centos7搭建docker私人仓库的方法（kubernetes）

mkdir /mnt/registry

docker run -d \
 -p 5000:5000 \
 --restart=always \
 --name registry \
 -v /mnt/registry:/var/lib/registry \
 registry:2.6.2

vim /etc/sysconfig/docker

# 在OPTIONS下添加--insecure-registry=:5000
OPTIOnS='--selinux-enabled --log-driver=json-file --signature-verification=false --insecure-registry=10.34.31.13:5000'

# 重启docker
systemctl restart docker

docker push 10.34.31.13:5000/hello-world:v1

yum install -y openssl

vim /etc/pki/tls/openssl.cnf

# 找到v3_ca,在下面添加宿主机的IP地址
[ v3_ca ]
subjectAltName = IP:10.34.31.13

mkdir /certs
openssl req -newkey rsa:4096 -nodes -sha256 \
      -keyout /certs/domain.key -x509 -days 1000 \
      -out /certs/domain.cert

# 生成证书的过程中需要填写以下参数,在Conmmon那一栏填写你为dokcer仓库准备的域名
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:10.34.31.13:5000
Email Address []:

# 这里启动方式跟上面差别不大，多了挂载/certs文件夹和添加了两个certificate参数
docker run -d \
 --restart=always \
 --name registry \
 -v /certs:/certs \
 -v /var/lib/registry:/var/lib/registry \
 -e REGISTRY_HTTP_ADDR=0.0.0.0:5000 \
 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.cert \
 -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
 -p 5000:5000 \
 registry:2.6.2

# 以后需要使用这个仓库的机器，在客户端像这样配置一下就可以了
mkdir /etc/docker/certs.d/10.34.31.13:5000
cp /certs/domain.cert /etc/docker/certs.d/10.34.31.13:5000/ca.crt

# 现在就可以测试一下了
docker push 10.34.31.13:5000/hello-world:v1

# n3是这个节点的hostname.如果没有添加k8s客户端权限，可以在master节点上执行。
kubectl label node n3 bind-registry=ture

mkdir /var/lib/registry

kubectl create -f dockerhub-dp.yaml

# 以后需要使用这个仓库的机器，在客户端像这样配置一下就可以了
mkdir /etc/docker/certs.d/10.34.31.13:30003
cp /certs/domain.cert /etc/docker/certs.d/10.34.31.13:5000/ca.crt

apiVersion: apps/v1beta2
kind: Deployment
metadata:
 name: docker-local-hub
 namespace: kube-system
 labels:
  app: registry
spec:
 replicas: 1
 selector:
  matchLabels:
   app: registry
 template:
  metadata:
   labels:
    app: registry
  spec:
   containers:
   - name: registry
    image: registry:2.6.2
    ports:
    - containerPort: 5000
    env:
    - name: REGISTRY_HTTP_TLS_CERTIFICATE
     value: "/certs/domain.cert"
    - name: REGISTRY_HTTP_TLS_KEY
     value: "/certs/domain.key"
    volumeMounts:
    - mountPath: /var/lib/registry
     name: docker-hub
    - mountPath: /certs
     name: certs
   nodeSelector:
    bind-registry: "ture"
   volumes:
   - name: docker-hub
    hostPath:
     path: /var/lib/registry
     type: Directory
   - name: certs
    hostPath:
     path: /certs
     type: Directory
---
apiVersion: v1
kind: Service
metadata:
 name: docker-local-hub
 namespace: kube-system
 labels:
  app: registry
spec:
 selector:
  app: registry
 ports:
 - port: 5000
  targetPort: 5000
  nodePort: 30003
 type: NodePort