docker/docs
1
0
Fork 0
mirror of https://github.com/docker/docs.git synced 2026-11-05 00:14:17 +03:00
Code Activity
Files
4635c210feaa524dde862e4ce19c7a4e30cc2df2
docs/certs.md
Daniel Hiltgen 6bacb243bb Add docs explaining how to wire up certs by hand 
We might want to take the time to make this work via compose, but that
will require some custom bootstrap scripts, so for now, lets just use
manual cut-and-paste for anyone who needs a "real" cert setup in dev mode.
2015-08-12 17:28:59 -07:00

6.1 KiB
Raw Blame History

Manually setting up a CA

A few features of Orca require an external CA (cfssl or equivalent) to sign certs. By default in developer mode, these services aren't created (maybe we'll set them up someday, but there's some bootstrapping challenges...) The following instructions explain how to set this up manually so you can do developer mode with CA support.

sudo mkdir -p /etc/docker/ssl/orca

sudo sh -c 'cat << EOF > /etc/docker/ssl/orca/config.json
{
    "roots": {
        "orca": {
            "key": "/etc/docker/ssl/orca/orca_ca_key.pem",
            "certificate": "/etc/docker/ssl/orca/orca_ca.pem"
        },
        "swarm": {
            "key": "/etc/docker/ssl/orca/swarm_ca_key.pem",
            "certificate": "/etc/docker/ssl/orca/swarm_ca.pem"
        }
    },
    "signing": {
        "default": {
            "expiry": "87600h"
        },
        "profiles": {
            "client": {
                    "usages": [
                            "signing",
                            "key encipherment",
                            "client auth"
                    ],
                    "expiry": "87600h"
            },
            "node": {
                    "usages": [
                            "signing",
                            "key encipherment",
                            "server auth",
                            "client auth"
                    ],
                    "expiry": "87600h"
            },
            "intermediate": {
                    "usages": [
                            "signing",
                            "key encipherment",
                            "cert sign",
                            "crl sign"
                    ],
                    "is_ca": true,
                    "expiry": "87600h"
            }
        }
    }
}
EOF'

sudo sh -c 'cat << EOF > /etc/docker/ssl/orca/orca_ca.json
{
    "key": {
        "algo": "rsa",
        "size": 4096
    },
    "CN": "Orca Root CA"
}
EOF'

sudo sh -c 'cat << EOF > /etc/docker/ssl/orca/swarm_ca.json
{
    "key": {
        "algo": "rsa",
        "size": 4096
    },
    "CN": "Swarm Root CA"
}
EOF'

docker run --rm -v /etc/docker/ssl/orca:/etc/docker/ssl/orca -w /etc/docker/ssl/orca dockerorca/orca-cfssl genkey -initca orca_ca.json | \
    docker run --rm -i -v /etc/docker/ssl/orca:/etc/docker/ssl/orca --entrypoint cfssljson -w /etc/docker/ssl/orca dockerorca/orca-cfssl -bare orca_ca

docker run --rm -v /etc/docker/ssl/orca:/etc/docker/ssl/orca -w /etc/docker/ssl/orca dockerorca/orca-cfssl genkey -initca swarm_ca.json | \
    docker run --rm -i -v /etc/docker/ssl/orca:/etc/docker/ssl/orca --entrypoint cfssljson -w /etc/docker/ssl/orca dockerorca/orca-cfssl -bare swarm_ca


# Just to keep the naming consistent...
sudo mv /etc/docker/ssl/orca/orca_ca-key.pem /etc/docker/ssl/orca/orca_ca_key.pem
sudo mv /etc/docker/ssl/orca/swarm_ca-key.pem /etc/docker/ssl/orca/swarm_ca_key.pem

Once you've generated the root cert (above) you can start the servers

docker run -d \
    -v /etc/docker/ssl/orca/orca_ca.pem:/etc/cfssl/ca.pem:ro \
    -v /etc/docker/ssl/orca/orca_ca_key.pem:/etc/cfssl/ca-key.pem:ro \
    -v /etc/docker/ssl/orca/config.json:/etc/cfssl/config.json:ro \
    --name orca-ca \
    dockerorca/orca-cfssl serve --address 0.0.0.0 -config config.json

docker run -d \
    -v /etc/docker/ssl/orca/swarm_ca.pem:/etc/cfssl/ca.pem:ro \
    -v /etc/docker/ssl/orca/swarm_ca_key.pem:/etc/cfssl/ca-key.pem:ro \
    -v /etc/docker/ssl/orca/config.json:/etc/cfssl/config.json:ro \
    --name orca-swarm-ca \
    dockerorca/orca-cfssl serve --address 0.0.0.0 -config config.json

Now you can generate a server cert (you might want to edit this to make the hostname/ip match your config

sudo sh -c 'cat << EOF > /etc/docker/ssl/orca/server.json
{
    "hosts": [
        "127.0.0.1"
    ],
    "key": {
        "algo": "rsa",
        "size": 4096
    },
    "CN": "My Server"
}
EOF'

docker run --rm --link=orca-swarm-ca:swarm_ca \
    -v /etc/docker/ssl/orca:/etc/docker/ssl/orca \
    -w /etc/docker/ssl/orca \
    --entrypoint=/bin/sh \
    dockerorca/orca-cfssl -c \
    'cfssl gencert -remote $SWARM_CA_PORT_8888_TCP_ADDR -profile=node server.json' | \
    docker run --rm -i -v /etc/docker/ssl/orca:/etc/docker/ssl/orca \
    -w /etc/docker/ssl/orca \
    --entrypoint=cfssljson dockerorca/orca-cfssl \
    -bare swarm_orca_server

docker run --rm --link=orca-ca:orca_ca \
    -v /etc/docker/ssl/orca:/etc/docker/ssl/orca \
    -w /etc/docker/ssl/orca \
    --entrypoint=/bin/sh \
    dockerorca/orca-cfssl -c \
    'cfssl gencert -remote $ORCA_CA_PORT_8888_TCP_ADDR -profile=node server.json' | \
    docker run --rm -i -v /etc/docker/ssl/orca:/etc/docker/ssl/orca \
    -w /etc/docker/ssl/orca \
    --entrypoint=cfssljson dockerorca/orca-cfssl \
    -bare orca_server

# Just to keep the naming consistent...
sudo mv /etc/docker/ssl/orca/swarm_orca_server-key.pem /etc/docker/ssl/orca/swarm_orca_server_key.pem
sudo mv /etc/docker/ssl/orca/orca_server-key.pem /etc/docker/ssl/orca/orca_server_key.pem

Now you can run Orca

(proxy)

docker run -d \
    -v /etc/docker/ssl/orca:/etc/docker/ssl/orca:ro \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -e SSL_CA=/etc/docker/ssl/orca/swarm_ca.pem  \
    -e SSL_CERT=/etc/docker/ssl/orca/swarm_orca_server.pem  \
    -e SSL_KEY=/etc/docker/ssl/orca/swarm_orca_server_key.pem  \
    --name orca-proxy \
    dockerorca/orca-proxy

(rethinkdb)

docker run -d \
    --name orca-db \
    dockerorca/rethinkdb

Then orca itself

docker run --rm -it \
    -v /etc/docker/ssl/orca:/etc/docker/ssl/orca:ro \
    --link orca-ca:orca_ca \
    --link orca-swarm-ca:swarm_ca \
    --link orca-proxy:proxy \
    --link orca-db:rethinkdb \
    --name orca-controller \
    dockerorca/orca \
    --debug server \
    --docker tcp://proxy:2375 \
    --tls-ca-cert /etc/docker/ssl/orca/swarm_ca.pem \
    --tls-cert /etc/docker/ssl/orca/swarm_orca_server.pem \
    --tls-key /etc/docker/ssl/orca/swarm_orca_server_key.pem \
    --orca-tls-ca-cert /etc/docker/ssl/orca/orca_ca.pem \
    --orca-tls-cert /etc/docker/ssl/orca/orca_server.pem \
    --orca-tls-key /etc/docker/ssl/orca/orca_server_key.pem
View Git Blame Copy Permalink