[Docker] Harbor HTTPS ๊ตฌ์„ฑ์œผ๋กœ ๊ตฌ์ถ•ํ•˜๊ธฐ

2023. 2. 6. 14:54ยทCloud Engineering/Docker ๐Ÿณ
๋ชฉ์ฐจ
  1.  
  2. 1. Harbor  ์„ค์น˜ 
  3.  
  4. 2. docker compose ์„ค์น˜ 
  5. Harbor ์‚ฌ์šฉํ•˜๊ธฐ (https)
  6. registry.example.com ์ด๋ผ๋Š” ๋„๋ฉ”์ธ์œผ๋กœ ๊ตฌ์„ฑํ•ด๋ณด๊ธฐ
  7. CA ์ธ์ฆ์„œ ์ƒ์„ฑํ•˜๊ธฐ 
728x90

 

1. Harbor  ์„ค์น˜ 

https://github.com/goharbor/harbor

 

GitHub - goharbor/harbor: An open source trusted cloud native registry project that stores, signs, and scans content.

An open source trusted cloud native registry project that stores, signs, and scans content. - GitHub - goharbor/harbor: An open source trusted cloud native registry project that stores, signs, and ...

github.com

์›ํ•˜๋Š” ๋ฆด๋ฆฌ์ฆˆ ๋ฒ„์ „ ํŒŒ์ผ์˜ ๋งํฌ๋ฅผ ๋ณต์‚ฌํ•œ๋‹ค. 

๋ฆด๋ฆฌ์ฆˆ๋ฅผ ๋ˆ„๋ฅด๋ฉด ์—ฌ๋Ÿฌ ๋ฐฐํฌ ๋ฒ„์ „์„ ๋ณผ ์ˆ˜ ์žˆ๋‹ค. ๊ทธ์ค‘ offline ๋‹ค์šด๋กœ๋“œ ๋ฒ„์ „์„ ์„ค์น˜ํ•œ๋‹ค.  (wifi ๋Š๊ฒจ๋„ ์„ค์น˜๊ฐ€ ์ž˜ ๋  ์ˆ˜ ์žˆ๋„๋ก)

์˜ˆ์‹œ) 

wget https://github.com/goharbor/harbor/releases/download/v2.7.0/harbor-offline-installer-v2.7.0.tgz

์••์ถ• ํ•ด์ œ 

tar zxvf harbor-offline-installer-v2.7.0.tgz.1

์••์ถ•์„ ํ’€๋ฉด harbor ๋””๋ ‰ํ† ๋ฆฌ๊ฐ€ ์ƒ๊ธด๋‹ค. 

harbor ๋””๋ ‰ํ† ๋ฆฌ ๋‚ด์—์„œ ์„ค์ •ํŒŒ์ผ ํ…œํ”Œ๋ฆฟ์„ ๋ณต์‚ฌํ•ด์„œ ์‚ฌ์šฉํ•œ๋‹ค. 

cp harbor.yml.tmpl harbor.yml

 

2. docker compose ์„ค์น˜ 

 

curl -L "https://github.com/docker/compose/releases/download/v2.15.1/docker-compose-linux-x86_64"



์‹คํ–‰ ๊ถŒํ•œ์„ ๋ถ€์—ฌํ•œ๋‹ค

[user@localhost ~]$ sudo chmod a+x /usr/bin/docker-compose
[user@localhost ~]$ ls -l /usr/bin/docker-compose
-rwxr-xr-x. 1 root root 44953600 Feb  6 11:17 /usr/bin/docker-compose

๋ฒ„์ „ ํ™•์ธํ•˜๊ธฐ 

[user@localhost ~]$ docker-compose --version
Docker Compose version v2.15.1

 

 

Harbor ์‚ฌ์šฉํ•˜๊ธฐ (https)

registry.example.com ์ด๋ผ๋Š” ๋„๋ฉ”์ธ์œผ๋กœ ๊ตฌ์„ฑํ•ด๋ณด๊ธฐ

์šฐ์„  ์„ค์ •์‚ฌํ•ญ์„ ๋ณ€๊ฒฝํ•˜๊ธฐ ์ด์ „์— ์ปจํ…Œ์ด๋„ˆ๋ฅผ ์ข…๋ฃŒ์‹œํ‚จ๋‹ค.

docker-compose down

harbor.yml ํŒŒ์ผ์—์„œ hostname ์„ ๋ณ€๊ฒฝํ•œ๋‹ค 

hostname: registry.example.com

/etc/hosts ํŒŒ์ผ์— ํ˜„์žฌ ์„œ๋ฒ„์˜ ip ์™€ ๋„๋ฉ”์ธ ์ด๋ฆ„์„ ์ถ”๊ฐ€ํ•ด์ค€๋‹ค (์›๋ž˜๋Š” DNS ์„œ๋ฒ„๊ฐ€ ํ•„์š”ํ•˜๊ฒ ์ง€๋งŒ ์ž„์˜๋กœ ํ…Œ์ŠคํŠธํ•˜๊ธฐ ์œ„ํ•ด์„œ ๋ฐ”๋กœ ์จ์ค€๋‹ค. )

192.168.56.110 registry.example.com

CA ์ธ์ฆ์„œ ์ƒ์„ฑํ•˜๊ธฐ 

1)  CA ์ธ์ฆ์„œ Private Key ์ƒ์„ฑ

$ openssl genrsa -out ca.key 4096

2) CA ์ธ์ฆ์„œ ๋ฐœ๊ธ‰

$ openssl req -x509 -new -nodes -sha512 -days 3650 \
-subj "/C=KR/ST=Seoul/L=Gangnam/O=example/OU=infra/CN=registry.example.com" \
-key ca.key \
-out ca.crt

3) ์„œ๋ฒ„ Private Key ์ƒ์„ฑ

$ openssl genrsa -out registry.example.com.key 4096

 

4) ์„œ๋ฒ„ ํ˜ธ์ŠคํŠธ ์ธ์ฆ์„œ ๋ฐœ๊ธ‰์„ ์œ„ํ•œ CSR ์ƒ์„ฑ

$ openssl req -sha512 -new \
-subj "/C=KR/ST=Seoul/L=Gangnam/O=example/OU=infra/CN=registry.example.com" \
-key registry.example.com.key \
-out registry.example.com.csr

CA ์—์„œ ์ง์ ‘ ์ธ์ฆ์„œ๋ฅผ ๋ฐœ๊ธ‰๋ฐ›๋Š” ๊ฒƒ์ด ์•„๋‹ˆ๋ผ ์ž„์˜๋กœ ๊ฐœ์ธ ์ธ์ฆ์„œ๋ฅผ ๋ฐœ๊ธ‰ํ•˜๋ฏ€๋กœ v3.ext ํŒŒ์ผ์„ ์ž‘์„ฑํ•ด์ฃผ์–ด์•ผ ํ•œ๋‹ค. 

$ vim v3.ext

ํŒŒ์ผ ๋‚ด์— ์•ˆ์˜ ๋‚ด์šฉ์„ ์จ์ค€๋‹ค. 

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=registry.example.com
DNS.2=example
DNS.3=registry

์„œ๋ฒ„ ์ธ์ฆ์„œ๋ฅผ ๋ฐœ๊ธ‰ํ•œ๋‹ค. 

$ openssl x509 -req -sha512 -days 365 \
-extfile v3.ext \
-CA ca.crt -CAkey ca.key -CAcreateserial \
-in registry.example.com.csr \
-out registry.example.com.crt

 

๋„์ปค ๋ฐ๋ชฌ์— CA ์ธ์ฆ์„œ ์ ์šฉ

์„œ๋ฒ„ ์ธ์ฆ์„œ ๋ณ€ํ™˜ 

openssl x509 -inform PEM -in registry.example.com.crt -out registry.example.com.cert

Docker์— ์ธ์ฆ์„œ ์ ์šฉ์„ ์œ„ํ•œ ๋””๋ ‰ํ„ฐ๋ฆฌ ์ƒ์„ฑํ•˜๊ธฐ 

mkdir -p /etc/docker/certs.d/registry.example.com/

 

/etc/docker/certs.d ๋””๋ ‰ํ† ๋ฆฌ๋กœ ํ•„์š”ํ•œ ์ธ์ฆ์„œ ํŒŒ์ผ๋“ค์„ ๋ณต์‚ฌํ•œ๋‹ค. ๋„์ปค๊ฐ€ api๋กœ ํ†ต์‹ ์„ ํ•  ๋•Œ์—๋„ https ์ธ์ฆ์„œ๊ฐ€ ํ•„์š”ํ•˜๊ธฐ ๋•Œ๋ฌธ์ด๋‹ค. 

# cp ca.crt /etc/docker/certs.d/registry.example.com/
# cp registry.example.com.key /etc/docker/certs.d/registry.example.com/
# cp registry.example.com.cert /etc/docker/certs.d/registry.example.com/

๋„์ปค ์„œ๋น„์Šค๋ฅผ ๋‹ค์‹œ ์‹คํ–‰ํ•œ๋‹ค. 

systemctl restart docker.service

 

/harbor ๋””๋ ‰ํ† ๋ฆฌ์˜ harbor.yml ํŒŒ์ผ๋„ ์ˆ˜์ •ํ•ด์ค€๋‹ค. 
certificate ์™€ private_key ๊ฒฝ๋กœ๋ฅผ ์•Œ๋งž๊ฒŒ ์ ์–ด์ค€๋‹ค 

 

/harbor ๋””๋ ‰ํ† ๋ฆฌ์—์„œ ๋ณ€๊ฒฝ ์‚ฌํ•ญ์„ ์ ์šฉํ•œ๋‹ค. 

$ sudo ./install.sh

์žฌ๋กœ๊ทธ์ธํ•œ๋‹ค.

[user@localhost harbor]$ docker logout 192.168.56.110
Removing login credentials for 192.168.56.110
[user@localhost harbor]$ docker login 192.168.56.110

์›น๋ธŒ๋ผ์šฐ์ €๋กœ ์ ‘์†ํ•œ๋‹ค. Accept Risk๋ฅผ ์„ ํƒํ•˜๊ณ  Harbor ์›นํŽ˜์ด์ง€์— ์ ‘์†ํ•œ๋‹ค. 

๋กœ๊ทธ์ธ์„ ํ•˜๊ณ  ์ ‘์†ํ•œ๋‹ค 

registry ์— ์˜ฌ๋ฆด ์ด๋ฏธ์ง€๋ฅผ ์ƒ์„ฑํ•œ๋‹ค ํ˜•์‹์€ ๋‹ค์Œ๊ณผ ๊ฐ™๋‹ค !! library๋ฅผ ๊นŒ๋จน์ง€ ๋ง์ž 

[user@localhost harbor]$ docker tag httpd:2.4 registry.example.com/library/httpd:2.4

docker login์„ ํ•œ๋‹ค. ์„ค์ •์„ ๋”ฐ๋กœ ํ•˜์ง€ ์•Š์•˜๋‹ค๋ฉด user๋Š” admin, password๋Š” Harbor12345 ์ด๋‹ค. 

$ docker login https://registry.example.com

registry์— ์—…๋กœ๋“œํ•œ๋‹ค. 

[user@localhost harbor]$ docker push registry.example.com/library/httpd:2.4

 

*** ๋กœ๊ทธ์ธ์ด ๋˜์ง€ ์•Š๊ฑฐ๋‚˜ ์ž˜ ์˜ฌ๋ผ๊ฐ€์ง€ ์•Š๋Š” ๊ฒฝ์šฐ harbor ๋””๋ ‰ํ† ๋ฆฌ์—์„œ ./install.sh ๋ช…๋ น์–ด๋ฅผ ์‹คํ–‰ํ•œ๋‹ค. ๊ทธ๋ฆฌ๊ณ  ๋‹ค์‹œ ๋กœ๊ทธ์ธํ•˜๋ฉด๋œ๋‹ค 

 sudo ./install.sh

Harbor์— ์ด๋ฏธ์ง€๊ฐ€ ์ž˜ ์˜ฌ๋ผ๊ฐ„ ๊ฒƒ์„ ํ™•์ธํ•  ์ˆ˜ ์žˆ๋‹ค. 

728x90

'Cloud Engineering > Docker ๐Ÿณ' ์นดํ…Œ๊ณ ๋ฆฌ์˜ ๋‹ค๋ฅธ ๊ธ€

[Docker] Harbor HTTP ๊ตฌ์„ฑ์œผ๋กœ ๊ตฌ์ถ•ํ•˜๊ธฐ  (0) 2023.02.06
[Docker] Docker Registry ๋ฅผ ์ด์šฉํ•œ Private Registry ๊ตฌ์ถ•ํ•˜๊ธฐ  (0) 2023.02.06
[Docker] Docker ์ €์žฅ์†Œ์— ์ด๋ฏธ์ง€ ์—…๋กœ๋“œํ•˜๊ธฐ  (0) 2023.02.03
[Docker] ์ด๋ฏธ์ง€ ์ƒ์„ฑํ•˜๊ธฐ - Dockerfile / Commit / import /export / tag  (0) 2023.02.03
[Docker] ์ปจํ…Œ์ด๋„ˆ ํฌํŠธํฌ์›Œ๋”ฉ (docker run -p) ์„ค์ •  (0) 2023.02.03
  1.  
  2. 1. Harbor  ์„ค์น˜ 
  3.  
  4. 2. docker compose ์„ค์น˜ 
  5. Harbor ์‚ฌ์šฉํ•˜๊ธฐ (https)
  6. registry.example.com ์ด๋ผ๋Š” ๋„๋ฉ”์ธ์œผ๋กœ ๊ตฌ์„ฑํ•ด๋ณด๊ธฐ
  7. CA ์ธ์ฆ์„œ ์ƒ์„ฑํ•˜๊ธฐ 
'Cloud Engineering/Docker ๐Ÿณ' ์นดํ…Œ๊ณ ๋ฆฌ์˜ ๋‹ค๋ฅธ ๊ธ€
  • [Docker] Harbor HTTP ๊ตฌ์„ฑ์œผ๋กœ ๊ตฌ์ถ•ํ•˜๊ธฐ
  • [Docker] Docker Registry ๋ฅผ ์ด์šฉํ•œ Private Registry ๊ตฌ์ถ•ํ•˜๊ธฐ
  • [Docker] Docker ์ €์žฅ์†Œ์— ์ด๋ฏธ์ง€ ์—…๋กœ๋“œํ•˜๊ธฐ
  • [Docker] ์ด๋ฏธ์ง€ ์ƒ์„ฑํ•˜๊ธฐ - Dockerfile / Commit / import /export / tag
minjiwoo
minjiwoo
Data Engineering๊ณผ Cloud Native ๊ธฐ์ˆ ์— ๋Œ€ํ•ด Dive Deep ํ•˜๋Š” ํ”Œ๋žซํผ ์—”์ง€๋‹ˆ์–ด๊ฐ€ ๋˜๋Š” ๊ฒƒ์„ ๋ชฉํ‘œ๋กœ ํ•˜๊ณ  ์žˆ์Šต๋‹ˆ๋‹ค. ๊ฒฝํ—˜๊ณผ ๊ณต๋ถ€ํ•œ ๋‚ด์šฉ์„ ๊ธฐ๋กํ•˜๋ฉฐ ์ง€์†๊ฐ€๋Šฅํ•œ ์—”์ง€๋‹ˆ์–ด๊ฐ€ ๋˜๋Š” ๊ฒƒ์ด ๊ฟˆ์ž…๋‹ˆ๋‹ค.
minji's engineering noteData Engineering๊ณผ Cloud Native ๊ธฐ์ˆ ์— ๋Œ€ํ•ด Dive Deep ํ•˜๋Š” ํ”Œ๋žซํผ ์—”์ง€๋‹ˆ์–ด๊ฐ€ ๋˜๋Š” ๊ฒƒ์„ ๋ชฉํ‘œ๋กœ ํ•˜๊ณ  ์žˆ์Šต๋‹ˆ๋‹ค. ๊ฒฝํ—˜๊ณผ ๊ณต๋ถ€ํ•œ ๋‚ด์šฉ์„ ๊ธฐ๋กํ•˜๋ฉฐ ์ง€์†๊ฐ€๋Šฅํ•œ ์—”์ง€๋‹ˆ์–ด๊ฐ€ ๋˜๋Š” ๊ฒƒ์ด ๊ฟˆ์ž…๋‹ˆ๋‹ค.
minjiwoo
minji's engineering note
minjiwoo
์ „์ฒด
์˜ค๋Š˜
์–ด์ œ
  • ๋ถ„๋ฅ˜ ์ „์ฒด๋ณด๊ธฐ (613)
    • Data Engineering (42)
      • Apache Spark (11)
      • Databricks & Delta Lake (9)
      • Airflow (3)
      • SQL (6)
      • Trouble Shooting (2)
      • Hadoop (2)
      • MLOps (1)
    • Cloud Engineering (104)
      • AWS (23)
      • Linux ๐Ÿง (29)
      • Docker ๐Ÿณ (21)
      • Kubernetes โš™๏ธ (20)
      • Ansible (10)
    • Computer Science (87)
      • ๋„คํŠธ์›Œํฌ (9)
      • ์šด์˜์ฒด์ œ (25)
      • ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ์‚ฌ (48)
      • CS ๊ธฐ์ˆ  ๋ฉด์ ‘ ์Šคํ„ฐ๋”” (3)
    • Programming Languages (27)
      • Python (17)
      • C์™€ C++ (10)
    • Backend (5)
      • Django (2)
    • ํ”„๋กœ์ ํŠธ (2)
      • ํ…Œํฌํฌ์ž„ํŒฉํŠธ (2)
    • iOS (11)
      • ๋ ˆ์ด๋ธ”๋Ÿฌ๋ฆฌ (2)
    • Algorithm (PS) (275)
      • LeetCode (6)
    • ๊ฐœ๋ฐœ์ผ๊ธฐ (30)
      • ๋‚ด๋ˆ๋‚ด์‚ฐ ํ›„๊ธฐ๐ŸŽฎ (3)
      • ๊ฐœ๋ฐœ์ž ์ทจ์ค€์ƒ (5)
      • Today I Learned (1)

๋ธ”๋กœ๊ทธ ๋ฉ”๋‰ด

  • ํ™ˆ
  • ํƒœ๊ทธ
  • ๋ฐฉ๋ช…๋ก

๊ณต์ง€์‚ฌํ•ญ

  • Hi there

์ธ๊ธฐ ๊ธ€

ํƒœ๊ทธ

  • ํ”„๋กœ๊ทธ๋ž˜๋จธ์Šค
  • linux
  • Kubernetes
  • ํด๋ผ์šฐ๋“œ
  • dp
  • ๋ฐ์ดํ„ฐ์—”์ง€๋‹ˆ์–ด๋ง
  • ๋น…๋ฐ์ดํ„ฐ
  • Databricks
  • ๋ฐฑ์ค€
  • ์ฝ”๋”ฉํ…Œ์ŠคํŠธ
  • ์นด์นด์˜ค์ฝ”๋”ฉํ…Œ์ŠคํŠธ
  • ํŒŒ์ด์ฌ
  • Leetcode
  • ๋ฐ์ดํ„ฐ์—”์ง€๋‹ˆ์–ด
  • Swift
  • ์•Œ๊ณ ๋ฆฌ์ฆ˜
  • AWS
  • ์šด์˜์ฒด์ œ
  • docker
  • ์ŠคํŒŒํฌ
  • ๋ฆฌ๋ˆ…์Šค
  • EC2
  • python
  • ์ฟ ๋ฒ„๋„คํ‹ฐ์Šค
  • ๋ฐฑํŠธ๋ž˜ํ‚น
  • ๋ฐ์ดํ„ฐ๋ธŒ๋ฆญ์Šค
  • BFS
  • ansible
  • dfs
  • SPARK

์ตœ๊ทผ ๋Œ“๊ธ€

์ตœ๊ทผ ๊ธ€

hELLOยท Designed By์ •์ƒ์šฐ.v4.5.2
minjiwoo
[Docker] Harbor HTTPS ๊ตฌ์„ฑ์œผ๋กœ ๊ตฌ์ถ•ํ•˜๊ธฐ
์ƒ๋‹จ์œผ๋กœ

ํ‹ฐ์Šคํ† ๋ฆฌํˆด๋ฐ”

๋‹จ์ถ•ํ‚ค

๋‚ด ๋ธ”๋กœ๊ทธ

๋‚ด ๋ธ”๋กœ๊ทธ - ๊ด€๋ฆฌ์ž ํ™ˆ ์ „ํ™˜
Q
Q
์ƒˆ ๊ธ€ ์“ฐ๊ธฐ
W
W

๋ธ”๋กœ๊ทธ ๊ฒŒ์‹œ๊ธ€

๊ธ€ ์ˆ˜์ • (๊ถŒํ•œ ์žˆ๋Š” ๊ฒฝ์šฐ)
E
E
๋Œ“๊ธ€ ์˜์—ญ์œผ๋กœ ์ด๋™
C
C

๋ชจ๋“  ์˜์—ญ

์ด ํŽ˜์ด์ง€์˜ URL ๋ณต์‚ฌ
S
S
๋งจ ์œ„๋กœ ์ด๋™
T
T
ํ‹ฐ์Šคํ† ๋ฆฌ ํ™ˆ ์ด๋™
H
H
๋‹จ์ถ•ํ‚ค ์•ˆ๋‚ด
Shift + /
โ‡ง + /

* ๋‹จ์ถ•ํ‚ค๋Š” ํ•œ๊ธ€/์˜๋ฌธ ๋Œ€์†Œ๋ฌธ์ž๋กœ ์ด์šฉ ๊ฐ€๋Šฅํ•˜๋ฉฐ, ํ‹ฐ์Šคํ† ๋ฆฌ ๊ธฐ๋ณธ ๋„๋ฉ”์ธ์—์„œ๋งŒ ๋™์ž‘ํ•ฉ๋‹ˆ๋‹ค.