Docker私有倉庫更換過期的自簽證書

• 容器雲
• docker

更換Docker registry證書

拉取映象時報錯如下：

k8s@master:~/shiyu$ docker pull reg.netlab.com/tensorflow-cpu
Using default tag: latest
Error response from daemon: Get https://reg.netlab.com/v2/: x509: certificate has expired or is not yet valid

查詢/etc/docker/certs下的證書是否已過期

root@master:~# openssl x509 -in /etc/docker/certs.d/reg.netlab.com/reg.netlab.com.crt -noout -dates
notBefore=Apr  1 13:21:22 2019 GMT
notAfter=Mar 31 13:21:22 2020 GMT
 

顯然，該自簽證書在2020年3月31號已過期。

重新自籤新證書

• 建立~/certs資料夾存放key和金鑰

  mkdir -p ~/certs
  

• 生成key

  cd ~/certs
  openssl genrsa -out reg.netlab.com.key 2048
  

• 生金鑰檔案

  openssl req -newkey rsa:4096 -nodes -sha256 -keyout reg.netlab.com.key -x509 -days 365 -out reg.netlab.com.crt
  

• 填寫相關資訊

  Country Name (2 letter code) [XX]:CN									# 你的國家名稱
  State or Province Name (full name) []:guangdong
  # 省份
  Locality Name (eg, city) [Default City]:guagnzhou								# 所在城市
  Organization Name (eg, company) [Default Company Ltd]:sysu
  # 組織名稱
  Organizational Unit Name (eg, section) []:netlab						# 組織單元名稱
  Common Name (eg, your name or your server's hostname) []:reg.netlab.com # 域名
  Email Address []:[email protected]
   
  

  至此，證書自簽完成。

將該證書新增到docker根證書中,重啟docker

注：由於是自簽名證書，預設是不受Docker信任的，故而需要將證書新增到Docker的根證書中，Docker在CentOS 7/ubuntu 18中，證書存放路徑是/etc/docker/certs.d/域名：

• 新增證書到docker根證書中

  mkdir -p /etc/docker/certs.d/reg.netlab.com
  cp ~/certs/reg.netlab.com.crt /etc/docker/certs.d/reg.netlab.com/
  

• 重啟Docker

  systemctl restart docker
  

替換Docker registry容器中的過期證書

• 檢視registry容器ID

  k8s@master:~$ docker ps |grep registry
  3eb5eda4b75e        registry.docker-cn.com/library/registry:2   "/entrypoint.sh /etc…"   13 months ago       Up 44 minutes       0.0.0.0:443->5000/tcp    registry
  b84ea71a572f        f32a97de94e1                                "/entrypoint.sh /etc…"   13 months ago       Up About an hour    0.0.0.0:5000->5000/tcp   registry_mirror
  

• 根據ID檢視rigstry的掛載路徑

  k8s@master:~$ docker inspect  3eb5eda4b75e
  ...
  "Binds": [
              "/root/certs:/certs",
              "/home/registry:/var/lib/registry"
          ]
  ...
  

• 將剛剛新生成的證書cp到/root/certs:/certs目錄下

  root@master:~/certs# ll
  總用量 16
  drwxr-xr-x 2 root root 4096 Apr  1  2019 ./
  drwx------ 8 root root 4096 May  2 14:06 ../
  -rw-r--r-- 1 root root 2126 Apr  1  2019 reg.netlab.com.crt
  -rw------- 1 root root 3272 Apr  1  2019 reg.netlab.com.key
  

• 重啟registry容器

  k8s@master:~$ systemctl restart docker
  

  至此，自簽證書更新完畢！

測試

k8s@master:~/shiyu$ docker pull reg.netlab.com/tensorflow-cpu
Using default tag: latest
latest: Pulling from tensorflow-cpu
Digest: sha256:68da50778a5f80e0676c4ca617299444fc71677a2d83cacccaf7a08d08cc1df6
Status: Image is up to date for reg.netlab.com/tensorflow-cpu:latest