GoWiki | k8s | Harbor Registry

# Harbor Registry

## Prepare

```
apt install -y docker.io nginx
cat <<EOF> /etc/docker/daemon.json
{
  "exec-opts": ["native.cgroupdriver=systemd"],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m"
  },
  "storage-driver": "overlay2"
}
EOF
systemctl enable docker
systemctl start docker
```

## Install

### Docker-Compose

```
curl -s -L https://github.com/docker/compose/releases/download/1.24.1/docker-compose-Linux-x86_64 -o /usr/local/bin/docker-compose
[[ $(sha256sum /usr/local/bin/docker-compose|cut -d" " -f1) == "cfb3439956216b1248308141f7193776fcf4b9c9b49cbbe2fb07885678e2bb8a" ]] || echo "checksum validation failed"
chmod 755 /usr/local/bin/docker-compose
ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
```

### Nginx

See [k8s/Nginx](/k8s/Nginx)

```
cat <<'EOF'> /etc/nginx/sites-available/reg.conf
server {
  listen 80;
  server_name reg.example.com;
  root /var/www;
  location /.well-known/acme-challenge {
    root /var/www/acme;
  }
  location / {
    return 301 https://reg.example.com$request_uri;
  }
}
EOF
ln -s /etc/nginx/sites-available/reg.conf /etc/nginx/sites-enabled/reg.conf
```

Get Certificates:

```
groupadd acme
useradd -m -g acme -s /bin/bash acme
curl -s https://raw.githubusercontent.com/Neilpang/acme.sh/2.8.3/acme.sh >/home/acme/acme.sh
chmod 755 /home/acme/acme.sh
sudo -i -u acme /home/acme/acme.sh --install
echo "acme ALL=(ALL) NOPASSWD: /bin/systemctl restart nginx" > /etc/sudoers.d/20-acme
chmod 440 /etc/sudoers.d/20-acme

mkdir /var/www/acme /etc/acme
chown acme:acme /var/www/acme /etc/acme
chmod 750 /etc/acme

sudo -i -u acme /bin/bash -c '~/.acme.sh/acme.sh --issue -d reg.example.com -w /var/www/acme'
sudo -i -u acme /bin/bash -c '~/.acme.sh/acme.sh --install-cert -d reg.example.com --key-file /etc/acme/reg.key --fullchain-file /etc/acme/reg.pem --reloadcmd "sudo systemctl restart nginx"'
```

### Harbor

Download the Online Installer:

```
wget https://storage.googleapis.com/harbor-releases/release-1.9.0/harbor-online-installer-v1.9.0.tgz
[[ $(md5sum harbor-online-installer-v1.9.0.tgz|cut -d" " -f1) == "197273c3f181d5bd56749bec1987f4d9" ]] || echo "checksum validation failed"

tar xfvz harbor-online-installer-v1.9.0.tgz
```

Change `harbor.yml`:

```
hostname: reg.example.com

http:
  port: 8080

https:
  port: 443
  certificate: /etc/acme/reg.pem
  private_key: /etc/acme/reg.key
```

Run the install script:

```
./install.sh --with-notary --with-clair
```

# Kubernetes Secret

First create a robot account and copy the access token.

Now create the secret:

```
kubectl create secret docker-registry regcred --docker-server=<server> --docker-username='robot$<user>' --docker-password=<token>
```

OR:

```
user='robot$<username>'
pass=<token>
srv=<server>

cat <<EOF> regcred.yaml
apiVersion: v1
kind: Secret
metadata:
  name: regcred
data:
  .dockerconfigjson: $(echo -n '{"auths":{"'$srv'":{"username":"'$user'","password":"'$pass'","auth":"'$(echo -n $user':'$pass|base64 -w0)'"}}}'|base64 -w0)
type: kubernetes.io/dockerconfigjson
EOF
unset user pass srv
```