前回 の続き。 クライアント認証できるようにしていく。
環境
- OS: Windows 10 Pro
- Docker version 18.03.1-ce, build 9ee9f40
- docker-compose version 1.21.1, build 7641a569
- 使用イメージ
- gitlab & gitlab-runner
- gitlab: gitlab/gitlab-ce:11.0.1-ce.0
- gitlab-runner: gitlab/gitlab-runner:v11.0.0
- 証明書作成関係
- gitlab & gitlab-runner
PATH_TO_WORKING_DIR も前回と同じ。
クライアント証明書作成
前回準備した openssl 環境でクライアント証明書を作る。
openssl 環境を実行
$WORKING_DIR="PATH_TO_WORKING_DIR"
cd $WORKING_DIR\work
docker-compose.exe run --rm openssl /bin/bashopenssl 環境での作業
CLIENT_COMMON="client.mikoto2000.example.com"
CLIENT_KEY_FILE="/client/${CLIENT_COMMON}.key"
CLIENT_CSR_FILE="/client/${CLIENT_COMMON}.csr"
CLIENT_CRT_FILE="/client/${CLIENT_COMMON}.crt"
CLIENT_COUNTRY="JP"
CLIENT_STATE="Tokyo"
CLIENT_LOCALITY="foo-ku"
CLIENT_ORGANIZATION="bar Inc."
CLIENT_ORGANIZATIONAL_UNIT="baz"
CLIENT_EMAIL="mikoto2000@gmail.com"
# クライアント秘密鍵作成
openssl genrsa -out ${CLIENT_KEY_FILE} 2048
# クライアント証明書要求作成
CLIENT_SUBJECT="/C=${CLIENT_COUNTRY}/ST=${CLIENT_STATE}/L=${CLIENT_LOCALITY}/O=${CLIENT_ORGANIZATION}/OU=${CLIENT_ORGANIZATIONAL_UNIT}/CN=${CLIENT_COMMON}"
openssl req -new -key ${CLIENT_KEY_FILE} -out ${CLIENT_CSR_FILE} -subj "${CLIENT_SUBJECT}"
# クライアント証明書要求確認
openssl req -noout -text -in ${CLIENT_CSR_FILE}
### クライアント証明書作成
cd /client
yes | openssl ca -out ${CLIENT_CRT_FILE} -infiles ${CLIENT_CSR_FILE}
### p12 形式に変換
COMMON="client.mikoto2000.example.com"
CACERT_FILE=/ca/cacert.pem
KEY_FILE=/client/${COMMON}.key
CRT_FILE=/client/${COMMON}.crt
P12_FILE=/client/${COMMON}.p12
openssl pkcs12 -export -out ${P12_FILE} -inkey ${KEY_FILE} -in ${CRT_FILE} -certfile ${CACERT_FILE}gitlabの設定
設定ファイルの更新
docker-compose.yml を更新する。
version: '3'
services:
gitlab:
image: gitlab/gitlab-ce:11.0.1-ce.0
restart: always
hostname: gitlab.example.com
container_name: gitlab.example.com
volumes:
- gitlab_etc:/etc/gitlab
- gitlab_log:/var/log/gitlab
- gitlab_opt:/var/opt/gitlab
environment:
GITLAB_OMNIBUS_CONFIG: |
external_url 'https://gitlab.example.com/'
gitlab_rails['gitlab_shell_ssh_port'] = 8022
nginx['redirect_http_to_https'] = true
nginx['redirect_http_to_https_port'] = 80
nginx['ssl_verify_client'] = "on"
nginx['ssl_client_certificate'] = '/etc/gitlab/trusted-certs/ca.crt'
nginx['ssl_crl'] = '/etc/gitlab/CA.crl'
ports:
- "80:80"
- "443:443"
- "8022:22"
networks:
gitlab_net:
ipv4_address: 172.16.238.2
gitlab-runner:
image: gitlab/gitlab-runner:v11.0.0
restart: always
hostname: gitlab-runner.example.com
container_name: gitlab-runner.example.com
volumes:
- gitlab-runner_config:/etc/gitlab-runner
- /var/run/docker.sock:/var/run/docker.sock
depends_on:
- gitlab
networks:
gitlab_net:
ipv4_address: 172.16.238.3
networks:
gitlab_net:
ipam:
config:
- subnet: 172.16.238.0/24
volumes:
gitlab_etc:
external: true
gitlab_log:
external: true
gitlab_opt:
external: true
gitlab-runner_config:
external: truenginx['ssl_verify_client'] = "on": クライアント認証を onnginx['ssl_client_certificate'] = '/etc/gitlab/trusted-certs/cacert.pem': クライアント認証する際に信頼する ca 証明書の場所を指定nginx['ssl_crl'] = '/etc/gitlab/CA.crl': 失効リストの場所
証明書コピー
GitLab が信頼する CA 証明書を設置する。
適当なコンテナを起動して、コピー。
docker run -it --rm -v "PATH_TO_WORKING_DIR/work/client:/client" -v "gitlab_etc:/gitlab_etc" debian:stretch-slim /bin/bash
cp /client/ca.crt /gitlab_etc/trusted-certs/gitlab-runner の設定
設定ファイルを変更
gitlab-runner のコンテナ内の /etc/gitlab-runner/config.toml を編集し、 クライアント認証用の設定を行う。
cd $PATH_TO_WORKING_DIR
docker-compose up -d
docker-compose exec gitlab-runner vi /etc/gitlab-runner/config.toml/etc/gitlab-runner/config.toml を編集し、 tls-cert-file, tls-key-file を追加する。
/etc/gitlab-runner/config.toml
concurrent = 1
check_interval = 0
[[runners]]
name = "gitlab-runner"
url = "https://gitlab.example.com/"
token = "a6219b6094d056e471105e5b026aec"
executor = "docker"
environment = ["GODEBUG=netdns=cgo"]
tls-cert-file = "/etc/gitlab-runner/mycert/client.mikoto2000.example.com.crt"
tls-key-file = "/etc/gitlab-runner/mycert/client.mikoto2000.example.com.key"
[runners.docker]
tls_verify = false
image = "debian:stretch-slim"
privileged = false
disable_cache = false
volumes = ["/cache"]
extra_hosts = ["gitlab.example.com:172.16.238.1"]
shm_size = 0
[runners.cache]
[[runners]]
name = "gitlab-runner"
url = "https://gitlab.example.com/"
token = "2c55ab3d9289874bfb7e265d37678b"
executor = "docker"
environment = ["GODEBUG=netdns=cgo"]
tls-cert-file = "/etc/gitlab-runner/mycert/client.mikoto2000.example.com.crt"
tls-key-file = "/etc/gitlab-runner/mycert/client.mikoto2000.example.com.key"
[runners.docker]
tls_verify = false
image = "debian:stretch-slim"
privileged = false
disable_cache = false
volumes = ["/cache"]
extra_hosts = ["gitlab.example.com:172.16.238.1"]
shm_size = 0
[runners.cache]tls-cert-file = "/etc/gitlab-runner/mycert/client.mikoto2000.example.com.crt": クライアント認証に使うクライアント証明書の配置場所を指定tls-key-file = "/etc/gitlab-runner/mycert/client.mikoto2000.example.com.key": クライアント認証に使うクライアントの秘密鍵配置場所を指定
証明書・秘密鍵をコンテナにコピー
docker-compose exec gitlab-runner mkdir /etc/gitlab-runner/mycert
docker cp c:/Users/mikoto/project/gitlab-runner5/work/client/client.mikoto2000.example.com.crt 7875f5d4c9e2:/etc/gitlab-runner/mycert/
docker cp c:/Users/mikoto/project/gitlab-runner5/work/client/client.mikoto2000.example.com.key 7875f5d4c9e2:/etc/gitlab-runner/mycert/動作確認
前回作った job を retry してみる。ok.
