以Docker API方式添加到Potrainer端点,开启Docker TLS

1.创建CA证书,服务端和客户端秘钥.

$openssl genrsa -aes256 -out ca-key.pem 4096
$openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:Queensland
Locality Name (eg, city) []:Brisbane
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Docker Inc
Organizational Unit Name (eg, section) []:Sales
Common Name (e.g. server FQDN or YOUR name) []:$HOST
Email Address []:Sven@home.org.au

PS:$HOST 是指Docker的DNS名称(原文:Replace all instances of $HOST in the following example with the DNS name of your Docker daemon’s host.)

2.创建服务器秘钥

$ openssl genrsa -out server-key.pem 4096
Generating RSA private key, 4096 bit long modulus
.....................................................................++
.................................................................................................++
e is 65537 (0x10001)

$ openssl req -subj "/CN=$HOST" -sha256 -new -key server-key.pem -out server.csr

3.CA证书签署公钥

$ echo subjectAltName = DNS:$HOST(DNS Name),IP:10.10.10.20(服务器IP地址),IP:127.0.0.1 >> extfile.cnf
$ echo extendedKeyUsage = serverAuth >> extfile.cnf
$ openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem  
 \ -CAcreateserial -out server-cert.pem -extfile extfile.cnf

4.创建客户端秘钥和证书签名请求

$ openssl genrsa -out key.pem 4096
Generating RSA private key, 4096 bit long modulus
.........................................................++
................++
e is 65537 (0x10001)

$ openssl req -subj '/CN=client' -new -key key.pem -out client.csr
$ echo extendedKeyUsage = clientAuth > extfile-client.cnf
$ openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem \
  -CAcreateserial -out cert.pem -extfile extfile-client.cnf
$ rm -v client.csr server.csr extfile.cnf extfile-client.cnf

5.修改Docker服务文件

vim /usr/lib/systemd/system/docker.service
#run 
ExecStart=/usr/bin/dockerd --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem -H unix:///var/run/docker.sock  -H=0.0.0.0:2376

6.重启服务

systemctl daemon-reload
systemctl restart docker.service 

7.Portainer添加新端点,以Docker API方式

image20200401131145644.png