Harbor容器镜像仓库实战：私有仓库部署与镜像安全扫描配置方案

Harbor是企业级容器镜像仓库，提供镜像存储、访问控制、安全扫描、镜像签名、复制同步等功能。在Kubernetes集群部署中，私有镜像仓库是CI/CD流水线的重要环节。本文介绍Harbor的安装部署、镜像管理、漏洞扫描及多仓库复制配置。

Harbor架构与离线安装部署

Harbor核心组件包括：nginx反向代理、registry镜像存储、core服务API、jobservice异步任务、trivy漏洞扫描、chartmuseum Helm仓库。离线安装包包含全部依赖镜像，适合内网环境部署。

下载离线安装包并解压：

wget https://github.com/goharbor/harbor/releases/download/v2.11.0/harbor-offline-installer-v2.11.0.tgz
tar xvf harbor-offline-installer-v2.11.0.tgz
cd harbor

修改配置文件harbor.yml：

hostname: harbor.example.com
http:
  port: 80
https:
  port: 443
  certificate: /data/cert/harbor.crt
  private_key: /data/cert/harbor.key
harbor_admin_password: Harbor12345
data_volume: /data/harbor
trivy:
  ignore_unfixed: false
  skip_update: false
  offline_scan: false

生成自签名证书并执行安装：

mkdir -p /data/cert
openssl genrsa -out /data/cert/harbor.key 4096
openssl req -new -x509 -key /data/cert/harbor.key -out /data/cert/harbor.crt \\
  -days 3650 -subj "/CN=harbor.example.com"

./install.sh --with-trivy --with-chartmuseum

验证服务状态：

docker-compose ps
curl -k https://localhost/api/v2.0/health

镜像推拉与项目管理

配置Docker客户端信任Harbor证书：

cp /data/cert/harbor.crt /etc/docker/certs.d/harbor.example.com/ca.crt
systemctl restart docker
docker login harbor.example.com

创建项目并推送镜像：

docker build -t harbor.example.com/myapp/frontend:v1.0 .
docker push harbor.example.com/myapp/frontend:v1.0
docker pull harbor.example.com/myapp/frontend:v1.0

使用Harbor API批量管理项目：

import requests
url = "https://harbor.example.com/api/v2.0"
auth = ("admin", "Harbor12345")

resp = requests.post(f"{url}/projects", auth=auth, json={
    "project_name": "production",
    "metadata": {"public": "false", "auto_scan": "true"}
})

resp = requests.post(f"{url}/projects/production/robots", auth=auth, json={
    "name": "cicd-robot",
    "permissions": [{"access": [{"action": "push", "resource": "repository"}]}]
})
token = resp.json()["token"]

Trivy镜像漏洞扫描与安全策略

Harbor集成Trivy扫描器，推送镜像后自动触发安全扫描。通过API开启项目自动扫描：

resp = requests.put(f"{url}/projects/production/metadatas", auth=auth, json={
    "metadata": {
        "auto_scan": "true",
        "reuse_sys_cve_allowlist": "false"
    }
})

查看镜像扫描结果：

resp = requests.get(
    f"{url}/projects/production/repositories/frontend/artifacts/v1.0/additions/vulnerabilities",
    auth=auth
)
report = resp.json()
for severity in ["Critical", "High", "Medium", "Low"]:
    count = len([v for v in report.get("report", {}).get("vulnerabilities", [])
                 if v.get("severity") == severity])
    print(f"{severity}: {count}个漏洞")

配置镜像签名验证（Cosign），只允许签名镜像部署：

export COSIGN_PASSWORD="your-password"
cosign generate-key-pair
cosign sign --key cosign.key harbor.example.com/production/frontend:v1.0

配置漏洞策略，阻止含严重漏洞的镜像被拉取：

resp = requests.put(f"{url}/system/policies/vulnerability", auth=auth, json={
    "scan_type": "vulnerability",
    "policy": {
        "mode": "block",
        "threshold": "critical"
    }
})

多仓库复制与高可用配置

配置主从仓库复制，实现跨数据中心镜像同步：

resp = requests.post(f"{url}/replication/policies", auth=auth, json={
    "name": "sync-to-dr",
    "src_registry": {"id": 1},
    "dest_registry": {"id": 2},
    "trigger": {
        "type": "scheduled",
        "schedule": "0 2 * * * *"
    },
    "filters": [
        {"type": "repository", "value": "production/*"},
        {"type": "tag", "value": "v*"}
    ],
    "deletion": True,
    "override": True
})

Harbor数据库使用外部PostgreSQL提升可用性：

external_database:
  postgres:
    host: pg-primary.internal
    port: 5432
    username: harbor
    password: HarborDB123
    core_database: harbor_core
external_redis:
  host: redis.internal
  port: 6379

Harbor镜像仓库在CI/CD流程中的典型用法：CI流水线构建镜像后推送至Harbor，Harbor自动触发Trivy安全扫描，扫描通过后通过Webhook通知部署系统。若发现Critical漏洞则阻止镜像进入生产环境，构建自动化安全闭环。多仓库复制功能可实现异地灾备，主仓库故障时从仓库可继续提供镜像拉取服务。