Rancher前奏--配置Nexus

悠悠 2022-10-18 11:27 230阅读 0赞

### 一、安装新版本Nexus ###

1.拉取镜像

docker pull sonatype/nexus3

2.启动容器

docker run -d -p 8081:8081 -p 8082:8082 -p 8083:8083 -v /etc/localtime:/etc/localtime --name nexus3   sonatype/nexus3

3.开放端口

firewall-cmd --zone=public  --permanent --add-port=8081/tcp
    
    firewall-cmd --zone=public  --permanent --add-port=8082/tcp
    
    firewall-cmd --zone=public  --permanent --add-port=8083/tcp
    
    
    systemctl restart firewalld

4.查看密码

cd /opt/sonatype/sonatype-work/nexus3
    
    cat admin.password

5.开机自启

docker update --restart=always nexus3

6.访问网址 http://ip:8081

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70][]

### 二、配置docker私有仓库 ###

1.创建blob存储

登陆之后，先创建一个用于存储镜像的空间

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 1][]

定义一个name，下边的内容会自动补全。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 2][]

然后保存即可。

### 2，创建一个hosted类型的docker仓库 ###

点击步骤如下：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 3][]

这里我们看到docker类型有三种：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 4][]

hosted : 本地存储，即同 docker 官方仓库一样提供本地私服功能。  
proxy : 提供代理其他仓库的类型，如 docker 中央仓库。  
group : 组类型，实质作用是组合多个仓库为一个地址。

先来创建一个hosted类型的私有仓库。

点击 Repository下面的Repositories – Create repository – docker(hosted) :

Name: 定义一个名称docker-local

Online: 勾选。这个开关可以设置这个Docker repo是在线还是离线。

Repository Connectors

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 5][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 6][]

### 3，创建一个proxy类型的docker仓库 ###

proxy类型仓库，可以帮助我们访问不能直接到达的网络，如另一个私有仓库，或者国外的公共仓库，如官方的dockerhub镜像库。

创建一个proxy类型的仓库

Name: proxy-docker-hub

Repository Connectors: 不设置。

Remote Storage: docker hub的proxy，https://8pf5a51j.mirror.aliyuncs.com这个是一个加速的链接

Docker Index： Use Docker Hub

Storage：idocker-hub

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 7][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 8][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 9][]

### 4.创建一个group类型的docker仓库 ###

group类型的docker仓库，是一个聚合类型的仓库。它可以将前面我们创建的3个仓库聚合成一个URL对外提供服务，可以屏蔽后端的差异性，实现类似透明代理的功能。

name：docker-group

Repository Connectors：启用了一个监听在8181端口的http连接器；

Storage：选择专用的blob存储idocker-hub。

group : 将左边可选的3个仓库，添加到右边的members下。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 10][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 11][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 12][]

### 三、测试 ###

1.pull镜像

[root@nexus ~]#  docker pull redis
    Using default tag: latest
    latest: Pulling from library/redis
    8559a31e96f4: Pull complete 
    85a6a5c53ff0: Pull complete 
    b69876b7abed: Pull complete 
    a72d84b9df6a: Pull complete 
    5ce7b314b19c: Pull complete 
    04c4bfb0b023: Pull complete 
    Digest: sha256:800f2587bf3376cb01e6307afe599ddce9439deafbd4fb8562829da96085c9c5
    Status: Downloaded newer image for redis:latest
    docker.io/library/redis:latest

2.登录私服

[root@nexus ~]# docker login -u admin -p admin idocker.io
    WARNING! Using --password via the CLI is insecure. Use --password-stdin. 
    WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
    Configure a credential helper to remove this warning. 
    See https://docs.docker.com/engine/reference/commandline/login/#credentials-store Login Succeeded

3.push镜像

docker push idocker.io/nginx

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 13][]

**其他服务器登录nexus服务器需要做的配置**

修改其他要访问nexus的服务器的daemon.josn文件

vi /etc/docker/daemon.json

添加如下内容：   自己私服的ip地址

{
    
    "registry-mirrors": [
    
          "http://192.168.xxx.xxx"
    
      ],
    
      "insecure-registries": [
    
           "http://192.168.xxx.xxx"
    
      ]
    
    }

然后重启daemon

Systemctl daemon-reload

再重启docker

systemctl restart docker

登录私服

docker login 192.168.xxx.xxx

四、Nginx分流

在此服务器上安装nginx 做分流 配置拉取和推送镜像的端口 这样就拉取或者推送镜像时 就可以直接写192.168.xxx.xxx  端口号就不用写了

cd  /etc/nginx/
    vi  nginx.conf

修改为下面内容：

user  nginx;
    worker_processes  auto;
    error_log  /var/log/nginx/error.log notice;
    pid        /var/run/nginx.pid;
    events {
        worker_connections  1024;
    }
    http{
    upstream nexus_docker_get {
        server 192.168.xxx.xxx:8181;
    }
    upstream nexus_docker_put {
        server 192.168.xxx.xxx:8182;
    }
    server {
        listen 80;
        listen 443 ssl;
        server_name idocker.io;
        access_log /var/log/nginx/idocker.io.log;
        # 证书
        ssl_certificate /etc/nginx/conf.d/ssl/out/idocker.io/idocker.io.crt; # 证书路径根据上面生成的来定
        ssl_certificate_key /etc/nginx/conf.d/ssl/out/idocker.io/idocker.io.key.pem;
        ssl_protocols TLSv1.1 TLSv1.2;
        ssl_ciphers '!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES:';
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        # disable any limits to avoid HTTP 413 for large image uploads
        client_max_body_size 0;
        # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
        chunked_transfer_encoding on;
        # 设置默认使用推送代理
        set $upstream "nexus_docker_put";
        # 当请求是GET，也就是拉取镜像的时候，这里改为拉取代理，如此便解决了拉取和推送的端口统一
        if ( $request_method ~* 'get') {
            set $upstream "nexus_docker_get";
        }
        # 只有本地仓库才支持搜索，所以将搜索请求转发到本地仓库，否则出现500报错
        if ($request_uri ~ '/search') {
            set $upstream "nexus_docker_put"; 
        }
        index index.html index.htm index.php;
        location / {
            proxy_pass http://$upstream;
            proxy_set_header Host $host;
            proxy_connect_timeout 3600;
            proxy_send_timeout 3600;
            proxy_read_timeout 3600;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_buffering off;
            proxy_request_buffering off;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto http;
        }

nginx -t测试配置文件修改后的语法是否正确

使用命令nginx -s reload命令重启让配置文件生效

### 五、账号分配 ###

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 14][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 15][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70]: /images/20221014/667de781edc94cdea4e3333ec38bd0bf.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 1]: /images/20221014/a2bc90da00f540df8b937f328e506b6a.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 2]: /images/20221014/da06faf07b0943b1b1a91d08345a303b.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 3]: /images/20221014/548e85ecb8114359b12a5807b7522ca9.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 4]: /images/20221014/a259098428eb44b3a0c1ce944bb2dbd4.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 5]: /images/20221014/e9e1d615b0d14971b24f309144e9784e.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 6]: /images/20221014/39a3f929989b4762a062b69023de3c23.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 7]: /images/20221014/541e7464efb84ea59afc6024619a7ebf.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 8]: /images/20221014/b44f9107684142c39c190aacb2a209df.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 9]: /images/20221014/560f41bd5e3946d1acda5a50d9fb8baf.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 10]: /images/20221014/b2e760b4f85d4aab98dbcd6fbac7143c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 11]: /images/20221014/19bb987bdd394be9976814da018dc3e9.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 12]: /images/20221014/07023f114c0142debad575ad4242a9fa.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 13]: /images/20221014/ab0c89417b8748a8a6d30fa72e78b468.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 14]: /images/20221014/218e6ed1ca8640919d04d35dc2d70eaa.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM5MDcxNTk5_size_16_color_FFFFFF_t_70 15]: /images/20221014/e6c81345f0334f9983c9ab7f54db8342.png