: ServiceAccount #指定主体类型为ServiceAccount
    name: nfs-client-provisioner #ServiceAccount的名称
    namespace: nfs-storageclass  # 部署provisioner的命名空间
roleRef:
  kind: ClusterRole #引用的角色类型,对于集群范围的权限绑定，必须是ClusterRole
  name: nfs-client-provisioner-runner #引用的ClusterRole名称
  apiGroup: rbac.authorization.k8s.io
---
kind: Role #Role: 权限仅在指定命名空间内有效,ClusterRole: 权限在整个集群内有效
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: leader-locking-nfs-client-provisioner
  namespace: nfs-storageclass  #定义这个 Role 所属的命名空间,权限规则只对 nfs-storageclass 命名空间内的资源生效
rules:
  - apiGroups: [""] #空字符串表示核心 API 组（core API group）
    resources: ["endpoints"] #指定操作的目标资源类型为 endpoints,Endpoints 资源记录 Service 后端的 Pod IP 和端口列表
    verbs: ["get", "list", "watch", "create", "update", "patch"] #verbs 权限动作,get: 获取单个 endpoints 资源的详情，等
---
kind: RoleBinding #RoleBinding 是将 Role 的权限绑定到主体的资源,同样是命名空间作用域，只在指定命名空间内生效
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: leader-locking-nfs-client-provisioner
  namespace: nfs-storageclass#部署provisioner的命名空间
subjects: #绑定目标 (subjects)
  - kind: ServiceAccount #主体类型: ServiceAccount
    name: nfs-client-provisioner#主体名称: nfs-client-provisioner
    namespace: nfs-storageclass  #主体命名空间: nfs-storageclass
roleRef:
  kind: Role
  name: leader-locking-nfs-client-provisioner
  apiGroup: rbac.authorization.k8s.io

存储类

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: nfs-client #存储类的名称，在整个集群中必须唯一,PVC 中通过这个名称引用 StorageClass
namespace: nfs-storageclass
provisioner: k8s-sigs.io/nfs-subdir-external-provisioner
parameters:
pathPattern: ${.PVC.namespace}/${.PVC.name}
onDelete: delete

运行deployment.yaml rbac.yaml storageclass.yaml

[root@k8s-master01 19]# kubectl create ns nfs-storageclass
[root@k8s-master01 19]# ls
deployment.yaml  rbac.yaml  storageclass.yaml
[root@k8s-master01 19]# kubectl apply -f ../19/

4.安装ingress-nginx

#master,node01,node02节点都要导入这两个镜像，ingress-nginx-kube-webhook-certgen-v20231011-8b53cabe0.tar，registry.k8s.io-ingress-nginx-controller-v1.9.4.tar(我自己是镜像上传到服务器然后docker load -i导入的)
[root@k8s-master01 image]# docker load -i ingress-nginx-kube-webhook-certgen-v20231011-8b53cabe0.tar
Loaded image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0
[root@k8s-master01 image]# docker load -i registry.k8s.io-ingress-nginx-controller-v1.9.4.tar
Loaded image: registry.k8s.io/ingress-nginx/controller:v1.9.4


[root@k8s-master01 image]# cd ..
[root@k8s-master01 2、ingress-nginx]# cd chart/
[root@k8s-master01 chart]# ls
ingress-nginx-4.8.3.tgz  values.yaml
[root@k8s-master01 chart]# tar -zxvf ingress-nginx-4.8.3.tingress-nginx/Chart.yaml
ingress-nginx/values.yaml
ingress-nginx/templates/NOTES.txt
ingress-nginx/templates/_helpers.tpl
......
[root@k8s-master01 chart]# ls
ingress-nginx  ingress-nginx-4.8.3.tgz  values.yaml
[root@k8s-master01 chart]# ls
ingress-nginx  ingress-nginx-4.8.3.tgz  values.yaml
[root@k8s-master01 chart]# cd ingress-nginx
[root@k8s-master01 ingress-nginx]# ls
CHANGELOG.md  Chart.yaml  OWNERS  README.md  README.md.gotmpl  changelog  changelog.md.gotmpl  ci  templates  values.yaml
[root@k8s-master01 ingress-nginx]# vi values.yaml
#修改部分如下：
  hostNetwork: true (运行的这个pod，它的网络名称空间不再独立创建，而是和物理机的共用)
  dnsPolicy: ClusterFirstWithHostNet 
  kind: DaemonSet
 #把所有这样的digest全部注释
  # digest: sha256:5b161f051d017e55d358435f295f5e9a297e66158f136321d9b04520ec6c48a3
  # digestChroot: sha256:5976b106  ingressClassResource:

  ingressClassResource:
    default: true (把当前的nginx-ingress设置为默认的ingress类)



[root@k8s-master01 ingress-nginx]# kubectl create ns ingress
namespace/ingress created
[root@k8s-master01 ingress-nginx]# helm install ingress-nginx -n ingress . -f values.yaml
NAME: ingress-nginx
LAST DEPLOYED: Wed Jan 28 22:33:12 2026
......

[root@k8s-master01 ingress-nginx]# kubectl get pod -n ingress
NAME                             READY   STATUS    RESTARTS   AGE
ingress-nginx-controller-7hbnx   1/1     Running   0          34s
ingress-nginx-controller-g64td   1/1     Running   0          34s

一、创建namespace

后续的harbor的组件或者pod，都会放在这样的名字空间下

[root@k8s-master01 1]# kubectl get ns harbor

二、选择节点进行 harbor 安装[可选]

[root@k8s-master01 1]# kubectl edit ns harbor -o yaml #查看或编辑名为 harbor 的命名空间（Namespace）的定义。
apiVersion: v1
kind: Namespace
metadata:
  annotations:
    scheduler.alpha.kubernetes.io/node-selector: harbor=env #必须被调度到拥有 harbor=env 这个标签的节点上
  name: harbor
[root@k8s-master01 1]# kubectl label node k8s-node02 harbor=env #调度到k8s-node02节点

三、添加 helm repo

[root@k8s-master01 1]# helm repo add harbor https://helm.goharbor.io
[root@k8s-master01 1]# helm search repo
bitnami/harbor                                  27.0.3          2.13.2 
[root@k8s-master01 1]# helm pull harbor/harbor --version 1.11.0
[root@k8s-master01 1]# tar -zxvf harbor-1.11.0.tgz
[root@k8s-master01 1]# cd harbor
[root@k8s-master01 harbor]# ls
Chart.yaml  LICENSE  README.md  cert  conf  templates  values.yaml

四、修改values.yaml文件里一些东西

1.里面的storageClass全部改为nfs-client

#storageclass的名字叫nfs-client
[root@k8s-master01 harbor]# kubectl get storageclass
NAME         PROVISIONER                                   RECLAIMPOLICY   VOLUMEBINDINGMODE   ALLOWVOLUMEEXPANSION   AGE
nfs-client   k8s-sigs.io/nfs-subdir-external-provisioner   Delete          Immediate           false                  5d23h
#values.yaml
[root@k8s-master01 harbor]# vi values.yaml
#里面的storageClass全部改为nfs-client
      storageClass: "nfs-client"

2.关闭漏扫(国内网络很慢,如果是false,它一连接的时候就会从github上更新最新的漏洞库，网络极有可能会超时，自己想更新的话，手动更新也可以)

[root@k8s-master01 harbor]# vi values.yaml
   skipUpdate: true

五、helm 安装 harbor

#前置： 修改 skipUpdate: true，添加存储类
[root@k8s-master harbor]# helm install harbor . -f values.yaml -n harbor
[root@k8s-master01 harbor]# kubectl get pod -n harbor
NAME                                    READY   STATUS    RESTARTS        AGE
harbor-chartmuseum-8dd95c968-jbmr6      1/1     Running   0               15m
harbor-core-876554cdf-wlh7b             1/1     Running   4 (4m27s ago)   15m
harbor-database-0                       1/1     Running   0               15m
harbor-jobservice-86bbc77b85-2blxn      1/1     Running   6 (4m16s ago)   15m
harbor-notary-server-84765dddcf-tvqfx   1/1     Running   6 (6m22s ago)   15m
harbor-notary-signer-d855fd5d5-rpkr7    1/1     Running   5 (4m19s ago)   15m
harbor-portal-64bb85667c-hbdpx          1/1     Running   0               15m
harbor-redis-0                          1/1     Running   0               15m
harbor-registry-58f4645cb5-j4vx4        2/2     Running   0               15m
harbor-trivy-0                          1/1     Running   0               15m

#这里它帮我们创建了两个ingress,core.harbor.domain是外部访问的时候的域名,把core.harbor.domain添加到电脑的解析记录里面来
[root@k8s-master01 harbor]# kubectl get ingress -n harbor
NAME                    CLASS   HOSTS                  ADDRESS   PORTS     AGE
harbor-ingress          nginx   core.harbor.domain               80, 443   122m
harbor-ingress-notary   nginx   notary.harbor.domain             80, 443   122m

#把core.harbor.domain添加到电脑的解析记录里面来~~~~

完成harbor镜像仓库的搭建

#master,node01,node02三个节点都要做，为了在这些服务器节点本身完成 本地域名解析。
[root@k8s-master01 harbor]# echo "192.168.175.12 core.harbor.domain" >>/etc/hosts

六、harbor仓库怎么上传镜像

1.上传helm chart包(手动推)(感觉命令推没有手动推方便)

Prov文件相当于它的身份，可以选择不选(我这里直接点的上传)

2.上传镜像到harbor镜像仓库

#这里提前pull了一个镜像做示例
[root@k8s-master01 ~]# docker pull wangyanglinux/myapp:v6.0
v6.0: Pulling from wangyanglinux/myapp
9398808236ff: Pull complete
5f6f45a46f36: Pull complete
10840918b3c8: Pull complete
87f35c454b8f: Pull complete
95045127ee09: Pull complete
03ce7c584195: Pull complete
3f34dbc1d74e: Pull complete
Digest: sha256:84283dabf34c53419a8309bd4344b5c8d60537dde6c221344c657740d0231fd2
Status: Downloaded newer image for wangyanglinux/myapp:v6.0
docker.io/wangyanglinux/myapp:v6.0

#在harbor里查看镜像的官方推送命令

1.镜像改别名
#官方初始改名命令
[root@k8s-master01 1]# docker tag SOURCE_IMAGE[:TAG] core.harbor.domain/library/REPOSITORY[:TAG]
[root@k8s-master01 1]# docker tag wangyanglinux/myapp:v6.0 core.harbor.domain/library/myapp:v6.0

2.修正Docker 客户端无法验证 Harbor 仓库使用的 TLS 证书问题，不然后续docker login core.harbor.domain登录不上
两种方案：(1)在docker的配置文件中添加一个信任的域名core.harbor.domain（仅限测试环境）(登录的上，镜像推送不了，80端口或许可以推送成功，没试)
sudo vi /etc/docker/daemon.json
添加:
{
  "insecure-registries": ["core.harbor.domain"]
}
# 重新加载systemd管理的服务配置
sudo systemctl daemon-reload
# 重启Docker守护进程
sudo systemctl restart docker
(2)把当前harbor仓库的ca.crt证书文件配置给docker
[root@k8s-master01 harbor]# kubectl get secret harbor-ingress -n harbor -o yaml(Kubernetes + Ingress 部署的 Harbor，证书是通过 Ingress TLS Secret 管理的。Ingress Controller（如 Nginx Ingress、Traefik 等）使用 Kubernetes Secret 存储 TLS 证书)
apiVersion: v1
data:
  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUk4QVc2R05aTFBIdzNs......
#secret都是通过base64编码的，我们需要对ca.crt进行解码
[root@k8s-master01 harbor]# echo -n 'LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0
lSQUk4QVc2R05aTFBIdzNsajJGQjUyMXN3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSmFHRnlZbTl5TFdOaE1CNFhEVEkyT
URFeU9ERXlOVFV6TTFvWERUSTNNREV5T0RFeQpOVFV6TTFvd0ZERVNNQkFHQTFVRUF4TUphR0Z5WW05eUxXTmhNSUlCSWpBTkJna3Foa2lHOXcw
QkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUExcE1LcUhkYncyNUtyYXdndUN0TzgvMGEvU1JQWHVYTDJQME8vWjJYVWpBM0tCQUwKdFlRTEw5UUN
NUS9CekRhYkpLWUUvb1JPU0RmZ1k5VW1WYlJyRnk2b2Rxak12R0JmcmFOeXdpcXVCcW5samNZbApOeE9tbTJIVitreUlKeXgrL3JvM0gzM0owNW
pGWlNZdk51elhmVmhCY05FMFNReXo2eEpORTJBb2w1V3NqejhmCmFCMit1WjNxZ3NwQlJuNTRZU0JQRDBQaFlxVEpZVjdoOVVsYnJUS1l0aW1GM
0NDbWdSR085Rk9ybU1hb0hlOE4KYWpHYWtwOU9PbVFlSE1LLzJMbEdxSTJpU2JVc1EvaHZKS1IvcEpYbWNyR1BbmJCZThVWTNnYjRkYllJWU1s
MQo3NkFRV1N6TS8xbWw0TG1EOXhlUUZRNHVqeFRKWFdyeGZIVTJYd0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGx
CQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGSkNVNEkxSWttRGVsUV
BzZzNpMlZqVFptY0lwTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRRFJmYXEzYmY4dTV0SmxPcDR2bWhKc1dlOWIwY1pmNk9ydmYwZG45eU91d
TBHY1lsbFA3UmJyCmFtZ1FFMkdZVTZ0ajZ2NVE5cGdzdXZteXlDeHM0a3M0eUJTM3pvTkg3MUg5c0JDTVRRYWFqaFlNYXBOVnkwUlIKTnhtZXp2
QWZYRE1vdW5jYWhhbTVVb3hYdWVYTTlkNXF2NEV5WTJjcVA5T3R3Z2dVTzAvY3dvUUcwcGx1dXBTOApjNWlVaWxiKzJBaHlVMnU1UzdiZ1N6Q0p
Pb1NNMVIzUlpzOGEyTnh5c094QzFZZmpYczNDckN1anl4eUE4cjA2CitucnVXaFljRlB2ZHR2MWtLREtyT3BlUGRrUUVTV0I4UlhUbm1wSUVQUT
FMbHYvUk54Qis0QzBhaUlJekdTVTcKbnFtWEp6L2k4V2hxMTNCWnRlME4vb01obFd2Y001NUgKLS0tLS1FTkQgQ0VSVElGSUNBEUtLS0tLQo=' | base64 -d
-----BEGIN CERTIFICATE-----
MIIDFDCCAfygAwIBAgIRAI8AW6GNZLPHw3lj2FB521swDQYJKoZIhvcNAQELBQAw
FDESMBAGA1UEAxMJaGFyYm9yLWNhMB4XDTI2MDEyODEyNTUzM1oXDTI3MDEyODEy
NTUzM1owFDESMBAGA1UEAxMJaGFyYm9yLWNhMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEA1pMKqHdbw25KrawguCtO8/0a/SRPXuXL2P0O/Z2XUjA3KBAL
tYQLL9QCMQ/BzDabJKYE/oROSDfgY9UmVbRrFy6odjMvGBfraNywiquBqnljcYl
NxOmm2HV+kyIJyx+/ro3H33J05jFZSYvNuzXfVhBcNE0SQyz6xJNE2Aol5Wsjz8f
aB2+uZ3qgspBRn54YSBPD0PhYqTJYV7h9UlbrTKYtimF3CCmgRGO9FOrmMaoHe8N
ajGakp9OOmQeHMK/2LlGqI2iSbUsQ/hvJKR/pJXmcrGPYnbBe8UY3gb4dbYIYMl1
76AQWSzM/1ml4LmD9xeQFQ4ujxTJXWrxfHU2XwIDAQABo2EwXzAOBgNVHQ8BAf8E
BAMCAqQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA8GA1UdEwEB/wQF
MAMBAf8wHQYDVR0OBBYEFJCU4I1IkmDelQPsg3i2VjTZmcIpMA0GCSqGSIb3DQEB
CwUAA4IBAQDRfaq3bf8u5tJlOp4vmhJsWe9b0cZf6Orvf0dn9yOuu0GcYllP7Rbr
amgQE2GYU6tj6v5Q9pgsuvmyyCxs4ks4yBS3zoNH71H9sBCMTQaajhYMapNVy0RR
NxmezvAfXDMouncaham5UoxXueXM9d5qv4EyY2cqP9OtwggUO0/cwoQG0pluupS8
c5iUilb+2AhyU2u5S7bgSzCJOoSM1R3RZs8a2NxysOxC1YfjXs3CrCujyxyA8r06
+nruWhYcFPvdtv1kKDKrOpePdkQESWB8RXTnmpIEPQ1Llv/RNxB+4C0aiIIzGSU7
nqmXJz/i8Whq13BZte0N/oMhlWvcM55H
-----END CERTIFICATE-----
[root@k8s-master01 harbor]#
[root@k8s-master01 harbor]# echo -n 'LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0l
SQUk4QVc2R05aTFBIdzNsajJGQjUyMXN3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSmFHRnlZbTl5TFdOaE1CNFhEVEkyTUR
FeU9ERXlOVFV6TTFvWERUSTNNREV5T0RFeQpOVFV6TTFvd0ZERVNNQkFHQTFVRUF4TUphR0Z5WW05eUxXTmhNSUlCSWpBTkJna3Foa2lHOXcwQkF
RRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUExcE1LcUhkYncyNUtyYXdndUN0TzgvMGEvU1JQWHVYTDJQME8vWjJYVWpBM0tCQUwKdFlRTEw5UUNNUS9
CekRhYkpLWUUvb1JPU0RmZ1k5VW1WYlJyRnk2b2Rxak12R0JmcmFOeXdpcXVCcW5samNZbApOeE9tbTJIVitrelKeXgrL3JvM0gzM0owNWpGWlN
Zdk51elhmVmhCY05FMFNReXo2eEpORTJBb2w1V3NqejhmCmFCMit1WjNxZ3NwQlJuNTRZU0JQRDBQaFlxVEpZVjdoOVVsYnJUS1l0aW1GM0NDbWd
SR085Rk9ybU1hb0hlOE4KYWpHYWtwOU9PbVFlSE1LLzJMbEdxSTJpU2JVc1EvaHZKS1IvcEpYbWNyR1BZbmJCZThVWTNnYjRkYllJWU1sMQo3NkF
RV1N6TS8xbWw0TG1EOXhlUUZRNHVqeFRKWFdyeGZIVTJYd0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZFZSMGxCQll3RkF
ZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGSkNVNEkxSWttRGVsUVBzZzNpMlZ
qVFptY0lwTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRRFJmYXEzYmY4dTV0SmxPcDR2bWhKc1dlOWIwY1pmNk9ydmYwZG45eU91dTHY1lsbFA
3UmJyCmFtZ1FFMkdZVTZ0ajZ2NVE5cGdzdXZteXlDeHM0a3M0eUJTM3pvTkg3MUg5c0JDTVRRYWFqaFlNYXBOVnkwUlIKTnhtZXp2QWZYRE1vdW5
jYWhhbTVVb3hYdWVYTTlkNXF2NEV5WTJjcVA5T3R3Z2dVTzAvY3dvUUcwcGx1dXBTOApjNWlVaWxiKzJBaHlVMnU1UzdiZ1N6Q0pPb1NNMVIzUlp
zOGEyTnh5c094QzFZZmpYczNDckN1anl4eUE4cjA2CitucnVXaFljRlB2ZHR2MWtLREtyT3BlUGRrUUVTV0I4UlhUbm1wSUVQUTFMbHYvUk54Qis
0QzBhaUlJekdTVTcKbnFtWEp6L2k4V2hxMTNCWnRlME4vb01obFd2Y001NUgKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=' | base64 -d >ca.crt
[root@k8s-master01 harbor]# ls
ca.crt
# 将证书保存在docker目录下，创建根域名相同的子目录，这一步建议所有机器都执行
[root@k8s-master harbor]# mkdir -p /etc/docker/certs.d/core.harbor.domain(master,node01,node02三个节点都要创建这个目录)
[root@k8s-master harbor]# cp ca.crt /etc/docker/certs.d/core.harbor.domain
[root@k8s-master01 core.harbor.domain]# scp /etc/docker/certs.d/core.harbor.domain/ca.crt root@n1:/etc/docker/certs.d/core.harbor.domain/
root@n1's password:
ca.crt                                                                                         100% 1127   938.6KB/s   00:00
[root@k8s-master01 core.harbor.domain]# scp /etc/docker/certs.d/core.harbor.domain/ca.crt root@n2:/etc/docker/certs.d/core.harbor.domain/
root@n2's password:
ca.crt                                                                                         100% 1127     1.1MB/s   00:00
[root@k8s-master01 core.harbor.domain]# cp /etc/docker/certs.d/core.harbor.domain/ca.crt /etc/pki/ca-trust/source/anchors/harbor-ca.crt #将Harbor的 CA 证书复制到系统的信任证书存储目录,/etc/pki/ca-trust/source/anchors/ 是系统级别信任证书的目录
[root@k8s-master01 core.harbor.domain]# update-ca-trust #更新系统的证书信任存储
[root@k8s-master01 core.harbor.domain]# systemctl restart docker #重启 Docker 服务
[root@k8s-master01 core.harbor.domain]# kubectl rollout restart deployment -n harbor
deployment.apps/harbor-chartmuseum restarted
deployment.apps/harbor-core restarted
deployment.apps/harbor-jobservice restarted
deployment.apps/harbor-notary-server restarted
deployment.apps/harbor-notary-signer restarted
deployment.apps/harbor-portal restarted
deployment.apps/harbor-registry restarted

3.登录core.harbor.domain
[root@k8s-master01 core.harbor.domain]# docker login core.harbor.domain
Authenticating with existing credentials... [Username: admin]

i Info → To login with a different account, run 'docker logout' followed by 'docker login'


Login Succeeded

4.可以把刚才下载，改名的镜像推过去了
[root@k8s-master01 core.harbor.domain]# docker push core.harbor.domain/library/myapp:v6.0
The push refers to repository [core.harbor.domain/library/myapp]
5f6f45a46f36: Pushed
10840918b3c8: Pushed
87f35c454b8f: Pushed
03ce7c584195: Pushed
95045127ee09: Pushed
9398808236ff: Pushed
3f34dbc1d74e: Pushed
v6.0: digest: sha256:84283dabf34c53419a8309bd4344b5c8d60537dde6c221344c657740d0231fd2 size: 1783