Registry容器仓库

1. 安装openssl证书

 yum -y install openssl -y
 vim /etc/pki/tls/openssl.cnf

2. 创建证书

mkdir /certs  &&   openssl req -newkey rsa:4096 -nodes -sha256 -keyout /certs/domain.key -x509 -days 10000 -out /certs/domain.cert

3. 在部署节点上打一个标签，让其调度上去

kubectl  label node k8s-master01 bind-registry=true

4. 创建一个映射目录

mkdir -p /var/lib/registry

5. 通过yaml创建

cat dockerhub.yaml


apiVersion: apps/v1
kind: Deployment
metadata:
  name: docker-local-hub
  namespace: kube-system
  labels:
    app: registry
spec:
  replicas: 1
  selector:
    matchLabels:
      app: registry
  template:
    metadata:
      labels:
        app: registry
    spec:
      containers:
      - name: registry
        image: registry:2
        ports:
        - containerPort: 5000
        env:
        - name: REGISTRY_HTTP_TLS_CERTIFICATE
          value: "/certs/domain.cert"
        - name: REGISTRY_HTTP_TLS_KEY
          value: "/certs/domain.key"
        volumeMounts:
        - name: docker-hub
          mountPath: /var/lib/registry 
        - name: certs       
          mountPath: /certs # 挂载容器路径下
      nodeSelector:
        bind-registry: "true" 
      volumes:
      - name: docker-hub
        hostPath:
          path: /var/lib/registry
      - name: certs
        hostPath:
          path: /certs

--- 

apiVersion: v1
kind: Service
metadata:
  name: docker-local-hub
  namespace: kube-system  
  labels:
    app: registry
spec:
  selector:
    app: registry
  ports:
  - port: 5000
    targetPort: 5000
    nodePort: 30003
  type: NodePort

6. 所有节点创建证书路径

mkdir -p /etc/docker/certs.d/192.168.42.122:30003
cp /certs/domain.cert  /etc/docker/certs.d/192.168.42.122\:30003/ca.crt

7. 测试
   
8. 上传镜像