Integrate Harbor into Pipelines
This tutorial demonstrates how to integrate Harbor into KubeSphere pipelines.
Prerequisites
- You need to enable the KubeSphere DevOps System.
- You need to create a workspace, a DevOps project, and a user (
project-regular
). This account needs to be invited to the DevOps project with theoperator
role. See Create Workspaces, Projects, Users and Roles if they are not ready.
Install Harbor
It is highly recommended that you install Harbor through the App Store of KubeSphere. Alternatively, install Harbor manually through Helm3.
helm repo add harbor https://helm.goharbor.io
# For a quick start, you can expose Harbor by nodeport and disable tls.
# Set externalURL to one of your node ip and make sure it can be accessed by jenkins.
helm install harbor-release harbor/harbor --set expose.type=nodePort,externalURL=http://$ip:30002,expose.tls.enabled=false
Get Harbor Credentials
After Harbor is installed, visit
<NodeIP>:30002
and log in to the console with the default account and password (admin/Harbor12345
). Click Projects in the left navigation pane and click NEW PROJECT on the Projects page.In the displayed dialog box, set a name (
ks-devops-harbor
) and click OK.Click the project you just created, and click NEW ROBOT ACCOUNT under the Robot Accounts tab.
In the displayed dialog box, set a name (
robot-test
) for the robot account and click SAVE. Make sure you select the checkbox for pushing artifact in Permissions.In the displayed dialog box, click EXPORT TO FILE to save the token.
Enable Insecure Registry
You have to configure Docker to disregard security for your Harbor registry.
Run the
vim /etc/docker/daemon.json
command on your host to edit thedaemon.json
file, enter the following contents, and save the changes.{ "insecure-registries" : ["103.61.38.55:30002"] }
Note
Make sure you replace103.61.38.55:30002
with your Harbor registry address. The default location of thedaemon.json
file is/etc/docker/daemon.json
on Linux orC:\ProgramData\docker\config\daemon.json
on Windows.Run the following commands to restart Docker for the changes to take effect.
sudo systemctl daemon-reload sudo systemctl restart docker
Note
It is suggested that you use this solution for isolated testing or in a tightly controlled, air-gapped environment. For more information, refer to Deploy a plain HTTP registry. After you finish the above operations, you can also use the images in your Harbor registry when deploying workloads in your project. You need to create an image Secret for your Harbor registry, and then select your Harbor registry and enter the absolute path of your images in Container Settings under the Container Image tab to search for your images.
Create Credentials
Log in to KubeSphere as
project-regular
, go to your DevOps project and create credentials for Harbor in Credentials under DevOps Project Settings.On the Create Credentials page, set a credential ID (
robot-test
) and select Username and password for Type. The Username field must be the same as the value ofname
in the JSON file you just downloaded and enter the value oftoken
in the file for Password/Token.Click OK to save it.
Create a Pipeline
Go to the Pipelines page and click Create. In the Basic Information tab, enter a name (
demo-pipeline
) for the pipeline and click Next.Use default values in Advanced Settings and click Create.
Edit the Jenkinsfile
Click the pipeline to go to its details page and click Edit Jenkinsfile.
Copy and paste the following contents into the Jenkinsfile. Note that you must replace the values of
REGISTRY
,HARBOR_NAMESPACE
,APP_NAME
, andHARBOR_CREDENTIAL
with your own values.pipeline { agent { node { label 'maven' } } environment { // the address of your harbor registry REGISTRY = '103.61.38.55:30002' // the project name // make sure your robot account have enough access to the project HARBOR_NAMESPACE = 'ks-devops-harbor' // docker image name APP_NAME = 'docker-example' // ‘robot-test’ is the credential ID you created on the KubeSphere console HARBOR_CREDENTIAL = credentials('robot-test') } stages { stage('docker login') { steps{ container ('maven') { // replace the Docker Hub username behind -u and do not forget ''. You can also use a Docker Hub token. sh '''echo $HARBOR_CREDENTIAL_PSW | docker login $REGISTRY -u 'robot$robot-test' --password-stdin''' } } } stage('build & push') { steps { container ('maven') { sh 'git clone https://github.com/kstaken/dockerfile-examples.git' sh 'cd dockerfile-examples/rethinkdb && docker build -t $REGISTRY/$HARBOR_NAMESPACE/$APP_NAME:devops-test .' sh 'docker push $REGISTRY/$HARBOR_NAMESPACE/$APP_NAME:devops-test' } } } } }
Note
You can pass the parameter todocker login -u
via Jenkins credentials with environment variables. However, every Harbor robot account's username contains a "$" character, which will be converted into "$$" by Jenkins when used by environment variables. Learn more.
Run the Pipeline
Save the Jenkinsfile and KubeSphere automatically creates all stages and steps on the graphical editing panel. Click Run to run the pipeline. If everything goes well, the image is pushed to your Harbor registry by Jenkins.
Feedback
Was this page Helpful?
Receive the latest news, articles and updates from KubeSphere
Thanks for the feedback. If you have a specific question about how to use KubeSphere, ask it on Slack. Open an issue in the GitHub repo if you want to report a problem or suggest an improvement.