f125a8b892
This change addresses a long-standing issue in rST documentation imported from XML.
That import process added backslash escapes in front of various characters. The three
most common being '(', ')', and '_'.
These instances are removed.
Signed-off-by: Ron Stone <ronald.stone@windriver.com>
Change-Id: Id43a9337ffcd505ccbdf072d7b29afdb5d2c997e
4.1 KiB
Local Registry Server Certificates
Note
This procedure is deprecated. For up-to-date information, refer to:
configure-docker-registry-certificate-after-installation-c519edbfe90a.
For the Local Docker Registry, HTTPS is always enabled. By default, a self-signed server certificate and key is generated and installed for this endpoint. However, it is strongly recommended that you update the server certificate used after installation with an Intermediate or Root -signed server certificate and key. Refer to the documentation for the external Intermediate or Root that you are using, on how to create public certificate and private key pairs, signed by a Root , for HTTPS.
The local Docker registry provides Docker image service that can be accessed using the registry API by secure HTTPS. Standalone system, central cloud and every subcloud of system has their own Docker registry called registry.local.
The Docker registry on the central cloud of system has an alias of registry.central, which is used by subcloud to remotely login or pull images from this central Docker registry.
By default a self-signed certificate is generated at installation time for the registry API. For more secure access, an Intermediate or Root -signed certificate is strongly recommended.
The Intermediate or Root -signed certificate for the registry must
have at least the following : DNS:registry.local,
DNS:registry.central, IP
Address:<oam-floating-ip-address>, IP
Address:<mgmt-floating-ip-address>. Use the system addrpool-list
command to get the floating IP Address and management floating IP
Address for your system. You can add any additional DNS entry(s) that
you have set up for your floating IP Address.
Use the following procedure to install an intermediate or Root -signed certificate to either replace the default self-signed certificate or to replace an expired or soon to expire certificate.
Obtain an intermediate or Root -signed certificate and key from a trusted Intermediate or Root . Refer to the documentation for the external Root that you are using, on how to create public certificate and private key pairs, signed by an Intermediate or Root , for HTTPS.
For lab purposes, see Create Certificates Locally using openssl
<create-certificates-locally-using-openssl> for how to
create a test Intermediate or Root certificate and key, and use it to
sign test certificates.
Put the encoded versions of the certificate and key in a single file, and copy the file to the controller host.
Also, obtain the certificate of the Intermediate or Root that signed the above certificate.
In order to enable internal use of the Docker registry certificate, update the trusted list for this system with the Root associated with the Docker registry certificate.
~(keystone_admin)]$ system certificate-install --mode ssl_ca <pathTocertificate>where:
<pathTocertificate>-
is the path to the intermediate or Root certificate associated with the Docker registry's Intermediate or Root -signed certificate.
Update the Docker registry certificate using the
certificate-installcommand.Set the
mode (-m or --mode)parameter todocker_registry.~(keystone_admin)]$ system certificate-install --mode docker_registry <pathTocertificateAndKey>where:
<pathTocertificateAndKey>-
is the path to the file containing both the Docker registry's Intermediate or Root CA-signed certificate and private key to install.
Refer to Install/Update Local Registry Certificates
<installing-updating-the-docker-registry-certificate> on
how to install/update and renew local registry certificates.