《OpenShift 4.x HOL教程汇总》
说明：本文已经在OpenShift 4.7环境中验证

文章目录

获得OpenShift Internal Registry的访问证书
- 准备环境
- 方法1
- 方法2
- 方法3
- 验证用CA证书访问
用Token访问Internal Registry
- 获取Token
- 验证用Token访问
参考

通常我们是使用username/password登录OpenShift，不过还可以使用以下方法获得访问CA证书或Token，然后利用它们作为访问OpenShift的凭证。

X.509 Certificates：Requires a HTTPS connection to the API server.
OAuth Access Tokens：Sent as an Authorization: Bearer… header or an access_token=… query parameter

获得OpenShift Internal Registry的访问证书

准备环境

安装软件

$ yum install -f podman skopeo java-1.8.0-openjdk

开启OpenShift内部的registry的Route。

$ oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge
$ REGISTRY=$(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')

方法1

进入到操作系统的root用户，执行以下命令获得OpenShift的CA证书。说明：由于是自签名，所以提示错误，可以忽略。

$ openssl s_client -showcerts -connect ${REGISTRY}:443 < /dev/null | awk '/BEGIN/ {c=1; print >"openshift-ca.crt"; next} /END/ {print >"openshift-ca.crt"; exit}; c{print >"openshift-ca.crt"}'
depth=1 CN = ingress-operator@1620998392
verify error:num=19:self signed certificate in certificate chain
DONE

查看证书内容。

$ cat openshift-ca.crt
$ openssl x509 -noout -text -in openshift-ca.crt

将证书复制到podman的默认目录。说明：podman缺省从/etc/containers/certs.d存放CA证书。

$ mkdir -p /etc/containers/certs.d/${REGISTRY}
$ cp openshift-ca.crt /etc/containers/certs.d/${REGISTRY}

方法2

首先开启OpenShift内部的registry的Route。

$ POD=$(oc get pod -n openshift-authentication | grep oauth-openshift | head -n 1 | cut -d " " -f 1)
$ oc exec $POD -n openshift-authentication -- cat /run/secrets/kubernetes.io/serviceaccount/ca.crt > openshift_ca.crt

将证书复制到系统缺省存放目录。说明：使用系统缺省存放目录，需执行update-ca-trust通知系统。

$ cp openshift_ca.crt /etc/pki/ca-trust/source/anchors/
$ update-ca-trust extract

方法3

$ keytool -printcert -sslserver $REGISTRY -rfc > /etc/pki/ca-trust/source/anchors/myregistry.crt
$ update-ca-trust

验证用CA证书访问

使用证书查看OpenShift中的openshift/nodejs镜像信息。

$ TOKEN=$(oc whoami -t)
$ skopeo inspect docker://${REGISTRY}/openshift/nodejs
{"Name": "default-route-openshift-image-registry.apps.cluster-beijing-f5b3.beijing-f5b3.sandbox1120.opentlc.com/openshift/nodejs","Digest": "sha256:b77bb2f8d35ae3f30998135387c73a3943222dd0948ef9be3eb87207b3fba99a","RepoTags": ["12","latest","10"],"Created": "2020-07-22T06:35:50.433115Z","DockerVersion": "1.13.1","Labels": {"architecture": "x86_64","build-date": "2020-07-22T06:34:32.929721","com.redhat.build-host": "cpt-1006.osbs.prod.upshift.rdu2.redhat.com","com.redhat.component": "rh-nodejs12-container","com.redhat.deployments-dir": "/opt/app-root/src","com.redhat.dev-mode": "DEV_MODE:false","com.redhat.dev-mode.port": "DEBUG_PORT:5858","com.redhat.license_terms": "https://www.redhat.com/en/about/red-hat-end-user-license-agreements#UBI","description": "Node.js 12 available as container is a base platform for building and running various Node.js 12 applications and frameworks. Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.",
。。。

用Token访问Internal Registry

获取Token

OpenShift4 - 获取能访问API服务的用户认证Token

验证用Token访问

如果没有OpenShift认可的CA证书，访问OpenShift的内部资源的操作必须使用“–insecurity=true”或“–tls-verify=false”。如果有了合法证书，则可以通过TLS访问OpenShift。

使用证书查看OpenShift中的openshift/nodejs镜像信息。

$ TOKEN=$(oc whoami -t)
$ skopeo inspect --creds="-:${TOKEN}" --tls-verify=false docker://${REGISTRY}/openshift/nodejs
{"Name": "default-route-openshift-image-registry.apps.cluster-beijing-f5b3.beijing-f5b3.sandbox1120.opentlc.com/openshift/nodejs","Digest": "sha256:b77bb2f8d35ae3f30998135387c73a3943222dd0948ef9be3eb87207b3fba99a","RepoTags": ["12","latest","10"],"Created": "2020-07-22T06:35:50.433115Z","DockerVersion": "1.13.1","Labels": {"architecture": "x86_64","build-date": "2020-07-22T06:34:32.929721","com.redhat.build-host": "cpt-1006.osbs.prod.upshift.rdu2.redhat.com","com.redhat.component": "rh-nodejs12-container","com.redhat.deployments-dir": "/opt/app-root/src","com.redhat.dev-mode": "DEV_MODE:false","com.redhat.dev-mode.port": "DEBUG_PORT:5858","com.redhat.license_terms": "https://www.redhat.com/en/about/red-hat-end-user-license-agreements#UBI","description": "Node.js 12 available as container is a base platform for building and running various Node.js 12 applications and frameworks. Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.",
。。。

其他还可参见：容器入门（4） - skopeo

参考

https://www.ibm.com/support/knowledgecenter/SS8QRN_1.1.0/ocp-prepare-internal-registry.html
https://github.com/liuxiaoyu-git/OpenShift-Examples-1/blob/master/Using-Skopeo/README.md
https://blog.csdn.net/haohzhang/article/details/86580119

OpenShift 4 - 用CA证书或Token访问Internal Registry中的容器相关推荐

OpenShift 4 - 验证 Pod 内部容器使用 CA 和 ServiceAccount Token访问API服务
<OpenShift 4.x HOL教程汇总> 说明:本文已经在OpenShift 4.7环境中验证文章目录部署测试应用在容器内部访问API服务部署测试应用部署测试应用 $ oc ...
php支付宝支付证书模式,，支付宝接口中的cacert.pem（ca证书）是怎么来的呢？
小弟最近在搞支付宝支付接口,碰到个问题,help-- 我看demo中有下面一行代码: //ca证书路径地址,用于curl中ssl校验//请保证cacert.pem文件在当前文件夹目录中$alipay_ ...
android系统证书导入工具,如何将CA证书导入Android手机？
我想使用Nexus One连接到大学的无线网络.当我转到"无线设置"中的"添加Wi-Fi网络"时,我填写网络SSID并选择802.1x Enterprise作为 ...
eap wifi 证书_如何以编程方式在Android中安装CA证书（用于EAP WiFi配置）？
我的目标:在Android programmitcally中创建一个EAP WiFi配置 - 包括CA证书 . 问题:如何以编程方式安装CA证书(然后在EAP WiFi配置中引用该证书)? 但是,假设 ...
eap方法华为手机怎么连wifi_如何以编程方式在Android中安装CA证书(用于EAP WiFi配置)？...
我的目标: 在 Android programmitcally中创建EAP WiFi配置 – 包括CA证书. 问题: 如何以编程方式安装CA证书(然后在EAP WiFi配置中引用该证书)? 但是,这假 ...
OpenShift 4 - 为客户端配置使用基于CA证书的kubeconfig实现无密码登录
<OpenShift 4.x HOL教程汇总> 说明:本文已经在OpenShift 4.7环境中验证文章目录 OpenShift的身份认证方式为客户端配置认证CA证书参考 OpenS ...
OpenShift4 - 使用 Service CA 证书增加内部通讯安全
<OpenShift 4.x HOL教程汇总> 说明:本文已经在OpenShift 4.7环境中验证文章目录 Service Certificate的作用 Service CA Oper ...
Harbor .v1.10.2 私有镜像仓库的自签CA证书、安装使用【超详细官方文档翻译说明】...
需求在以前搭建docker镜像私有仓库的时候,我都是使用registery搭建.本篇章来尝试另一个新的镜像仓库Harbor. Harbor介绍 Harbor是由VMware公司开源的企业级的Dock ...
自建CA证书搭建https服务器
由于CA收费,所以可以自建CA,通过将CA导入浏览器实现https的效果,曾经12306购票就需要自行导入网站证书. 关于https 2015年阿里巴巴将旗下淘宝.天猫(包括移动客户端)全站启用HTT ...

OpenShift 4 - 用CA证书或Token访问Internal Registry中的容器