hostnamectl set-hostname xianchao.lucky.mecat  /etc/hosts192.168.199.164 xianchao.lucky.me

mkdir /data/ssl -pcd /data/ssl/#生成一个3072位的key，也就是私钥openssl genrsa -out ca.key 3072#生成一个数字证书ca.pem，1095表示证书的有效时间是3年openssl req -new -x509 -days 1095 -key ca.key -out ca.pem

Country Name (2 letter code) [XX]:CNState or Province Name (full name) []:BJLocality Name (eg, city) [Default City]:BJOrganization Name (eg, company) [Default Company Ltd]:Organizational Unit Name (eg, section) []:Common Name (eg, your name or your server's hostname) []:Email Address []:
注：[]表示默认不填写内容，其他的按上面配置即可

#生成一个3072位的key，也就是私钥openssl genrsa -out xianchao.lucky.me.key  3072#生成一个证书请求openssl req -new -key xianchao.lucky.me.key  -out xianchao.lucky.me.csr

Country Name (2 letter code) [XX]:CNState or Province Name (full name) []:BJLocality Name (eg, city) [Default City]:BJOrganization Name (eg, company) [Default Company Ltd]:Organizational Unit Name (eg, section) []:Common Name (eg, your name or your server's hostname) []:xianchao.lucky.meEmail Address []:Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []:An optional company name []:
注：[]表示默认不填写内容，其他的按上面配置即可Common Name (eg, your name or your server's hostname)这个位置的xianchao.lucky.me是harbor的主机名

#签发证书openssl x509 -req -in xianchao.lucky.me.csr -CA ca.pem -CAkey ca.key  -CAcreateserial -out xianchao.lucky.me.pem -days 1095

Signature oksubject=/C=CN/ST=BJ/L=BJ/O=Default Company Ltd/CN=xianchao.lucky.meGetting CA Private Key

openssl x509 -noout -text -in xianchao.lucky.me.pem 

Certificate:    Data:        Version: 1 (0x0)        Serial Number:            e5:5b:2e:bf:bf:61:da:5a    Signature Algorithm: sha256WithRSAEncryption        Issuer: C=CN, ST=BJ, L=BJ, O=Default Company Ltd        Validity            Not Before: Sep 26 08:58:11 2019 GMT            Not After : Sep 25 08:58:11 2022 GMT        Subject: C=CN, ST=BJ, L=BJ, O=Default Company Ltd, CN=xianchao.lucky.me        Subject Public Key Info:            Public Key Algorithm: rsaEncryption                Public-Key: (3072 bit)                Modulus:                    00:f3:c9:53:28:34:22:67:18:e0:a5:4a:c0:24:ac:                    0a:59:d7:f2:cd:ad:7e:bd:29:26:ad:67:2f:50:6f:                    f5:c4:ba:75:35:c7:54:bf:b1:dc:15:21:20:b8:32:                    5b:40:38:78:5e:b1:c7:d6:b6:5e:44:8d:f8:a1:88:                    7e:01:43:35:b1:1b:53:9d:65:88:8a:7c:90:93:5f:                    6d:66:71:d3:11:44:e4:3d:af:0d:d2:89:29:2a:55:                    ee:ec:23:3b:6a:10:dc:99:68:e3:7c:05:97:11:66:                    65:b9:98:e7:07:7c:7b:86:73:bd:43:a4:15:e6:36:                    36:3d:f9:16:20:ed:d0:f2:cd:bd:8c:a1:ae:e5:cf:                    ee:cc:ab:1b:02:4f:56:28:2e:54:f4:3c:38:aa:67:                    0f:20:24:a5:cd:9d:3b:72:3a:81:18:dd:cc:57:fc:                    24:5f:c8:22:c2:37:29:3b:63:c3:b0:4b:0e:77:18:                    7e:49:32:72:17:76:41:53:29:b8:da:54:69:9b:11:                    ad:86:cc:5e:3a:54:dd:0f:0a:3e:72:6f:cf:38:01:                    0a:83:40:b4:bc:81:b2:b8:83:82:3f:b2:9e:dd:6c:                    29:f4:68:1a:90:f9:32:07:ab:71:ef:f2:a2:ce:07:                    61:44:25:0a:e9:ec:ad:28:7f:eb:a1:ee:2b:90:a6:                    52:05:95:42:e1:d9:16:2b:97:84:20:32:0c:c7:aa:                    1e:d9:c9:aa:58:c2:ee:a6:94:71:36:e0:0e:dd:f5:                    6e:5f:c3:b0:d4:2e:e8:c4:73:89:65:91:54:1f:38:                    37:a9:56:15:92:de:8e:86:72:89:56:d1:8c:d2:15:                    78:59:3a:66:60:63:c3:af:66:6d:e0:dc:12:4c:a3:                    76:f2:10:44:db:5d:36:8e:e7:33:27:49:e2:1f:ca:                    e5:15:cb:52:05:06:0f:7d:89:3c:2f:cb:7d:10:60:                    8c:4c:96:f2:54:1b:54:66:c1:54:d4:38:45:6b:dc:                    29:ae:e5:2f:da:e1:45:e9:c2:39                Exponent: 65537 (0x10001)    Signature Algorithm: sha256WithRSAEncryption         1e:b8:34:f7:dc:74:4b:2a:92:8d:c7:00:de:e2:70:de:34:a2:         75:b6:4b:88:9f:0a:99:79:e5:6b:78:78:38:0c:6c:12:af:94:         d6:9d:19:30:95:14:cb:64:6c:c7:6a:8e:db:d1:bd:36:04:04:         9b:64:8b:9d:c5:f8:ff:05:1b:98:53:01:3a:76:21:b8:56:a0:         2a:cc:bd:33:f9:db:74:bd:09:f8:2e:50:8f:37:2d:ec:cb:6a:         e1:cc:4f:fc:4a:3b:51:5f:17:53:7a:8c:13:99:38:bb:94:dd:         b4:e5:26:97:6f:e8:84:ec:e9:e4:ba:95:3a:03:1d:d2:42:85:         ad:33:2f:1d:1e:34:4f:f8:38:d6:fe:91:89:23:67:f1:e7:d7:         54:e0:4d:26:22:b4:ec:9f:8f:04:f9:4d:e8:8e:d2:87:ff:58:         7d:f3:87:a6:c9:91:2e:52:40:19:9f:87:63:32:47:a5:86:7f:         ae:de:d9:f8:5a:97:c2:0a:4e:b3:15:f5:d1:09:cb:77:b4:41:         f7:c2:08:6c:f8:e4:ef:b1:3b:98:52:e5:df:82:0f:79:20:ac:         ae:5f:41:ca:99:c4:0b:f4:cb:e5:d0:8f:c9:f6:be:9a:32:3f:         e4:21:74:d6:bb:a6:a5:09:4c:64:3a:b9:95:9a:c3:c1:88:74:         aa:8f:ac:af:bc:2e:78:6d:b1:46:0e:7a:51:69:b8:1e:22:87:         11:2e:5c:16:91:33:ad:f3:4f:52:44:0c:02:f4:b4:00:96:80:         42:cc:b9:9e:3f:fa:f5:42:e0:d0:51:84:95:f2:84:b0:0e:81:         dc:4c:94:ed:2a:4c:36:2c:35:1d:45:53:da:a3:52:84:63:56:         76:90:96:79:7a:85:8e:29:1f:0e:99:ed:2a:99:7f:55:0f:93:         bc:13:56:de:39:dd:c7:39:d3:68:2f:db:54:17:51:05:d3:db:         01:02:a7:b6:a4:c8:40:48:1d:e9:8d:a0:03:c4:56:37:f5:2d:         c2:ab:48:0e:a9:f5

cd /data/sslcp ca.pem /etc/pki/ca-trust/source/anchors/update-ca-trust enable  && update-ca-trust extract

 mkdir /data/install cd /data/install/

yum install -y yum-utils device-mapper-persistent-data lvm2#设置dacoker安装的yum源yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo                cat /etc/yum.repos.d/docker-ce.repo 显示如下：

[docker-ce-stable]name=Docker CE Stable - $basearchbaseurl=https://mirrors.aliyun.com/docker-ce/linux/centos/7/$basearch/stableenabled=1gpgcheck=1gpgkey=https://mirrors.aliyun.com/docker-ce/linux/centos/gpg [docker-ce-stable-debuginfo]name=Docker CE Stable - Debuginfo $basearchbaseurl=https://mirrors.aliyun.com/docker-ce/linux/centos/7/debug-$basearch/stableenabled=0gpgcheck=1gpgkey=https://mirrors.aliyun.com/docker-ce/linux/centos/gpg [docker-ce-stable-source]name=Docker CE Stable - Sourcesbaseurl=https://mirrors.aliyun.com/docker-ce/linux/centos/7/source/stableenabled=0gpgcheck=1gpgkey=https://mirrors.aliyun.com/docker-ce/linux/centos/gpg [docker-ce-edge]name=Docker CE Edge - $basearchbaseurl=https://mirrors.aliyun.com/docker-ce/linux/centos/7/$basearch/edgeenabled=0gpgcheck=1gpgkey=https://mirrors.aliyun.com/docker-ce/linux/centos/gpg [docker-ce-edge-debuginfo]name=Docker CE Edge - Debuginfo $basearchbaseurl=https://mirrors.aliyun.com/docker-ce/linux/centos/7/debug-$basearch/edgeenabled=0gpgcheck=1gpgkey=https://mirrors.aliyun.com/docker-ce/linux/centos/gpg [docker-ce-edge-source]name=Docker CE Edge - Sourcesbaseurl=https://mirrors.aliyun.com/docker-ce/linux/centos/7/source/edgeenabled=0gpgcheck=1gpgkey=https://mirrors.aliyun.com/docker-ce/linux/centos/gpg [docker-ce-test]name=Docker CE Test - $basearchbaseurl=https://mirrors.aliyun.com/docker-ce/linux/centos/7/$basearch/testenabled=0gpgcheck=1gpgkey=https://mirrors.aliyun.com/docker-ce/linux/centos/gpg [docker-ce-test-debuginfo]name=Docker CE Test - Debuginfo $basearchbaseurl=https://mirrors.aliyun.com/docker-ce/linux/centos/7/debug-$basearch/testenabled=0gpgcheck=1gpgkey=https://mirrors.aliyun.com/docker-ce/linux/centos/gpg [docker-ce-test-source]name=Docker CE Test - Sourcesbaseurl=https://mirrors.aliyun.com/docker-ce/linux/centos/7/source/testenabled=0gpgcheck=1gpgkey=https://mirrors.aliyun.com/docker-ce/linux/centos/gpg [docker-ce-nightly]name=Docker CE Nightly - $basearchbaseurl=https://mirrors.aliyun.com/docker-ce/linux/centos/7/$basearch/nightlyenabled=0gpgcheck=1gpgkey=https://mirrors.aliyun.com/docker-ce/linux/centos/gpg [docker-ce-nightly-debuginfo]name=Docker CE Nightly - Debuginfo $basearchbaseurl=https://mirrors.aliyun.com/docker-ce/linux/centos/7/debug-$basearch/nightlyenabled=0gpgcheck=1gpgkey=https://mirrors.aliyun.com/docker-ce/linux/centos/gpg [docker-ce-nightly-source]name=Docker CE Nightly - Sourcesbaseurl=https://mirrors.aliyun.com/docker-ce/linux/centos/7/source/nightlyenabled=0gpgcheck=1gpgkey=https://mirrors.aliyun.com/docker-ce/linux/centos/gpg

#安装dockeryum install docker-ce -y   #启动dockersystemctl start docker   #设置docker为开机自启动systemctl enable docker#查看docker版本docker version     Version:  19.03.2  

cat /etc/docker/daemon.json    添加如下一行{"registry-mirrors": ["http://6e9e5b27.m.daocloud.io"]}#重启dockersystemctl daemon-reloadsystemctl restart docker.service这样我们就配置好了docker hub的加速器了，docker pull镜像的时候速度就会加快！

有两个证书文件xianchao.lucky.me.key      xianchao.lucky.me.pem

https://github.com/vmware/harbor

#下载地址https://github.com/goharbor/harbor/releases#下载方法curl -LO  'https://storage.googleapis.com/harbor-releases/harbor-offline-installer-v1.5.4.tgz'

#下载地址http://harbor.orientsoft.cn/cd /data/installwget 'http://harbor.orientsoft.cn/harbor-v1.4.0/harbor-offline-installer-v1.4.0.tgz'

tar zxvf harbor-offline-installer-v1.4.0.tgzcd harborcommon目录：存放模板配置ha目录：做harbor高可用的

cat harbor.cfghostname = xianchao.lucky.me#修改hostname，跟上面签发的证书域名保持一致ui_url_protocol = https#协议用httpsssl_cert = /data/ssl/xianchao.lucky.me.pemssl_cert_key = /data/ssl/xianchao.lucky.me.key邮件和ldap不需要配置，在harbor的web界面可以配置harbor默认的账号密码：admin/Harbor12345其他配置采用默认即可

yum install docker-compose -y

#官方安装文档说明：https://github.com/goharbor/harbor/blob/master/docs/installation_guide.md
./install.sh --with-notary --with-clair   #clair 开启镜像的漏洞扫描显示如下说明安装完成

✔ ----Harbor has been installed and started successfully.----
Now you should be able to visit the admin portal at https://xianchao.lucky.me. For more details, please visit https://github.com/vmware/harbor .

192.168.199.164   xianchao.lucky.me

在浏览器输入：https://xianchao.lucky.me出现如下界面，说明可以正常访问harbor

系统管理-->配置管理处修改如下项目创建：仅管理员允许自动注册：取消

所有基础镜像都会放在library里面，这是一个公开的镜像仓库公有项目下的镜像任何成员都能下载私有项目下的镜像需要添加对应的的成员才可以下载

docker pull  centos

docker tag centos:latest xianchao.lucky.me/library/centos:v1

docker login -u admin  xianchao.lucky.me密码：Harbor123

Login Succeeded

docker push xianchao.lucky.me/library/centos:v1

内容信任：仅允许部署通过认证的镜像，也就是需要给镜像签名阻止危险级别严重的镜像运行：如果镜像漏洞危险级别高，则阻止其拉取下载如果这个选项打开的话，需要对上传的镜像都做扫描，否则将阻止拉取下载

选中阻止潜在漏洞镜像   组织危险级别设置成严重选中自动扫描镜像

docker loginUsername: xianchaoPassword:1989*****

docker pull tomcat

docker tag tomcat  xianchao.lucky.me/library/tonmcat:v1

docker login xianchao.lucky.me

docker push xianchao.lucky.me/library/tonmcat:v1

docker rmi -f xianchao.lucky.me/library/tonmcat:v1

docker login xianchao.lucku.medocker pull xianchao.lucky.me/library/tonmcat:v1

Error response from daemon: unknown: Cannot get the image severity.

docker pull xianchao.lucky.me/library/tonmcat:v1

Error response from daemon: unknown: The severity of vulnerability of the image: "high" is equal or higher than the threshold in project setting: "high".

docker pull xianchao.lucky.me/library/tonmcat:v1