搭建基于TLS认证的Docker Registry

Docker Registry

生成SSL证书

$ openssl req -newkey rsa:4096 -nodes -sha256 -keyout alleyz.key -x509 -days 365 -out alleyz.crt

Generating a 4096 bit RSA private key
............................................................................................................................................................................................++
......................................................................................++
writing new private key to 'alleyz.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:86
State or Province Name (full name) []:Beijing
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:1233
Organizational Unit Name (eg, section) []:1233
Common Name (eg, your name or your server's hostname) []:alleyz.com

启动Register容器

$ sudo docker run -d -p 5000:5000 --restart=always --name registry \
 -v /home/docker-registry/repo:/var/lib/registry \
 -v /home/docker-registry/certs:/certs \
 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/alleyz.crt \
 -e REGISTRY_HTTP_TLS_KEY=/certs/alleyz.key \
 registry

访问配置

其他需要访问的节点也需要这个操作

• 配置HOST

echo "10.8.177.28 alleyz.com" >> /etc/hosts

• 下发证书

mkdir -p /etc/docker/certs.d/alleyz.com\:5000
cp alleyz.crt /etc/docker/certs.d/alleyz.com\:5000

验证

• 找一镜像进行tag

# docker tag alleyj/pause-amd64:3.0 alleyz.com:5000/kubernetets/pause-amd64:3.0

• 推送至仓库

# docker push alleyz.com:5000/kubernetets/pause-amd64

The push refers to a repository [alleyz.com:5000/kubernetets/pause-amd64]
5f70bf18a086: Pushed 
41ff149e94f2: Pushed 
3.0: digest: sha256:a09bb715971a53b59980eefadcb2d82d44607916b73a4aa160bc53ced390627c size: 939

• 去其他机器pull

docker pull alleyz.com:5000/kubernetets/pause-amd64:3.0

3.0: Pulling from kubernetets/pause-amd64
a3ed95caeb02: Pull complete 
d7968197c95c: Pull complete 
Digest: sha256:a09bb715971a53b59980eefadcb2d82d44607916b73a4aa160bc53ced390627c
Status: Downloaded newer image for alleyz.com:5000/kubernetets/pause-amd64:3.0