linuxea:gitlab-ci/cd htpps配置和gitlab-runner配置(十)


gitlab https配置

自己签名一个证书给gitlab使用
事实上我并不推荐使用https自签证书,如果还使用了runner那你肯定会明白的

根证书自签

开始根证书私钥文件创建

[root@Linuxea-VM-Node146 /etc/gitlab/trusted-certs]# cd /etc/pki/CA/
[root@Linuxea-VM-Node146 /etc/pki/CA]#(umask 077; openssl genrsa -out /etc/pki/CA/private/cakey.pem 2048)
Generating RSA private key, 2048 bit long modulus
....+++
..................................................................+++
e is 65537 (0x10001)

生成CA自己的私钥文件,cakey.pem。默认权限为600;

[root@Linuxea-VM-Node146 /etc/pki/CA]#  openssl req -new -x509 -key /etc/pki/CA/private/cakey.pem -out /etc/pki/CA/cacert.pem -days 36
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn  #国家
State or Province Name (full name) []:shanghai # 身份
Locality Name (eg, city) [Default City]:shanghai # 城市
Organization Name (eg, company) [Default Company Ltd]:ca #机构i
Organizational Unit Name (eg, section) []:ops # 部门名称
Common Name (eg, your name or your server's hostname) []:linuxea-gitlab.ds.com # 主机名称
Email Address []:user@163.com  # 邮箱

根据私钥文件生成CA自签证书。CA给自己签发一个证书;
来关注下以下几个文件

  • index.txt 创建索引文件
  • serial 证书编号位置
  • echo 01 > serial 自定义开始证书编号
  • touch crlnumber 已吊销证书编号文件
[root@Linuxea-VM-Node146 /etc/pki/CA]# touch index.txt  serial
[root@Linuxea-VM-Node146 /etc/pki/CA]# echo 01 > serial 
[root@Linuxea-VM-Node146 /etc/pki/CA]# touch crlnumber  

以上的三个文件,是CA配置文件中定义的文件名,必须手动创建出来;
以上简单自建CA配置完毕;

签发gitlab证书

到gitlab目录在创建一个证书,而后用上面的根证书来进行签发

[root@Linuxea-VM-Node146 /etc/pki/CA]# mkdir /etc/gitlab/ssl
[root@Linuxea-VM-Node146 /etc/pki/CA]# cd /etc/gitlab/ssl
[root@Linuxea-VM-Node146 /etc/gitlab/ssl]#  (umask 077; openssl genrsa -out linuxea-gitlab.ds.com.key 1024)
Generating RSA private key, 1024 bit long modulus
.......................++++++
....................++++++
e is 65537 (0x10001)
[root@Linuxea-VM-Node146 /etc/gitlab/ssl]# ll
总用量 4
-rw------- 1 root root 891 7月   9 13:10 linuxea-gitlab.ds.com.key

创建申请

[root@Linuxea-VM-Node146 /etc/gitlab/ssl]# openssl req -new -key ./linuxea-gitlab.ds.com.key -out ./linuxea-gitlab.ds.com.csr -days 365
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:cn
State or Province Name (full name) []:shanghai
Locality Name (eg, city) [Default City]:shanghai
Organization Name (eg, company) [Default Company Ltd]:gitlab-linuxea
Organizational Unit Name (eg, section) []:linuxea
Common Name (eg, your name or your server's hostname) []:linuxea-gitlab.ds.com
Email Address []:user@163.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

CA服务器上操作
开始签发

[root@Linuxea-VM-Node146 /etc/gitlab/ssl]# openssl ca -in linuxea-gitlab.ds.com.csr -out ./linuxea-gitlab.ds.com.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
The organizationName field needed to be the same in the
CA certificate (ca) and the request (gitlab-linuxea)

解决报错,修改配置文件

[root@Linuxea-VM-Node146 /etc/gitlab/ssl]# vim /etc/pki/tls/openssl.cnf 
 84 [ policy_match ]
 85 countryName||   = optional
 86 stateOrProvinceName|= optional
 87 organizationName|   = optional                 
 88 organizationalUnitName| = optional
 89 commonName| |   = supplied
 90 emailAddress|   |   = optional

在颁发一次

[root@Linuxea-VM-Node146 /etc/gitlab/ssl]# openssl ca -in linuxea-gitlab.ds.com.csr -out ./linuxea-gitlab.ds.com.crt -days 365
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Jul  9 05:19:07 2018 GMT
            Not After : Jul  9 05:19:07 2019 GMT
        Subject:
            countryName               = cn
            stateOrProvinceName       = shanghai
            organizationName          = gitlab-linuxea
            organizationalUnitName    = linuxea
            commonName                = linuxea-gitlab.ds.com
            emailAddress              = user@163.com
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            Netscape Comment: 
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier: 
                DE:FF:FD:A3:6E:96:9A:F8:D4:9A:1E:F2:FE:1B:99:FB:A3:A3:07:4F
            X509v3 Authority Key Identifier: 
                keyid:00:8A:F1:19:5D:42:7E:CD:14:10:56:62:6C:C1:D6:00:36:6C:B0:29

Certificate is to be certified until Jul  9 05:19:07 2019 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

查看

[root@Linuxea-VM-Node146 /etc/gitlab/ssl]# cat /etc/pki/CA/serial
02
[root@Linuxea-VM-Node146 /etc/gitlab/ssl]# ll /etc/pki/CA/newcerts/01.pem 
-rw-r--r-- 1 root root 3917 7月   9 13:19 /etc/pki/CA/newcerts/01.pem

修改gitlab文件

[root@Linuxea-VM-Node146 ~]# vim /etc/gitlab/gitlab.rb 
13 external_url 'https://linuxea-gitlab.ds.com'
14 nginx['redirect_http_to_https']=true
15 nginx['ssl_certificate'] = "/etc/pki/CA/newcerts/01.pem"
16 nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/linuxea-gitlab.ds.com.key"  
[root@Linuxea-VM-Node146 ~]# gitlab-ctl reconfigure


gitlab https已经配置完成

gitlab runner配置

gitlab一旦用来https,这可不当紧,但是runner也就需要了,不然会报错

[root@Linuxea-VM-Node_10_10_240_145 ~]$ gitlab-runner verify
Running in system-mode.                                                                   
ERROR: Verifying runner... failed                   runner=awSshzhi status=couldn't execute POST against https://linuxea-gitlab.ds.com/api/v4/runners/verify: Post https://linuxea-gitlab.ds.com/api/v4/runners/verify: x509: certificate signed by unknown authority
ERROR: Verifying runner... failed                   runner=fc4a03c9 status=couldn't execute POST against https://linuxea-gitlab.ds.com/api/v4/runners/verify: Post https://linuxea-gitlab.ds.com/api/v4/runners/verify: x509: certificate signed by unknown authority

--tls-ca-file来解决

[root@Linuxea-VM-Node_10_10_240_145 /etc/gitlab-runner]$ gitlab-runner register --tls-ca-file ~/01.pem 
Running in system-mode.                            
                                                   
Please enter the gitlab-ci coordinator URL (e.g. https://gitlab.com/):
https://linuxea-gitlab.ds.com/
Please enter the gitlab-ci token for this runner:
awSshzhiuXp1KbxmXbk3
Please enter the gitlab-ci description for this runner:
[Linuxea-VM-Node_10_10_240_145.dwhd.org]: 145-runner
Please enter the gitlab-ci tags for this runner (comma separated):
 145-runner 
Whether to run untagged builds [true/false]:
[false]: true
Whether to lock the Runner to current project [true/false]:
[true]: true
Registering runner... succeeded                     runner=awSshzhi
Please enter the executor: docker, parallels, shell, docker-ssh+machine, kubernetes, docker-ssh, ssh, virtualbox, docker+machine:
shell
Runner registered successfully. Feel free to start it, but if it's running already the config should be automatically reloaded! 

正确的方式

这样操作完成后,可能还是不行的,将之前的文件都拿到runner机器上来
创建目录后,使用tls_cert_path=/etc/gitlab-runner/certs指定即可

[root@Linuxea-VM-Node_10_10_240_145 /etc/gitlab-runner/certs]$ ll
总用量 12
-rw-r--r-- 1 root root 3917 7月  26 22:14 01.pem
-rw-r--r-- 1 root root 3917 7月  26 22:04 linuxea-gitlab.ds.com.crt
-rw------- 1 root root  891 7月  26 22:13 linuxea-gitlab.ds.com.key
[root@Linuxea-VM-Node_10_10_240_145 /etc/gitlab-runner/certs]$  gitlab-runner register tls_cert_path=/etc/gitlab-runner/certs
Running in system-mode.                            
                                                   
Please enter the gitlab-ci coordinator URL (e.g. https://gitlab.com/):

Please enter the gitlab-ci coordinator URL (e.g. https://gitlab.com/):
https://linuxea-gitlab.ds.com/
Please enter the gitlab-ci token for this runner:
awSshzhiuXp1KbxmXbk3
Please enter the gitlab-ci description for this runner:
[Linuxea-VM-Node_10_10_240_145.dwhd.org]: test
Please enter the gitlab-ci tags for this runner (comma separated):
test
Whether to run untagged builds [true/false]:
[false]: true
Whether to lock the Runner to current project [true/false]:
[true]: true
Registering runner... succeeded                     runner=awSshzhi
Please enter the executor: docker+machine, kubernetes, ssh, virtualbox, parallels, shell, docker-ssh+machine, docker, docker-ssh:
shell
Runner registered successfully. Feel free to start it, but if it's running already the config should be automatically reloaded! 
[root@Linuxea-VM-Node_10_10_240_145 /etc/gitlab-runner/certs]$ 

参考:

https://docs.gitlab.com/runner/configuration/advanced-configuration.html
0 分享

您可以选择一种方式赞助本站

支付宝扫码赞助

支付宝扫码赞助

日期: 2018-07-10分类: 持续集成

标签: gitlab

发表评论