k8s 集群搭建之 本地仓库建立https通信

一、使用自签名证书

1.1 生成自签名证书

在docker registry的server上执行：

[root@docker-node1 certs]# openssl req -newkey rsa:4096 -nodes -sha256 -keyout /root/certs/domain.key -x509 -days 365 -out /root/certs/domain.crt

红色框住部份注意：common name要填写实际的域名，不能使用IP地址，否则在使用的时候可能会提示如下错误：
Get https://192.168.2.240/v2/: x509: cannot validate certificate for 192.168.2.240 because it doesn't contain any IP SANs

1.2 重启registry镜像

[root@docker-node1 certs]# docker run -d --name=registry --restart=always -v /root/certs:/certs -e REGISTRY_HTTP_ADDR=0.0.0.0:443 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key -p 443:443 registry:2.6.2
  错误：证书不可信
[root@docker-node1 docker.service.d]# docker push reregistry.com/nginx:v1
The push refers to repository [reregistry.com/nginx]
Get https://reregistry.com/v2/: x509: certificate is valid for registry.com, not registry.com 

1.3 添加任务关系（以centos7作为示例） 在所有docker客户端添加 crt证书

[root@docker-node1 certs]# cp domain.crt /etc/pki/ca-trust/source/anchors/
[root@docker-node1 certs]# update-ca-trust 
[root@docker-node1 certs]# docker push registry.com/nginx:v1

1.4 重启docker

[root@docker-node1 certs]# systemctl restart docker

1.5 上传镜像

[root@docker-node1 certs]# docker push registry.com/nginx:v1
The push refers to repository [registry.com/nginx]
579c75bb43c0: Pushed 
67d3ae5dfa34: Pushed 
8b15606a9e3e: Pushed 
v1: digest: sha256:c0b69559d28fb325a64c6c8f47d14c26b95aa047312b29c699da10380e90b4d7 size: 948