docker - Kubernetes 私有(private) Docker 注册表推送错误

Question

所以我已经部署了一个 Kubernetes 集群并安装了一个私有(private) Docker 注册表。这是我的注册表 Controller :

---
  apiVersion: v1
  kind: ReplicationController
  metadata:
    name: registry-master
    labels:
      name: registry-master
  spec:
    replicas: 1
    selector:
      name: registry-master
    template:
      metadata:
        labels:
          name: registry-master
      spec:
        containers:
        - name: registry-master
          image: registry
          ports:
          - containerPort: 5000
          command: ["docker-registry"]

和服务:

---
  apiVersion: v1
  kind: Service
  metadata:
    name: registry-master
    labels:
      name: registry-master
  spec:
    ports:
      # the port that this service should serve on
    - port: 5000
      targetPort: 5000
    selector:
      name: registry-master

现在我 sshed 到 Kubernetes 的一个节点并构建了一个 Ruby 应用程序容器:

cd /tmp
git clone https://github.com/RichardKnop/sinatra-redis-blog.git
cd sinatra-redis-blog
docker build -t ruby-redis-app

当我尝试标记它并将其推送到注册表时:

docker tag ruby-redis-app registry-master/ruby-redis-app
docker push 10.100.129.115:5000/registry-master/ruby-redis-app

我收到此错误:

Error response from daemon: invalid registry endpoint https://10.100.129.115:5000/v0/: unable to ping registry endpoint https://10.100.129.115:5000/v0/
v2 ping attempt failed with error: Get https://10.100.129.115:5000/v2/: read tcp 10.100.129.115:5000: connection reset by peer
 v1 ping attempt failed with error: Get https://10.100.129.115:5000/v1/_ping: read tcp 10.100.129.115:5000: connection reset by peer. If this private registry supports only HTTP or HTTPS with an unknown CA certificate, please add `--insecure-registry 10.100.129.115:5000` to the daemon's arguments. In the case of HTTPS, if you have access to the registry's CA certificate, no need for the flag; simply place the CA certificate at /etc/docker/certs.d/10.100.129.115:5000/ca.crt

知道如何解决吗？我已经为此苦苦挣扎了几个小时。

理查德

Answer 1

如果您使用 HTTPS，则必须创建自签名证书(使用您自己的 CA 授权)，或者您拥有 CA 签名证书。

如果是这样，您需要在您调用 FROM 的机器上安装此 CA 证书

将您的 CA 证书放入

/etc/ssl/certs

并运行

update-ca-certificates

有时我不得不把它也放进去

/usr/local/share/ca-certificates/

(在这两种情况下，您的 CA 文件 EXTENSION 都应该是 .pem
对于 Docker，您可能还需要将文件放入

/etc/docker/certs.d/<--your-site-url--->/ca.crt

并且文件必须命名为 ca.crt(与 .pem 文件相同但名为 ca.crt 的文件)