問(wèn)題現(xiàn)象:
[root@localhost ~]# docker image pull xxx.com.cn/centos7
Using default tag: latest
Error response from daemon: Get https://xxx.com.cn/v1/_ping: x509: certificate has expired or is not yet valid
可能的原因分析:
linux使用查看date查看當(dāng)前時(shí)間,與證書(shū)的有效時(shí)間作比對(duì),得出具體的原因,可能為以下二種之一:
1.本機(jī)的時(shí)間不對(duì);
2.Registry的證書(shū)確實(shí)已過(guò)期;
解決方法:
1.本機(jī)的時(shí)間不對(duì);
修改本機(jī)時(shí)間即可
2.Registry的證書(shū)確實(shí)已過(guò)期;
對(duì) Registry 創(chuàng)建 SSL 安全例外,放棄對(duì) Registry 服務(wù)器證書(shū)合法性校驗(yàn),但是具有安全風(fēng)險(xiǎn).
insecure registries 使能后, Docker 將以以下步驟嘗試https連接:
首先嘗試使用HTTPS.
如果 HTTPS 連接可達(dá)但是證書(shū)不可用, 忽略證書(shū)錯(cuò)誤;
如果 HTTPS 連接不可用, 使用 HTTP.
centos 在 /etc/docker/ 目錄下創(chuàng)建daemon的配置文件 daemon.json ,將你的目標(biāo) Registry 所處的 IP 地址段或者具體的服務(wù)域名端口號(hào)寫(xiě)入 json 文件,
舉個(gè)例子,筆者的服務(wù)器所在網(wǎng)段為10.0.0.0/8.那么內(nèi)容如下:
{
"insecure-registries" : ["10.0.0.0/8"]
}
也可以使用域名加端口號(hào),示例如下:
{
"insecure-registries" : ["myregistrydomain.com:5000"]
}
windows 則修改文件 C:\ProgramData\docker\config\daemon.json ,格式與linux操作的一樣.
重啟docker服務(wù).
查看是否生效,注意 Insecure Registries 字段.
[root@localhost ~]# docker info
docker info :
Containers: 0
Running: 0
Paused: 0
Stopped: 0
Images: 2
Server Version: 17.05.0-ce
Storage Driver: overlay
Backing Filesystem: xfs
Supports d_type: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: bridge host macvlan null overlay
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 9048e5e50717ea4497b757314bad98ea3763c145
runc version: 9c2d8d184e5da67c95d601382adf14862e4f2228
init version: 949e6fa
Security Options:
seccomp
Profile: default
Kernel Version: 3.10.0-693.el7.x86_64
Operating System: CentOS Linux 7 (Core)
OSType: linux
Architecture: x86_64
CPUs: 24
Total Memory: 62.74GiB
Name: localhost.localdomain
ID: 755F:OEFV:VP3S:BMGQ:VUFW:WGT5:YQHO:EW6T:AAVE:NHS2:TPV3:SBTJ
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Experimental: false
Insecure Registries:
10.0.0.0/8
127.0.0.0/8
Live Restore Enabled: false
如何查看服務(wù)器證書(shū)有效期
以火狐瀏覽器為例
補(bǔ)充：Docker私有倉(cāng)庫(kù)更換過(guò)期的自簽證書(shū)
更換Docker registry證書(shū)
拉取鏡像時(shí)報(bào)錯(cuò)如下：
k8s@master:~/shiyu$ docker pull reg.netlab.com/tensorflow-cpu
Using default tag: latest
Error response from daemon: Get https://reg.netlab.com/v2/: x509: certificate has expired or is not yet valid
查詢/etc/docker/certs下的證書(shū)是否已過(guò)期
root@master:~# openssl x509 -in /etc/docker/certs.d/reg.netlab.com/reg.netlab.com.crt -noout -dates
notBefore=Apr 1 13:21:22 2019 GMT
notAfter=Mar 31 13:21:22 2020 GMT
顯然，該自簽證書(shū)在2020年3月31號(hào)已過(guò)期。
重新自簽新證書(shū)
創(chuàng)建~/certs文件夾存放key和密鑰
生成key
cd ~/certs
openssl genrsa -out reg.netlab.com.key 2048
生密鑰文件
openssl req -newkey rsa:4096 -nodes -sha256 -keyout reg.netlab.com.key -x509 -days 365 -out reg.netlab.com.crt
填寫(xiě)相關(guān)信息
Country Name (2 letter code) [XX]:CN # 你的國(guó)家名稱
State or Province Name (full name) []:guangdong
# 省份
Locality Name (eg, city) [Default City]:guagnzhou # 所在城市
Organization Name (eg, company) [Default Company Ltd]:sysu
# 組織名稱
Organizational Unit Name (eg, section) []:netlab # 組織單元名稱
Common Name (eg, your name or your server's hostname) []:reg.netlab.com # 域名
Email Address []:urmsone@163.com
至此，證書(shū)自簽完成。
將該證書(shū)添加到docker根證書(shū)中,重啟docker
注：由于是自簽名證書(shū)，默認(rèn)是不受Docker信任的，故而需要將證書(shū)添加到Docker的根證書(shū)中，Docker在CentOS 7/ubuntu 18中，證書(shū)存放路徑是/etc/docker/certs.d/域名：
添加證書(shū)到docker根證書(shū)中
mkdir -p /etc/docker/certs.d/reg.netlab.com
cp ~/certs/reg.netlab.com.crt /etc/docker/certs.d/reg.netlab.com/
重啟Docker
替換Docker registry容器中的過(guò)期證書(shū)
查看registry容器ID
k8s@master:~$ docker ps |grep registry
3eb5eda4b75e registry.docker-cn.com/library/registry:2 "/entrypoint.sh /etc…" 13 months ago Up 44 minutes 0.0.0.0:443->5000/tcp registry
b84ea71a572f f32a97de94e1 "/entrypoint.sh /etc…" 13 months ago Up About an hour 0.0.0.0:5000->5000/tcp registry_mirror
根據(jù)ID查看rigstry的掛載路徑
k8s@master:~$ docker inspect 3eb5eda4b75e
...
"Binds": [
"/root/certs:/certs",
"/home/registry:/var/lib/registry"
]
...
將剛剛新生成的證書(shū)cp到/root/certs:/certs目錄下
root@master:~/certs# ll
總用量 16
drwxr-xr-x 2 root root 4096 Apr 1 2019 ./
drwx------ 8 root root 4096 May 2 14:06 ../
-rw-r--r-- 1 root root 2126 Apr 1 2019 reg.netlab.com.crt
-rw------- 1 root root 3272 Apr 1 2019 reg.netlab.com.key
重啟registry容器
k8s@master:~$ systemctl restart docker
至此，自簽證書(shū)更新完畢！
測(cè)試
k8s@master:~/shiyu$ docker pull reg.netlab.com/tensorflow-cpu
Using default tag: latest
latest: Pulling from tensorflow-cpu
Digest: sha256:68da50778a5f80e0676c4ca617299444fc71677a2d83cacccaf7a08d08cc1df6
Status: Image is up to date for reg.netlab.com/tensorflow-cpu:latest
以上為個(gè)人經(jīng)驗(yàn)，希望能給大家一個(gè)參考，也希望大家多多支持腳本之家。如有錯(cuò)誤或未考慮完全的地方，望不吝賜教。
