# 一、前提先安装好docker

安装k8s的1.19版本，该版本还支持docker
```js
export REGISTRY_MIRROR=https://registry.cn-hangzhou.aliyuncs.com
curl -sSL https://kuboard.cn/install-script/v1.19.x/install_kubelet.sh | sh -s 1.19.5
```

然后master节点执行以下命令
```js
export MASTER_IP=192.168.201.108

# 替换 apiserver.demo 为 您想要的 dnsName
export APISERVER_NAME=songxuan.com
# Kubernetes 容器组所在的网段，该网段安装完成后，由 kubernetes 创建，事先并不存在于您的物理网络中
export POD_SUBNET=10.100.0.1/16
echo "${MASTER_IP}    ${APISERVER_NAME}" >> /etc/hosts
curl -sSL https://kuboard.cn/install-script/v1.19.x/init_master.sh | sh -s 1.19.5
```

如果拉取镜像不下来，配置docker加速地址

![image.png](/static/img/aa2563295fc736db9555f092b04163cc.image.webp)


```js
vi /etc/docker/daemon.json

```

```js
{
    "registry-mirrors": [
        "https://docker.m.daocloud.io",
        "https://docker.1panel.live",
        "https://hub.rat.dev"
    ]
}
```
```js
systemctl daemon-reload
systemctl restart docker
```
![image.png](/static/img/06b8550c274187583e649fd5618f25d7.image.webp)

# 二、在主节点生成token让node节点加入
主节点执行
```js
kubeadm token create --print-join-command
```
获取到的加入节点token
![image.png](/static/img/59b3589df4e23ebb2247e499b5511c18.image.webp)


工作节点执行

```js
# 只在 worker 节点执行
# 替换 x.x.x.x 为 master 节点的内网 IP
export MASTER_IP=192.168.201.108
# 替换 apiserver.demo 为初始化 master 节点时所使用的 APISERVER_NAME
export APISERVER_NAME=songxuan.com
echo "${MASTER_IP}    ${APISERVER_NAME}" >> /etc/hosts

# 替换为 master 节点上 kubeadm token create 命令的输出
kubeadm join songxuan.com:6443 --token pwvmg4.1ismiw5mrztxkufm     --discovery-token-ca-cert-hash sha256:58ce169877173dbe41dce9ac563955d8561916bc87ebc3b905b7bc38af6b7ad7
```

最后完成k8s的安装
![image.png](/static/img/39b5a81795a5f5234ace076bbdf037e6.image.webp)


# 三、安装Kuboard图形化界面

Kuboard地址：https://www.kuboard.cn/install/v3/install-in-k8s.html#%E6%96%B9%E6%B3%95%E4%B8%80-%E4%BD%BF%E7%94%A8-hostpath-%E6%8F%90%E4%BE%9B%E6%8C%81%E4%B9%85%E5%8C%96

```js
kubectl apply -f https://addons.kuboard.cn/kuboard/kuboard-v3.yaml
```

在浏览器中打开链接 http://IP:30080

输入初始用户名和密码，并登录

用户名： admin
密码： Kuboard123


![image.png](/static/img/f1cdaa5fd805c03a72e08dc9925b723b.image.webp)

13.整合K8S-安装K8S和K8S图形化界面

# 一、下载插件

![image.png](/static/img/2e3d284e3aad2ccdf57053b44b7d7c6a.image.webp)

然后去钉钉添加机器人
![image.png](/static/img/0aabd322b74d280179dd3b925cb2cb6c.image.webp)

![image.png](/static/img/a66a9ca6c4b7b09a2ab56b405e37252d.image.webp)

![image.png](/static/img/96faa845d04f4fc88cab2e76009360b5.image.webp)

![image.png](/static/img/f8215b459b65986af3c30a84356e7276.image.webp)

复制下来
![image.png](/static/img/b2fbc34ca294c49f39a5d58937c47fc2.image.webp)

```js
https://oapi.dingtalk.com/robot/send?access_token=f1888f239560668660d65047a4c8079ceba05e96c07c6a3f7686f6875b602839
```

# 二、Jenkins配置钉钉
![image.png](/static/img/e9fe745d1fdb8ca09ed28bed211ec273.image.webp)


![image.png](/static/img/822c1c658bab1e4bb546a3dfea8df317.image.webp)


然后去gitlab仓库的jenkins文件添加代码

![image.png](/static/img/06f99d8b97bda414d6b1d9bff83e9d4c.image.webp)
```js
pipeline {
    agent any
    
    stages {
        stage('1.拉取git仓库代码') {
            steps {
                checkout scmGit(branches: [[name: '${tag}']], extensions: [], userRemoteConfigs: [[credentialsId: '41ccb3f5-d95e-4f7c-94cd-8af30c885e0d', url: 'http://192.168.201.105:8929/root/mytest1.git']])
            }
        }
        
        stage('2.通过Maven构建项目') {
            steps {
                sh '/var/jenkins_home/maven/bin/mvn  clean package -DskipTests'
            }
        }
        
        stage('3.质量代码检测') {
            steps {
                sh '/var/jenkins_home/sonar-scanner-4.8.0.2856-linux/bin/sonar-scanner  -Dsonar.sources=./  -Dsonar.projectname=${JOB_NAME}  -Dsonar.projectKey=${JOB_NAME}   -Dsonar.java.binaries=./target/  -Dsonar.login=178e1842a7318cabd37749b7f2f5a5b88a5fb997'            
                }
        }
        
        stage('4.Docker制作镜像') {
            steps {
                sh '''cp -rf  ./target/*.jar ./docker/
docker build -t ${JOB_NAME}:${tag} ./docker/'''
            }
        }
        
        stage('5.自定义镜像推送Harbor') {
            steps {
               sh '''docker login 192.168.201.107:80 -u admin -p 123456
docker tag ${JOB_NAME}:${tag} 192.168.201.107:80/${JOB_NAME}/${JOB_NAME}:${tag}
docker push  192.168.201.107:80/${JOB_NAME}/${JOB_NAME}:${tag}'''
            }
        }
        
        stage('6.通知目标服务器拉取镜像启动') {
            steps {
                sshPublisher(publishers: [sshPublisherDesc(configName: '测试本机服务器', transfers: [sshTransfer(cleanRemote: false, excludes: '', execCommand: "jiaoben.sh 192.168.201.107:80 mytest1test ${JOB_NAME} $tag  $host_port $port", execTimeout: 120000, flatten: false, makeEmptyDirs: false, noDefaultExcludes: false, patternSeparator: '[, ]+', remoteDirectory: '', remoteDirectorySDF: false, removePrefix: '', sourceFiles: '')], usePromotionTimestamp: false, useWorkspaceInPromotion: false, verbose: false)])
            }
        }
    }




post {
    success {
        dingtalk (
            robot: 'jenkins-dingding',
            type: 'MARKDOWN',
            title: "构建成功: ${env.JOB_NAME}",
            text: [
                "### 项目: ${env.JOB_NAME}",
                "### 版本: ${tag}",
                "### 构建结果: SUCCESS",
                "### 持续时间: ${currentBuild.durationString}"
                
                
            ],
            at: []
        )
    }
    failure {
        dingtalk (
            robot: 'jenkins-dingding',
            type: 'MARKDOWN',
            title: "构建失败: ${env.JOB_NAME}",
            text: [
                "### 项目: ${env.JOB_NAME}",
                "### 版本: ${tag}",
                "### 构建结果: FAILURE",
                "### 持续时间: ${currentBuild.durationString}",               
                "**失败原因:**",
                "${currentBuild.currentResult}"
            ],
            atAll: true
        )
    }
}


} 
```
执行完成Jenkins流水线任务后，成功通知钉钉机器人
![image.png](/static/img/d871579affb0cfd83bafe6a00a9a3eec.image.webp)


12.构建后进行钉钉通知

# 一、Jenkins创建任务

![image.png](/static/img/8634b05f803f9bd7222596b1abb6490d.image.webp)

选择一个列子测试
![image.png](/static/img/56b84c1288c0f7195ec254186c0e4ae6.image.webp)
执行流水线后可以看到，输出了hello的列子
![image.png](/static/img/bc66f82d5b4e398e7c9ed716631bbd0a.image.webp)



```js
pipeline {
    agent any
    
    stages {
        stage('1.拉取git仓库代码') {
            steps {
                echo '拉取git仓库代码成功'
            }
        }
        
        stage('2.通过Maven构建项目') {
            steps {
                echo '通过Maven构建项目成功'
            }
        }
        
        stage('3.质量代码检测') {
            steps {
                echo '质量代码检测成功'
            }
        }
        
        stage('4.Docker制作镜像') {
            steps {
                echo 'docker制作镜像成功'
            }
        }
        
        stage('5.自定义镜像推送Harbor') {
            steps {
                echo '自定义镜像推送Harbor成功'
            }
        }
        
        stage('6.通知目标服务器拉取镜像启动') {
            steps {
                echo '通知目标服务器拉取镜像启动成功'
            }
        }
    }
}

```

# 二、流水线语法生成

![image.png](/static/img/adbbe2006a2fd8eb90e04b7cb44544d2.image.webp)

![image.png](/static/img/50c26594d15a1cd9aa88b1f15268cbf4.image.webp)



![image.png](/static/img/ab35372f376063847e9bb8502464cef9.image.webp)

最后吧git仓库生成的代码粘贴但这里就行了
![image.png](/static/img/935c3293f2d4c24dcbaad772b3541bae.image.webp)



# 二、但这种方式在配置代码里面改太麻烦，直接使用GIT仓库的形式进行



![image.png](/static/img/f916749e87296e78e21f249a91f2560c.image.webp)

添加一个名为Jenkinsfile的文件
![image.png](/static/img/35b2ca3879cba74b8f18da1a8335368c.image.webp)

然后回到Jenkins更改方式，把gitlab仓库地址填上
![image.png](/static/img/dbec8aed4e1d5730ae89199a6dd2ea46.image.webp)

然后tag标签版本控制也添加上

![image.png](/static/img/6d153767fa077b9836321f6a4fb0d571.image.webp)

gitlab这里改成变量的tag控制版本

![image.png](/static/img/146a3e9972b3963b464330e69f7b305f.image.webp)




# 三、maven编译构建

![image.png](/static/img/93cac7b62ec562cf298607f1ae1865aa.image.webp)

生成脚本
![image.png](/static/img/e3139774958463aebea4e9f1380864ed.image.webp)

然后放到gitlab的Jenkinsfile中
```js
sh '/var/jenkins_home/maven/bin/mvn  clean package -DskipTests'
```

![image.png](/static/img/acd55b3975601bab3553ad8ebc943d22.image.webp)



# 四、质量代码的检测

```js
/var/jenkins_home/sonar-scanner-4.8.0.2856-linux/bin/sonar-scanner  -Dsonar.sources=./  -Dsonar.projectname=${JOB_NAME}  -Dsonar.projectKey=${JOB_NAME}   -Dsonar.java.binaries=./target/  -Dsonar.login=178e1842a7318cabd37749b7f2f5a5b88a5fb997
```

![image.png](/static/img/55f3461aeec9b90f81c8454a3ccdb6cc.image.webp)

```js
sh '/var/jenkins_home/sonar-scanner-4.8.0.2856-linux/bin/sonar-scanner  -Dsonar.sources=./  -Dsonar.projectname=${JOB_NAME}  -Dsonar.projectKey=${JOB_NAME}   -Dsonar.java.binaries=./target/  -Dsonar.login=178e1842a7318cabd37749b7f2f5a5b88a5fb997'
```



![image.png](/static/img/8f5c2b0743a1948c980fdd0b1362c1be.image.webp)

![image.png](/static/img/12b90fdf1a29d48a5d4761d913a74364.image.webp)

# 五、构建docker镜像

```js
cp -rf  ./target/*.jar ./docker/
docker build -t ${JOB_NAME}:${tag} ./docker/
```

![image.png](/static/img/aa87018b35ebcbe93cdcfac679d52511.image.webp)


```js
sh '''cp -rf  ./target/*.jar ./docker/
docker build -t ${JOB_NAME}:${tag} ./docker/'''
```


![image.png](/static/img/6c0f89edd08107602385c37d550c1510.image.webp)


# 六、推送镜像到Harbor

```js
sh '''docker login 192.168.201.107:80 -u admin -p 123456
docker tag ${JOB_NAME}:${tag} 192.168.201.107:80/${JOB_NAME}/${JOB_NAME}:${tag}
docker push  192.168.201.107:80/${JOB_NAME}/${JOB_NAME}:${tag}'''
```

![image.png](/static/img/9062bc7330446b44f1c71af139d71cc8.image.webp)
已成功推送到Harbor仓库，注意的是，前提要创建好这个仓库

![image.png](/static/img/b3a137ee3e6c2f83a187c0bd9ae006ad.image.webp)

# 七、连接目标服务器拉取镜像进行启动
配置好端口的变量


![image.png](/static/img/9995be6b052a513e1678d0e6b5123368.image.webp)
```js
jiaoben.sh 192.168.201.107:80 mytest1test ${JOB_NAME} $tag  $host_port $port
```


```js
sshPublisher(publishers: [sshPublisherDesc(configName: '测试本机服务器', transfers: [sshTransfer(cleanRemote: false, excludes: '', execCommand: "jiaoben.sh 192.168.201.107:80 mytest1test ${JOB_NAME} $tag  $host_port $port", execTimeout: 120000, flatten: false, makeEmptyDirs: false, noDefaultExcludes: false, patternSeparator: '[, ]+', remoteDirectory: '', remoteDirectorySDF: false, removePrefix: '', sourceFiles: '')], usePromotionTimestamp: false, useWorkspaceInPromotion: false, verbose: false)])
```
![image.png](/static/img/cb842789add9a2f449e5612cc34507b2.image.webp)

注意变量在gitlab仓库那边要改成双引号
![image.png](/static/img/2a135690c39c48fb2128633b721466e5.image.webp)


最后完成整个pipeline的CI/CD流程

![image.png](/static/img/d5ea20fee9453d2020f85767a911c6bf.image.webp)

![image.png](/static/img/49c06808e3cc714b71a9273785a8ac94.image.webp)

11.pipeline-构建一个自由风格的流水线

# 一、在目标服务器编写一个脚本
![](https://songxuan.vip/static/img/7c025c8189c32e81e2c32a700a843cc2.image.webp)

```sh
harbor_url=$1
harbor_project_name=$2
project_name=$3
tag=$4
host_port=$5
port=$6

imageName=$harbor_url/$harbor_project_name/$project_name:$tag

containerId=`docker ps -a | grep ${project_name} | awk '{print $1}'`
if [ "$containerId" != "" ] ; then
    docker stop $containerId
    docker rm $containerId
    echo "Delete Container Success"
fi

imageId=`docker images | grep ${project_name} | awk '{print $3}'`

if [ "$imageId" != "" ] ; then
    docker rmi -f $imageId
    echo "Delete Image Success"
fi

docker login -u DevOps -p P@ssw0rd $harbor_url

docker pull $imageName

docker run -d -p $host_port:$port --name $project_name $imageName

echo "Start Container Success"
echo $project_name

```
移动到该路径下随时可以执行
```js
mv  jiaoben.sh  /usr/bin/
```
测试脚本是否能正常启动
```js
sh jiaoben.sh 192.168.201.107:80 mytest1 mytest1 V6.0.0 8081 8080
```





# 二、配置Jenkins


![image.png](/static/img/24dab7566f46fb41d802961a6da10151.image.webp)


![image.png](/static/img/d65030881f0033e6c6e0c7e5eb8caaef.image.webp)


```js
jiaoben.sh 192.168.201.107:80 mytest1 ${JOB_NAME} $tag $host_port  $port
```

![image.png](/static/img/8ca1b30b00de4189c6fad83a7976f390.image.webp)

然后添加容器内端口
![image.png](/static/img/c08c7aeb7c86af65ec807c3b6095a9ce.image.webp)

![image.png](/static/img/a24a85309671ee13986634d03b9e2b68.image.webp)




Jenkins加一个宿主机端口

![image.png](/static/img/d8d70207edc38cfc9d607ba59f38330b.image.webp)


![image.png](/static/img/2c487e9c2de38be383421aa7b9cd9923.image.webp)

```js
jiaoben.sh 192.168.201.107:80 mytest1 ${JOB_NAME} $tag  $host_port $port
```
最后完成整个devops的流程

![image.png](/static/img/1d4cf0a3096ef5f91dc3015331b564ca.image.webp)

10.在目标服务器完成自动拉取部署

# 一、Harbor安装
再新建一台虚拟机作为Harbor的安装部署：192.168.201.107

Harbor下载官网：https://github.com/goharbor/harbor/releases/tag/v2.14.0

![image.png](/static/img/7fcbf223d2ab614f2ca3c6f6dc34b169.image.webp)

```js
tar -zxvf harbor-offline-installer-v2.14.0.tgz
```

## 然后进入文件目录，修改配置文件

```js
cp harbor.yml.tmpl harbor.yml
vim harbor.yml
```


```yml
# Configuration file of Harbor

# The IP address or hostname to access admin UI and registry service.
# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
hostname: 192.168.201.107

# http related config
http:
  # port for http, default is 80. If https enabled, this port will redirect to https port
  port: 80

# https related config
#https:
  # https port for harbor, default is 443
 # port: 443
  # The path of cert and key files for nginx
  #certificate: /your/certificate/path
 # private_key: /your/private/key/path
  # enable strong ssl ciphers (default: false)
  # strong_ssl_ciphers: false

# # Harbor will set ipv4 enabled only by default if this block is not configured
# # Otherwise, please uncomment this block to configure your own ip_family stacks
# ip_family:
#   # ipv6Enabled set to true if ipv6 is enabled in docker network, currently it affected the nginx related component
#   ipv6:
#     enabled: false
#   # ipv4Enabled set to true by default, currently it affected the nginx related component
#   ipv4:
#     enabled: true

# # Uncomment following will enable tls communication between all harbor components
# internal_tls:
#   # set enabled to true means internal tls is enabled
#   enabled: true
#   # put your cert and key files on dir
#   dir: /etc/harbor/tls/internal


# Uncomment external_url if you want to enable external proxy
# And when it enabled the hostname will no longer used
# external_url: https://reg.mydomain.com:8433

# The initial password of Harbor admin
# It only works in first time to install harbor
# Remember Change the admin password from UI after launching Harbor.
harbor_admin_password: 123456

# Harbor DB configuration
database:
  # The password for the user('postgres' by default) of Harbor DB. Change this before any production use.
  password: root123
  # The maximum number of connections in the idle connection pool. If it <=0, no idle connections are retained.
  max_idle_conns: 100
  # The maximum number of open connections to the database. If it <= 0, then there is no limit on the number of open connections.
  # Note: the default number of connections is 1024 for postgres of harbor.
  max_open_conns: 900
  # The maximum amount of time a connection may be reused. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's age.
  # The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
  conn_max_lifetime: 5m
  # The maximum amount of time a connection may be idle. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's idle time.
  # The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
  conn_max_idle_time: 0

# The default data volume
data_volume: /data

# Harbor Storage settings by default is using /data dir on local filesystem
# Uncomment storage_service setting If you want to using external storage
# storage_service:
#   # ca_bundle is the path to the custom root ca certificate, which will be injected into the truststore
#   # of registry's containers.  This is usually needed when the user hosts a internal storage with self signed certificate.
#   ca_bundle:

#   # storage backend, default is filesystem, options include filesystem, azure, gcs, s3, swift and oss
#   # for more info about this configuration please refer https://distribution.github.io/distribution/about/configuration/
#   # and https://distribution.github.io/distribution/storage-drivers/
#   filesystem:
#     maxthreads: 100
#   # set disable to true when you want to disable registry redirect
#   redirect:
#     disable: false

# Trivy configuration
#
# Trivy DB contains vulnerability information from NVD, Red Hat, and many other upstream vulnerability databases.
# It is downloaded by Trivy from the GitHub release page https://github.com/aquasecurity/trivy-db/releases and cached
# in the local file system. In addition, the database contains the update timestamp so Trivy can detect whether it
# should download a newer version from the Internet or use the cached one. Currently, the database is updated every
# 12 hours and published as a new release to GitHub.
trivy:
  # ignoreUnfixed The flag to display only fixed vulnerabilities
  ignore_unfixed: false
  # skipUpdate The flag to enable or disable Trivy DB downloads from GitHub
  #
  # You might want to enable this flag in test or CI/CD environments to avoid GitHub rate limiting issues.
  # If the flag is enabled you have to download the `trivy-offline.tar.gz` archive manually, extract `trivy.db` and
  # `metadata.json` files and mount them in the `/home/scanner/.cache/trivy/db` path.
  skip_update: false
  #
  # skipJavaDBUpdate If the flag is enabled you have to manually download the `trivy-java.db` file and mount it in the
  # `/home/scanner/.cache/trivy/java-db/trivy-java.db` path
  skip_java_db_update: false
  #
  # The offline_scan option prevents Trivy from sending API requests to identify dependencies.
  # Scanning JAR files and pom.xml may require Internet access for better detection, but this option tries to avoid it.
  # For example, the offline mode will not try to resolve transitive dependencies in pom.xml when the dependency doesn't
  # exist in the local repositories. It means a number of detected vulnerabilities might be fewer in offline mode.
  # It would work if all the dependencies are in local.
  # This option doesn't affect DB download. You need to specify "skip-update" as well as "offline-scan" in an air-gapped environment.
  offline_scan: false
  #
  # Comma-separated list of what security issues to detect. Possible values are `vuln`, `config` and `secret`. Defaults to `vuln`.
  security_check: vuln
  #
  # insecure The flag to skip verifying registry certificate
  insecure: false
  #
  # timeout The duration to wait for scan completion.
  # There is upper bound of 30 minutes defined in scan job. So if this `timeout` is larger than 30m0s, it will also timeout at 30m0s.
  timeout: 5m0s
  #
  # github_token The GitHub access token to download Trivy DB
  #
  # Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough
  # for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000
  # requests per hour by specifying the GitHub access token. For more details on GitHub rate limiting please consult
  # https://docs.github.com/rest/overview/resources-in-the-rest-api#rate-limiting
  #
  # You can create a GitHub token by following the instructions in
  # https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line
  #
  # github_token: xxx

jobservice:
  # Maximum number of job workers in job service
  max_job_workers: 10
  # Maximum hours of task duration in job service, default 24
  max_job_duration_hours: 24
  # The jobLoggers backend name, only support "STD_OUTPUT", "FILE" and/or "DB"
  job_loggers:
    - STD_OUTPUT
    - FILE
    # - DB
  # The jobLogger sweeper duration (ignored if `jobLogger` is `stdout`)
  logger_sweeper_duration: 1 #days

notification:
  # Maximum retry count for webhook job
  webhook_job_max_retry: 3
  # HTTP client timeout for webhook job
  webhook_job_http_client_timeout: 3 #seconds

# Log configurations
log:
  # options are debug, info, warning, error, fatal
  level: info
  # configs for logs in local storage
  local:
    # Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.
    rotate_count: 50
    # Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes.
    # If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G
    # are all valid.
    rotate_size: 200M
    # The directory on your host that store log
    location: /var/log/harbor

  # Uncomment following lines to enable external syslog endpoint.
  # external_endpoint:
  #   # protocol used to transmit log to external endpoint, options is tcp or udp
  #   protocol: tcp
  #   # The host of external endpoint
  #   host: localhost
  #   # Port of external endpoint
  #   port: 5140

#This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY!
_version: 2.14.0

# Uncomment external_database if using external database.
# external_database:
#   harbor:
#     host: harbor_db_host
#     port: harbor_db_port
#     db_name: harbor_db_name
#     username: harbor_db_username
#     password: harbor_db_password
#     ssl_mode: disable
#     max_idle_conns: 2
#     max_open_conns: 0

# Uncomment redis if need to customize redis db
# redis:
#   # db_index 0 is for core, it's unchangeable
#   # registry_db_index: 1
#   # jobservice_db_index: 2
#   # trivy_db_index: 5
#   # it's optional, the db for harbor business misc, by default is 0, uncomment it if you want to change it.
#   # harbor_db_index: 6
#   # it's optional, the db for harbor cache layer, by default is 0, uncomment it if you want to change it.
#   # cache_layer_db_index: 7

# Uncomment external_redis if using external Redis server
# external_redis:
#   # support redis, redis+sentinel
#   # host for redis: <host_redis>:<port_redis>
#   # host for redis+sentinel:
#   #  <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
#   host: redis:6379
#   password:
#   # Redis AUTH command was extended in Redis 6, it is possible to use it in the two-arguments AUTH <username> <password> form.
#   # there's a known issue when using external redis username ref:https://github.com/goharbor/harbor/issues/18892
#   # if you care about the image pull/push performance, please refer to this https://github.com/goharbor/harbor/wiki/Harbor-FAQs#external-redis-username-password-usage
#   # username:
#   # sentinel_master_set must be set to support redis+sentinel
#   #sentinel_master_set:
#   # tls configuration for redis connection
#   # only server-authentication is supported
#   # mtls for redis connection is not supported
#   # tls connection will be disable by default
#   tlsOptions:
#     enable: false
#   # if it is a self-signed ca, please set the ca path specifically.
#     rootCA:
#   # db_index 0 is for core, it's unchangeable
#   registry_db_index: 1
#   jobservice_db_index: 2
#   trivy_db_index: 5
#   idle_timeout_seconds: 30
#   # it's optional, the db for harbor business misc, by default is 0, uncomment it if you want to change it.
#   # harbor_db_index: 6
#   # it's optional, the db for harbor cache layer, by default is 0, uncomment it if you want to change it.
#   # cache_layer_db_index: 7

# Uncomment uaa for trusting the certificate of uaa instance that is hosted via self-signed cert.
# uaa:
#   ca_file: /path/to/ca

# Global proxy
# Config http proxy for components, e.g. http://my.proxy.com:3128
# Components doesn't need to connect to each others via http proxy.
# Remove component from `components` array if want disable proxy
# for it. If you want use proxy for replication, MUST enable proxy
# for core and jobservice, and set `http_proxy` and `https_proxy`.
# Add domain to the `no_proxy` field, when you want disable proxy
# for some special registry.
proxy:
  http_proxy:
  https_proxy:
  no_proxy:
  components:
    - core
    - jobservice
    - trivy

# metric:
#   enabled: false
#   port: 9090
#   path: /metrics

# Trace related config
# only can enable one trace provider(jaeger or otel) at the same time,
# and when using jaeger as provider, can only enable it with agent mode or collector mode.
# if using jaeger collector mode, uncomment endpoint and uncomment username, password if needed
# if using jaeger agetn mode uncomment agent_host and agent_port
# trace:
#   enabled: true
#   # set sample_rate to 1 if you wanna sampling 100% of trace data; set 0.5 if you wanna sampling 50% of trace data, and so forth
#   sample_rate: 1
#   # # namespace used to differentiate different harbor services
#   # namespace:
#   # # attributes is a key value dict contains user defined attributes used to initialize trace provider
#   # attributes:
#   #   application: harbor
#   # # jaeger should be 1.26 or newer.
#   # jaeger:
#   #   endpoint: http://hostname:14268/api/traces
#   #   username:
#   #   password:
#   #   agent_host: hostname
#   #   # export trace data by jaeger.thrift in compact mode
#   #   agent_port: 6831
#   # otel:
#   #   endpoint: hostname:4318
#   #   url_path: /v1/traces
#   #   compression: false
#   #   insecure: true
#   #   # timeout is in seconds
#   #   timeout: 10

# Enable purge _upload directories
upload_purging:
  enabled: true
  # remove files in _upload directories which exist for a period of time, default is one week.
  age: 168h
  # the interval of the purge operations
  interval: 24h
  dryrun: false

# Cache layer configurations
# If this feature enabled, harbor will cache the resource
# `project/project_metadata/repository/artifact/manifest` in the redis
# which can especially help to improve the performance of high concurrent
# manifest pulling.
# NOTICE
# If you are deploying Harbor in HA mode, make sure that all the harbor
# instances have the same behaviour, all with caching enabled or disabled,
# otherwise it can lead to potential data inconsistency.
cache:
  # not enabled by default
  enabled: false
  # keep cache for one day by default
  expire_hours: 24

# Harbor core configurations
# Uncomment to enable the following harbor core related configuration items.
# core:
#   # The provider for updating project quota(usage), there are 2 options, redis or db,
#   # by default is implemented by db but you can switch the updation via redis which
#   # can improve the performance of high concurrent pushing to the same project,
#   # and reduce the database connections spike and occupies.
#   # By redis will bring up some delay for quota usage updation for display, so only
#   # suggest switch provider to redis if you were ran into the db connections spike around
#   # the scenario of high concurrent pushing to same project, no improvement for other scenes.
#   quota_update_provider: redis # Or db

```
## 然后执行安装脚本

```js
sh install.sh
```

![image.png](/static/img/2dc5fac03d953d807d6f0f0ff8223d59.image.webp)

# 二、Harbor使用
创建一个项目

![image.png](/static/img/e5a8ba7e501d62c6468cb3d2ed18d3c4.image.webp)

拉取下harbor的镜像
```js
docker pull harbor的地址/项目名/镜像名称:版本
```
配置好harbor的镜像源地址

```js
vi /etc/docker/daemon.json
```
每台机器都配置上
```js
{
  "insecure-registries": ["192.168.201.107:80"],
  "registry-mirrors": [
    "https://w14ki3ju.mirror.aliyuncs.com",
    "https://registry.docker-cn.com",
    "https://docker.m.daocloud.io"
  ]
}
```
修改完成后，关闭harbor服务器后再重启docker

```js
docker-compose down
```
```js
systemctl restart docker
```


# 三、手动测试上传一个镜像到harbor
先给镜像加一个标识

```js
docker tag 0d93d97a7fee  192.168.201.107:80/mytest1/mytest1:v5.0
# 格式应为：<仓库地址>:<端口>/<项目名称>/<镜像名称>:<标签>
```

![image.png](/static/img/e92c267268b07058b086f674e97e269d.image.webp)



## 上传镜像到harbor

```js
docker push  192.168.201.107:80/mytest1/mytest1:v5.0
```
发现没有权限，需要先登录
![image.png](/static/img/9ce22063a44539abe122a12a0c6e3c23.image.webp)


```js
docker login 192.168.201.107:80 -u 用户名 -p 密码
```

![image.png](/static/img/d6ebd9d203ad3ca1407aae5d4b70cf68.image.webp)

登录后重新再执行一次命令，已经成功上传


![image.png](/static/img/2a414a258397e4ae35f1cdf2fef21825.image.webp)

![image.png](/static/img/20174e91e35a4b8a029c4ee873bdbd8d.image.webp)


尝试去harbor拉取镜像

```js
docker pull 192.168.201.107:80/mytest1/mytest1:v5.0
```