https:\/\/goharbor.io\/<\/a><\/p>\n\n\n\n\u5982\u679c\u7f51\u901f\u5feb\uff0c\u53ef\u4ee5\u9009\u62e9offline\u7684\u7248\u672c\u3002 \u6211\u8fd9\u91cc\u7528\u7684\u662fonline\u7684\u3002<\/p>\n\n\n\n![\"\"](\"https:\/\/www.gbase8.cn\/wp-content\/uploads\/2023\/06\/image-10.png\")
<\/figure>\n\n\n\n<\/span>\u4fee\u6539harbor\u652f\u6301https<\/span><\/h2>\n\n\n\n\u89e3\u538b\u7f29\u540e\uff0c\u5c06harbor\u76ee\u5f55\u4e0b\u7684harbor.yml.tmp\u590d\u5236\u4e00\u4efd\u4e3aharbor.yml<\/p>\n\n\n\n
<\/span>\u4fee\u6539\u914d\u7f6e\u6587\u4ef6<\/span><\/h3>\n\n\n\n\u5305\u62ec hostname<\/code> \u548c https<\/code> \u90e8\u5206\uff0c\u5176\u4e2d\u8bc1\u4e66\u548c\u79c1\u94a5\u6b63\u786e\u914d\u7f6e\u3002 \u5982\u679c\u4e0d\u5f00\u901ahttps\u670d\u52a1\uff0c\u53ef\u4ee5\u6ce8\u91ca\u6389\u76f8\u5173\u90e8\u5206\u3002 \u6ce8\u610f\u914d\u7f6e\u6587\u4ef6\u7f29\u8fdb\u683c\u5f0f\uff0c\u4e0d\u8981\u51fa\u73b0\u65e0\u6548\u7684\u989d\u5916\u7a7a\u683c\u7b49\uff0c\u5426\u5219\u4f1a\u9020\u6210\u89e3\u6790\u9519\u8bef\u3002<\/p>\n\n\n\n[root@vm249 ssl]# cat ..\/harbor.yml\n# Configuration file of Harbor\n\n# The IP address or hostname to access admin UI and registry service.\n# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.\nhostname: 172.16.3.249<\/span>\n\n# http related config\nhttp:\n # port for http, default is 80. If https enabled, this port will redirect to https port\n port: 8088<\/span>\n\n# https related config\nhttps:\n # https port for harbor, default is 443\n port: 8443<\/span>\n # The path of cert and key files for nginx\n certificate: \/data\/cert\/172.16.3.249.crt\n private_key: \/data\/cert\/172.16.3.249.key<\/span>\n\u3002\u3002\u3002\u3002\u3002\u3002<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/www.gbase8.cn\/wp-content\/uploads\/2023\/06\/image-11.png\")
<\/figure>\n\n\n\n<\/span>\u542f\u52a8\u670d\u52a1<\/span><\/h3>\n\n\n\n\u5982\u679c\u6ca1\u6709\u8fd0\u884c\u5728http\u6a21\u5f0f\u4e0b\uff0c\u53ef\u4ee5\u76f4\u63a5install.sh\u5b89\u88c5<\/p>\n\n\n\n
.\/install.sh<\/code><\/pre>\n\n\n\n\u5982\u679c\u5df2\u7ecf\u90e8\u7f72\u4e86http\u6a21\u5f0f\uff0c\u53ef\u4ee5\u91cd\u65b0\u90e8\u7f72<\/p>\n\n\n\n
.\/prepare\ndocker-compose down -v\ndocker-compose up -d<\/code><\/pre>\n\n\n\n\u6267\u884c\u8bb0\u5f55<\/p>\n\n\n\n
[root@vm249 harbor]# .\/prepare\nprepare base dir is set to \/root\/harbor\nClearing the configuration file: \/config\/portal\/nginx.conf\nClearing the configuration file: \/config\/log\/logrotate.conf\nClearing the configuration file: \/config\/log\/rsyslog_docker.conf\nClearing the configuration file: \/config\/nginx\/nginx.conf\nClearing the configuration file: \/config\/core\/env\nClearing the configuration file: \/config\/core\/app.conf\nClearing the configuration file: \/config\/registry\/passwd\nClearing the configuration file: \/config\/registry\/config.yml\nClearing the configuration file: \/config\/registryctl\/env\nClearing the configuration file: \/config\/registryctl\/config.yml\nClearing the configuration file: \/config\/db\/env\nClearing the configuration file: \/config\/jobservice\/env\nClearing the configuration file: \/config\/jobservice\/config.yml\nGenerated configuration file: \/config\/portal\/nginx.conf\nGenerated configuration file: \/config\/log\/logrotate.conf\nGenerated configuration file: \/config\/log\/rsyslog_docker.conf\nGenerated configuration file: \/config\/nginx\/nginx.conf\nGenerated configuration file: \/config\/core\/env\nGenerated configuration file: \/config\/core\/app.conf\nGenerated configuration file: \/config\/registry\/config.yml\nGenerated configuration file: \/config\/registryctl\/env\nGenerated configuration file: \/config\/registryctl\/config.yml\nGenerated configuration file: \/config\/db\/env\nGenerated configuration file: \/config\/jobservice\/env\nGenerated configuration file: \/config\/jobservice\/config.yml\nloaded secret from file: \/data\/secret\/keys\/secretkey\nGenerated configuration file: \/compose_location\/docker-compose.yml\nClean up the input dir\n[root@vm249 harbor]# ll -rt\ntotal 56\n-rwxr-xr-x. 1 root root 1881 Dec 14 20:29 prepare\n-rwxr-xr-x. 1 root root 3171 Dec 14 20:29 install.sh\n-rw-r--r--. 1 root root 11567 Dec 14 20:29 harbor.yml.tmpl\n-rw-r--r--. 1 root root 3639 Dec 14 20:29 common.sh\n-rw-r--r--. 1 root root 11347 Dec 14 20:29 LICENSE\ndrwxr-xr-x. 3 root root 20 Feb 21 00:33 common\ndrwxr-xr-x. 2 root root 159 Feb 21 19:17 ssl\n-rw-r--r--. 1 root root 11576 Feb 21 21:42 harbor.yml\n-rw-r--r--. 1 root root 5947 Feb 21 21:47 docker-compose.yml\n[root@vm249 harbor]# systemctl daemon-reload\n[root@vm249 harbor]# docker-compose down -v^C\n[root@vm249 harbor]# systemctl restart docker\n[root@vm249 harbor]# docker-compose down -v\n[+] Running 10\/10\n \u283f Container harbor-jobservice Removed 11.3s\n \u283f Container registryctl Removed 10.4s\n \u283f Container nginx Removed 1.3s\n \u283f Container harbor-portal Removed 0.3s\n \u283f Container harbor-core Removed 3.4s\n \u283f Container harbor-db Removed 1.0s\n \u283f Container registry Removed 0.9s\n \u283f Container redis Removed 1.0s\n \u283f Container harbor-log Removed 10.3s\n \u283f Network harbor_harbor Removed 0.2s\n[root@vm249 harbor]# docker-compose down -v^C\n[root@vm249 harbor]# docker-compose up -d\n[+] Running 10\/10\n \u283f Network harbor_harbor Created 0.3s\n \u283f Container harbor-log Started 2.2s\n \u283f Container registry Started 5.4s\n \u283f Container harbor-db Started 6.2s\n \u283f Container registryctl Started 5.9s\n \u283f Container harbor-portal Started 6.1s\n \u283f Container redis Started 5.8s\n \u283f Container harbor-core Started 6.8s\n \u283f Container nginx Started 9.2s\n \u283f Container harbor-jobservice Started 9.1s\n[root@vm249 harbor]#\n<\/code><\/pre>\n\n\n\n<\/span>\u6d4b\u8bd5\u6548\u679c<\/span><\/h2>\n\n\n\n\u5982\u679c\u8bbf\u95ee\u7684\u662f8088\u7aef\u53e3\uff0c\u4e5f\u4f1a\u81ea\u52a8\u8f6c\u52308443\u7684https\u3002<\/p>\n\n\n\n
\u9ed8\u8ba4\u8bbf\u95ee\u5bc6\u7801\uff0c\u53ef\u4ee5\u4eceharbor.yml\u91cc\u770b\u5230\uff0c\u641c\u7d22\uff1a harbor_admin_password<\/p>\n\n\n\n![\"\"](\"https:\/\/www.gbase8.cn\/wp-content\/uploads\/2023\/02\/1677045069892.png\")
<\/figure>\n\n\n\n\u589e\u52a0https\u7684docker daemon.json\u914d\u7f6e<\/p>\n\n\n\n
[root@vm249 harbor]# vi \/etc\/docker\/daemon.json\n[root@vm249 harbor]# cat \/etc\/docker\/daemon.json\n{\n \"registry-mirrors\": [\n \"https:\/\/registry.docker-cn.com\",\n \"http:\/\/hub-mirror.c.163.com\",\n \"https:\/\/docker.mirrors.ustc.edu.cn\",\n \"https:\/\/172.16.3.249:8443\"\n ],\n \"insecure-registries\": [ \n ],\n\n \"log-opts\": {\n \"max-size\": \"10m\"\n }\n}\n\n[root@vm249 harbor]#\n[root@vm249 harbor]# systemctl daemon-reload\n[root@vm249 harbor]# systemctl restart docker\n[root@vm249 harbor]# systemctl restart harbor\n[root@vm249 harbor]# docker login 172.16.3.249:8443\nUsername: admin\nPassword:\nWARNING! Your password will be stored unencrypted in \/root\/.docker\/config.json.\nConfigure a credential helper to remove this warning. See\nhttps://docs.docker.com\/engine\/reference\/commandline\/login\/#credentials-store\n\nLogin Succeeded\n[root@vm249 harbor]#\n<\/code><\/pre>\n\n\n\n<\/span>\u5176\u5b83\u8282\u70b9\u8fdc\u7a0b\u8bbf\u95eeharbor\u7684\u65b9\u6cd5<\/span><\/h2>\n\n\n\n\u9700\u8981\u5c06\u6240\u9700\u7684\/etc\/docker\/cert.d\u4e0b\u5bf9\u5e94\u7684\u5730\u5740\u7684\u8bc1\u4e66\u590d\u5236\u8fc7\u53bb\u3002 \u5176\u4e2d\u7684daemon.json\uff0c\u6839\u636e\u9700\u8981\u8fdb\u884c\u4fee\u6539\u3002 \u5982\u679c\u76ee\u5f55\u4e0d\u5b58\u5728\uff0c\u53ef\u4ee5\u63d0\u524d\u521b\u5efa\u3002<\/p>\n\n\n\n
<\/span>docker login<\/span><\/h3>\n\n\n\ndocker\u8bbf\u95eeharbor\u9700\u8981\u5148login,\u8f93\u5165\u7528\u6237\u540d\u548c\u5bc6\u7801\u3002 \u9ed8\u8ba4\u4f1a\u5c06\u767b\u5f55\u4fe1\u606f\u4fdd\u5b58\u5230\/root\/.docker\/config.json.<\/p>\n\n\n\n
[root@k8s-81 ~]# docker login https:\/\/172.16.3.249:8443\nUsername: admin\nPassword:\nError response from daemon: Get \"https:\/\/172.16.3.249:8443\/v2\/\": x509: certificate signed by unknown authority\n[root@k8s-81 ~]#<\/code><\/pre>\n\n\n\n<\/p>\n\n\n\n
[root@k8s-81 ~]# docker login https:\/\/172.16.3.249:8443\nUsername: admin\nPassword:\nError response from daemon: Get \"https:\/\/172.16.3.249:8443\/v2\/\": x509: certificate signed by unknown authority\n[root@k8s-81 ~]# cd \/etc\/docker\/\n[root@k8s-81 docker]# ll\ntotal 0\n[root@k8s-81 docker]# scp -r 172.16.3.249:\/etc\/docker\/cert.d\/172.16.3.249:8443 .\/certd.d\/\nThe authenticity of host '172.16.3.249 (172.16.3.249)' can't be established.\nECDSA key fingerprint is SHA256:Xs1gi6NKPEsAxLRIL2NHIv7jG1vt68oBlWZ0YUe\/Swk.\nECDSA key fingerprint is MD5:b4:9c:dd:e1:3c:42:28:8d:db:c5:a0:73:30:2f:60:78.\nAre you sure you want to continue connecting (yes\/no)? yes\nWarning: Permanently added '172.16.3.249' (ECDSA) to the list of known hosts.\nroot@172.16.3.249's password:\nPermission denied, please try again.\nroot@172.16.3.249's password:\n172.16.3.249.cert 100% 2053 36.5KB\/s 00:00\n172.16.3.249.crt 100% 2053 44.7KB\/s 00:00\n172.16.3.249.key 100% 3247 597.2KB\/s 00:00\nca.crt 100% 2029 29.0KB\/s 00:00\ndaemon.json 100% 276 42.9KB\/s 00:00\n[root@k8s-81 docker]# ll\ntotal 4\ndrwxr-xr-x. 3 root root 31 Feb 23 08:59 certs.d\n-rw-r--r--. 1 root root 276 Feb 23 08:59 daemon.json\n[root@k8s-81 docker]# cat daemon.json\n{\n \"registry-mirrors\": [\n \"https:\/\/registry.docker-cn.com\",\n \"http:\/\/hub-mirror.c.163.com\",\n \"https:\/\/docker.mirrors.ustc.edu.cn\",\n \"https:\/\/172.16.3.249:8443\"\n ],\n \"insecure-registries\": [\n ],\n\n \"log-opts\": {\n \"max-size\": \"10m\"\n }\n}\n\n[root@k8s-81 docker]# ll\ntotal 4\ndrwxr-xr-x. 3 root root 31 Feb 23 08:59 certs.d\n-rw-r--r--. 1 root root 276 Feb 23 08:59 daemon.json\n[root@k8s-81 docker]# cd certs.d\/\n[root@k8s-81 certs.d]# ll\ntotal 0\ndrwxr-xr-x. 2 root root 93 Feb 23 08:59 172.16.3.249:8443\n[root@k8s-81 certs.d]# systemctl daemon-reload\n[root@k8s-81 certs.d]# docker login https:\/\/172.16.3.249:8443\nUsername: admin\nPassword:\nWARNING! Your password will be stored unencrypted in \/root\/.docker\/config.json.\nConfigure a credential helper to remove this warning. See\nhttps://docs.docker.com\/engine\/reference\/commandline\/login\/#credentials-store\n\nLogin Succeeded\n[root@k8s-81 certs.d]# ll\ntotal 0\ndrwxr-xr-x. 2 root root 93 Feb 23 08:59 172.16.3.249:8443\n[root@k8s-81 certs.d]# cd ..\n[root@k8s-81 docker]# ll\ntotal 4\ndrwxr-xr-x. 3 root root 31 Feb 23 08:59 certs.d\n-rw-r--r--. 1 root root 276 Feb 23 08:59 daemon.json\n[root@k8s-81 docker]#\n<\/code><\/pre>\n\n\n\n<\/span>\u5b8c\u6574\u5b89\u88c5\u8bb0\u5f55<\/span><\/h2>\n\n\n\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\r\n \u2502 \u2022 MobaXterm 10.4 \u2022 \u2502\r\n \u2502 (SSH client, X-server and networking tools) \u2502\r\n \u2502 \u2502\r\n \u2502 \u27a4 SSH session to root@172.16.3.249 \u2502\r\n \u2502 \u2022 SSH compression : \u2714 \u2502\r\n \u2502 \u2022 SSH-browser : \u2714 \u2502\r\n \u2502 \u2022 X11-forwarding : \u2714 (remote display is forwarded through SSH) \u2502\r\n \u2502 \u2022 DISPLAY : \u2714 (automatically set on remote server) \u2502\r\n \u2502 \u2502\r\n \u2502 \u27a4 For more info, ctrl+click on help or visit our website \u2502\r\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\r\n\r\nLast login: Mon Jun 26 02:53:46 2023 from 172.16.35.241\r\n[root@vm249 ~]# docker\r\nbash: docker: command not found...\r\n[root@vm249 ~]# cat \/etc\/hosts\r\n127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4\r\n::1 localhost localhost.localdomain localhost6 localhost6.localdomain6\r\n[root@vm249 ~]# vi \/etc\/hosts\r\n[root@vm249 ~]# yum install docker-ce docker-ce-cli containerd.io docker-compose-plugin\r\nLoaded plugins: fastestmirror, langpacks\r\nLoading mirror speeds from cached hostfile\r\n * base: mirrors.nju.edu.cn\r\n * extras: mirrors.bfsu.edu.cn\r\n * updates: mirrors.bfsu.edu.cn\r\nbase | 3.6 kB 00:00:00\r\nextras | 2.9 kB 00:00:00\r\nupdates | 2.9 kB 00:00:00\r\nupdates\/7\/x86_64\/primary_db | 22 MB 00:00:09\r\nNo package docker-ce available.\r\nNo package docker-ce-cli available.\r\nNo package containerd.io available.\r\nNo package docker-compose-plugin available.\r\nError: Nothing to do\r\n[root@vm249 ~]# curl -o \/etc\/yum.repos.d\/Centos-7.repo http:\/\/mirrors.aliyun.com\/repo\/Centos-7.repo\r\ncat <<EOF > \/etc\/yum.repos.d\/kubernetes.repo\r\n[kubernetes]\r\nname=Kubernetes\r\nbaseurl=http:\/\/mirrors.aliyun.com\/kubernetes\/yum\/repos\/kubernetes-el7-x86_64\r\nenabled=1\r\ngpgcheck=0\r\nrepo_gpgcheck=0\r\ngpgkey=http:\/\/mirrors.aliyun.com\/kubernetes\/yum\/doc\/yum-key.gpg\r\n http://mirrors.aliyun.com\/kubernetes\/yum\/doc\/rpm-package-key.gpg\r\nEOF % Total % Received % Xferd Average Speed Time Time Time Current\r\n Dload Upload Total Spent Left Speed\r\n100 2523 100 2523 0 0 10864 0 --:--:-- --:--:-- --:--:-- 10922\r\n[root@vm249 ~]# curl -o \/etc\/yum.repos.d\/docker-ce.repo http:\/\/mirrors.aliyun.com\/docker-ce\/linux\/centos\/docker-ce.repo\r\n % Total % Received % Xferd Average Speed Time Time Time Current\r\n Dload Upload Total Spent Left Speed\r\n100 2081 100 2081 0 0 11384 0 --:--:-- --:--:-- --:--:-- 11434\r\n[root@vm249 ~]# cat <<EOF > \/etc\/yum.repos.d\/kubernetes.repo\r\n> [kubernetes]\r\n> name=Kubernetes\r\n> baseurl=http:\/\/mirrors.aliyun.com\/kubernetes\/yum\/repos\/kubernetes-el7-x86_64\r\n> enabled=1\r\n> gpgcheck=0\r\n> repo_gpgcheck=0\r\n> gpgkey=http:\/\/mirrors.aliyun.com\/kubernetes\/yum\/doc\/yum-key.gpg\r\n> http:\/\/mirrors.aliyun.com\/kubernetes\/yum\/doc\/rpm-package-key.gpg\r\n> EOF\r\n[root@vm249 ~]# yum clean all && yum makecache\r\nLoaded plugins: fastestmirror, langpacks\r\nRepository base is listed more than once in the configuration\r\nRepository updates is listed more than once in the configuration\r\nRepository extras is listed more than once in the configuration\r\nRepository centosplus is listed more than once in the configuration\r\nCleaning repos: base docker-ce-stable extras kubernetes updates\r\nCleaning up list of fastest mirrors\r\nLoaded plugins: fastestmirror, langpacks\r\nRepository base is listed more than once in the configuration\r\nRepository updates is listed more than once in the configuration\r\nRepository extras is listed more than once in the configuration\r\nRepository centosplus is listed more than once in the configuration\r\nDetermining fastest mirrors\r\n * base: mirrors.bfsu.edu.cn\r\n * extras: mirrors.bfsu.edu.cn\r\n * updates: mirrors.bfsu.edu.cn\r\nbase | 3.6 kB 00:00:00\r\ndocker-ce-stable | 3.5 kB 00:00:00\r\nextras | 2.9 kB 00:00:00\r\nkubernetes | 1.4 kB 00:00:00\r\nupdates | 2.9 kB 00:00:00\r\n(1\/17): docker-ce-stable\/7\/x86_64\/filelists_db | 45 kB 00:00:00\r\n(2\/17): docker-ce-stable\/7\/x86_64\/updateinfo | 55 B 00:00:00\r\n(3\/17): base\/7\/x86_64\/group_gz | 153 kB 00:00:00\r\n(4\/17): docker-ce-stable\/7\/x86_64\/primary_db | 111 kB 00:00:00\r\n(5\/17): extras\/7\/x86_64\/filelists_db | 276 kB 00:00:00\r\n(6\/17): docker-ce-stable\/7\/x86_64\/other_db | 133 kB 00:00:00\r\n(7\/17): extras\/7\/x86_64\/primary_db | 249 kB 00:00:00\r\n(8\/17): extras\/7\/x86_64\/other_db | 149 kB 00:00:00\r\n(9\/17): kubernetes\/filelists | 43 kB 00:00:00\r\n(10\/17): base\/7\/x86_64\/filelists_db | 7.2 MB 00:00:04\r\n(11\/17): kubernetes\/primary | 132 kB 00:00:02\r\n(12\/17): kubernetes\/other | 86 kB 00:00:03\r\n(13\/17): base\/7\/x86_64\/other_db | 2.6 MB 00:00:08\r\n(14\/17): updates\/7\/x86_64\/primary_db | 22 MB 00:00:12\r\n(15\/17): updates\/7\/x86_64\/filelists_db | 12 MB 00:00:14\r\n(16\/17): updates\/7\/x86_64\/other_db | 1.4 MB 00:00:18\r\n(17\/17): base\/7\/x86_64\/primary_db | 6.1 MB 00:01:01\r\nkubernetes 980\/980\r\nkubernetes 980\/980\r\nkubernetes 980\/980\r\nMetadata Cache Created\r\n[root@vm249 ~]# yum install docker-ce docker-ce-cli containerd.io docker-compose-plugin\r\nLoaded plugins: fastestmirror, langpacks\r\nRepository base is listed more than once in the configuration\r\nRepository updates is listed more than once in the configuration\r\nRepository extras is listed more than once in the configuration\r\nRepository centosplus is listed more than once in the configuration\r\nLoading mirror speeds from cached hostfile\r\n * base: mirrors.bfsu.edu.cn\r\n * extras: mirrors.bfsu.edu.cn\r\n * updates: mirrors.bfsu.edu.cn\r\nResolving Dependencies\r\n--> Running transaction check\r\n---> Package containerd.io.x86_64 0:1.6.21-3.1.el7 will be installed\r\n--> Processing Dependency: container-selinux >= 2:2.74 for package: containerd.io-1.6.21-3.1.el7.x86_64\r\n---> Package docker-ce.x86_64 3:24.0.2-1.el7 will be installed\r\n--> Processing Dependency: docker-ce-rootless-extras for package: 3:docker-ce-24.0.2-1.el7.x86_64\r\n---> Package docker-ce-cli.x86_64 1:24.0.2-1.el7 will be installed\r\n--> Processing Dependency: docker-buildx-plugin for package: 1:docker-ce-cli-24.0.2-1.el7.x86_64\r\n---> Package docker-compose-plugin.x86_64 0:2.18.1-1.el7 will be installed\r\n--> Running transaction check\r\n---> Package container-selinux.noarch 2:2.119.2-1.911c772.el7_8 will be installed\r\n---> Package docker-buildx-plugin.x86_64 0:0.10.5-1.el7 will be installed\r\n---> Package docker-ce-rootless-extras.x86_64 0:24.0.2-1.el7 will be installed\r\n--> Processing Dependency: fuse-overlayfs >= 0.7 for package: docker-ce-rootless-extras-24.0.2-1.el7.x86_64\r\n--> Processing Dependency: slirp4netns >= 0.4 for package: docker-ce-rootless-extras-24.0.2-1.el7.x86_64\r\n--> Running transaction check\r\n---> Package fuse-overlayfs.x86_64 0:0.7.2-6.el7_8 will be installed\r\n--> Processing Dependency: libfuse3.so.3(FUSE_3.2)(64bit) for package: fuse-overlayfs-0.7.2-6.el7_8.x86_64\r\n--> Processing Dependency: libfuse3.so.3(FUSE_3.0)(64bit) for package: fuse-overlayfs-0.7.2-6.el7_8.x86_64\r\n--> Processing Dependency: libfuse3.so.3()(64bit) for package: fuse-overlayfs-0.7.2-6.el7_8.x86_64\r\n---> Package slirp4netns.x86_64 0:0.4.3-4.el7_8 will be installed\r\n--> Running transaction check\r\n---> Package fuse3-libs.x86_64 0:3.6.1-4.el7 will be installed\r\n--> Finished Dependency Resolution\r\n\r\nDependencies Resolved\r\n\r\n=====================================================================================================================================================================\r\n Package Arch Version Repository Size\r\n=====================================================================================================================================================================\r\nInstalling:\r\n containerd.io x86_64 1.6.21-3.1.el7 docker-ce-stable 34 M\r\n docker-ce x86_64 3:24.0.2-1.el7 docker-ce-stable 24 M\r\n docker-ce-cli x86_64 1:24.0.2-1.el7 docker-ce-stable 13 M\r\n docker-compose-plugin x86_64 2.18.1-1.el7 docker-ce-stable 12 M\r\nInstalling for dependencies:\r\n container-selinux noarch 2:2.119.2-1.911c772.el7_8 extras 40 k\r\n docker-buildx-plugin x86_64 0.10.5-1.el7 docker-ce-stable 12 M\r\n docker-ce-rootless-extras x86_64 24.0.2-1.el7 docker-ce-stable 9.1 M\r\n fuse-overlayfs x86_64 0.7.2-6.el7_8 extras 54 k\r\n fuse3-libs x86_64 3.6.1-4.el7 extras 82 k\r\n slirp4netns x86_64 0.4.3-4.el7_8 extras 81 k\r\n\r\nTransaction Summary\r\n=====================================================================================================================================================================\r\nInstall 4 Packages (+6 Dependent packages)\r\n\r\nTotal download size: 105 M\r\nInstalled size: 372 M\r\nIs this ok [y\/d\/N]: y\r\nDownloading packages:\r\n(1\/10): container-selinux-2.119.2-1.911c772.el7_8.noarch.rpm | 40 kB 00:00:00\r\nwarning: \/var\/cache\/yum\/x86_64\/7\/docker-ce-stable\/packages\/docker-buildx-plugin-0.10.5-1.el7.x86_64.rpm: Header V4 RSA\/SHA512 Signature, key ID 621e9f35: NOKEY0 ETA\r\nPublic key for docker-buildx-plugin-0.10.5-1.el7.x86_64.rpm is not installed\r\n(2\/10): docker-buildx-plugin-0.10.5-1.el7.x86_64.rpm | 12 MB 00:00:43\r\n(3\/10): containerd.io-1.6.21-3.1.el7.x86_64.rpm | 34 MB 00:02:11\r\n(4\/10): docker-ce-24.0.2-1.el7.x86_64.rpm | 24 MB 00:01:42\r\n(5\/10): docker-ce-rootless-extras-24.0.2-1.el7.x86_64.rpm | 9.1 MB 00:00:40\r\n(6\/10): fuse-overlayfs-0.7.2-6.el7_8.x86_64.rpm | 54 kB 00:00:00\r\n(7\/10): fuse3-libs-3.6.1-4.el7.x86_64.rpm | 82 kB 00:00:00\r\n(8\/10): docker-ce-cli-24.0.2-1.el7.x86_64.rpm | 13 MB 00:00:57\r\nslirp4netns-0.4.3-4.el7_8.x86_ FAILED ================================================== ] 276 kB\/s | 102 MB 00:00:11 ETA\r\nhttp:\/\/mirror.lzu.edu.cn\/centos\/7.9.2009\/extras\/x86_64\/Packages\/slirp4netns-0.4.3-4.el7_8.x86_64.rpm: [Errno 12] Timeout on http:\/\/mirror.lzu.edu.cn\/centos\/7.9.2009\/extras\/x86_64\/Packages\/slirp4netns-0.4.3-4.el7_8.x86_64.rpm: (28, 'Operation too slow. Less than 1000 bytes\/sec transferred the last 30 seconds')\r\nTrying other mirror.\r\n(9\/10): slirp4netns-0.4.3-4.el7_8.x86_64.rpm | 81 kB 00:00:00\r\n(10\/10): docker-compose-plugin-2.18.1-1.el7.x86_64.rpm | 12 MB 00:00:45\r\n---------------------------------------------------------------------------------------------------------------------------------------------------------------------\r\nTotal 463 kB\/s | 105 MB 00:03:51\r\nRetrieving key from https:\/\/mirrors.aliyun.com\/docker-ce\/linux\/centos\/gpg\r\nImporting GPG key 0x621E9F35:\r\n Userid : \"Docker Release (CE rpm) <docker@docker.com>\"\r\n Fingerprint: 060a 61c5 1b55 8a7f 742b 77aa c52f eb6b 621e 9f35\r\n From : https:\/\/mirrors.aliyun.com\/docker-ce\/linux\/centos\/gpg\r\nIs this ok [y\/N]: y\r\nRunning transaction check\r\nRunning transaction test\r\nTransaction test succeeded\r\nRunning transaction\r\n Installing : 2:container-selinux-2.119.2-1.911c772.el7_8.noarch 1\/10\r\n Installing : containerd.io-1.6.21-3.1.el7.x86_64 2\/10\r\n Installing : docker-buildx-plugin-0.10.5-1.el7.x86_64 3\/10\r\n Installing : slirp4netns-0.4.3-4.el7_8.x86_64 4\/10\r\n Installing : fuse3-libs-3.6.1-4.el7.x86_64 5\/10\r\n Installing : fuse-overlayfs-0.7.2-6.el7_8.x86_64 6\/10\r\n Installing : docker-compose-plugin-2.18.1-1.el7.x86_64 7\/10\r\n Installing : 1:docker-ce-cli-24.0.2-1.el7.x86_64 8\/10\r\n Installing : docker-ce-rootless-extras-24.0.2-1.el7.x86_64 9\/10\r\n Installing : 3:docker-ce-24.0.2-1.el7.x86_64 10\/10\r\n Verifying : 3:docker-ce-24.0.2-1.el7.x86_64 1\/10\r\n Verifying : docker-compose-plugin-2.18.1-1.el7.x86_64 2\/10\r\n Verifying : fuse3-libs-3.6.1-4.el7.x86_64 3\/10\r\n Verifying : fuse-overlayfs-0.7.2-6.el7_8.x86_64 4\/10\r\n Verifying : containerd.io-1.6.21-3.1.el7.x86_64 5\/10\r\n Verifying : slirp4netns-0.4.3-4.el7_8.x86_64 6\/10\r\n Verifying : 2:container-selinux-2.119.2-1.911c772.el7_8.noarch 7\/10\r\n Verifying : 1:docker-ce-cli-24.0.2-1.el7.x86_64 8\/10\r\n Verifying : docker-ce-rootless-extras-24.0.2-1.el7.x86_64 9\/10\r\n Verifying : docker-buildx-plugin-0.10.5-1.el7.x86_64 10\/10\r\n\r\nInstalled:\r\n containerd.io.x86_64 0:1.6.21-3.1.el7 docker-ce.x86_64 3:24.0.2-1.el7 docker-ce-cli.x86_64 1:24.0.2-1.el7 docker-compose-plugin.x86_64 0:2.18.1-1.el7\r\n\r\nDependency Installed:\r\n container-selinux.noarch 2:2.119.2-1.911c772.el7_8 docker-buildx-plugin.x86_64 0:0.10.5-1.el7 docker-ce-rootless-extras.x86_64 0:24.0.2-1.el7\r\n fuse-overlayfs.x86_64 0:0.7.2-6.el7_8 fuse3-libs.x86_64 0:3.6.1-4.el7 slirp4netns.x86_64 0:0.4.3-4.el7_8\r\n\r\nComplete!\r\n[root@vm249 ~]# yum install systemd-resolved\r\nLoaded plugins: fastestmirror, langpacks\r\nRepository base is listed more than once in the configuration\r\nRepository updates is listed more than once in the configuration\r\nRepository extras is listed more than once in the configuration\r\nRepository centosplus is listed more than once in the configuration\r\nLoading mirror speeds from cached hostfile\r\n * base: mirrors.bfsu.edu.cn\r\n * extras: mirrors.bfsu.edu.cn\r\n * updates: mirrors.bfsu.edu.cn\r\nResolving Dependencies\r\n--> Running transaction check\r\n---> Package systemd-resolved.x86_64 0:219-78.el7_9.7 will be installed\r\n--> Processing Dependency: systemd = 219-78.el7_9.7 for package: systemd-resolved-219-78.el7_9.7.x86_64\r\n--> Running transaction check\r\n---> Package systemd.x86_64 0:219-78.el7 will be updated\r\n--> Processing Dependency: systemd = 219-78.el7 for package: systemd-python-219-78.el7.x86_64\r\n--> Processing Dependency: systemd = 219-78.el7 for package: systemd-sysv-219-78.el7.x86_64\r\n---> Package systemd.x86_64 0:219-78.el7_9.7 will be an update\r\n--> Processing Dependency: systemd-libs = 219-78.el7_9.7 for package: systemd-219-78.el7_9.7.x86_64\r\n--> Running transaction check\r\n---> Package systemd-libs.x86_64 0:219-78.el7 will be updated\r\n--> Processing Dependency: systemd-libs = 219-78.el7 for package: libgudev1-219-78.el7.x86_64\r\n---> Package systemd-libs.x86_64 0:219-78.el7_9.7 will be an update\r\n---> Package systemd-python.x86_64 0:219-78.el7 will be updated\r\n---> Package systemd-python.x86_64 0:219-78.el7_9.7 will be an update\r\n---> Package systemd-sysv.x86_64 0:219-78.el7 will be updated\r\n---> Package systemd-sysv.x86_64 0:219-78.el7_9.7 will be an update\r\n--> Running transaction check\r\n---> Package libgudev1.x86_64 0:219-78.el7 will be updated\r\n---> Package libgudev1.x86_64 0:219-78.el7_9.7 will be an update\r\n--> Finished Dependency Resolution\r\n\r\nDependencies Resolved\r\n\r\n=====================================================================================================================================================================\r\n Package Arch Version Repository Size\r\n=====================================================================================================================================================================\r\nInstalling:\r\n systemd-resolved x86_64 219-78.el7_9.7 updates 422 k\r\nUpdating for dependencies:\r\n libgudev1 x86_64 219-78.el7_9.7 updates 110 k\r\n systemd x86_64 219-78.el7_9.7 updates 5.1 M\r\n systemd-libs x86_64 219-78.el7_9.7 updates 419 k\r\n systemd-python x86_64 219-78.el7_9.7 updates 146 k\r\n systemd-sysv x86_64 219-78.el7_9.7 updates 97 k\r\n\r\nTransaction Summary\r\n=====================================================================================================================================================================\r\nInstall 1 Package\r\nUpgrade ( 5 Dependent packages)\r\n\r\nTotal download size: 6.2 M\r\nIs this ok [y\/d\/N]: y\r\nDownloading packages:\r\nNo Presto metadata available for updates\r\n(1\/6): libgudev1-219-78.el7_9.7.x86_64.rpm | 110 kB 00:00:00\r\n(2\/6): systemd-python-219-78.el7_9.7.x86_64.rpm | 146 kB 00:00:00\r\n(3\/6): systemd-sysv-219-78.el7_9.7.x86_64.rpm | 97 kB 00:00:00\r\n(4\/6): systemd-resolved-219-78.el7_9.7.x86_64.rpm | 422 kB 00:00:00\r\n(5\/6): systemd-219-78.el7_9.7.x86_64.rpm | 5.1 MB 00:00:02\r\nsystemd-libs-219-78.el7_9.7.x8 FAILED\r\nhttp:\/\/ftp.ksu.edu.tw\/pub\/CentOS\/7.9.2009\/updates\/x86_64\/Packages\/systemd-libs-219-78.el7_9.7.x86_64.rpm: [Errno 12] Timeout on http:\/\/ftp.ksu.edu.tw\/pub\/CentOS\/7.9.2009\/updates\/x86_64\/Packages\/systemd-libs-219-78.el7_9.7.x86_64.rpm: (28, 'Connection timed out after 30001 milliseconds')\r\nTrying other mirror.\r\n(6\/6): systemd-libs-219-78.el7_9.7.x86_64.rpm | 419 kB 00:00:00\r\n---------------------------------------------------------------------------------------------------------------------------------------------------------------------\r\nTotal 211 kB\/s | 6.2 MB 00:00:30\r\nRunning transaction check\r\nRunning transaction test\r\nTransaction test succeeded\r\nRunning transaction\r\n Updating : systemd-libs-219-78.el7_9.7.x86_64 1\/11\r\n Updating : systemd-219-78.el7_9.7.x86_64 2\/11\r\n Updating : systemd-sysv-219-78.el7_9.7.x86_64 3\/11\r\n Installing : systemd-resolved-219-78.el7_9.7.x86_64 4\/11\r\n Updating : systemd-python-219-78.el7_9.7.x86_64 5\/11\r\n Updating : libgudev1-219-78.el7_9.7.x86_64 6\/11\r\n Cleanup : systemd-sysv-219-78.el7.x86_64 7\/11\r\n Cleanup : systemd-python-219-78.el7.x86_64 8\/11\r\n Cleanup : systemd-219-78.el7.x86_64 9\/11\r\n Cleanup : libgudev1-219-78.el7.x86_64 10\/11\r\n Cleanup : systemd-libs-219-78.el7.x86_64 11\/11\r\n Verifying : systemd-libs-219-78.el7_9.7.x86_64 1\/11\r\n Verifying : systemd-219-78.el7_9.7.x86_64 2\/11\r\n Verifying : systemd-sysv-219-78.el7_9.7.x86_64 3\/11\r\n Verifying : systemd-resolved-219-78.el7_9.7.x86_64 4\/11\r\n Verifying : systemd-python-219-78.el7_9.7.x86_64 5\/11\r\n Verifying : libgudev1-219-78.el7_9.7.x86_64 6\/11\r\n Verifying : systemd-python-219-78.el7.x86_64 7\/11\r\n Verifying : systemd-sysv-219-78.el7.x86_64 8\/11\r\n Verifying : systemd-libs-219-78.el7.x86_64 9\/11\r\n Verifying : libgudev1-219-78.el7.x86_64 10\/11\r\n Verifying : systemd-219-78.el7.x86_64 11\/11\r\n\r\nInstalled:\r\n systemd-resolved.x86_64 0:219-78.el7_9.7\r\n\r\nDependency Updated:\r\n libgudev1.x86_64 0:219-78.el7_9.7 systemd.x86_64 0:219-78.el7_9.7 systemd-libs.x86_64 0:219-78.el7_9.7 systemd-python.x86_64 0:219-78.el7_9.7\r\n systemd-sysv.x86_64 0:219-78.el7_9.7\r\n\r\nComplete!\r\n[root@vm249 ~]# swapoff -a\r\n[root@vm249 ~]# vi \/etc\/fstab\r\n[root@vm249 ~]# setenforce 0\r\n[root@vm249 ~]# sed -i 's\/^SELINUX=enforcing$\/SELINUX=permissive\/' \/etc\/selinux\/config\r\n[root@vm249 ~]# systemctl stop firewalld\r\n[root@vm249 ~]# systemctl disable firewalld\r\n[root@vm249 ~]# cat <<EOF | sudo tee \/etc\/modules-load.d\/k8s.conf\r\n> overlay\r\n> br_netfilter\r\n> EOF\r\noverlay\r\nbr_netfilter\r\n[root@vm249 ~]#\r\n[root@vm249 ~]# sudo modprobe overlay\r\n[root@vm249 ~]# sudo modprobe br_netfilter\r\n[root@vm249 ~]# cat <<EOF | sudo tee \/etc\/sysctl.d\/k8s.conf\r\n> net.bridge.bridge-nf-call-iptables = 1\r\n> net.bridge.bridge-nf-call-ip6tables = 1\r\n> net.ipv4.ip_forward = 1\r\n> EOF\r\nnet.bridge.bridge-nf-call-iptables = 1\r\nnet.bridge.bridge-nf-call-ip6tables = 1\r\nnet.ipv4.ip_forward = 1\r\n[root@vm249 ~]#\r\n[root@vm249 ~]# # \u5e94\u7528 sysctl \u53c2\u6570\u800c\u4e0d\u91cd\u65b0\u542f\u52a8\r\n[root@vm249 ~]# sudo sysctl --system\r\n* Applying \/usr\/lib\/sysctl.d\/00-system.conf ...\r\nnet.bridge.bridge-nf-call-ip6tables = 0\r\nnet.bridge.bridge-nf-call-iptables = 0\r\nnet.bridge.bridge-nf-call-arptables = 0\r\n* Applying \/usr\/lib\/sysctl.d\/10-default-yama-scope.conf ...\r\nkernel.yama.ptrace_scope = 0\r\n* Applying \/usr\/lib\/sysctl.d\/50-default.conf ...\r\nkernel.sysrq = 16\r\nkernel.core_uses_pid = 1\r\nkernel.kptr_restrict = 1\r\nnet.ipv4.conf.default.rp_filter = 1\r\nnet.ipv4.conf.all.rp_filter = 1\r\nnet.ipv4.conf.default.accept_source_route = 0\r\nnet.ipv4.conf.all.accept_source_route = 0\r\nnet.ipv4.conf.default.promote_secondaries = 1\r\nnet.ipv4.conf.all.promote_secondaries = 1\r\nfs.protected_hardlinks = 1\r\nfs.protected_symlinks = 1\r\n* Applying \/usr\/lib\/sysctl.d\/60-libvirtd.conf ...\r\nfs.aio-max-nr = 1048576\r\n* Applying \/etc\/sysctl.d\/99-sysctl.conf ...\r\n* Applying \/etc\/sysctl.d\/k8s.conf ...\r\nnet.bridge.bridge-nf-call-iptables = 1\r\nnet.bridge.bridge-nf-call-ip6tables = 1\r\nnet.ipv4.ip_forward = 1\r\n* Applying \/etc\/sysctl.conf ...\r\n[root@vm249 ~]# openssl genrsa -out ca.key 4096\r\nGenerating RSA private key, 4096 bit long modulus\r\n..............................................................................................................++\r\n......................................................................................++\r\ne is 65537 (0x10001)\r\n[root@vm249 ~]# ll\r\ntotal 16\r\n-rw-------. 1 root root 4682 Feb 8 12:16 anaconda-ks.cfg\r\n-rw-r--r--. 1 root root 3243 Jun 26 16:59 ca.key\r\n-rw-------. 1 root root 3711 Feb 8 12:16 original-ks.cfg\r\ndrwxr-xr-x. 3 root root 49 Jun 25 20:04 software\r\n[root@vm249 ~]# openssl req -x509 -new -nodes -sha512 -days 3650 \\\r\n> -subj \"\/C=CN\/ST=Beijing\/L=Beijing\/O=example\/OU=Personal\/CN=172.16.3.249\" \\\r\n> -key ca.key \\\r\n> -out ca.crt\r\n[root@vm249 ~]# ll\r\ntotal 20\r\n-rw-------. 1 root root 4682 Feb 8 12:16 anaconda-ks.cfg\r\n-rw-r--r--. 1 root root 2029 Jun 26 17:00 ca.crt\r\n-rw-r--r--. 1 root root 3243 Jun 26 16:59 ca.key\r\n-rw-------. 1 root root 3711 Feb 8 12:16 original-ks.cfg\r\ndrwxr-xr-x. 3 root root 49 Jun 25 20:04 software\r\n[root@vm249 ~]# openssl genrsa -out 172.16.3.249.key 4096\r\nGenerating RSA private key, 4096 bit long modulus\r\n................................++\r\n............................++\r\ne is 65537 (0x10001)\r\n[root@vm249 ~]# openssl req -sha512 -new \\\r\n> > -subj \"\/C=CN\/ST=Beijing\/L=Beijing\/O=example\/OU=Personal\/CN=172.16.3.249\" \\\r\n> > -key 172.16.3.249.key \\\r\n> > -out 172.16.3.249.csr\r\nunknown option \/C=CN\/ST=Beijing\/L=Beijing\/O=example\/OU=Personal\/CN=172.16.3.249\r\nreq [options] <infile >outfile\r\nwhere options are\r\n -inform arg input format - DER or PEM\r\n -outform arg output format - DER or PEM\r\n -in arg input file\r\n -out arg output file\r\n -text text form of request\r\n -pubkey output public key\r\n -noout do not output REQ\r\n -verify verify signature on REQ\r\n -modulus RSA modulus\r\n -nodes don't encrypt the output key\r\n -engine e use engine e, possibly a hardware device\r\n -subject output the request's subject\r\n -passin private key password source\r\n -key file use the private key contained in file\r\n -keyform arg key file format\r\n -keyout arg file to send the key to\r\n -rand file:file:...\r\n load the file (or the files in the directory) into\r\n the random number generator\r\n -newkey rsa:bits generate a new RSA key of 'bits' in size\r\n -newkey dsa:file generate a new DSA key, parameters taken from CA in 'file'\r\n -newkey ec:file generate a new EC key, parameters taken from CA in 'file'\r\n -[digest] Digest to sign with (see openssl dgst -h for list)\r\n -config file request template file.\r\n -subj arg set or modify request subject\r\n -multivalue-rdn enable support for multivalued RDNs\r\n -new new request.\r\n -batch do not ask anything during request generation\r\n -x509 output a x509 structure instead of a cert. req.\r\n -days number of days a certificate generated by -x509 is valid for.\r\n -set_serial serial number to use for a certificate generated by -x509.\r\n -newhdr output \"NEW\" in the header lines\r\n -asn1-kludge Output the 'request' in a format that is wrong but some CA's\r\n have been reported as requiring\r\n -extensions .. specify certificate extension section (override value in config file)\r\n -reqexts .. specify request extension section (override value in config file)\r\n -utf8 input characters are UTF8 (default ASCII)\r\n -nameopt arg - various certificate name options\r\n -reqopt arg - various request text options\r\n\r\n[root@vm249 ~]# openssl req -sha512 -new > -subj \"\/C=CN\/ST=Beijing\/L=Beijing\/O=example\/OU=Personal\/CN=172.16.3.249\" > -key 172.16.3.249.key > -out 172.16.3.249.csr^C\r\n[root@vm249 ~]# openssl req -sha512 -new \\\r\n> -subj \"\/C=CN\/ST=Beijing\/L=Beijing\/O=example\/OU=Personal\/CN=172.16.3.249\" \\\r\n> -key 172.16.3.249.key \\\r\n> -out 172.16.3.249.csr\r\n[root@vm249 ~]# ll\r\ntotal 28\r\n-rw-r--r--. 1 root root 1704 Jun 26 17:01 172.16.3.249.csr\r\n-rw-r--r--. 1 root root 3247 Jun 26 17:00 172.16.3.249.key\r\n-rw-------. 1 root root 4682 Feb 8 12:16 anaconda-ks.cfg\r\n-rw-r--r--. 1 root root 2029 Jun 26 17:00 ca.crt\r\n-rw-r--r--. 1 root root 3243 Jun 26 16:59 ca.key\r\n-rw-r--r--. 1 root root 0 Jun 26 17:01 -key\r\n-rw-------. 1 root root 3711 Feb 8 12:16 original-ks.cfg\r\n-rw-r--r--. 1 root root 0 Jun 26 17:01 -out\r\ndrwxr-xr-x. 3 root root 49 Jun 25 20:04 software\r\n-rw-r--r--. 1 root root 0 Jun 26 17:01 -subj\r\n[root@vm249 ~]# cat > v3.ext <<-EOF\r\n> authorityKeyIdentifier=keyid,issuer\r\n> basicConstraints=CA:FALSE\r\n> keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment\r\n> extendedKeyUsage = serverAuth\r\n> subjectAltName = IP:172.16.3.249\r\n> EOF\r\n[root@vm249 ~]# openssl x509 -req -sha512 -days 3650 \\\r\n> -extfile v3.ext \\\r\n> -CA ca.crt -CAkey ca.key -CAcreateserial \\\r\n> -in 172.16.3.249.csr \\\r\n> -out 172.16.3.249.crt\r\nSignature ok\r\nsubject=\/C=CN\/ST=Beijing\/L=Beijing\/O=example\/OU=Personal\/CN=172.16.3.249\r\nGetting CA Private Key\r\n[root@vm249 ~]# mkdir -p \/data\/cert\r\n[root@vm249 ~]# cp 172.16.3.249.crt \/data\/cert\/\r\n[root@vm249 ~]# cp 172.16.3.249.key \/data\/cert\/\r\n[root@vm249 ~]# ll\r\ntotal 40\r\n-rw-r--r--. 1 root root 2053 Jun 26 17:02 172.16.3.249.crt\r\n-rw-r--r--. 1 root root 1704 Jun 26 17:01 172.16.3.249.csr\r\n-rw-r--r--. 1 root root 3247 Jun 26 17:00 172.16.3.249.key\r\n-rw-------. 1 root root 4682 Feb 8 12:16 anaconda-ks.cfg\r\n-rw-r--r--. 1 root root 2029 Jun 26 17:00 ca.crt\r\n-rw-r--r--. 1 root root 3243 Jun 26 16:59 ca.key\r\n-rw-r--r--. 1 root root 17 Jun 26 17:02 ca.srl\r\n-rw-r--r--. 1 root root 0 Jun 26 17:01 -key\r\n-rw-------. 1 root root 3711 Feb 8 12:16 original-ks.cfg\r\n-rw-r--r--. 1 root root 0 Jun 26 17:01 -out\r\ndrwxr-xr-x. 3 root root 49 Jun 25 20:04 software\r\n-rw-r--r--. 1 root root 0 Jun 26 17:01 -subj\r\n-rw-r--r--. 1 root root 204 Jun 26 17:02 v3.ext\r\n[root@vm249 ~]# openssl x509 -inform PEM -in 172.16.3.249.crt -out 172.16.3.249.cert\r\n[root@vm249 ~]# ll\r\ntotal 44\r\n-rw-r--r--. 1 root root 2053 Jun 26 17:03 172.16.3.249.cert\r\n-rw-r--r--. 1 root root 2053 Jun 26 17:02 172.16.3.249.crt\r\n-rw-r--r--. 1 root root 1704 Jun 26 17:01 172.16.3.249.csr\r\n-rw-r--r--. 1 root root 3247 Jun 26 17:00 172.16.3.249.key\r\n-rw-------. 1 root root 4682 Feb 8 12:16 anaconda-ks.cfg\r\n-rw-r--r--. 1 root root 2029 Jun 26 17:00 ca.crt\r\n-rw-r--r--. 1 root root 3243 Jun 26 16:59 ca.key\r\n-rw-r--r--. 1 root root 17 Jun 26 17:02 ca.srl\r\n-rw-r--r--. 1 root root 0 Jun 26 17:01 -key\r\n-rw-------. 1 root root 3711 Feb 8 12:16 original-ks.cfg\r\n-rw-r--r--. 1 root root 0 Jun 26 17:01 -out\r\ndrwxr-xr-x. 3 root root 49 Jun 25 20:04 software\r\n-rw-r--r--. 1 root root 0 Jun 26 17:01 -subj\r\n-rw-r--r--. 1 root root 204 Jun 26 17:02 v3.ext\r\n[root@vm249 ~]# mkdir -p \/etc\/docker\/certs.d\/172.16.3.249\/\r\n[root@vm249 ~]# cp 172.16.3.249.cert \/etc\/docker\/certs.d\/172.16.3.249\/\r\n[root@vm249 ~]# cp 172.16.3.249.key \/etc\/docker\/certs.d\/172.16.3.249\/\r\n[root@vm249 ~]# cp ca.crt \/etc\/docker\/certs.d\/172.16.3.249\/\r\n[root@vm249 ~]# ll \/etc\/docker\/certs.d\/172.16.3.249\/\r\ntotal 12\r\n-rw-r--r--. 1 root root 2053 Jun 26 17:04 172.16.3.249.cert\r\n-rw-r--r--. 1 root root 3247 Jun 26 17:04 172.16.3.249.key\r\n-rw-r--r--. 1 root root 2029 Jun 26 17:04 ca.crt\r\n[root@vm249 ~]# mkdir \/etc\/docker\/certs.d\/172.16.3.249:8443^C\r\n[root@vm249 ~]# cd \/etc\/docker\/certs.d\/\r\n[root@vm249 certs.d]# ll\r\ntotal 0\r\ndrwxr-xr-x. 2 root root 69 Jun 26 17:04 172.16.3.249\r\n[root@vm249 certs.d]# mv 172.16.3.249 172.16.3.249:8443\r\n[root@vm249 certs.d]# ll\r\ntotal 0\r\ndrwxr-xr-x. 2 root root 69 Jun 26 17:04 172.16.3.249:8443\r\n[root@vm249 certs.d]# systemctl restart docker\r\n[root@vm249 certs.d]# journalctl -u docker.service\r\n-- Logs begin at Thu 2023-02-09 06:20:43 PST, end at Mon 2023-06-26 17:05:42 PDT. --\r\nJun 26 17:05:42 vm249 systemd[1]: Starting Docker Application Container Engine...\r\nJun 26 17:05:42 vm249 dockerd[129391]: time=\"2023-06-26T17:05:42.156371597-07:00\" level=info msg=\"Starting up\"\r\nJun 26 17:05:42 vm249 dockerd[129391]: time=\"2023-06-26T17:05:42.191182327-07:00\" level=info msg=\"Loading containers: start.\"\r\nJun 26 17:05:42 vm249 dockerd[129391]: time=\"2023-06-26T17:05:42.415895163-07:00\" level=info msg=\"Loading containers: done.\"\r\nJun 26 17:05:42 vm249 dockerd[129391]: time=\"2023-06-26T17:05:42.437600858-07:00\" level=info msg=\"Docker daemon\" commit=659604f graphdriver=overlay2 version=24.0.2\r\nJun 26 17:05:42 vm249 dockerd[129391]: time=\"2023-06-26T17:05:42.438899998-07:00\" level=info msg=\"Daemon has completed initialization\"\r\nJun 26 17:05:42 vm249 dockerd[129391]: time=\"2023-06-26T17:05:42.478909857-07:00\" level=info msg=\"API listen on \/run\/docker.sock\"\r\nJun 26 17:05:42 vm249 systemd[1]: Started Docker Application Container Engine.\r\n[root@vm249 certs.d]# journalctl -u docker.service -n 100 -f\r\n-- Logs begin at Thu 2023-02-09 06:20:43 PST. --\r\nJun 26 17:05:42 vm249 systemd[1]: Starting Docker Application Container Engine...\r\nJun 26 17:05:42 vm249 dockerd[129391]: time=\"2023-06-26T17:05:42.156371597-07:00\" level=info msg=\"Starting up\"\r\nJun 26 17:05:42 vm249 dockerd[129391]: time=\"2023-06-26T17:05:42.191182327-07:00\" level=info msg=\"Loading containers: start.\"\r\nJun 26 17:05:42 vm249 dockerd[129391]: time=\"2023-06-26T17:05:42.415895163-07:00\" level=info msg=\"Loading containers: done.\"\r\nJun 26 17:05:42 vm249 dockerd[129391]: time=\"2023-06-26T17:05:42.437600858-07:00\" level=info msg=\"Docker daemon\" commit=659604f graphdriver=overlay2 version=24.0.2\r\nJun 26 17:05:42 vm249 dockerd[129391]: time=\"2023-06-26T17:05:42.438899998-07:00\" level=info msg=\"Daemon has completed initialization\"\r\nJun 26 17:05:42 vm249 dockerd[129391]: time=\"2023-06-26T17:05:42.478909857-07:00\" level=info msg=\"API listen on \/run\/docker.sock\"\r\nJun 26 17:05:42 vm249 systemd[1]: Started Docker Application Container Engine.\r\n^C\r\n[root@vm249 certs.d]# date\r\nMon Jun 26 17:06:13 PDT 2023\r\n[root@vm249 certs.d]# cd\r\n[root@vm249 ~]# wget https:\/\/github.com\/goharbor\/harbor\/releases\/download\/v2.8.2\/harbor-online-installer-v2.8.2.tgz\r\n--2023-06-26 17:09:40-- https:\/\/github.com\/goharbor\/harbor\/releases\/download\/v2.8.2\/harbor-online-installer-v2.8.2.tgz\r\nResolving github.com (github.com)... 20.205.243.166\r\nConnecting to github.com (github.com)|20.205.243.166|:443... connected.\r\n^C\r\n[root@vm249 ~]# wget https:\/\/github.com\/goharbor\/harbor\/releases\/download\/v2.8.2\/harbor-online-installer-v2.8.2.tgz\r\n--2023-06-26 17:10:04-- https:\/\/github.com\/goharbor\/harbor\/releases\/download\/v2.8.2\/harbor-online-installer-v2.8.2.tgz\r\nResolving github.com (github.com)... 20.205.243.166\r\nConnecting to github.com (github.com)|20.205.243.166|:443... connected.\r\n^C\r\n[root@vm249 ~]# ll\r\ntotal 56\r\n-rw-r--r--. 1 root root 2053 Jun 26 17:03 172.16.3.249.cert\r\n-rw-r--r--. 1 root root 2053 Jun 26 17:02 172.16.3.249.crt\r\n-rw-r--r--. 1 root root 1704 Jun 26 17:01 172.16.3.249.csr\r\n-rw-r--r--. 1 root root 3247 Jun 26 17:00 172.16.3.249.key\r\n-rw-------. 1 root root 4682 Feb 8 12:16 anaconda-ks.cfg\r\n-rw-r--r--. 1 root root 2029 Jun 26 17:00 ca.crt\r\n-rw-r--r--. 1 root root 3243 Jun 26 16:59 ca.key\r\n-rw-r--r--. 1 root root 17 Jun 26 17:02 ca.srl\r\n-rw-r--r--. 1 root root 11032 Jun 26 17:10 harbor-online-installer-v2.8.2.tgz\r\n-rw-r--r--. 1 root root 0 Jun 26 17:01 -key\r\n-rw-------. 1 root root 3711 Feb 8 12:16 original-ks.cfg\r\n-rw-r--r--. 1 root root 0 Jun 26 17:01 -out\r\ndrwxr-xr-x. 3 root root 49 Jun 25 20:04 software\r\n-rw-r--r--. 1 root root 0 Jun 26 17:01 -subj\r\n-rw-r--r--. 1 root root 204 Jun 26 17:02 v3.ext\r\n[root@vm249 ~]# tar xvf harbor-online-installer-v2.8.2.tgz\r\nharbor\/prepare\r\nharbor\/LICENSE\r\nharbor\/install.sh\r\nharbor\/common.sh\r\nharbor\/harbor.yml.tmpl\r\n[root@vm249 ~]# cd harbor\/\r\n[root@vm249 harbor]# ll\r\ntotal 36\r\n-rw-r--r--. 1 root root 3639 Jun 2 04:46 common.sh\r\n-rw-r--r--. 1 root root 11736 Jun 2 04:46 harbor.yml.tmpl\r\n-rwxr-xr-x. 1 root root 2725 Jun 2 04:46 install.sh\r\n-rw-r--r--. 1 root root 11347 Jun 2 04:46 LICENSE\r\n-rwxr-xr-x. 1 root root 1881 Jun 2 04:46 prepare\r\n[root@vm249 harbor]# vi harbor.yml.tmpl ^C\r\n[root@vm249 harbor]# cp harbor.yml.tmpl harbor.yml\r\n[root@vm249 harbor]# vi harbor.yml\r\n[root@vm249 harbor]# .\/install.sh\r\n\r\n[Step 0]: checking if docker is installed ...\r\n\r\nNote: docker version: 24.0.2\r\n\r\n[Step 1]: checking docker-compose is installed ...\r\n\r\nNote: Docker Compose version v2.18.1\r\n\r\n\r\n[Step 2]: preparing environment ...\r\n\r\n[Step 3]: preparing harbor configs ...\r\nprepare base dir is set to \/root\/harbor\r\nUnable to find image 'goharbor\/prepare:v2.8.2' locally\r\nv2.8.2: Pulling from goharbor\/prepare\r\n06212d50621c: Pull complete\r\nc43a11a41dd8: Pull complete\r\n9e83342251c5: Pull complete\r\n628dbbe4d69c: Pull complete\r\ne02a6cdc2a2e: Pull complete\r\n74305682af4e: Pull complete\r\nd714712cc6df: Pull complete\r\n2e443303cc8f: Pull complete\r\n7b608b2485a2: Pull complete\r\ndcd76662a9cc: Pull complete\r\nDigest: sha256:72252d93c32f774567400834b95e5446706106ff51efac2a20523238617d760d\r\nStatus: Downloaded newer image for goharbor\/prepare:v2.8.2\r\nGenerated configuration file: \/config\/portal\/nginx.conf\r\nGenerated configuration file: \/config\/log\/logrotate.conf\r\nGenerated configuration file: \/config\/log\/rsyslog_docker.conf\r\nGenerated configuration file: \/config\/nginx\/nginx.conf\r\nGenerated configuration file: \/config\/core\/env\r\nGenerated configuration file: \/config\/core\/app.conf\r\nGenerated configuration file: \/config\/registry\/config.yml\r\nGenerated configuration file: \/config\/registryctl\/env\r\nGenerated configuration file: \/config\/registryctl\/config.yml\r\nGenerated configuration file: \/config\/db\/env\r\nGenerated configuration file: \/config\/jobservice\/env\r\nGenerated configuration file: \/config\/jobservice\/config.yml\r\nGenerated and saved secret to file: \/data\/secret\/keys\/secretkey\r\nSuccessfully called func: create_root_cert\r\nGenerated configuration file: \/compose_location\/docker-compose.yml\r\nClean up the input dir\r\n\r\n\r\nNote: stopping existing Harbor instance ...\r\n\r\n\r\n[Step 4]: starting Harbor ...\r\n[+] Running 60\/11\r\n \u2714 proxy 2 layers [\u28ff\u28ff] 0B\/0B Pulled 27.1s\r\n \u2714 portal 3 layers [\u28ff\u28ff\u28ff] 0B\/0B Pulled 115.4s\r\n \u2714 log 7 layers [\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff] 0B\/0B Pulled 133.2s\r\n \u2714 postgresql 10 layers [\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff] 0B\/0B Pulled 69.9s\r\n \u2714 core 9 layers [\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff] 0B\/0B Pulled 43.6s\r\n \u2714 registry 5 layers [\u28ff\u28ff\u28ff\u28ff\u28ff] 0B\/0B Pulled 16.0s\r\n \u2714 registryctl 6 layers [\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff] 0B\/0B Pulled 99.7s\r\n \u2714 redis 4 layers [\u28ff\u28ff\u28ff\u28ff] 0B\/0B Pulled 128.6s\r\n \u2714 jobservice 5 layers [\u28ff\u28ff\u28ff\u28ff\u28ff] 0B\/0B Pulled 88.9s\r\n\r\n\r\n[+] Building 0.0s (0\/0)\r\n[+] Running 10\/10\r\n \u2714 Network harbor_harbor Created 0.1s\r\n \u2714 Container harbor-log Started 1.2s\r\n \u2714 Container registryctl Started 1.9s\r\n \u2714 Container harbor-portal Started 1.5s\r\n \u2714 Container redis Started 2.1s\r\n \u2714 Container harbor-db Started 1.9s\r\n \u2714 Container registry Started 1.8s\r\n \u2714 Container harbor-core Started 2.4s\r\n \u2714 Container nginx Started 3.6s\r\n \u2714 Container harbor-jobservice Started 3.5s\r\n\u2714 ----Harbor has been installed and started successfully.----\r\n[root@vm249 harbor]# cat harbor.yml\r\n# Configuration file of Harbor\r\n\r\n# The IP address or hostname to access admin UI and registry service.\r\n# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.\r\nhostname: 172.16.3.249\r\n\r\n# http related config\r\nhttp:\r\n # port for http, default is 80. If https enabled, this port will redirect to https port\r\n port: 8080\r\n\r\n# https related config\r\nhttps:\r\n # https port for harbor, default is 443\r\n port: 8443\r\n # The path of cert and key files for nginx\r\n certificate: \/data\/cert\/172.16.3.249.crt\r\n private_key: \/data\/cert\/172.16.3.249.key\r\n\r\n# # Uncomment following will enable tls communication between all harbor components\r\n# internal_tls:\r\n# # set enabled to true means internal tls is enabled\r\n# enabled: true\r\n# # put your cert and key files on dir\r\n# dir: \/etc\/harbor\/tls\/internal\r\n\r\n# Uncomment external_url if you want to enable external proxy\r\n# And when it enabled the hostname will no longer used\r\n# external_url: https:\/\/reg.mydomain.com:8433\r\n\r\n# The initial password of Harbor admin\r\n# It only works in first time to install harbor\r\n# Remember Change the admin password from UI after launching Harbor.\r\nharbor_admin_password: Harbor12345\r\n\r\n# Harbor DB configuration\r\ndatabase:\r\n # The password for the root user of Harbor DB. Change this before any production use.\r\n password: root123\r\n # The maximum number of connections in the idle connection pool. If it <=0, no idle connections are retained.\r\n max_idle_conns: 100\r\n # The maximum number of open connections to the database. If it <= 0, then there is no limit on the number of open connections.\r\n # Note: the default number of connections is 1024 for postgres of harbor.\r\n max_open_conns: 900\r\n # The maximum amount of time a connection may be reused. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's age.\r\n # The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300ms\", \"-1.5h\" or \"2h45m\". Valid time units are \"ns\", \"us\" (or \"\u00b5s\"), \"ms\", \"s\", \"m\", \"h\".\r\n conn_max_lifetime: 5m\r\n # The maximum amount of time a connection may be idle. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's idle time.\r\n # The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300ms\", \"-1.5h\" or \"2h45m\". Valid time units are \"ns\", \"us\" (or \"\u00b5s\"), \"ms\", \"s\", \"m\", \"h\".\r\n conn_max_idle_time: 0\r\n\r\n# The default data volume\r\ndata_volume: \/data\r\n\r\n# Harbor Storage settings by default is using \/data dir on local filesystem\r\n# Uncomment storage_service setting If you want to using external storage\r\n# storage_service:\r\n# # ca_bundle is the path to the custom root ca certificate, which will be injected into the truststore\r\n# # of registry's containers. This is usually needed when the user hosts a internal storage with self signed certificate.\r\n# ca_bundle:\r\n\r\n# # storage backend, default is filesystem, options include filesystem, azure, gcs, s3, swift and oss\r\n# # for more info about this configuration please refer https:\/\/docs.docker.com\/registry\/configuration\/\r\n# filesystem:\r\n# maxthreads: 100\r\n# # set disable to true when you want to disable registry redirect\r\n# redirect:\r\n# disable: false\r\n\r\n# Trivy configuration\r\n#\r\n# Trivy DB contains vulnerability information from NVD, Red Hat, and many other upstream vulnerability databases.\r\n# It is downloaded by Trivy from the GitHub release page https:\/\/github.com\/aquasecurity\/trivy-db\/releases and cached\r\n# in the local file system. In addition, the database contains the update timestamp so Trivy can detect whether it\r\n# should download a newer version from the Internet or use the cached one. Currently, the database is updated every\r\n# 12 hours and published as a new release to GitHub.\r\ntrivy:\r\n # ignoreUnfixed The flag to display only fixed vulnerabilities\r\n ignore_unfixed: false\r\n # skipUpdate The flag to enable or disable Trivy DB downloads from GitHub\r\n #\r\n # You might want to enable this flag in test or CI\/CD environments to avoid GitHub rate limiting issues.\r\n # If the flag is enabled you have to download the `trivy-offline.tar.gz` archive manually, extract `trivy.db` and\r\n # `metadata.json` files and mount them in the `\/home\/scanner\/.cache\/trivy\/db` path.\r\n skip_update: false\r\n #\r\n # The offline_scan option prevents Trivy from sending API requests to identify dependencies.\r\n # Scanning JAR files and pom.xml may require Internet access for better detection, but this option tries to avoid it.\r\n # For example, the offline mode will not try to resolve transitive dependencies in pom.xml when the dependency doesn't\r\n # exist in the local repositories. It means a number of detected vulnerabilities might be fewer in offline mode.\r\n # It would work if all the dependencies are in local.\r\n # This option doesn't affect DB download. You need to specify \"skip-update\" as well as \"offline-scan\" in an air-gapped environment.\r\n offline_scan: false\r\n #\r\n # Comma-separated list of what security issues to detect. Possible values are `vuln`, `config` and `secret`. Defaults to `vuln`.\r\n security_check: vuln\r\n #\r\n # insecure The flag to skip verifying registry certificate\r\n insecure: false\r\n # github_token The GitHub access token to download Trivy DB\r\n #\r\n # Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough\r\n # for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000\r\n # requests per hour by specifying the GitHub access token. For more details on GitHub rate limiting please consult\r\n # https:\/\/developer.github.com\/v3\/#rate-limiting\r\n #\r\n # You can create a GitHub token by following the instructions in\r\n # https:\/\/help.github.com\/en\/github\/authenticating-to-github\/creating-a-personal-access-token-for-the-command-line\r\n #\r\n # github_token: xxx\r\n\r\njobservice:\r\n # Maximum number of job workers in job service\r\n max_job_workers: 10\r\n # The jobLogger sweeper duration (ignored if `jobLogger` is `stdout`)\r\n logger_sweeper_duration: 1 #days\r\n\r\nnotification:\r\n # Maximum retry count for webhook job\r\n webhook_job_max_retry: 3\r\n # HTTP client timeout for webhook job\r\n webhook_job_http_client_timeout: 3 #seconds\r\n\r\n# Log configurations\r\nlog:\r\n # options are debug, info, warning, error, fatal\r\n level: info\r\n # configs for logs in local storage\r\n local:\r\n # Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.\r\n rotate_count: 50\r\n # Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes.\r\n # If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G\r\n # are all valid.\r\n rotate_size: 200M\r\n # The directory on your host that store log\r\n location: \/var\/log\/harbor\r\n\r\n # Uncomment following lines to enable external syslog endpoint.\r\n # external_endpoint:\r\n # # protocol used to transmit log to external endpoint, options is tcp or udp\r\n # protocol: tcp\r\n # # The host of external endpoint\r\n # host: localhost\r\n # # Port of external endpoint\r\n # port: 5140\r\n\r\n#This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY!\r\n_version: 2.8.0\r\n\r\n# Uncomment external_database if using external database.\r\n# external_database:\r\n# harbor:\r\n# host: harbor_db_host\r\n# port: harbor_db_port\r\n# db_name: harbor_db_name\r\n# username: harbor_db_username\r\n# password: harbor_db_password\r\n# ssl_mode: disable\r\n# max_idle_conns: 2\r\n# max_open_conns: 0\r\n# notary_signer:\r\n# host: notary_signer_db_host\r\n# port: notary_signer_db_port\r\n# db_name: notary_signer_db_name\r\n# username: notary_signer_db_username\r\n# password: notary_signer_db_password\r\n# ssl_mode: disable\r\n# notary_server:\r\n# host: notary_server_db_host\r\n# port: notary_server_db_port\r\n# db_name: notary_server_db_name\r\n# username: notary_server_db_username\r\n# password: notary_server_db_password\r\n# ssl_mode: disable\r\n\r\n# Uncomment external_redis if using external Redis server\r\n# external_redis:\r\n# # support redis, redis+sentinel\r\n# # host for redis: <host_redis>:<port_redis>\r\n# # host for redis+sentinel:\r\n# # <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>\r\n# host: redis:6379\r\n# password:\r\n# # Redis AUTH command was extended in Redis 6, it is possible to use it in the two-arguments AUTH <username> <password> form.\r\n# # username:\r\n# # sentinel_master_set must be set to support redis+sentinel\r\n# #sentinel_master_set:\r\n# # db_index 0 is for core, it's unchangeable\r\n# registry_db_index: 1\r\n# jobservice_db_index: 2\r\n# trivy_db_index: 5\r\n# idle_timeout_seconds: 30\r\n\r\n# Uncomment uaa for trusting the certificate of uaa instance that is hosted via self-signed cert.\r\n# uaa:\r\n# ca_file: \/path\/to\/ca\r\n\r\n# Global proxy\r\n# Config http proxy for components, e.g. http:\/\/my.proxy.com:3128\r\n# Components doesn't need to connect to each others via http proxy.\r\n# Remove component from `components` array if want disable proxy\r\n# for it. If you want use proxy for replication, MUST enable proxy\r\n# for core and jobservice, and set `http_proxy` and `https_proxy`.\r\n# Add domain to the `no_proxy` field, when you want disable proxy\r\n# for some special registry.\r\nproxy:\r\n http_proxy:\r\n https_proxy:\r\n no_proxy:\r\n components:\r\n - core\r\n - jobservice\r\n - trivy\r\n\r\n# metric:\r\n# enabled: false\r\n# port: 9090\r\n# path: \/metrics\r\n\r\n# Trace related config\r\n# only can enable one trace provider(jaeger or otel) at the same time,\r\n# and when using jaeger as provider, can only enable it with agent mode or collector mode.\r\n# if using jaeger collector mode, uncomment endpoint and uncomment username, password if needed\r\n# if using jaeger agetn mode uncomment agent_host and agent_port\r\n# trace:\r\n# enabled: true\r\n# # set sample_rate to 1 if you wanna sampling 100% of trace data; set 0.5 if you wanna sampling 50% of trace data, and so forth\r\n# sample_rate: 1\r\n# # # namespace used to differenciate different harbor services\r\n# # namespace:\r\n# # # attributes is a key value dict contains user defined attributes used to initialize trace provider\r\n# # attributes:\r\n# # application: harbor\r\n# # # jaeger should be 1.26 or newer.\r\n# # jaeger:\r\n# # endpoint: http:\/\/hostname:14268\/api\/traces\r\n# # username:\r\n# # password:\r\n# # agent_host: hostname\r\n# # # export trace data by jaeger.thrift in compact mode\r\n# # agent_port: 6831\r\n# # otel:\r\n# # endpoint: hostname:4318\r\n# # url_path: \/v1\/traces\r\n# # compression: false\r\n# # insecure: true\r\n# # timeout: 10s\r\n\r\n# Enable purge _upload directories\r\nupload_purging:\r\n enabled: true\r\n # remove files in _upload directories which exist for a period of time, default is one week.\r\n age: 168h\r\n # the interval of the purge operations\r\n interval: 24h\r\n dryrun: false\r\n\r\n# Cache layer configurations\r\n# If this feature enabled, harbor will cache the resource\r\n# `project\/project_metadata\/repository\/artifact\/manifest` in the redis\r\n# which can especially help to improve the performance of high concurrent\r\n# manifest pulling.\r\n# NOTICE\r\n# If you are deploying Harbor in HA mode, make sure that all the harbor\r\n# instances have the same behaviour, all with caching enabled or disabled,\r\n# otherwise it can lead to potential data inconsistency.\r\ncache:\r\n # not enabled by default\r\n enabled: false\r\n # keep cache for one day by default\r\n expire_hours: 24\r\n[root@vm249 harbor]# cat harbor.yml | grep pass\r\n# The initial password of Harbor admin\r\n# Remember Change the admin password from UI after launching Harbor.\r\nharbor_admin_password: Harbor12345\r\n # The password for the root user of Harbor DB. Change this before any production use.\r\n password: root123\r\n# password: harbor_db_password\r\n# password: notary_signer_db_password\r\n# password: notary_server_db_password\r\n# password:\r\n# # Redis AUTH command was extended in Redis 6, it is possible to use it in the two-arguments AUTH <username> <password> form.\r\n# if using jaeger collector mode, uncomment endpoint and uncomment username, password if needed\r\n# # password:\r\n[root@vm249 harbor]# docker ps\r\nCONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES\r\nfacae319c827 goharbor\/nginx-photon:v2.8.2 \"nginx -g 'daemon of\u2026\" About a minute ago Up About a minute (healthy) 0.0.0.0:8080->8080\/tcp, :::8080->8080\/tcp, 0.0.0.0:8443->8443\/tcp, :::8443->8443\/tcp nginx\r\ne1ac0a3eeba4 goharbor\/harbor-jobservice:v2.8.2 \"\/harbor\/entrypoint.\u2026\" About a minute ago Up About a minute (healthy) harbor-jobservice\r\n3768487b45f7 goharbor\/harbor-core:v2.8.2 \"\/harbor\/entrypoint.\u2026\" About a minute ago Up About a minute (healthy) harbor-core\r\nea1996570673 goharbor\/harbor-db:v2.8.2 \"\/docker-entrypoint.\u2026\" About a minute ago Up About a minute (healthy) harbor-db\r\n7a69890bf969 goharbor\/registry-photon:v2.8.2 \"\/home\/harbor\/entryp\u2026\" About a minute ago Up About a minute (healthy) registry\r\ne2d7461138fc goharbor\/harbor-registryctl:v2.8.2 \"\/home\/harbor\/start.\u2026\" About a minute ago Up About a minute (healthy) registryctl\r\nc3948d042541 goharbor\/harbor-portal:v2.8.2 \"nginx -g 'daemon of\u2026\" About a minute ago Up About a minute (healthy) harbor-portal\r\na88cf970d5fa goharbor\/redis-photon:v2.8.2 \"redis-server \/etc\/r\u2026\" About a minute ago Up About a minute (healthy) redis\r\n3cca3b17f6da goharbor\/harbor-log:v2.8.2 \"\/bin\/sh -c \/usr\/loc\u2026\" About a minute ago Up About a minute (healthy) 127.0.0.1:1514->10514\/tcp harbor-log\r\n[root@vm249 harbor]# ll \/etc\/docker\/\r\ntotal 0\r\ndrwxr-xr-x. 3 root root 31 Jun 26 17:05 certs.d\r\n[root@vm249 harbor]# vi \/etc\/docker\/^C\r\n[root@vm249 harbor]# ll\r\ntotal 56\r\ndrwxr-xr-x. 3 root root 20 Jun 26 17:17 common\r\n-rw-r--r--. 1 root root 3639 Jun 2 04:46 common.sh\r\n-rw-r--r--. 1 root root 5892 Jun 26 17:17 docker-compose.yml\r\n-rw-r--r--. 1 root root 11745 Jun 26 17:16 harbor.yml\r\n-rw-r--r--. 1 root root 11736 Jun 2 04:46 harbor.yml.tmpl\r\n-rwxr-xr-x. 1 root root 2725 Jun 2 04:46 install.sh\r\n-rw-r--r--. 1 root root 11347 Jun 2 04:46 LICENSE\r\n-rwxr-xr-x. 1 root root 1881 Jun 2 04:46 prepare\r\n[root@vm249 harbor]# docker images\r\nREPOSITORY TAG IMAGE ID CREATED SIZE\r\ngoharbor\/redis-photon v2.8.2 6f4498a430ca 3 weeks ago 121MB\r\ngoharbor\/harbor-registryctl v2.8.2 fa61a236a6d6 3 weeks ago 142MB\r\ngoharbor\/registry-photon v2.8.2 f80e71363231 3 weeks ago 79.3MB\r\ngoharbor\/nginx-photon v2.8.2 3d009028f260 3 weeks ago 120MB\r\ngoharbor\/harbor-log v2.8.2 2914d282d9bf 3 weeks ago 127MB\r\ngoharbor\/harbor-jobservice v2.8.2 40118f1568a8 3 weeks ago 141MB\r\ngoharbor\/harbor-core v2.8.2 0bbbd1f379fc 3 weeks ago 165MB\r\ngoharbor\/harbor-portal v2.8.2 3e74e0758aa4 3 weeks ago 127MB\r\ngoharbor\/harbor-db v2.8.2 5126635ae9f0 3 weeks ago 174MB\r\ngoharbor\/prepare v2.8.2 eb3cf3cdd17a 3 weeks ago 163MB\r\n[root@vm249 harbor]#\r\n<\/code><\/pre>\n\n\n\n