其他机器上访问harbor机器，报错tls: failed to verify certificate: x509: cannot validate certificate for

报错信息：
Error response from daemon: Get "https://192.168.40.110/v2/": tls: failed to verify certificate: x509: cannot validate certificate for 192.168.40.110 because it doesn't contain any IP SANs

复现：

[root@master1 ~]# docker login 192.168.40.110
Username: admin
Password: 
Error response from daemon: Get "https://192.168.40.110/v2/": tls: failed to verify certificate: x509: cannot validate certificate for 192.168.40.110 because it doesn't contain any IP SANs

这里我百度了一下，看到其中有部分是写到了docker的镜像配置文件daemon.json，同时有证书问题的指导，回想到harbor机器上配置了相关的免证书登录（insecure-registary）

• docker客户端如果配置中添加了insecure-registary配置，就不需要在docker 客户端配置上对应证书
• 如果不配置就需要在/etc/docker/certs.d/目录中添加对应证书才能正常登录

harbor机器上的daemon.json配置如下：

[root@harbor harbor]# cat /etc/docker/daemon.json 
{  "registry-mirrors": ["https://rsbud4vc.mirror.aliyuncs.com","https://registry.docker-cn.com","https://docker.mirrors.ustc.edu.cn","https://dockerhub.azk8s.cn","http://hub-mirror.c.163.com"],
"insecure-registries": ["192.168.40.110","harbor"]
}
You have new mail in /var/spool/mail/root
[root@harbor harbor]# 

查看其他k8s节点（其他机器），发现没有

[root@node1 ~]# cat /etc/docker/daemon.json 
{
 "registry-mirrors":["https://vh3bm52y.mirror.aliyuncs.com","https://registry.docker-cn.com","https://docker.mirrors.ustc.edu.cn","https://dockerhub.azk8s.cn","http://hub-mirror.c.163.com"]
}

[root@master1 ~]# cat /etc/docker/daemon.json 
{
 "registry-mirrors":["https://vh3bm52y.mirror.aliyuncs.com","https://registry.docker-cn.com","https://docker.mirrors.ustc.edu.cn","https://dockerhub.azk8s.cn","http://hub-mirror.c.163.com"]
}

复制,  "insecure-registries": ["192.168.40.110","harbor"]  将此免密配置加入到其他节点的daemon.json配置文件

如下：

编辑/创建 daemon.json文件
[root@master1 ~]# vim /etc/docker/daemon.json
{
 "registry-mirrors":["https://vh3bm52y.mirror.aliyuncs.com","https://registry.docker-cn.com","https://docker.mirrors.ustc.edu.cn","https://dockerhub.azk8s.cn","http://hub-mirror.c.163.com"],
"insecure-registries": ["192.168.40.110","harbor"]
}
强制保存并退出vim编辑(ESC 然后:wq!  然后回车)


回到命令行后复制此命令，粘贴，回车
[root@master1 ~]# systemctl daemon-reload && systemctl restart docker && systemctl status docker  

配置hosts文件：

在每一个节点配置如下：主机ip +空格+ 主机名


[root@harbor harbor]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.40.180 180master
192.168.40.181 181node
192.168.40.182 182node
192.168.40.180 master1
192.168.40.181 node1
192.168.40.110 harbor

You have new mail in /var/spool/mail/root
[root@harbor harbor]#

主机ip和主机名

不清楚主机ip的 ip addr 查看 或 cat /etc/sysconfig/network-scripts/ifcfg-ens33
想修改主机名的：hostnamectl set-hostname node1 && bash

[root@harbor harbor]# cat /etc/sysconfig/network-scripts/ifcfg-ens33
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=static
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=ens33
DEVICE=ens33
ONBOOT=yes
IPADDR=192.168.40.110
NETMASK=255.255.255.0
GATEWAY=192.168.40.2
DNS1=114.114.114.114
ZONE=public

以上均配置完成后，重新在其他的节点登录harbor

[root@master1 ~]# docker login 192.168.40.110
Username: admin
Password: 
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
[root@master1 ~]# 

这里密码是拉建harbor时，最原始的密码和登录名

用户名：admin

密码：Harbor12345