Chapter 3. Setting up and configuring the registry

Procedure

1. To configure your registry to use storage, change the

   spec.storage.pvc

   in the

   configs.imageregistry/cluster

   resource.
   Note

   When you use shared storage, review your security settings to prevent outside access.

2. Verify that you do not have a registry pod:

   $ oc get pod -n openshift-image-registry -l docker-registry=default

   Example output

   No resources found in openshift-image-registry namespace

   Note

   If you do have a registry pod in your output, you do not need to continue with this procedure.

3. Check the registry configuration:

   $ oc edit configs.imageregistry.operator.openshift.io

   Example output

   storage:
     pvc:
       claim:

   Leave the

   claim

   field blank to allow the automatic creation of an

   image-registry-storage

   PVC.

4. Check the

   clusteroperator

   status:

   $ oc get clusteroperator image-registry

   Example output

   NAME             VERSION              AVAILABLE   PROGRESSING   DEGRADED   SINCE   MESSAGE
   image-registry   4.12                 True        False         False      6h50m

5. Ensure that your registry is set to managed to enable building and pushing of images.

   • Run:

     $ oc edit configs.imageregistry/cluster

     Then, change the line

     managementState: Removed

     to

     managementState: Managed

Procedure

1. Enter the following command to set the image registry storage as a block storage type, patch the registry so that it uses the

   Recreate

   rollout strategy, and runs with only one (

   1

   ) replica:

   $ oc patch config.imageregistry.operator.openshift.io/cluster --type=merge -p '{"spec":{"rolloutStrategy":"Recreate","replicas":1}}'

2. Provision the PV for the block storage device, and create a PVC for that volume. The requested block volume uses the ReadWriteOnce (RWO) access mode.

   1. Create a

      pvc.yaml

      file with the following contents to define a VMware vSphere

      PersistentVolumeClaim

      object:

      kind: PersistentVolumeClaim
      apiVersion: v1
      metadata:
        name: image-registry-storage 

      1

      
        namespace: openshift-image-registry 

      2

      
      spec:
        accessModes:
        - ReadWriteOnce 

      3

      
        resources:
          requests:
            storage: 100Gi 

      4

      1

      A unique name that represents the PersistentVolumeClaim object.

      2

      The namespace for the PersistentVolumeClaim object, which is openshift-image-registry.

      3

      The access mode of the persistent volume claim. With ReadWriteOnce, the volume can be mounted with read and write permissions by a single node.

      4

      The size of the persistent volume claim.

   2. Enter the following command to create the

      PersistentVolumeClaim

      object from the file:

      $ oc create -f pvc.yaml -n openshift-image-registry

3. Enter the following command to edit the registry configuration so that it references the correct PVC:

   $ oc edit config.imageregistry.operator.openshift.io -o yaml

   Example output

   storage:
     pvc:
       claim: 

   1

   1

   By creating a custom PVC, you can leave the claim field blank for the default automatic creation of an image-registry-storage PVC.

Procedure

1. Create the object bucket claim using the

   ocs-storagecluster-ceph-rgw

   storage class. For example:

   cat <<EOF | oc apply -f -
   apiVersion: objectbucket.io/v1alpha1
   kind: ObjectBucketClaim
   metadata:
     name: rgwbucket
     namespace: openshift-storage 

   1

   
   spec:
     storageClassName: ocs-storagecluster-ceph-rgw
     generateBucketName: rgwbucket
   EOF

   1

   Alternatively, you can use the openshift-image-registry namespace.

2. Get the bucket name by entering the following command:

   $ bucket_name=$(oc get obc -n openshift-storage rgwbucket -o jsonpath='{.spec.bucketName}')

3. Get the AWS credentials by entering the following commands:

   $ AWS_ACCESS_KEY_ID=$(oc get secret -n openshift-storage rgwbucket -o jsonpath='{.data.AWS_ACCESS_KEY_ID}' | base64 --decode)

   $ AWS_SECRET_ACCESS_KEY=$(oc get secret -n openshift-storage rgwbucket -o jsonpath='{.data.AWS_SECRET_ACCESS_KEY}' | base64 --decode)

4. Create the secret

   image-registry-private-configuration-user

   with the AWS credentials for the new bucket under

   openshift-image-registry project

   by entering the following command:

   $ oc create secret generic image-registry-private-configuration-user --from-literal=REGISTRY_STORAGE_S3_ACCESSKEY=${AWS_ACCESS_KEY_ID} --from-literal=REGISTRY_STORAGE_S3_SECRETKEY=${AWS_SECRET_ACCESS_KEY} --namespace openshift-image-registry

5. Get the

   route

   host by entering the following command:

   $ route_host=$(oc get route ocs-storagecluster-cephobjectstore -n openshift-storage --template='{{ .spec.host }}')

6. Create a config map that uses an ingress certificate by entering the following commands:

   $ oc extract secret/$(oc get ingresscontroller -n openshift-ingress-operator default -o json | jq '.spec.defaultCertificate.name // "router-certs-default"' -r) -n openshift-ingress --confirm

   $ oc create configmap image-registry-s3-bundle --from-file=ca-bundle.crt=./tls.crt  -n openshift-config

7. Configure the image registry to use the Ceph RGW object storage by entering the following command:

   $ oc patch config.image/cluster -p '{"spec":{"managementState":"Managed","replicas":2,"storage":{"managementState":"Unmanaged","s3":{"bucket":'\"${bucket_name}\"',"region":"us-east-1","regionEndpoint":'\"https://${route_host}\"',"virtualHostedStyle":false,"encrypt":false,"trustedCA":{"name":"image-registry-s3-bundle"}}}}}' --type=merge

Procedure

1. Create the object bucket claim using the

   openshift-storage.noobaa.io

   storage class. For example:

   cat <<EOF | oc apply -f -
   apiVersion: objectbucket.io/v1alpha1
   kind: ObjectBucketClaim
   metadata:
     name: noobaatest
     namespace: openshift-storage 

   1

   
   spec:
     storageClassName: openshift-storage.noobaa.io
     generateBucketName: noobaatest
   EOF

   1

   Alternatively, you can use the openshift-image-registry namespace.

2. Get the bucket name by entering the following command:

   $ bucket_name=$(oc get obc -n openshift-storage noobaatest -o jsonpath='{.spec.bucketName}')

3. Get the AWS credentials by entering the following commands:

   $ AWS_ACCESS_KEY_ID=$(oc get secret -n openshift-storage noobaatest -o yaml | grep -w "AWS_ACCESS_KEY_ID:" | head -n1 | awk '{print $2}' | base64 --decode)

   $ AWS_SECRET_ACCESS_KEY=$(oc get secret -n openshift-storage noobaatest -o yaml | grep -w "AWS_SECRET_ACCESS_KEY:" | head -n1 | awk '{print $2}' | base64 --decode)

4. Create the secret

   image-registry-private-configuration-user

   with the AWS credentials for the new bucket under

   openshift-image-registry project

   by entering the following command:

   $ oc create secret generic image-registry-private-configuration-user --from-literal=REGISTRY_STORAGE_S3_ACCESSKEY=${AWS_ACCESS_KEY_ID} --from-literal=REGISTRY_STORAGE_S3_SECRETKEY=${AWS_SECRET_ACCESS_KEY} --namespace openshift-image-registry

5. Get the route host by entering the following command:

   $ route_host=$(oc get route s3 -n openshift-storage -o=jsonpath='{.spec.host}')

6. Create a config map that uses an ingress certificate by entering the following commands:

   $ oc extract secret/$(oc get ingresscontroller -n openshift-ingress-operator default -o json | jq '.spec.defaultCertificate.name // "router-certs-default"' -r) -n openshift-ingress --confirm

   $ oc create configmap image-registry-s3-bundle --from-file=ca-bundle.crt=./tls.crt  -n openshift-config

7. Configure the image registry to use the Nooba object storage by entering the following command:

   $ oc patch config.image/cluster -p '{"spec":{"managementState":"Managed","replicas":2,"storage":{"managementState":"Unmanaged","s3":{"bucket":'\"${bucket_name}\"',"region":"us-east-1","regionEndpoint":'\"https://${route_host}\"',"virtualHostedStyle":false,"encrypt":false,"trustedCA":{"name":"image-registry-s3-bundle"}}}}}' --type=merge

Procedure

1. To configure your registry to use storage, change the

   spec.storage.pvc

   in the

   configs.imageregistry/cluster

   resource.
   Note

   When you use shared storage, review your security settings to prevent outside access.

2. Verify that you do not have a registry pod:

   $ oc get pod -n openshift-image-registry -l docker-registry=default

   Example output

   No resourses found in openshift-image-registry namespace

   Note

   If you do have a registry pod in your output, you do not need to continue with this procedure.

3. Check the registry configuration:

   $ oc edit configs.imageregistry.operator.openshift.io

   Example output

   storage:
     pvc:
       claim: 

   1

   1

   Leave the claim field blank to allow the automatic creation of an image-registry-storage persistent volume claim (PVC). The PVC is generated based on the default storage class. However, be aware that the default storage class might provide ReadWriteOnce (RWO) volumes, such as a RADOS Block Device (RBD), which can cause issues when you replicate to more than one replica.

4. Check the

   clusteroperator

   status:

   $ oc get clusteroperator image-registry

   Example output

   NAME             VERSION                              AVAILABLE   PROGRESSING   DEGRADED   SINCE   MESSAGE
   image-registry   4.7                                  True        False         False      6h50m

Procedure

1. Enter the following command to set the image registry storage as a block storage type, patch the registry so that it uses the

   Recreate

   rollout strategy, and runs with only

   1

   replica:

   $ oc patch config.imageregistry.operator.openshift.io/cluster --type=merge -p '{"spec":{"rolloutStrategy":"Recreate","replicas":1}}'

2. Provision the PV for the block storage device, and create a PVC for that volume. The requested block volume uses the ReadWriteOnce (RWO) access mode.

   1. Create a

      pvc.yaml

      file with the following contents to define a VMware vSphere

      PersistentVolumeClaim

      object:

      kind: PersistentVolumeClaim
      apiVersion: v1
      metadata:
        name: image-registry-storage 

      1

      
        namespace: openshift-image-registry 

      2

      
      spec:
        accessModes:
        - ReadWriteOnce 

      3

      
        resources:
          requests:
            storage: 100Gi 

      4

      1

      A unique name that represents the PersistentVolumeClaim object.

      2

      The namespace for the PersistentVolumeClaim object, which is openshift-image-registry.

      3

      The access mode of the persistent volume claim. With ReadWriteOnce, the volume can be mounted with read and write permissions by a single node.

      4

      The size of the persistent volume claim.

   2. Enter the following command to create the

      PersistentVolumeClaim

      object from the file:

      $ oc create -f pvc.yaml -n openshift-image-registry

3. Enter the following command to edit the registry configuration so that it references the correct PVC:

   $ oc edit config.imageregistry.operator.openshift.io -o yaml

   Example output

   storage:
     pvc:
       claim: 

   1

   1

   By creating a custom PVC, you can leave the claim field blank for the default automatic creation of an image-registry-storage PVC.

Procedure

1. Create the object bucket claim using the

   ocs-storagecluster-ceph-rgw

   storage class. For example:

   cat <<EOF | oc apply -f -
   apiVersion: objectbucket.io/v1alpha1
   kind: ObjectBucketClaim
   metadata:
     name: rgwbucket
     namespace: openshift-storage 

   1

   
   spec:
     storageClassName: ocs-storagecluster-ceph-rgw
     generateBucketName: rgwbucket
   EOF

   1

   Alternatively, you can use the openshift-image-registry namespace.

2. Get the bucket name by entering the following command:

   $ bucket_name=$(oc get obc -n openshift-storage rgwbucket -o jsonpath='{.spec.bucketName}')

3. Get the AWS credentials by entering the following commands:

   $ AWS_ACCESS_KEY_ID=$(oc get secret -n openshift-storage rgwbucket -o jsonpath='{.data.AWS_ACCESS_KEY_ID}' | base64 --decode)

   $ AWS_SECRET_ACCESS_KEY=$(oc get secret -n openshift-storage rgwbucket -o jsonpath='{.data.AWS_SECRET_ACCESS_KEY}' | base64 --decode)

4. Create the secret

   image-registry-private-configuration-user

   with the AWS credentials for the new bucket under

   openshift-image-registry project

   by entering the following command:

   $ oc create secret generic image-registry-private-configuration-user --from-literal=REGISTRY_STORAGE_S3_ACCESSKEY=${AWS_ACCESS_KEY_ID} --from-literal=REGISTRY_STORAGE_S3_SECRETKEY=${AWS_SECRET_ACCESS_KEY} --namespace openshift-image-registry

5. Get the

   route

   host by entering the following command:

   $ route_host=$(oc get route ocs-storagecluster-cephobjectstore -n openshift-storage --template='{{ .spec.host }}')

6. Create a config map that uses an ingress certificate by entering the following commands:

   $ oc extract secret/$(oc get ingresscontroller -n openshift-ingress-operator default -o json | jq '.spec.defaultCertificate.name // "router-certs-default"' -r) -n openshift-ingress --confirm

   $ oc create configmap image-registry-s3-bundle --from-file=ca-bundle.crt=./tls.crt  -n openshift-config

7. Configure the image registry to use the Ceph RGW object storage by entering the following command:

   $ oc patch config.image/cluster -p '{"spec":{"managementState":"Managed","replicas":2,"storage":{"managementState":"Unmanaged","s3":{"bucket":'\"${bucket_name}\"',"region":"us-east-1","regionEndpoint":'\"https://${route_host}\"',"virtualHostedStyle":false,"encrypt":false,"trustedCA":{"name":"image-registry-s3-bundle"}}}}}' --type=merge

Procedure

1. Create the object bucket claim using the

   openshift-storage.noobaa.io

   storage class. For example:

   cat <<EOF | oc apply -f -
   apiVersion: objectbucket.io/v1alpha1
   kind: ObjectBucketClaim
   metadata:
     name: noobaatest
     namespace: openshift-storage 

   1

   
   spec:
     storageClassName: openshift-storage.noobaa.io
     generateBucketName: noobaatest
   EOF

   1

   Alternatively, you can use the openshift-image-registry namespace.

2. Get the bucket name by entering the following command:

   $ bucket_name=$(oc get obc -n openshift-storage noobaatest -o jsonpath='{.spec.bucketName}')

3. Get the AWS credentials by entering the following commands:

   $ AWS_ACCESS_KEY_ID=$(oc get secret -n openshift-storage noobaatest -o yaml | grep -w "AWS_ACCESS_KEY_ID:" | head -n1 | awk '{print $2}' | base64 --decode)

   $ AWS_SECRET_ACCESS_KEY=$(oc get secret -n openshift-storage noobaatest -o yaml | grep -w "AWS_SECRET_ACCESS_KEY:" | head -n1 | awk '{print $2}' | base64 --decode)

4. Create the secret

   image-registry-private-configuration-user

   with the AWS credentials for the new bucket under

   openshift-image-registry project

   by entering the following command:

   $ oc create secret generic image-registry-private-configuration-user --from-literal=REGISTRY_STORAGE_S3_ACCESSKEY=${AWS_ACCESS_KEY_ID} --from-literal=REGISTRY_STORAGE_S3_SECRETKEY=${AWS_SECRET_ACCESS_KEY} --namespace openshift-image-registry

5. Get the route host by entering the following command:

   $ route_host=$(oc get route s3 -n openshift-storage -o=jsonpath='{.spec.host}')

6. Create a config map that uses an ingress certificate by entering the following commands:

   $ oc extract secret/$(oc get ingresscontroller -n openshift-ingress-operator default -o json | jq '.spec.defaultCertificate.name // "router-certs-default"' -r) -n openshift-ingress --confirm

   $ oc create configmap image-registry-s3-bundle --from-file=ca-bundle.crt=./tls.crt  -n openshift-config

7. Configure the image registry to use the Nooba object storage by entering the following command:

   $ oc patch config.image/cluster -p '{"spec":{"managementState":"Managed","replicas":2,"storage":{"managementState":"Unmanaged","s3":{"bucket":'\"${bucket_name}\"',"region":"us-east-1","regionEndpoint":'\"https://${route_host}\"',"virtualHostedStyle":false,"encrypt":false,"trustedCA":{"name":"image-registry-s3-bundle"}}}}}' --type=merge

Procedure

1. To configure your registry to use storage, change the

   spec.storage.pvc

   in the

   configs.imageregistry/cluster

   resource.
   Note

   When you use shared storage, review your security settings to prevent outside access.

2. Verify that you do not have a registry pod:

   $ oc get pod -n openshift-image-registry -l docker-registry=default

   Example output

   No resourses found in openshift-image-registry namespace

   Note

   If you do have a registry pod in your output, you do not need to continue with this procedure.

3. Check the registry configuration:

   $ oc edit configs.imageregistry.operator.openshift.io

   Example output

   storage:
     pvc:
       claim: 

   1

   1

   Leave the claim field blank to allow the automatic creation of an image-registry-storage persistent volume claim (PVC). The PVC is generated based on the default storage class. However, be aware that the default storage class might provide ReadWriteOnce (RWO) volumes, such as a RADOS Block Device (RBD), which can cause issues when you replicate to more than one replica.

4. Check the

   clusteroperator

   status:

   $ oc get clusteroperator image-registry

   Example output

   NAME             VERSION                              AVAILABLE   PROGRESSING   DEGRADED   SINCE   MESSAGE
   image-registry   4.13                                  True        False         False      6h50m

Procedure

1. Enter the following command to set the image registry storage as a block storage type, patch the registry so that it uses the

   Recreate

   rollout strategy, and runs with only one (

   1

   ) replica:

   $ oc patch config.imageregistry.operator.openshift.io/cluster --type=merge -p '{"spec":{"rolloutStrategy":"Recreate","replicas":1}}'

2. Provision the PV for the block storage device, and create a PVC for that volume. The requested block volume uses the ReadWriteOnce (RWO) access mode.

   1. Create a

      pvc.yaml

      file with the following contents to define a Nutanix

      PersistentVolumeClaim

      object:

      kind: PersistentVolumeClaim
      apiVersion: v1
      metadata:
        name: image-registry-storage 

      1

      
        namespace: openshift-image-registry 

      2

      
      spec:
        accessModes:
        - ReadWriteOnce 

      3

      
        resources:
          requests:
            storage: 100Gi 

      4

      1

      A unique name that represents the PersistentVolumeClaim object.

      2

      The namespace for the PersistentVolumeClaim object, which is openshift-image-registry.

      3

      The access mode of the persistent volume claim. With ReadWriteOnce, the volume can be mounted with read and write permissions by a single node.

      4

      The size of the persistent volume claim.

   2. Enter the following command to create the

      PersistentVolumeClaim

      object from the file:

      $ oc create -f pvc.yaml -n openshift-image-registry

3. Enter the following command to edit the registry configuration so that it references the correct PVC:

   $ oc edit config.imageregistry.operator.openshift.io -o yaml

   Example output

   storage:
     pvc:
       claim: 

   1

   1

   By creating a custom PVC, you can leave the claim field blank for the default automatic creation of an image-registry-storage PVC.

Procedure

1. Create the object bucket claim using the

   ocs-storagecluster-ceph-rgw

   storage class. For example:

   cat <<EOF | oc apply -f -
   apiVersion: objectbucket.io/v1alpha1
   kind: ObjectBucketClaim
   metadata:
     name: rgwbucket
     namespace: openshift-storage 

   1

   
   spec:
     storageClassName: ocs-storagecluster-ceph-rgw
     generateBucketName: rgwbucket
   EOF

   1

   Alternatively, you can use the openshift-image-registry namespace.

2. Get the bucket name by entering the following command:

   $ bucket_name=$(oc get obc -n openshift-storage rgwbucket -o jsonpath='{.spec.bucketName}')

3. Get the AWS credentials by entering the following commands:

   $ AWS_ACCESS_KEY_ID=$(oc get secret -n openshift-storage rgwbucket -o jsonpath='{.data.AWS_ACCESS_KEY_ID}' | base64 --decode)

   $ AWS_SECRET_ACCESS_KEY=$(oc get secret -n openshift-storage rgwbucket -o jsonpath='{.data.AWS_SECRET_ACCESS_KEY}' | base64 --decode)

4. Create the secret

   image-registry-private-configuration-user

   with the AWS credentials for the new bucket under

   openshift-image-registry project

   by entering the following command:

   $ oc create secret generic image-registry-private-configuration-user --from-literal=REGISTRY_STORAGE_S3_ACCESSKEY=${AWS_ACCESS_KEY_ID} --from-literal=REGISTRY_STORAGE_S3_SECRETKEY=${AWS_SECRET_ACCESS_KEY} --namespace openshift-image-registry

5. Get the

   route

   host by entering the following command:

   $ route_host=$(oc get route ocs-storagecluster-cephobjectstore -n openshift-storage --template='{{ .spec.host }}')

6. Create a config map that uses an ingress certificate by entering the following commands:

   $ oc extract secret/$(oc get ingresscontroller -n openshift-ingress-operator default -o json | jq '.spec.defaultCertificate.name // "router-certs-default"' -r) -n openshift-ingress --confirm

   $ oc create configmap image-registry-s3-bundle --from-file=ca-bundle.crt=./tls.crt  -n openshift-config

7. Configure the image registry to use the Ceph RGW object storage by entering the following command:

   $ oc patch config.image/cluster -p '{"spec":{"managementState":"Managed","replicas":2,"storage":{"managementState":"Unmanaged","s3":{"bucket":'\"${bucket_name}\"',"region":"us-east-1","regionEndpoint":'\"https://${route_host}\"',"virtualHostedStyle":false,"encrypt":false,"trustedCA":{"name":"image-registry-s3-bundle"}}}}}' --type=merge

Procedure

1. Create the object bucket claim using the

   openshift-storage.noobaa.io

   storage class. For example:

   cat <<EOF | oc apply -f -
   apiVersion: objectbucket.io/v1alpha1
   kind: ObjectBucketClaim
   metadata:
     name: noobaatest
     namespace: openshift-storage 

   1

   
   spec:
     storageClassName: openshift-storage.noobaa.io
     generateBucketName: noobaatest
   EOF

   1

   Alternatively, you can use the openshift-image-registry namespace.

2. Get the bucket name by entering the following command:

   $ bucket_name=$(oc get obc -n openshift-storage noobaatest -o jsonpath='{.spec.bucketName}')

3. Get the AWS credentials by entering the following commands:

   $ AWS_ACCESS_KEY_ID=$(oc get secret -n openshift-storage noobaatest -o yaml | grep -w "AWS_ACCESS_KEY_ID:" | head -n1 | awk '{print $2}' | base64 --decode)

   $ AWS_SECRET_ACCESS_KEY=$(oc get secret -n openshift-storage noobaatest -o yaml | grep -w "AWS_SECRET_ACCESS_KEY:" | head -n1 | awk '{print $2}' | base64 --decode)

4. Create the secret

   image-registry-private-configuration-user

   with the AWS credentials for the new bucket under

   openshift-image-registry project

   by entering the following command:

   $ oc create secret generic image-registry-private-configuration-user --from-literal=REGISTRY_STORAGE_S3_ACCESSKEY=${AWS_ACCESS_KEY_ID} --from-literal=REGISTRY_STORAGE_S3_SECRETKEY=${AWS_SECRET_ACCESS_KEY} --namespace openshift-image-registry

5. Get the route host by entering the following command:

   $ route_host=$(oc get route s3 -n openshift-storage -o=jsonpath='{.spec.host}')

6. Create a config map that uses an ingress certificate by entering the following commands:

   $ oc extract secret/$(oc get ingresscontroller -n openshift-ingress-operator default -o json | jq '.spec.defaultCertificate.name // "router-certs-default"' -r) -n openshift-ingress --confirm

   $ oc create configmap image-registry-s3-bundle --from-file=ca-bundle.crt=./tls.crt  -n openshift-config

7. Configure the image registry to use the Nooba object storage by entering the following command:

   $ oc patch config.image/cluster -p '{"spec":{"managementState":"Managed","replicas":2,"storage":{"managementState":"Unmanaged","s3":{"bucket":'\"${bucket_name}\"',"region":"us-east-1","regionEndpoint":'\"https://${route_host}\"',"virtualHostedStyle":false,"encrypt":false,"trustedCA":{"name":"image-registry-s3-bundle"}}}}}' --type=merge