generate certs if REGISTRY_TLS_VERIFY #31

proppy · 2014-11-07T12:32:33Z

Usage:

docker run -e REGISTRY_TLS_VERIFY=1 \
  -v /etc/docker/certs.d:/certs.d -p 5000:5000 \
  -e GCS_BUCKET= -e GCP_OAUTH2_REFRESH_TOKEN= \
  google/docker-registry

while waiting for docker-archive#693 to be merged.

/cc @tiborvass @dmp42 @dlorenc @ktintc @jbeda

tiborvass · 2014-11-07T13:46:29Z

@proppy If possible i'd like to agree on the API before this is merged. At the time of writing, we don't use SECURE=ssl but check for the /ssl directory, we don't use volumes only bind-mounts, and you're not doing the entrypoint and cmd the same way.

I hope to get it all sorted out today.

proppy · 2014-11-07T16:44:01Z

Hey @tiborvass, didn't meant to cause you more trouble. I'm fine to switching to the upstream convention once yours get merged.

proppy · 2014-11-07T17:51:08Z

@tiborvass changed the ENTRYPOINT to match yours,

A few comments about the rational behind the other changes:

having a separate SECURE variable makes it easy to switch to protocol.
having a separate VOLUME for generation the cert and exporting them, makes it so you can only export the CA in certs.d
having a separate bind mount for the certs when supplying them, allows you to use a different set of ca/certs for the registry, w/o messing up with certs.d, not sure what is more convenient though.

Sorry I didn't mention those earlier, most of them came up while I was playing with implementing a PoC w/ openssl.

proppy · 2014-11-07T17:56:15Z

@mmdriley @ewindisch, crypto noob here: is that "cool" to use a self-signed CA cert as the server cert and a CA key as the server key?

mmdriley · 2014-11-07T19:57:20Z

If you ever need to rev the certificate then you'd have to install a new CA on all clients. Seems poor?

proppy · 2014-11-07T20:26:38Z

So you'd recommend to maintain a separate server and CA cert?

Note that the CA cert is mount bound in /etc/docker/certs.d/<ip>:<port>, so the client doesn't really need to track it.

proppy · 2014-11-07T21:24:20Z

@mmdriley generating separate server certs/key, PTAL

…ontract

proppy · 2014-11-10T19:50:39Z

@dlorenc can I get a review?

tiborvass · 2014-11-10T19:59:16Z

So the registry certs need to be, not in /etc/docker/certs.d but in /etc/docker/certs.d/$REGISTRY_COMMON_NAME. The problem is that it includes a : and thus makes it impossible to bind mount.

One way to get around that is to bind mount /etc/docker/certs.d, but that would expose other registries's certs to the container.

proppy · 2014-11-10T20:04:15Z

@tiborvass the upstream "spec" only define the default for GUNICORN_OPTS to /ssl, and it's up to the caller to export the certs in the right place.

So I could imagine it's up to who consume generate_certs output to put the cert in the right place so that the daemon can look it up.

tiborvass · 2014-11-10T20:06:44Z

@proppy oh right, i was just reading the documentation that needs to be fixed then :)

EDIT: or rather, docker has to have escaping for : first.

proppy · 2014-11-10T20:09:00Z

@tiborvass, yes the current docs assume -v /etc/docker/certs.d when "generating certs": when you bring your own certs I'd assume you would have already them in the right place and won't need the /etc/docker/certs.d bind mount.

proppy · 2014-11-10T20:14:19Z

run.sh

@@ -53,5 +54,37 @@ else
  fi
 fi

-export GCS_BUCKET BOTO_PATH
-exec docker-registry $*
+if [ -n "${REGISTRY_TLS_VERIFY}" ]; then


only generate if GUNICORN_OPTS is empty.

proppy · 2014-11-10T21:33:53Z

PTAL

proppy · 2014-11-11T18:26:03Z

PTAL @mmdriley @ktintc @dlorenc I'd like to move forward with this.

proppy · 2014-11-11T18:47:41Z

FYI built: proppy/docker-registry:ssl for testing.

ktintc · 2014-11-11T20:20:53Z

lgtm, thank you!

proppy · 2014-11-11T21:44:00Z

@mmdriley PTAL simplified a lot based on your offline feedback.

No more conditional check if the certs exist, and I don't document /ssl mount anymore.

mmdriley · 2014-11-11T22:02:24Z

run.sh

+EOF
+  echo 01 > /ssl/ca.srl
+  openssl req -subj "/CN=local docker registry CA" -config /ssl/ssl.conf -extensions v3_ca -new -x509 -days 365 -newkey rsa:2048 -nodes -keyout /ssl/ca.key -out /ssl/ca.crt
+  openssl req -subj "/CN=local docker server cert" -config /ssl/ssl.conf -reqexts v3_req -new -newkey rsa:2048 -nodes -keyout /ssl/registry.key -out /ssl/registry.csr


I'd go with "Local CA" and "Local Docker registry".

mmdriley · 2014-11-11T22:05:56Z

Seems okay to me modulo above comments.

proppy · 2014-11-11T22:38:34Z

@tiborvass can you LGTM before I merge?

tiborvass · 2014-11-11T22:45:18Z

README.md

+    # assuming CA is already in /etc/docker/certs.d
+    docker run -e REGISTRY_TLS_VERIFY=1 \
+        -v /mycerts:/ssl \
+        -e GUNICORN_OPTS="['--certfile','/ssl/myserver.cert','--keyfile','/ssl/myserver.key','--ca-certs','/ssl/myca.crt']" \


@proppy don't you wanna make sure users are using tlsv1 ? (would need '--ssl-version', 3)

tiborvass · 2014-11-11T23:18:55Z

run.sh

+nsCertType = server
+subjectAltName = @alt_names
+[alt_names]
+DNS.1 = localhost


@proppy this is hardcoded isnt it?

yes, because when we generate cert we really only care about localhost/boot2docker.

If you want to support arbitrary hostname you should bring your own cert for now.

See also #33 for later

tiborvass · 2014-11-12T00:43:24Z

@proppy x509: certificate is valid for localhost, boot2docker.local, not boot2docker
but this is what i have on my boot2docker in /etc/hosts: 127.0.0.1 boot2docker localhost localhost.local

EDIT: works if I pass -e BOOT2DOCKER_HOST=boot2docker, so at least i tested that :) But would be good to have boot2docker part of the default.

proppy · 2014-11-12T00:47:14Z

Fixed, PTAL

tiborvass · 2014-11-12T01:02:50Z

LGTM

generate certs if REGISTRY_TLS_VERIFY

generate certs if SECURE=ssl

119a91a

better entrypoint and symbolic links for certs

ddab20d

run: generate separate server certs

32b9bb4

proppy added 2 commits November 7, 2014 14:45

run: update GUNICORN_OPTS and REGISTRY_TLS_VERIFY to match upstream c…

c92dfe3

…ontract

run: update default registry certs prefix

7b2e645

proppy changed the title ~~generate certs if SECURE=ssl~~ generate certs if REGISTRY_TLS_VERIFY Nov 8, 2014

proppy reviewed Nov 10, 2014
View reviewed changes

run: fix ssl configuration

d9966eb

proppy added 4 commits November 10, 2014 14:05

README: update ssl section

6dfe3eb

README: line split

ffa4032

run: fix alt name

bdf500b

run: empty subject remove port constraint

2b0b153

run: simplify cert generation logic

cbabe98

mmdriley reviewed Nov 11, 2014
View reviewed changes

run: better CN and perm for keys

dc6ed4a

tiborvass reviewed Nov 11, 2014
View reviewed changes

proppy added 2 commits November 11, 2014 14:48

README: add ssl gunicorn flag in usage

891f941

README: add documentation for non default port and cert

cc7a66b

tiborvass reviewed Nov 11, 2014
View reviewed changes

run: remove gunicorn debug

806ee20

run: add alt hostname for boot2docker

018e262

run: change b2d env var to ALT_NAMES_

4b3b9b6

run: prefix ALT_NAMES_ env vars with REGISTRY_

81c260b

proppy added a commit that referenced this pull request Nov 12, 2014

Merge pull request #31 from proppy/ssl

569a4d6

generate certs if REGISTRY_TLS_VERIFY

proppy merged commit 569a4d6 into GoogleCloudPlatform:master Nov 12, 2014

proppy mentioned this pull request Nov 12, 2014

Revert "generate certs if REGISTRY_TLS_VERIFY" #36

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

generate certs if REGISTRY_TLS_VERIFY #31

generate certs if REGISTRY_TLS_VERIFY #31

proppy commented Nov 7, 2014

tiborvass commented Nov 7, 2014

proppy commented Nov 7, 2014

proppy commented Nov 7, 2014

proppy commented Nov 7, 2014

mmdriley commented Nov 7, 2014

proppy commented Nov 7, 2014

proppy commented Nov 7, 2014

proppy commented Nov 10, 2014

tiborvass commented Nov 10, 2014

proppy commented Nov 10, 2014

tiborvass commented Nov 10, 2014

proppy commented Nov 10, 2014

proppy Nov 10, 2014

proppy Nov 10, 2014

proppy commented Nov 10, 2014

proppy commented Nov 11, 2014

proppy commented Nov 11, 2014

ktintc commented Nov 11, 2014

proppy commented Nov 11, 2014

mmdriley Nov 11, 2014

proppy Nov 11, 2014

mmdriley commented Nov 11, 2014

proppy commented Nov 11, 2014

tiborvass Nov 11, 2014

proppy Nov 11, 2014

tiborvass Nov 11, 2014

proppy Nov 11, 2014

tiborvass commented Nov 12, 2014

proppy commented Nov 12, 2014

tiborvass commented Nov 12, 2014

generate certs if REGISTRY_TLS_VERIFY #31

generate certs if REGISTRY_TLS_VERIFY #31

Conversation

proppy commented Nov 7, 2014

tiborvass commented Nov 7, 2014

proppy commented Nov 7, 2014

proppy commented Nov 7, 2014

proppy commented Nov 7, 2014

mmdriley commented Nov 7, 2014

proppy commented Nov 7, 2014

proppy commented Nov 7, 2014

proppy commented Nov 10, 2014

tiborvass commented Nov 10, 2014

proppy commented Nov 10, 2014

tiborvass commented Nov 10, 2014

proppy commented Nov 10, 2014

Choose a reason for hiding this comment

Choose a reason for hiding this comment

proppy commented Nov 10, 2014

proppy commented Nov 11, 2014

proppy commented Nov 11, 2014

ktintc commented Nov 11, 2014

proppy commented Nov 11, 2014

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mmdriley commented Nov 11, 2014

proppy commented Nov 11, 2014

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tiborvass commented Nov 12, 2014

proppy commented Nov 12, 2014

tiborvass commented Nov 12, 2014