splatform/eirini-cert-copier

splatform/eirini-cert-copier 镜像说明

镜像概述

splatform/eirini-cert-copier是一个用于在Kubernetes集群中配置节点信任Eirini registry证书的Docker镜像。它解决了Eirini registry使用自签名证书时，集群节点无法正常拉取镜像的问题，保障Eirini组件的稳定运行。

核心功能

• 自动复制Eirini registry证书到节点系统信任目录
• 简化证书信任配置流程，替代手动操作
• 支持Kubernetes DaemonSet集成，实现集群节点批量配置

使用场景

• Kubernetes集群部署Eirini组件且其registry使用自签名证书
• 需要快速解决节点无法拉取Eirini镜像的问题
• 自动化运维中批量处理节点证书信任需求

配置说明

1. 证书挂载：将Eirini registry证书挂载到镜像内/cert目录（可通过CERT_PATH环境变量自定义路径）
2. 目标目录：默认复制证书到节点/usr/local/share/ca-certificates/并执行update-ca-certificates更新信任列表
3. 环境变量：
   • CERT_PATH：镜像内证书路径，默认/cert/eirini-registry.crt
   • TARGET_DIR：节点信任证书目录，默认/usr/local/share/ca-certificates/

部署示例

Docker Run 示例

bash
docker run -v /host/path/to/eirini-registry.crt:/cert/eirini-registry.crt \
  -v /usr/local/share/ca-certificates/:/usr/local/share/ca-certificates/ \
  --privileged \
  splatform/eirini-cert-copier

Kubernetes DaemonSet 示例

yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: eirini-cert-copier
  namespace: eirini
spec:
  selector:
    matchLabels:
      app: eirini-cert-copier
  template:
    metadata:
      labels:
        app: eirini-cert-copier
    spec:
      containers:
      - name: cert-copier
        image: splatform/eirini-cert-copier
        volumeMounts:
        - name: eirini-cert
          mountPath: /cert
        - name: ca-certificates
          mountPath: /usr/local/share/ca-certificates/
        env:
        - name: CERT_PATH
          value: /cert/eirini-registry.crt
      volumes:
      - name: eirini-cert
        secret:
          secretName: eirini-registry-cert
      - name: ca-certificates
        hostPath:
          path: /usr/local/share/ca-certificates/
          type: Directory
      privileged: true