DevOps全链路实战 | 第 7 天：Harbor 镜像版本管理与 Tag 策略配置

# 查看镜像的 digest（不可变唯一标识）

docker inspect –format='{{index .RepoDigests 0}}' harbor.stellardata.top/app/frontend:v1.2.0

# 输出示例: harbor.stellardata.top/app/frontend@sha256:a1b2c3d4e5…

# 同一个 Tag 推送两次后 digest 不同

docker pull harbor.stellardata.top/app/frontend:v1.2.0

docker image inspect –format='{{.Id}}' harbor.stellardata.top/app/frontend:v1.2.0

# 每次重新构建后 .Id 会变化

# .gitlab-ci.yml 片段 — 构建阶段的 Tag 生成逻辑

variables:

HARBOR_REGISTRY: "harbor.stellardata.top"

IMAGE_NAME: "app/frontend"

# 短 commit hash (前 8 位)

SHORT_SHA: "${CI_COMMIT_SHORT_SHA}"

# 构建日期 (用于时间排序)

BUILD_DATE: "${CI_PIPELINE_CREATED_AT}"

build_image:

stage: build

image:

name: gcr.io/kaniko-project/executor:v1.23.0-debug

entrypoint: [""]

script:

# 生成多维度 Tag: 语义版本-commit hash

– TAG_VERSION="${CI_COMMIT_REF_NAME}-${CI_COMMIT_SHORT_SHA}"

– /kaniko/executor

–context="${CI_PROJECT_DIR}"

–dockerfile="${CI_PROJECT_DIR}/Dockerfile"

–destination="${HARBOR_REGISTRY}/${IMAGE_NAME}:${TAG_VERSION}"

–destination="${HARBOR_REGISTRY}/${IMAGE_NAME}:${CI_COMMIT_SHORT_SHA}"

–destination="${HARBOR_REGISTRY}/${IMAGE_NAME}:latest"

–build-arg="BUILD_DATE=${BUILD_DATE}"

–build-arg="GIT_COMMIT=${CI_COMMIT_SHA}"

–cache=true

–cache-repo="${HARBOR_REGISTRY}/${IMAGE_NAME}:cache"

rules:

– if: $CI_COMMIT_BRANCH == "main"

variables:

TAG_VERSION: "prod-${CI_COMMIT_SHORT_SHA}"

– if: $CI_COMMIT_BRANCH == "develop"

variables:

TAG_VERSION: "dev-${CI_COMMIT_SHORT_SHA}"

# 通过 Harbor REST API 设置 Tag 不可变规则

# 规则：匹配 prod- 前缀的 Tag 设为不可变

curl -X POST

"https://harbor.stellardata.top/api/v2.0/projects/app/repositories/frontend/immutablerules"

-H "Authorization: Basic $(echo -n 'admin:Harbor12345' | base64)"

-H "Content-Type: application/json"

-d '{

"tag_matching": "prod-*",

"repo_matching": "**",

"tag_excluding": "",

"repo_excluding": "",

"disabled": false

}'

# 验证不可变规则已生效

curl -s "https://harbor.stellardata.top/api/v2.0/projects/app/repositories/frontend/immutablerules"

-H "Authorization: Basic $(echo -n 'admin:Harbor12345' | base64)" | python3 -m json.tool

#!/usr/bin/env python3

"""

Harbor Tag Retention 策略配置脚本

为指定项目创建保留规则：

– prod-* Tag: 保留最近 30 个

– dev-* Tag: 保留最近 10 个

– 其他: 保留最近 5 个

"""

import requests

import base64

import json

HARBOR_URL = "https://harbor.stellardata.top"

USERNAME = "admin"

PASSWORD = "Harbor12345"

PROJECT_ID = 3 # app 项目 ID

auth = base64.b64encode(f"{USERNAME}:{PASSWORD}".encode()).decode()

headers = {"Authorization": f"Basic {auth}", "Content-Type": "application/json"}

# 创建保留策略

retention_policy = {

"algorithm": "or",

"rules": [

{

"action": "retain",

"scope_selectors": {

"repositories": [

{"kind": "doublestar", "decoration": "repoMatches", "pattern": "**"}

]

},

"tag_selectors": [

{"kind": "doublestar", "decoration": "matches", "pattern": "prod-*"}

],

"params": {"latest": 30}

},

{

"action": "retain",

"tag_selectors": [

{"kind": "doublestar", "decoration": "matches", "pattern": "dev-*"}

],

"params": {"latest": 10}

},

{

"action": "retain",

"tag_selectors": [

{"kind": "doublestar", "decoration": "matches", "pattern": "**"}

],

"params": {"latest": 5}

}

],

"trigger": {"kind": "Schedule", "settings": {"cron": "0 0 3 * * *"}, "references": []}

}

resp = requests.post(

f"{HARBOR_URL}/api/v2.0/retentions",

headers=headers,

json={"scope_selectors": {}, "rules": retention_policy["rules"],

"trigger": retention_policy["trigger"]}

)

print(f"Retention policy created: {resp.status_code}")

print(json.dumps(resp.json(), indent=2) if resp.status_code in (200, 201) else resp.text)

# 在 Harbor 部署目录执行垃圾回收（需先停止 Harbor）

cd /opt/harbor

docker-compose stop

# 执行垃圾回收（不带 –dry-run 为真实执行）

docker run -it –name gc –rm

-v /data/harbor/registry:/storage

-e "REGISTRY_REDIS_ADDR=redis:6379"

goharbor/registry-photon:v2.12.0 garbage-collect

–dry-run /etc/registry/config.yml

# 确认无误后执行真实回收

docker run -it –name gc –rm

-v /data/harbor/registry:/storage

-e "REGISTRY_REDIS_ADDR=redis:6379"

goharbor/registry-photon:v2.12.0 garbage-collect

/etc/registry/config.yml

# 重启 Harbor

docker-compose up -d

# Harbor values.yaml 中的 GC 配置（Helm 部署方式）

harbor:

gc:

enabled: true

schedule: "0 0 4 * * *" # 每天凌晨 4 点执行

forceSecureGc: false # 不强制停止 Harbor

persistence:

persistentVolumeClaim:

registry:

size: 200Gi

storageClass: "nfs-client"

# 1. 模拟 GitLab CI 构建推送（main 分支）

docker tag app/frontend:local harbor.stellardata.top/app/frontend:prod-a1b2c3d4

docker push harbor.stellardata.top/app/frontend:prod-a1b2c3d4

# 2. 查看 Harbor 仓库中的所有 Tag

curl -s "https://harbor.stellardata.top/api/v2.0/projects/app/repositories/frontend/artifacts?with_tag=true"

-H "Authorization: Basic $(echo -n 'admin:Harbor12345' | base64)"

| python3 -c "

import sys, json

data = json.load(sys.stdin)

for artifact in data:

digest = artifact['digest'][:19]

tags = [t['name'] for t in artifact.get('tags', [])]

push_time = artifact.get('push_time', 'N/A')

print(f' Digest: {digest}… Tags: {tags} Pushed: {push_time}')

"

# 3. 验证不可变 Tag 规则 — 尝试覆盖推送应被拒绝

docker tag nginx:latest harbor.stellardata.top/app/frontend:prod-a1b2c3d4

docker push harbor.stellardata.top/app/frontend:prod-a1b2c3d4

# 预期输出: error: tag prod-a1b2c3d4 is immutable

# 4. 查看保留策略执行日志

curl -s "https://harbor.stellardata.top/api/v2.0/retentions/1/tasks"

-H "Authorization: Basic $(echo -n 'admin:Harbor12345' | base64)"

| python3 -m json.tool | head -50