How to Configure a external LB for Harbor Instance

Terminology

Scenario Description

Typically, when deploying a Harbor instance via a domain name, the domain certificate is configured on the cluster LB. However, if you want to configure the domain certificate on the front-end LB (such as f5), additional configuration is required.

Common scenarios:

1. Deploy Harbor via NodePort, then forward traffic to the NodePort through the front-end LB.
2. Deploy Harbor via domain name (HTTP), then forward traffic to the cluster LB through the front-end LB, and finally the cluster LB forwards it to the Harbor service.

Configuration Method

There are various types of load balancers, but their principles and configuration methods are similar. You only need to set the HTTP Headers correctly when the load balancer forwards the traffic. The required HTTP Headers are shown in the table below:

Below is the configuration process through an actual case, for example, to access the Harbor tool UI page via the domain https://harbor.example.com and pull/push image normally.

Scenario 1: Configure Front-end LB to Forward to Harbor Service’s NodePort Service

Prerequisites

1. Harbor has been deployed via NodePort.
2. Harbor service can be accessed via http://<node-ip>:<node-port> (e.g., http://192.168.1.100:30000).

Modify Harbor Instance Access Address

1. In the left navigation bar, click Toolchain Management > Instance Management.
2. Edit the corresponding Harbor instance and change the URL to https://harbor.example.com.

Configure Front-end LB

Take Nginx configuration as an example, set the forwarding address to the NodePort address corresponding to the Harbor service:

server {
    listen 443 ssl;
    server_name https://harbor.example.com;

    # SSL configuration
    ssl_certificate /etc/nginx/certs/domain.pem;
    ssl_certificate_key /etc/nginx/certs/domain.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location / {
        # Set the forwarding address to the NodePort address corresponding to the Harbor service
        proxy_pass http://192.168.1.100:30000;
        proxy_set_header Host $host;
        proxy_redirect   off;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $server_name:$server_port;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Ssl on;
    }
}

Test Verification

Access https://harbor.example.com in the browser, you should be able to access the Harbor service UI page normally and pull/push image successfully.

Scenario 2: Configure Front-end LB to Forward to Cluster LB

Prerequisites

1. Harbor has been deployed via Ingress with HTTP protocol.
2. The cluster where Harbor is located has already configured a cluster LB, and it can be accessed externally through the IP bound to the cluster LB (e.g., http://192.168.100.10:80).

Modify Harbor Instance Access Address

1. In the left navigation bar, click Toolchain Management > Instance Management.
2. Edit the corresponding Harbor instance.
   • Change the Domain to harbor.example.com.
   • Change the Protocol to HTTP.
   • Change the URL to https://harbor.example.com.

Configure Front-end LB

Take Nginx configuration as an example, set the forwarding address to the IP address corresponding to the cluster LB:

server {
    listen 443 ssl;
    server_name https://harbor.example.com;

    # SSL configuration
    ssl_certificate /etc/nginx/certs/domain.pem;
    ssl_certificate_key /etc/nginx/certs/domain.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location / {
        # Set the forwarding address to the IP address of the cluster LB
        proxy_pass http://192.168.100.10;
        proxy_set_header Host $host;
        proxy_redirect   off;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $server_name:$server_port;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Ssl on;
    }
}

Test Verification

Access https://harbor.example.com in the browser, you should be able to access the Harbor service UI page normally and pull/push image successfully.