带有私有 docker 注册表 v2 的 Kubernetes

Question

I am trying to setup a private docker registry to work with Kubernetes. I've setup the registry and the master-server thats running the Kubernetes cluster can pull images from the registry without a problem. Also, I've followed the docs of Kubernetes that explain how to connect to a private docker registry (see https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ ).

However, when I try to pull images from the docker registry through Kubernetes I get the following error:

Failed to pull image "xxx.xxx.xxx.xxx:5000/helloworld:latest": rpc error: code = Unknown desc = Error response from daemon: Get https://xxx.xxx.xxx.xxx:5000/v1/_ping: x509: certificate signed by unknown authority

What I noticed is that the link that ends with v1/_ping is incorrect, it should be v2/_ping.

I ran the following command to generate my regcred:

kubectl create secret docker-registry regcred --docker-server="https://xxx.xxx.xxx.xxx:5000/v2/" --docker-username=xxxxx --docker-password=xxxxxx --docker-email=xxxx@xxx.xx

I also googled a bit and found this: https://github.com/kubernetes/kubernetes/issues/20786

These suggestions, unfortunately, it didn't help, but they do indicate that more people face the same issue.

Does someone know how to correctly setup a docker registry v2 with Kubernetes?

Thanks

Answer 1

Solved this issue, the master-server by default doesn't launch your deployments. So I needed to do the following at my slave servers:

1. Add the certificate to /etc/docker/certs.d/my-registry-domain.com[:port]/ca.crt
2. Do docker login my-registry-domain.com[:port]
3. Add the docker registry secret to Kubernetes (see https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ ) --docker-server=docker-registry-domain.com/v2/ or v1 depending on what you run
4. Now it will successfully pull images from the docker registry.

Hope it will help someone.

Answer 2

Secure regisrty 

Registry servser side (http://tech.paulcz.net/2016/01/deploying-a-secure-docker-registry/)
1.mkdir -p /opt/registry/{data,ssl,config}
2. docker run --rm \
  -v /opt/registry/ssl:/certs \
  -e SSL_IP=172.17.8.101 \
  -e SSL_DNS=registry.local \
  paulczar/omgwtfssl

3.create /opt/registry/config/registry.env
# location of registry data
REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/opt/registry/data

# location of TLK key/cert
REGISTRY_HTTP_TLS_KEY=/opt/registry/ssl/key.pem
REGISTRY_HTTP_TLS_CERTIFICATE=/opt/registry/ssl/cert.pem

# location of CA of trusted clients
REGISTRY_HTTP_TLS_CLIENTCAS_0=/opt/registry/ssl/ca.pem


4.docker run -d --name registry \
  -v /opt/registry:/opt/registry \
  -p 443:5000 --restart always \
  --env-file /opt/registry/config/registry.env \
  registry:2

5.$ docker pull alpine
Using default tag: latest
latest: Pulling from library/alpine
Digest: sha256:78a756d480bcbc35db6dcc05b08228a39b32c2b2c7e02336a2dcaa196547a41d
Status: Downloaded newer image for alpine:latest
$ docker tag alpine 127.0.0.1/alpine
$ docker push 127.0.0.1/alpine

Registry client side

6.$ sudo mkdir -p /etc/docker/certs.d/172.17.8.101 (make in all node )
$ sudo scp core@172.17.8.101:/opt/docker/registry/ca.pem \
    /etc/docker/certs.d/172.17.8.101/ca.crt

7.$ docker pull 172.17.8.101/alpine
Using default tag: latest
latest: Pulling from alpine

340b2f9a2643: Already exists 
Digest: sha256:a96155be113bb2b4b82ebbc11cf1b511726c5b41617a70e0772f8180afc72fa5
Status: Downloaded newer image for 172.17.8.101/alpine:latest

mkdir 35.187.233.18`enter code here`2
cd 35.187.233.182/
rsync -avz 35.185.179.71:/opt/registry/ssl/ca.pem .
mv ca.pem ca.crt
docker run --rm   -v /opt/registry/ssl:/certs   -e SSL_IP=35.185.179.71   -e SSL_DNS=registry.local   paulczar/omgwtfssl
docker run -d --name registry3   -v /opt/registry:/opt/registry   -p 443:5000 --restart always   --env-file /opt/registry/config/registry.env   registry:2