更换Docker registry证书

拉取镜像时报错如下：

k8s@master:~/shiyu$ docker pull reg.netlab.com/tensorflow-cpu
Using default tag: latest
Error response from daemon: Get https://reg.netlab.com/v2/: x509: certificate has expired or is not yet valid

查询/etc/docker/certs下的证书是否已过期

root@master:~# openssl x509 -in /etc/docker/certs.d/reg.netlab.com/reg.netlab.com.crt -noout -dates
notBefore=Apr  1 13:21:22 2019 GMT
notAfter=Mar 31 13:21:22 2020 GMT

显然，该自签证书在2020年3月31号已过期。

重新自签新证书

• 创建~/certs文件夹存放key和密钥

  mkdir -p ~/certs
  

• 生成key

  cd ~/certs
  openssl genrsa -out reg.netlab.com.key 2048
  

• 生密钥文件

  openssl req -newkey rsa:4096 -nodes -sha256 -keyout reg.netlab.com.key -x509 -days 365 -out reg.netlab.com.crt
  

• 填写相关信息

  Country Name (2 letter code) [XX]:CN									# 你的国家名称
  State or Province Name (full name) []:guangdong
  # 省份
  Locality Name (eg, city) [Default City]:guagnzhou								# 所在城市
  Organization Name (eg, company) [Default Company Ltd]:sysu
  # 组织名称
  Organizational Unit Name (eg, section) []:netlab						# 组织单元名称
  Common Name (eg, your name or your server's hostname) []:reg.netlab.com # 域名
  Email Address []:urmsone@163.com
  

  至此，证书自签完成。

将该证书添加到docker根证书中,重启docker

注：由于是自签名证书，默认是不受Docker信任的，故而需要将证书添加到Docker的根证书中，Docker在CentOS 7/ubuntu 18中，证书存放路径是/etc/docker/certs.d/域名：

• 添加证书到docker根证书中

  mkdir -p /etc/docker/certs.d/reg.netlab.com
  cp ~/certs/reg.netlab.com.crt /etc/docker/certs.d/reg.netlab.com/
  

• 重启Docker

  systemctl restart docker
  

替换Docker registry容器中的过期证书

• 查看registry容器ID

  k8s@master:~$ docker ps |grep registry
  3eb5eda4b75e        registry.docker-cn.com/library/registry:2   "/entrypoint.sh /etc…"   13 months ago       Up 44 minutes       0.0.0.0:443->5000/tcp    registry
  b84ea71a572f        f32a97de94e1                                "/entrypoint.sh /etc…"   13 months ago       Up About an hour    0.0.0.0:5000->5000/tcp   registry_mirror
  

• 根据ID查看rigstry的挂载路径

  k8s@master:~$ docker inspect  3eb5eda4b75e
  ...
  "Binds": [
              "/root/certs:/certs",
              "/home/registry:/var/lib/registry"
          ]
  ...
  

• 将刚刚新生成的证书cp到/root/certs:/certs目录下

  root@master:~/certs# ll
  总用量 16
  drwxr-xr-x 2 root root 4096 Apr  1  2019 ./
  drwx------ 8 root root 4096 May  2 14:06 ../
  -rw-r--r-- 1 root root 2126 Apr  1  2019 reg.netlab.com.crt
  -rw------- 1 root root 3272 Apr  1  2019 reg.netlab.com.key
  

• 重启registry容器

  k8s@master:~$ systemctl restart docker
  

  至此，自签证书更新完毕！

测试

k8s@master:~/shiyu$ docker pull reg.netlab.com/tensorflow-cpu
Using default tag: latest
latest: Pulling from tensorflow-cpu
Digest: sha256:68da50778a5f80e0676c4ca617299444fc71677a2d83cacccaf7a08d08cc1df6
Status: Image is up to date for reg.netlab.com/tensorflow-cpu:latest