在内网部署支持ssl的docker私仓

头像
乐码客
    1
    发布于
    河北
     

    registry

    需要 443
    1194:1194/udp

    更换 来此加密 ssl 证书

    
\cp -a /free_cicdfs0/k8s_data/registry_ssl/certs/private.pem  /free_cicdfs0/k8s_data/registry_ssl/certs/domain.key
\cp -a /free_cicdfs0/k8s_data/registry_ssl/certs/fullchain.crt  /free_cicdfs0/k8s_data/registry_ssl/certs/domain.crt

    生效 配置

    
kubectl apply -f /free_cicdfs0/k8s_ymls/app-yml/registry_ssl/registry_ssl.yml


kubectl replace --force -f   /free_cicdfs0/k8s_ymls/app-yml/registry_ssl/registry_ssl.yml

    修改配置文件

    新版本 配置文件 大致结构发生了一些改变

    
cat /free_cicdfs0/k8s_data/bind9/etc/bind/named.conf
// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

    从 114 缓存 查询 数据

    
cat > /free_cicdfs0/k8s_data/bind9/etc/bind/named.conf.options <<"EOF"

# include "/etc/rndc.key";

controls {
    inet 127.0.0.1 port 953
    allow { 127.0.0.1; } keys { "rndckey"; };
};

options {
    
    // set no
    dnssec-enable no;
    dnssec-validation no;

    listen-on port 53 { any; };

    allow-query { any; };

    forwarders {
        114.114.114.114;
    };


};

EOF

chmod 777 -R  /free_cicdfs0/k8s_data/bind9/
chown root:root -R  /free_cicdfs0/k8s_data/bind9/

chown root:named -R  /free_cicdfs0/k8s_data/bind9/

docker-compose up -d 
# log error
couldn't add command channel 127.0.0.1#953: file not found


docker cp -a bind9:/etc/bind  /free_cicdfs0/k8s_data/bind9/etc/

docker cp -a bind9:/var/lib/bind  /free_cicdfs0/k8s_data/bind9/var/lib/

    可以 dig 无法 ping

    broken trust chain resolving 'baidu.com/AAAA/IN': 114.114.114.114#53

解决:
由于是局域网内非法DNS,所以将DNS安全关闭.
[root@192-168-174-42 ~]# vim /etc/named.conf
将下面的两项设置为no
        dnssec-enable no;
        dnssec-validation no;

    查看 已经 区域 解析，并添加 新的 解析 项

    
cat /free_cicdfs0/k8s_data/bind9/etc/bind/named.conf.default-zones
// prime the server with knowledge of the root servers
zone "." {
        type hint;
        file "/usr/share/dns/root.hints";
};

// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912

zone "localhost" {
        type master;
        file "/etc/bind/db.local";
};

zone "127.in-addr.arpa" {
        type master;
        file "/etc/bind/db.127";
};

zone "0.in-addr.arpa" {
        type master;
        file "/etc/bind/db.0";
};

zone "255.in-addr.arpa" {
        type master;
        file "/etc/bind/db.255";
};

    https://nginx164190.zk.wh.com/

    192.168.164.190 nginx164190.zk.wh.com

    在 linux 安装 局域网 cert

    # 添加 解析 条目
vi /etc/hosts
192.168.164.190  nginx164190.zk.wh.com
 
[root@node01 ~]# curl https://nginx164190.zk.wh.com/
curl: (60) Peer's Certificate issuer is not recognized.
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.


curl -o install_cert_linux.zip http://192.168.164.190:40080/install_cert_linux.zip
unzip install_cert_linux.zip

cd install_cert_linux
./install_cert.sh

# 测试 效果
curl https://nginx164190.zk.wh.com/
<html>
<head><title>Index of /</title></head>
<body>
<h1>Index of /</h1><hr><pre><a href="../">../</a>
<a href="_wildcard.zk.wh.com.crt">_wildcard.zk.wh.com.crt</a>                            18-Aug-2021 08:53    1464
<a href="_wildcard.zk.wh.com.pem">_wildcard.zk.wh.com.pem</a>                            18-Aug-2021 08:53    1464
<a href="install_cert_linux.zip">install_cert_linux.zip</a>                             19-Aug-2021 07:30      2M
<a href="rootCA-key.pem">rootCA-key.pem</a>                                     18-Aug-2021 08:53    2488
<a href="rootCA.pem">rootCA.pem</a>                                         18-Aug-2021 08:53    1635
<a href="test">test</a>                                               18-Aug-2021 08:47       7
</pre><hr></body>
</html>

    rndc

    1、953端口是rndc 的端口

    2、rndc是监控bind的统计数据用的,同时不需要为了更新某个zone而重启bind

    查看 默认的 解析条目

    cat /etc/bind/named.conf.default-zones
// prime the server with knowledge of the root servers
zone "." {
        type hint;
        file "/usr/share/dns/root.hints";
};

// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912

zone "localhost" {
        type master;
        file "/etc/bind/db.local";
};

zone "127.in-addr.arpa" {
        type master;
        file "/etc/bind/db.127";
};

zone "0.in-addr.arpa" {
        type master;
        file "/etc/bind/db.0";
};

zone "255.in-addr.arpa" {
        type master;
        file "/etc/bind/db.255";
};

    添加 自己的 解析条目

    
多台 dns 之间 进行 协同
SOA
NS

# A 代表 解析到 ipv4
@       IN      A       127.0.0.1

# A 代表 解析到 ipv6
@       IN      AAAA    ::1

# ptr 代表 逆向解析
1.0.0   IN      PTR     localhost.

    cat /etc/bind/named.conf
// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

// add you zones
include "/etc/bind/named.conf.my-zones";


# 模仿 /etc/bind/named.conf.default-zones 书写 新的 解析记录
cat > /etc/bind/named.conf.my-zones <<"EOF"

zone "zk.wh.com" {
        type master;
        file "/etc/bind/db.zk.wh.com";
};

zone "192.in-addr.arpa" {
        type master;
        file "/etc/bind/db.192";
};

EOF

# 模仿db 文件
cat /etc/bind/db.local
;
; BIND data file for local loopback interface
;
$TTL    604800
@       IN      SOA     localhost. root.localhost. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      localhost.
@       IN      A       127.0.0.1
@       IN      AAAA    ::1


cat > /etc/bind/db.zk.wh.com <<"EOF"
$TTL 86400
@ IN SOA localhost. root.localhost. (
        1  ; Serial
    604800  ; Refresh
    86400  ; Retry
   2419200  ; Expire
    86400 ) ; Negative Cache TTL
;
@ IN NS localhost.
nginx164190       IN      A       192.168.164.190
zcloud164190       IN      A       192.168.164.190


EOF


# 模仿 逆解 文件
cat /etc/bind/db.127
;
; BIND reverse data file for local loopback interface
;
$TTL    604800
@       IN      SOA     localhost. root.localhost. (
                              1         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      localhost.
1.0.0   IN      PTR     localhost.


cat > /etc/bind/db.192 <<"EOF"
$TTL 86400
@ IN SOA localhost. root.localhost. (
        1  ; Serial
    604800  ; Refresh
    86400  ; Retry
   2419200  ; Expire
    86400 ) ; Negative Cache TTL
;
@ IN NS localhost.
190.164.168   IN      PTR     nginx164190.

EOF

    更新 解析记录

    
# 局域网 x509 证书 无法 信任 多重域名
# Reminder: X.509 wildcards only go one level deep, so this won't match a.b.zk.wh.com ℹ️
cat > /free_cicdfs0/k8s_data/bind9/etc/bind/db.zk.wh.com <<"EOF"
$TTL 86400
@ IN SOA localhost. root.localhost. (
        1  ; Serial
    604800  ; Refresh
    86400  ; Retry
   2419200  ; Expire
    86400 ) ; Negative Cache TTL
;
@ IN NS localhost.
nginx164190       IN      A       192.168.164.190
zcloud164190      IN      A       192.168.164.190
hub-docker        IN      A       192.168.99.100
EOF


# 重启 容器 服务 即可生效
ssh root@192.168.99.2
cd /free_cicdfs0/composes/bind9
docker-compose restart



# test
ping hub-docker.zk.wh.com
PING hub-docker.zk.wh.com (192.168.99.100) 56(84) bytes of data.
64 bytes from 192.168.99.100: icmp_seq=1 ttl=64 time=0.172 ms
64 bytes from 192.168.99.100: icmp_seq=2 ttl=64 time=0.152 ms

    风险

    dns 尾缀过短 会导致 公网上的 .xyz 后缀 都无法 解析,
    应该修改为 one-k.xyz 作为 后缀

    添加 新的 解析记录

    one-k.xyz 192.168.99.100

    
vi /free_cicdfs0/k8s_data/bind9/etc/bind/named.conf.my-zones

cat > /etc/bind/named.conf.my-zones <<"EOF"


zone "one-k.xyz" {
        type master;
        file "/etc/bind/db.one-k.xyz";
};


zone "zk.wh.com" {
        type master;
        file "/etc/bind/db.zk.wh.com";
};

zone "192.in-addr.arpa" {
        type master;
        file "/etc/bind/db.192";
};

EOF


#  @ 的 含义 代表 域名 本身
cat > /free_cicdfs0/k8s_data/bind9/etc/bind/db.one-k.xyz <<"EOF"
$TTL 86400
@ IN SOA localhost. root.localhost. (
        1  ; Serial
    604800  ; Refresh
    86400  ; Retry
   2419200  ; Expire
    86400 ) ; Negative Cache TTL
;
@ IN NS localhost.
@              IN      A       192.168.99.100
k8s            IN      A       192.168.91.110
ingress        IN      A       192.168.99.200
test-nginx     IN      A       192.168.99.200
home-wuhan     IN      A       192.168.99.200
minio          IN      A       192.168.99.123
minio-one-node   IN      A       192.168.99.241

EOF



# Force replace, delete and then re-create the resource
kubectl replace --force -f /free_cicdfs0/k8s_ymls/app-yml/bind9.yml
deployment.apps "bind9-214-deployment" deleted
service "bind9-214-udp-deployment" deleted
deployment.apps/bind9-214-deployment replaced
service/bind9-214-udp-deployment replaced

    测试

    
ssh node02

cd /free_cicdfs0/composes/bind9/

docker-compose restart

docker pull one-k.xyz/nginx

Using default tag: latest
latest: Pulling from nginx
Digest: sha256:61191087790c31e43eb37caa10de1135b002f10c09fdda7fa8a5989db74033aa
Status: Downloaded newer image for one-k.xyz/nginx:latest
one-k.xyz/nginx:latest

    欢迎进群交流
    7e37995932c163b25751846c1293065.jpg

    dockerssl
    本作品系原创，采用《署名-非商业性使用-禁止演绎 4.0 国际》许可协议
    avatar
    1 声望
    1 粉丝
    0 条评论
    得票最新
    推荐阅读
    Vue3+vite项目在局域网内通过ip在手机端访问
    使用vite启动项目后，想在手机端访问项目，此时是访问不到的在网上查阅了相关内容，小结一下1.修改vite.confifg,js（未使用ts，使用的修改vite,config.ts）

    乐码客阅读 201

    张晋涛：我的 2022 总结
    大家好，我是张晋涛。2022 年已经结束，我每年都会惯例的做个小回顾，今年因为阳了在恢复身体，一直拖到了今天才写。生活在 2022 年初做回顾的时候，觉得 2021 是魔幻的一年，但现在看来 2022 年其实更加魔幻。一...

    张晋涛赞 6阅读 1.1k评论 2

    封面图
    利用Docker部署管理LDAP及其初次使用
    前言：本周主要写了gitlabWebhook转github的项目，总体上没有遇到什么大问题，这周接触到了LDAP，于是就花时间实际操作了解了一下。

    李明赞 5阅读 1.3k

    Docker学习：Image的本地存储结构
    在使用Docker时候，针对镜像的操作一般就是docker pull，docker build，docker commit（刚开始接触Docker的时候，还不会Dockerfile，经常使用这个命令，但是经历了一次血的教训，已经放弃这个命令很久）这些操作...

    backbp赞 4阅读 10k评论 3

    使用docker快速搭建xssPlatform测试平台实践
    笔者之前给一些开发团队多次做Web安全开发培训，为了让培训的学员能够理解XSS原理和XSS的危害，将xssPlatform进行了更新，之前一直放在GitHub中；发现关注的人越来越多，很多人在安装的过程中遇到问题不知道怎么...

    汤青松赞 1阅读 26.2k

    将node.js 应用构建成docker镜像
    本文内容：将node.js 应用构建成dokcer镜像, 并上传到阿里云创建 Node.js 应用1.首先，创建一个 package.json 文件，描述你应用程序以及需要的依赖： {代码...} 2.运行 npm install这会自动生成一个 package-lock...

    weiweiyi赞 3阅读 741

    突破难关：Docker镜像和容器的区别以及构建的最佳实践
    Docker 可谓是开启了容器化技术的新时代，现在无论大中小公司基本上都对容器化技术有不同程度的尝试，或是已经进行了大量容器化的改造。伴随着 Kubernetes 和 Cloud Native 等技术和理念的普及，也大大增加了业务...

    张晋涛赞 4阅读 416

    封面图
    avatar
    1 声望
    1 粉丝
    宣传栏