一、下載官方registry鏡像并啟動(dòng)測(cè)試
#docker pull registry
#mkdir /opt/data/registry -pv
# docker run -d -p 5000:5000 -v /opt/data/registry/:/var/lib/registry --name local-hub registry
如果不需要ssl安全認(rèn)證，可以在/etc/docker/daemon.json 添加如下信息，默認(rèn)是要啟用ssl認(rèn)證，不添加無(wú)法使用，IP地址替換為自己registry主機(jī)的IP地址。
{
"registry-mirror": [
"https://uf3mgws6.mirror.aliyuncs.com"
],
"insecure-registries": [
"192.168.15.102:5000"
]
}
添加好以后，提交鏡像測(cè)試
#docker tag java/tomcat:1.8.0_192 192.168.15.102:5000/java/tomcat:1.8.0_192
#docker push 192.168.15.102:5000/java/tomcat:1.8.0_192
#curl 192.168.15.102:5000/v2/_catalog #訪問(wèn)測(cè)試是否是否成功
二、配置私有CA認(rèn)證機(jī)構(gòu)
#cd /etc/pki/CA
#(umask 077; openssl genrsa -out private/cakey.pem) #生成一對(duì)密鑰
#openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3667 #生成自簽證書(shū)，然后填寫相關(guān)信息
創(chuàng)建相應(yīng)文件,如果/etc/pki/CA已經(jīng)有這些文件夾可以不用創(chuàng)建
#mkdir certs crl newcerts
#touch index.txt
#echo 00 > serial #設(shè)置序列號(hào)
三、創(chuàng)建認(rèn)證證書(shū)
#mkdir /root/hub
#cd /root/hub
#(umask 077; openssl genrsa 1024 >hub.key) #創(chuàng)建一對(duì)1024位長(zhǎng)度的密鑰
#openssl req -new -key hub.key -out hub.csr #生成證書(shū)頒發(fā)請(qǐng)求（然后將請(qǐng)求傳送給CA服務(wù)器,如果認(rèn)證服務(wù)器也是同一臺(tái)服務(wù)器就不用拷貝），此處填寫的信息要和前面CA生成自簽證書(shū)時(shí)候填寫的信息要一致
# openssl ca -in ./hub.csr -out ./hub.crt -days 3650 #簽署此證書(shū)10年的有效期
錯(cuò)誤1：
wrong number of fields on line 1 (looking for field 6, got 1, '' left)
原因：是你的index.txt文件不為空，改為空文件即可。
錯(cuò)誤2：
error while loading serial number
3078239980:error:0D066096:asn1 encoding routines:a2i_ASN1_INTEGER:short line:f_int.c:215:
原因：是因?yàn)閟erial文件中沒(méi)有賦初值，即沒(méi)有執(zhí)行echo 00 > serial
四、配置私有倉(cāng)庫(kù)
#mkdir {ssl,auth}
#mv hub.crt hub.key ./ssl
#rm -rf hub.crs
#docker run --rm --entrypoint htpasswd registry -Bbn admin admin123 > auth/nginx.htpasswd #生成 http 認(rèn)證文件，賬號(hào)密碼替換成自己的
配置config.yml文件，注意對(duì)齊
#cat config.yml
version: 0.1 log: accesslog: disabled: true level: debug formatter: text fields: service: registry environment: staging storage: delete: enabled: true cache: blobdescriptor: inmemory filesystem: rootdirectory: /var/lib/registry auth: htpasswd: realm: basic-realm path: /etc/docker/registry/auth/nginx.htpasswd http: addr: :443 host: https://hub.amd5.cn headers: X-Content-Type-Options: [nosniff] http2: disabled: false tls: certificate: /etc/docker/registry/ssl/hub.crt key: /etc/docker/registry/ssl/hub.key health: storagedriver: enabled: true interval: 10s threshold: 3
五、安裝docker-compose
1、在 Linux 64 位系統(tǒng)上直接下載對(duì)應(yīng)的二進(jìn)制包
#curl -L https://github.com/docker/compose/releases/download/1.17.1/docker-compose-`uname -s`-`uname -m` > /usr/local/bin/docker-compose
#chmod +x /usr/local/bin/docker-compose
2、bash補(bǔ)全命令
#curl -L https://raw.githubusercontent.com/docker/compose/1.8.0/contrib/completion/bash/docker-compose > /etc/bash_completion.d/docker-compose
3、編輯docker-compose.yml文件
#cat docker-compose.yml
version: '3' services: registry: image: registry ports: - "443:443" volumes: - ./:/etc/docker/registry - registry-data:/var/lib/registry volumes: registry-data:
4、配置host文件
# cat << EOF >> /etc/hosts
> 192.168.15.102 hub.amd5.cn
> EOF
5、配置讓docker識(shí)別證書(shū)，否則docker login會(huì)報(bào)錯(cuò)Error response from daemon: Get https://hub.amd5.cn/v1/users/: x509: certificate signed by unknown authority
#cat /etc/pki/CA/cacert.pem >>/etc/pki/tls/certs/ca-bundle.crt #讓操作系統(tǒng)信任我們的自簽名證書(shū)，如果需要在其他服務(wù)器登錄上傳下載鏡像，也需要把此文件內(nèi)容添加到對(duì)應(yīng)服務(wù)器的ca-bundle.crt 里面
#mkdir /etc/docker/certs.d
#cp /etc/pki/CA/cacert.pem /etc/docker/certs.d/ca.crt
#systemctl restart docker
#docker-compose up -d #啟動(dòng)測(cè)試
六、上傳下載測(cè)試
1、上傳鏡像測(cè)試
鏡像封裝參考docker封裝java/tomcat最小鏡像
#docker tag java/tomcat:1.8.0_192 hub.amd5.cn/java/tomcat:1.8.0_192 #在另外一臺(tái)服務(wù)器tag以后測(cè)試上傳
#docker push hub.amd5.cn/java/tomcat:1.8.0_192
2、查看證書(shū)
3、添加倉(cāng)庫(kù)地址
#cat /etc/docker/daemon.json
{
"registry-mirrors":[
"https://uf3mgws6.mirror.aliyuncs.com"
],
"insecure-registries":[
"https://hub.amd5.cn"
]
}
4、配置kubernetes拉取私有倉(cāng)庫(kù)鏡像
#kubectl create secret docker-registry registrysecret --docker-server=hub.amd5.cn --docker-username=admin --docker-password=admin123 #創(chuàng)建secret
#kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "registrysecret"}]}' #將該密鑰設(shè)置到k8s的默認(rèn)賬號(hào)中
#kubectl run java --image=hub.amd5.cn/java/tomcat:1.8.0_192 --relicas=2 #拉取鏡像測(cè)試
