Harbor Kubernetes Helm 설치

Harbor Kubernetes Helm 설치

오늘은 Harbor를 Kubernetes Cluster에 Helm을 통해 구축을 진행해보겠습니다.

namespace 생성을 진행하고 Istio Injection을 enabled로 설정합니다.

Istio 설치는 다음 글을 참고해주세요.

https://jeongchul.tistory.com/720

Istio Kubernetes 구축 및 Nginx 테스트

 

kubectl create ns harbor
kubectl label namespace harbor istio-injection=enabled

Helm

Helm을 통해 구축을 진행하겠습니다. harbor repository를 가져와 values.yaml을 수정합니다.

• StorageClass: nfs로 진행합니다.
• externalURL: 도메인으로 설정할 내용을 가져옵니다.
• harborAdminPassword: Harbor admin 계정에 대한 패스워드를 지정합니다. 

Storage Class의 nfs 구축 관련해서는 다음 글을 참고해주세요.

https://jeongchul.tistory.com/715

Kubernetes NFS StorageClass with MySQL

Istio의 Domain 설정 관련해서는 다음을 참고해주세요.

https://jeongchul.tistory.com/721

Cert Manager with SSL Domain with AWS Route53

 

helm repo add harbor <https://helm.goharbor.io>
helm fetch harbor/harbor --untar
cd harbor
ls

vi values.yaml
---

type: ingress

externalURL: https://harbor.xxx.com

harborAdminPassword: "[YOUR_ADMIN_HARBOR_PASSWORD]"

persistence:
  enabled: true
  # Setting it to "keep" to avoid removing PVCs during a helm delete
  # operation. Leaving it empty will delete PVCs after the chart deleted
  # (this does not apply for PVCs that are created for internal database
  # and redis components, i.e. they are never deleted automatically)
  resourcePolicy: "keep"
  persistentVolumeClaim:
    registry:
      # Use the existing PVC which must be created manually before bound,
      # and specify the "subPath" if the PVC is shared with other components
      existingClaim: ""
      # Specify the "storageClass" used to provision the volume. Or the default
      # StorageClass will be used (the default).
      # Set it to "-" to disable dynamic provisioning
      storageClass: nfs
      subPath: ""
      accessMode: ReadWriteOnce
      size: 200Gi
      annotations: {}
    jobservice:
      jobLog:
        existingClaim: ""
        storageClass: nfs
        subPath: ""
        accessMode: ReadWriteOnce
        size: 5Gi
    database:
      existingClaim: ""
      storageClass: nfs
      subPath: ""
      accessMode: ReadWriteOnce
      size: 10Gi
      annotations: {}
    redis:
      existingClaim: ""
      storageClass: nfs
      subPath: ""
      accessMode: ReadWriteOnce
      size: 5Gi
      annotations: {}
    trivy:
      existingClaim: ""
      storageClass: nfs
      subPath: ""
      accessMode: ReadWriteOnce
      size: 10Gi
      annotations: {}

helm install harbor . -n harbor

 

kubectl get all -nharbor

Jobservice 쪽 이슈 있어서 다음을 수정합니다.

• redis_url: "redis://harbor-redis.harbor.svc.cluster.local:6379"

kubectl edit cm -nharbor harbor-jobservice
---
apiVersion: v1
data:
  config.yml: |
    #Server listening port
    protocol: "http"
    port: 8080
    worker_pool:
      workers: 10
      backend: "redis"
      redis_pool:
        redis_url: "redis://harbor-redis.harbor.svc.cluster.local:6379" # <-----
        namespace: "harbor_job_service_namespace"

kubectl get all -nharbor

VirtualService

Istio 설정을 통해 도메인을 통해 들어오는 트래픽에 대한 설정을 진행합니다.

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: harbor
  namespace: harbor
spec:
  gateways:
  - default/cluster-gateway
  hosts:
  - harbor.xxx.com
  http:
  - corsPolicy:
      allowHeaders:
      - authorization
      - content-Type
      - accept
      allowMethods:
      - POST
      - GET
      - DELETE
      - PUT
      - OPTIONS
      allowOrigins:
      - regex: .*
      exposeHeaders:
      - authorization
      - location
      maxAge: 24h
    match:
    - uri:
        prefix: /api/
    - uri:
        prefix: /service/
    - uri:
        prefix: /v2/
    - uri:
        prefix: /chartrepo/
    - uri:
        prefix: /c/
    route:
    - destination:
        host: harbor-core.harbor.svc.cluster.local
        port:
          number: 80
  - corsPolicy:
      allowHeaders:
      - authorization
      - content-Type
      - accept
      allowMethods:
      - POST
      - GET
      - DELETE
      - PUT
      - OPTIONS
      allowOrigins:
      - regex: .*
      exposeHeaders:
      - authorization
      - location
      maxAge: 24h
    match:
    - uri:
        prefix: /
    route:
    - destination:
        host: harbor-portal.harbor.svc.cluster.local
        port:
          number: 80

kubectl create -f virtualservice.yaml

kubectl get vs -nharbor

Certificate

도메인을 추가를 위한 Certificate에 설정을 변경합니다.

kubectl edit certificate -nistio-system fancian-cert
---
spec:
  commonName: fancian.net
  dnsNames:
  - xxx.com
  - www.xxx.com
  - harbor.xxx.com <---

Gateway

kubectl edit gateway cluster-gateway
---
  - hosts:
    - xxx.com
    - www.xxx.com
    - harbor.xxx.com
    port:
      name: https
      number: 443
      protocol: HTTPS

Harbor

위에서 설정한 도메인으로 웹브라우저를 통해 이동합니다.

 

Docker Container Image Push Test

Docker Container Image Build를 진행합니다.

docker build --platform linux/x86_64 --tag harbor.xxx.com/xxx/xxx-api-server:alpha-v0.0.1 .

Harbor 측으로 login을 진행합니다.

docker login harbor.xxx.com

Harbor 측으로 Container Image를 Push 합니다.

docker push harbor.xxx.com/xxx/xxx-api-server:alpha-v0.0.1

Harbor WEB 브라우저에 들어가 Push 된 이미지를 확인해봅니다.

완료하였습니다! 올라간 이미지는 반대로 docker pull 명령어를 통해 가져올 수 있습니다.

GitLab CI를 활용해 Container Image를 Harbor로 Push하는 글을 소개 드립니다.

https://jeongchul.tistory.com/727

GitLab CI를 활용한 Harbor Registry로 Container Image Push

감사합니다!