Kubernetes不具备自签码头注册证书

Question

我们有一个私有的Docker注册中心，我们正在尝试获取一个Kubernetes集群来从中提取图像，但是它失败了，出现了以下错误：

  Type     Reason     Age                From               Message
  ----     ------     ----               ----               -------
  Normal   Scheduled  104s               default-scheduler  Successfully assigned namespace/service-8599c54df8-592wm to fat2
  Normal   Pulling    67s                kubelet            Pulling image "192.168.100.178:5000/service:ds-1.2"
  Warning  Failed     67s                kubelet            Error: ErrImagePull
  Warning  Failed     67s                kubelet            Failed to pull image "192.168.100.178:5000/service:ds-1.2": rpc error: code = Unknown desc = failed to pull and unpack image "192.168.100.178:5000/service:ds-1.2": failed to resolve reference "192.168.100.178:5000/service:ds-1.2": failed to do request: Head "https://192.168.100.178:5000/v2/service/manifests/ds-1.2": x509: certificate signed by unknown authority (possibly because of "x509: invalid signature: parent certificate cannot sign this kind of certificate" while trying to verify candidate authority certificate "192.168.100.174: hostname")
  Warning  Failed     65s (x2 over 66s)  kubelet            Error: ImagePullBackOff
  Normal   BackOff    65s (x2 over 66s)  kubelet            Back-off pulling image "192.168.100.178:5000/service:ds-1.2"

我已经将证书从Docker注册中心复制到了/etc/docker/certs.d/192.168.100.178:5000/，并且从另一个集群中复制了秘密逐字复制，从我们的Docker注册中心中提取图像是绝对没有问题的。无论如何，这里是(作为Helm模板)：

apiVersion: v1
kind: Secret
metadata:
  name: {{ .Values.global.image_pull_secret }}
  namespace: {{ .Values.global.namespace }}
  labels:
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/release-name: {{ .Release.Name }}
    app.kubernetes.io/release-namespace: {{ .Release.Namespace }}
data:
  .dockerconfigjson: {snipped}
type: kubernetes.io/dockerconfigjson

我已经验证了我可以成功地连接到一个docker login：

$ docker login https://192.168.100.178:5000
Username: myuser
Password:
WARNING! Your password will be stored unencrypted in /home/myuser/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

我在这里完全没有想法了，但是新集群似乎不信任签署了Docker注册中心证书的CA。我已经束手无策了，所以这里的任何帮助都是非常感谢的。

Answer 1

终于起作用了。我不得不通过将根证书复制到/etc/ssl/tls/certs来安装根证书。这是在为Docker注册表创建证书时使用的根证书。在错误消息中，这是CA的证书，它在结尾处引用："192.168.100.174: hostname"。