https://sueboy.blogspot.com/2019/11/kubernetes-nodeport.html
PS：Close basic auth just remark configmap.yml auth:
#auth:
# htpasswd:
# realm: basic-realm
# path: /auth/htpasswd
README.md
# Docker Registry K8s
Domain：docker-registry
Port:30500
/etc/hosts add 192.168.99.118 docker-registry ## ip is k8s host eth2's ip
Finish command： docker login -u username -p password docker-registry:30500
https://docs.docker.com/registry/insecure/
Deploy a plain HTTP registry
```bash
/etc/docker/daemon.json
{
"insecure-registries" : ["docker-registry:30500"]
}
Restart Docker for the changes to take effect
```
https://blog.csdn.net/zsd498537806/article/details/79290732
https://serverfault.com/questions/611120/failed-tls-handshake-does-not-contain-any-ip-sans
http://dockone.io/article/684
#-subj "/C=/ST=/L=/O=/OU=/CN=192.168.99.118"
-subj "/C=/ST=/L=/O=/OU=/CN=docker-registry"
## Generate private key & certificate
```bash
openssl req -nodes -newkey rsa:4096 -keyout certs/domain.key -out certs/domain.csr -subj "/C=/ST=/L=/O=/OU=/CN=docker-registry"
openssl x509 -req -sha256 -days 365 -in certs/domain.csr -signkey certs/domain.key -out certs/domain.crt
#> openssl req \
# -newkey rsa:4096 -nodes -keyout certs/domain.key \
# -x509 -days 365 -out certs/domain.crt
```
## login ID/PWD
```bash
docker run --rm --entrypoint htpasswd registry:2 -Bbn username password > htpasswd
```
## K8s Secret
```bash
cat domain.crt | base64
cat domain.key | base64
```
No bash64, just online 
yml
kubectl create -f xxx.yml
kubectl edit xxx ooo
example：
kubectl create -f secret.yml
kubectl edit secrets --namespace=docker-registry
kubectl edit secrets registry-tls --namespace=docker-registry
kubectl create -f configmap.yml
kubectl edit configmap --namespace=docker-registry
kubectl edit configmap docker-registry --namespace=docker-registry
PS
containers.volumeMounts mount path must different path. Same path get error: .mountPath: Invalid value: ooxxooxx : must be uniqueSo configmap
auth.htpasswd.path /etc/docker/registry/htpasswd -> /auth/htpasswd
Vaild
1. check Pod realy get config.yml & htpasswd is ok or not? Pod ip use minikube dashboard website more easy.
> minikube ssh
> curl -v -XGET -u username:password http://172.17.xxx.xxx:5000/v2/_catalog
get 200 OK.
2. Check Service is ok or not ? Service ip use minikube dashboard website more easy.
> minikube ssh
> curl -v -XGET -u username:password http://10.99.xxx.xxx:5000/v2/_catalog
get 200 OK.
3. 2. Check Ingress is ok or not ? Ingress ip use minikube dashboard website more easy.
> minikube ssh
> curl -v -XGET -u username:password http://10.0.xxx.xxx:5000/v2/_catalog
get 200 OK.
========
Ingress
have problems with windows minikube. So now check list：1、Use it is ingress-nginx
https://kubernetes.github.io/ingress-nginx/deploy/
2、On ingress-nginx deploy minikube
Don't USE
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/mandatory.yaml
USE
minikube addons enable ingress
Because nginx-control already be create by "minikube addons enable ingress". Check use
kubectl get pods --all-namespaces -l app.kubernetes.io/name=nginx-ingress-controller
PS：Use mandatory.yaml be create ingress-nginx namespace. Use minikube addons be put in kube-system namespace.
https://medium.com/@Oskarr3/setting-up-ingress-on-minikube-6ae825e98f82 Enabling the add-on provisions the following: ．a configMap for the Nginx loadbalancer ．the Nginx ingress controller ．a service that exposes a default Nginx backend pod for handling unmapped requests.
Best Important!!
Use nginx-ingress that let everything pass nginx-ingress. Thinking Way now is "path" or "domain" to "k8s service"Here use "domain" to "k8s service docker-registry"
EX： tt.t -> nginx-ingress -> service(docker-registry)
Windows use notepad(administrator mode) change C:\Windows\System32\drivers\etc\hosts
192.168.99.xxx tt.t
Run curl
curl -v -XGET -u username:password http://tt.t/
get 200. ok
Best Important!!
Use TLS just remove mark TLS insdie ingress.yml.Run curl
curl -v -XGET -u username:password https://tt.t/
But maybe get cert can't correct.
Best Important!!
ingress Only domain or path, So http & https. Can't custom port.
https://medium.com/google-cloud/kubernetes-nodeport-vs-loadbalancer-vs-ingress-when-should-i-use-what-922f010849e0
Maybe
you try to edit Deployments -> nginx-ingress-controller YAMLadd custom Port
"ports": [
...,
{
"hostPort": 5000,
"containerPort": 5000,
"protocol": "TCP"
}
]
Yes, This edit get No error, but ingress
can't
accept custom port
rules:
- http:
port: 5000
paths:
- backend:
serviceName: docker-registry
servicePort: 5000
path: /
Or
maybe you think Deployments -> nginx-ingress-controller YAML add name for Port. EX:registryhttp 5000But ingress
can't
accept registryport
rules:
- registryhttp:
paths:
- backend:
serviceName: docker-registry
servicePort: 5000
path: /
Other way is LoadBalancer
But only nodePort
apiVersion: v1
kind: Service
metadata:
name: docker-registry-lb
namespace: docker-registry
spec:
type: LoadBalancer
ports:
- name: registryhttp
port: 5000
targetPort: 5000
nodePort: 30500
selector:
app: registry
apiVersion: v1
kind: Service
metadata:
name: docker-registry
namespace: docker-registry
spec:
type: NodePort
ports:
- name: registryhttp
port: 5000
targetPort: 5000
nodePort: 30500
selector:
app: registry
Port 5000 still
can't use
Only Port 30500 can use
maybe you think
Use "selector" to focus nginx-ingress-controllerAnswer is can't, because ingress only http & https
OK, some demo add port on tcp-services (configmap)
https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/
https://yq.aliyun.com/articles/603225
apiVersion: v1
data:
"9000": docker-registry/docker-registry:5000
kind: ConfigMap
metadata:
creationTimestamp: "2019-01-30T05:24:36Z"
labels:
addonmanager.kubernetes.io/mode: EnsureExists
name: tcp-services
namespace: kube-system
resourceVersion: "256144"
selfLink: /api/v1/namespaces/kube-system/configmaps/tcp-services
uid: 552a9b32-244f-11e9-b70e-080027bbc6ea
Default backend Test
https://kubernetes.github.io/ingress-nginx/user-guide/default-backend/．/healthz that returns 200
．/ that returns 404