K8S异常之Harbor证书过期处理（完整版流程）

1、背景

如图所示，在登录harbor仓库时， 提示证书已经过期。

2、更新证书

2.1 停止harbor

docker-compose down

[root@nb001 harbor]# ls
common  common.sh  data  docker-compose.yml  docker-compose.yml.2022-1-7  harbor.v2.3.2.tar.gz  harbor.yml  harbor.yml.2022-1-7  harbor.yml.tmpl  install.sh  LICENSE  prepare  reg  ssl
[root@nb001 harbor]# docker-compose down
Stopping nginx             ... done
Stopping harbor-jobservice ... done
Stopping harbor-core       ... done
Stopping registry          ... done
Stopping registryctl       ... done
Stopping harbor-db         ... done
Stopping redis             ... done
Stopping harbor-portal     ... done
Stopping harbor-log        ... done
Removing nginx             ... done
Removing harbor-jobservice ... done
Removing harbor-core       ... done
Removing registry          ... done
Removing registryctl       ... done
Removing harbor-db         ... done
Removing redis             ... done
Removing harbor-portal     ... done
Removing harbor-log        ... done
Removing network harbor_harbor

2.2 更换证书

编辑harbor.yml文件：更换新的证书文件路径

2.3 重新执行./prepare

说明： 过期替换证书需要重新执行prepare， 否则只重启替换证书不生效，客户端仍然报证书过期。

执行过程如下：

[root@nb001 harbor]# ./prepare 
prepare base dir is set to /data/harbor
Unable to find image 'goharbor/prepare:v2.3.2' locally
v2.3.2: Pulling from goharbor/prepare
4fc7e8c5dda0: Already exists 
e101789e272e: Pull complete 
3356ca67bae9: Pull complete 
3d33c71b0e90: Pull complete 
ab76e2d8736b: Pull complete 
9d7f4a6ec28e: Pull complete 
2f6837c65c74: Pull complete 
bc8d1bca5b85: Pull complete 
Digest: sha256:e6ae1e30c8897ca54bcc89682dbb10c2dbd08d6c9bba647eacdef6fa776d6428
Status: Downloaded newer image for goharbor/prepare:v2.3.2
Clearing the configuration file: /config/portal/nginx.conf
Clearing the configuration file: /config/log/logrotate.conf
Clearing the configuration file: /config/log/rsyslog_docker.conf
Clearing the configuration file: /config/nginx/nginx.conf
Clearing the configuration file: /config/core/env
Clearing the configuration file: /config/core/app.conf
Clearing the configuration file: /config/registry/passwd
Clearing the configuration file: /config/registry/config.yml
Clearing the configuration file: /config/registry/root.crt
Clearing the configuration file: /config/registryctl/env
Clearing the configuration file: /config/registryctl/config.yml
Clearing the configuration file: /config/db/env
Clearing the configuration file: /config/jobservice/env
Clearing the configuration file: /config/jobservice/config.yml
Generated configuration file: /config/portal/nginx.conf
Generated configuration file: /config/log/logrotate.conf
Generated configuration file: /config/log/rsyslog_docker.conf
Generated configuration file: /config/nginx/nginx.conf
Generated configuration file: /config/core/env
Generated configuration file: /config/core/app.conf
Generated configuration file: /config/registry/config.yml
Generated configuration file: /config/registryctl/env
Generated configuration file: /config/registryctl/config.yml
Generated configuration file: /config/db/env
Generated configuration file: /config/jobservice/env
Generated configuration file: /config/jobservice/config.yml
loaded secret from file: /data/secret/keys/secretkey
Generated configuration file: /compose_location/docker-compose.yml
Clean up the input dir

2.4 启动harbor

docker-compose up -d

第一次启动：如下，是提示80端口被占用了

[root@nb001 harbor]# docker-compose up -d
Creating network "harbor_harbor" with the default driver
Creating harbor-log ... done
Creating harbor-portal ... done
Creating registryctl   ... done
Creating redis         ... done
Creating harbor-db     ... done
Creating registry      ... done
Creating harbor-core   ... done
Creating nginx         ... 
Creating nginx             ... error
WARNING: Host is already in use by another container

Creating harbor-jobservice ... done

ERROR: for proxy  Cannot start service proxy: driver failed programming external connectivity on endpoint nginx (c4956aad4a480bf00a4146d0d6c295959ebd3dbdaa972e50594c781eb5e10204): Error starting userland proxy: listen tcp4 0.0.0.0:80: bind: address already in use
ERROR: Encountered errors while bringing up the project.

解决：编辑vim docker-compose.yml
将80端口改成没有被占用的端口

第二次启动：docker-compose up -d

[root@nb001 harbor]# docker-compose up -d
harbor-log is up-to-date
harbor-portal is up-to-date
registry is up-to-date
registryctl is up-to-date
redis is up-to-date
harbor-db is up-to-date
harbor-core is up-to-date
Recreating nginx ... 
Recreating nginx ... done

再次访问，问题消失！

END