編輯openssl.cnf檔案

openssl.cnf 檔案位置：/etc/pki/tls/openssl.cnf

編輯/etc/pki/tls/openssl.cnf檔案，在 [v3_ca]下增加一行：

[ v3_ca ]  
subjectAltName = IP:192.168.169.125  # 此處IP設定為Docker本地私有庫所在主機IP

然後使用openssl命令在當前的certs目錄下建立了一個自簽名的證書：

[[email protected] tls]# mkdir -p certs && openssl req -newkey rsa:4096 \
 

-nodes -sha256 -keyout certs/domain.key \
-x509 -days 365 -out certs/domain.crt

在證書的建立過程中，會詢問國家、省分、城市、組織、部門和common name的資訊，其中common name資訊我填寫的是Docker私有庫主機的IP 10.0.11.150. 證書建立完畢後，在certs目錄下出現了兩個檔案：證書檔案domain.crt和私鑰檔案domain.key。

[[email protected] tls]# mkdir -p certs && openssl req -newkey rsa:4096 \
 

-nodes -sha256 -keyout certs/domain.key \
-x509 -days 365 -out certs/domain.crt

Generating a 4096 bit RSA private key
...........................................................++
..............++
writing new private key to 'certs/domain.key'
-----
You are about to be asked to enter information that will be incorporated
into
 
 your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:china
string is too long, it needs to be less than  2 bytes long
Country Name (2 letter code) [XX]:中國
string is too long, it needs to be less than  2 bytes long
Country Name (2 letter code) [XX]:CN    
State or Province Name (full name) []:TJ   
Locality Name (eg, city) [Default City]:TJ
Organization Name (eg, company) [Default Company Ltd]:TJXY
Organizational Unit Name (eg, section) []:AI    
Common Name (eg, your name or your server's hostname) []:10.0.11.150
Email Address []:
[[email protected] tls]# 

安裝Docker

在10.0.11.150主機上安裝Docker，安裝教程檢視：Docker安裝、操作常用命令

複製domain.crt到指定位置

將前面生成的domain.crt檔案複製到/etc/docker/certs.d/10.0.11.150:5000目錄下，然後重啟docker程序：

[root@mimo150 tls]# mkdir -p /etc/docker/certs.d/10.0.11.150:5000
[root@mimo150 tls]# cp certs/domain.crt /etc/docker/certs.d/10.0.11.150:5000/ca.crt
[root@mimo150 tls]# systemctl restart docker

執行registry容器

在Docker私有庫節點10.0.11.150上執行registry容器，並暴露容器的5000埠：

[[email protected] tls]# docker run -d -p 5000:5000 --restart=always \
 --name bigdata_docker_registry \
 --privileged=true \
 -v /etc/pki/tls/certs/certs:/certs \
 -v /data/docker/registry:/var/lib/registry \
 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
 -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
 docker.io/registry:latest

• -p 5000:5000 ： 指定外部埠5000對映容器內埠5000

• –name registry ： 容器名稱

• -v /etc/pki/tls/certs:/certs ： 指定外部目錄/etc/pki/tls/certs對映容器內部目錄/certs

• -v /data/docker/registry:/var/lib/registry : 同上一樣，指定目錄掛載對映

同步簽名證書到Docker節點

最後，將domain.crt檔案複製到Kubernetes叢集裡的所有節點的/etc/docker/certs.d/10.0.11.150:5000目錄下，並重啟各節點的docker程序，例如在10.0.11.151節點上執行：

# mkdir -p /etc/docker/certs.d/10.0.11.150:5000
# scp [email protected]:~/certs/domain.crt /etc/docker/certs.d/10.0.11.150:5000/ca.crt
# systemctl restart docker

至此，Docker私有庫搭建完成。