antony@notes:~/container$ cat "Podman-Spring-native.md"
Podman Spring native
Podman Spring native
1. 開發 TLS Http Web Server
1.1. 透過 Step-CA 產生自簽憑證
建立 certificate authority (CA) 設定檔
sudo mkdir -p /opt/zfs/ca sudo chown 1000:1000 /opt/zfs/ca sudo podman run --rm -it \ -v /opt/zfs/ca:/home/step \ smallstep/step-ca:latest \ step ca init \ --deployment-type "standalone" \ --name "Taroko" \ --dns "192.168.188.100" \ --address "192.168.188.100:443" \ --provisioner "bigred@k8s"執行結果：
there is no ca.json config file; please run step ca init, or provide config parameters via DOCKER_STEPCA_INIT_ vars Choose a password for your CA keys and first provisioner. ✔ [leave empty and we'll generate one]: bigred Generating root certificate... done! Generating intermediate certificate... done! ✔ Root certificate: /home/step/certs/root_ca.crt ✔ Root private key: /home/step/secrets/root_ca_key ✔ Root fingerprint: ec149e5b641071f34debb050f56732e120c01c01f4569d31c880880484e61972 ✔ Intermediate certificate: /home/step/certs/intermediate_ca.crt ✔ Intermediate private key: /home/step/secrets/intermediate_ca_key ✔ Database folder: /home/step/db ✔ Default configuration: /home/step/config/defaults.json ✔ Certificate Authority configuration: /home/step/config/ca.json Your PKI is ready to go. To generate certificates for individual services see 'step help ca'.建立 Step-CA Server
echo "bigred" > /opt/zfs/ca/secrets/password sudo podman run --name step-ca -itd \ -h ca.k8s --net=itfra --ip 192.168.188.100 \ --dns 192.168.188.10 --dns-search k8s \ -v /opt/zfs/ca:/home/step \ smallstep/step-ca確認 Step-CA Server 運作是否正常
$ sudo podman logs step-ca執行結果：
badger 2025/11/18 06:54:19 INFO: All 0 tables opened in 0s 2025/11/18 06:54:19 Building new tls configuration using step-ca x509 Signer Interface 2025/11/18 06:54:19 Starting Smallstep CA/0.28.4 (linux/amd64) 2025/11/18 06:54:19 Documentation: https://u.step.sm/docs/ca 2025/11/18 06:54:19 Community Discord: https://u.step.sm/discord 2025/11/18 06:54:19 Config file: /home/step/config/ca.json 2025/11/18 06:54:19 The primary server URL is https://192.168.188.100:443 2025/11/18 06:54:19 Root certificates are available at https://192.168.188.100:443/roots.pem 2025/11/18 06:54:19 X.509 Root Fingerprint: 440e375a87cfe8c75a0e10dcb8c00c306be0e8ae8d584c7a6b03c47c69c8b485 2025/11/18 06:54:19 Serving HTTPS on 192.168.188.100:443 ...檢測 Step-CA Server
curl -k https://192.168.188.100:443/health執行結果：
{"status":"ok"}製作 web.k8s 憑證
sudo podman exec -it step-ca step ca certificate web.k8s web.k8s.crt web.k8s.key執行結果：
✔ Provisioner: bigred@k8s (JWK) [kid: CGRqFRj6mGpgM1JttMTT4jydH-UlpWHh91hAEIc2Ssk] Please enter the password to decrypt the provisioner key: ✔ CA: https://192.168.188.100 ✔ Certificate: web.k8s.crt ✔ Private Key: web.k8s.key建立存放網站憑證的目錄，並將剛剛產生的憑證搬進該目錄
sudo mkdir -p /opt/zfs/java-web/{conf.d,certs} sudo mv /opt/zfs/ca/web.k8s* /opt/zfs/java-web/certs/將憑證轉換為 Java Keystore (PKCS12)
sudo openssl pkcs12 -export \ -inkey /opt/zfs/java-web/certs/web.k8s.key \ -in /opt/zfs/java-web/certs/web.k8s.crt \ -out /opt/zfs/java-web/certs/web.k8s.keystore.p12 \ -name "sb3-tls" \ -passout pass:bigred sudo cp /opt/zfs/java-web/certs/web.k8s.keystore.p12 ${HOME}/sb3/src/main/resources/
1.2. 開發 Web 網站
編輯 RESTful 網站開發套件
nano ${HOME}/sb3/src/main/java/k8s/sb3/TlsHelloController.java檔案內容：
package k8s.sb3; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.RestController; @RestController public class TlsHelloController { @GetMapping("/hello") public String hello() { return "Hello, GraalVM!\n"; } }修改 application.properties
nano ${HOME}/sb3/src/main/resources/application.properties執行結果：
spring.application.name=sb3 # 啟用 SSL server.port=8443 server.ssl.enabled=true server.ssl.key-store=classpath:web.k8s.keystore.p12 server.ssl.key-store-password=bigred server.ssl.key-store-type=PKCS12 server.ssl.key-alias=sb3-tls編輯
KeystoreRuntimeHints.java，將憑證 compile 進 jar 檔nano src/main/java/k8s/sb3/KeystoreRuntimeHints.java檔案內容:
package k8s.sb3; import org.springframework.aot.hint.RuntimeHints; import org.springframework.aot.hint.RuntimeHintsRegistrar; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.ImportRuntimeHints; @Configuration @ImportRuntimeHints(KeystoreRuntimeHints.KeystoreHintsRegistrar.class) public class KeystoreRuntimeHints { static class KeystoreHintsRegistrar implements RuntimeHintsRegistrar { @Override public void registerHints(RuntimeHints hints, ClassLoader classLoader) { // 精準指定檔名 hints.resources().registerPattern("web.k8s.keystore.p12"); // 或者你也可以用通配： // hints.resources().registerPattern("*.p12"); } } }build image
sudo ${HOME}/sb3/mvnw clean \ -Pnative spring-boot:build-image \ -Dspring-boot.build-image.imageName=sb3:v1-tls執行結果：
[INFO] Successfully built image 'docker.io/library/sb3:v1-tls' [INFO] [INFO] ------------------------------------------------------------------------ [INFO] BUILD SUCCESS [INFO] ------------------------------------------------------------------------ [INFO] Total time: 02:07 min [INFO] Finished at: 2025-11-18T21:23:22+08:00 [INFO] ------------------------------------------------------------------------檢視 image
docker images sb3:v1-tls執行結果:
REPOSITORY TAG IMAGE ID CREATED SIZE sb3 v1-tls f8c4fd25f90c 45 years ago 113MBRun Container
docker run --name sb3 -d -p 443:8443 sb3:v1-tls檢視 web container 運作狀態
docker ps -a --filter name=sb3執行結果:
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 70b0a080e03d sb3:v1-tls "" 45 minutes ago Up 45 minutes 0.0.0.0:443->8443/tcp sb3信任 root ca 和 中繼憑證
sudo cp /opt/zfs/ca/certs/root_ca.crt /usr/local/share/ca-certificates sudo cp /opt/zfs/ca/certs/intermediate_ca.crt /usr/local/share/ca-certificates sudo update-ca-certificates測試連線網站
curl https://web.k8s/hello執行結果:
Hello, GraalVM!