Kubernetes 私有仓库

使用自签名证书

mkdir -p /data/registry/certs
openssl req \
-newkey rsa:4096 -nodes -sha256 -keyout /data/registry/certs/domain.key \
-x509 -days 36500 -out /data/registry/certs/domain.crt
# 在字段 Common Name 中指定一个域名

启动镜像仓库

docker run -d \
  --restart=always \
  --name registry \
  -v /data/registry/certs:/certs \
  -v /data/registry/data:/var/lib/registry \
  -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
  -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
  -p 443:443 \
  registry:2

配置镜像仓库地址

配置证书

mkdir -p /etc/docker/certs.d/registry.acdiost.com/
cp /data/registry/certs/registry.acdiost.com.crt /etc/docker/certs.d/registry.acdiost.com/

配置 docker 并重启

cat <<EOF | tee /etc/docker/daemon.json
{
  "insecure-registries": ["harbor.address", "gcr.io", "docker.io", "k8s.gcr.io"],
  "registry-mirrors": ["https://registry.acdiost.com", "https://registry.docker-cn.com"],
  "exec-opts": ["native.cgroupdriver=systemd"],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m"
  },
  "storage-driver": "overlay2"
}
EOF