以Docker API方式添加到Potrainer端点,开启Docker TLS
1.创建CA证书,服务端和客户端秘钥.
1
2
3
4
5
6
7
8
9
|
$openssl genrsa -aes256 -out ca-key.pem 4096
$openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:Queensland
Locality Name (eg, city) []:Brisbane
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Docker Inc
Organizational Unit Name (eg, section) []:Sales
Common Name (e.g. server FQDN or YOUR name) []:$HOST
Email Address []:Sven@home.org.au
|
PS:$HOST 是指Docker的DNS名称(原文:Replace all instances of $HOST in the following example with the DNS name of your Docker daemon’s host.)
2.创建服务器秘钥
1
2
3
4
5
6
7
|
$ openssl genrsa -out server-key.pem 4096
Generating RSA private key, 4096 bit long modulus
.....................................................................++
.................................................................................................++
e is 65537 (0x10001)
$ openssl req -subj "/CN=$HOST" -sha256 -new -key server-key.pem -out server.csr
|
3.CA证书签署公钥
1
2
3
4
|
$ echo subjectAltName = DNS:$HOST(DNS Name),IP:10.10.10.20(服务器IP地址),IP:127.0.0.1 >> extfile.cnf
$ echo extendedKeyUsage = serverAuth >> extfile.cnf
$ openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem
\ -CAcreateserial -out server-cert.pem -extfile extfile.cnf
|
4.创建客户端秘钥和证书签名请求
1
2
3
4
5
6
7
8
9
10
11
|
$ openssl genrsa -out key.pem 4096
Generating RSA private key, 4096 bit long modulus
.........................................................++
................++
e is 65537 (0x10001)
$ openssl req -subj '/CN=client' -new -key key.pem -out client.csr
$ echo extendedKeyUsage = clientAuth > extfile-client.cnf
$ openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem \
-CAcreateserial -out cert.pem -extfile extfile-client.cnf
$ rm -v client.csr server.csr extfile.cnf extfile-client.cnf
|
5.修改Docker服务文件
1
2
3
|
vim /usr/lib/systemd/system/docker.service
#run
ExecStart=/usr/bin/dockerd --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem -H unix:///var/run/docker.sock -H=0.0.0.0:2376
|
6.重启服务
1
2
|
systemctl daemon-reload
systemctl restart docker.service
|
7.Portainer添加新端点,以Docker API方式
