搭建基于SSL认证的Docker Registry

Docker Registry

生成SSL证书

$ openssl req -newkey rsa:4096 -nodes -sha256 -keyout alleyz.key -x509 -days 365 -out alleyz.crt

Generating a 4096 bit RSA private key............................................................................................................................................................................................++......................................................................................++writing new private key to 'alleyz.key'-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [XX]:86State or Province Name (full name) []:BeijingLocality Name (eg, city) [Default City]:BeijingOrganization Name (eg, company) [Default Company Ltd]:1233Organizational Unit Name (eg, section) []:1233Common Name (eg, your name or your server's hostname) []:alleyz.com

启动Register容器

$ sudo docker run -d -p 5000:5000 --restart=always --name registry \ -v /home/docker-registry/config/config.yml:/etc/docker/registry/config.yml  \ -v /home/docker-registry/repo:/var/lib/registry \ -v /home/docker-registry/certs:/certs \ -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/alleyz.crt \ -e REGISTRY_HTTP_TLS_KEY=/certs/alleyz.key \ registry

访问配置

1. 配置HOST

echo "10.8.177.28 alleyz.com" >> /etc/hosts

1. 下发证书
   其他需要访问的节点也需要这个操作

mkdir -p /etc/docker/certs.d/alleyz.com\:5000cp alleyz.crt /etc/docker/certs.d/alleyz.com\:5000

验证

1. 找一镜像进行tag

# docker tag alleyj/pause-amd64:3.0 alleyz.com:5000/kubernetets/pause-amd64:3.0

1. 推送至仓库

# docker push alleyz.com:5000/kubernetets/pause-amd64The push refers to a repository [alleyz.com:5000/kubernetets/pause-amd64]5f70bf18a086: Pushed 41ff149e94f2: Pushed 3.0: digest: sha256:a09bb715971a53b59980eefadcb2d82d44607916b73a4aa160bc53ced390627c size: 939

1. 去其他机器pull

docker pull alleyz.com:5000/kubernetets/pause-amd64:3.03.0: Pulling from kubernetets/pause-amd64a3ed95caeb02: Pull complete d7968197c95c: Pull complete Digest: sha256:a09bb715971a53b59980eefadcb2d82d44607916b73a4aa160bc53ced390627cStatus: Downloaded newer image for alleyz.com:5000/kubernetets/pause-amd64:3.0