Registry

1. To configure an additional CA:

   $ oc create configmap registry-config --from-file=<external_registry_address>=ca.crt -n openshift-config

   $ oc edit image.config.openshift.io cluster

   spec:
     additionalTrustedCA:
       name: registry-config

1. Access the node by getting the node’s name:

   $ oc get nodes

   $ oc debug nodes/<node_name>

2. To enable access to tools such as oc and podman on the node, run the following command:

   sh-4.2# chroot /host

3. Log in to the container image registry by using your access token:

   sh-4.2# oc login -u kubeadmin -p <password_from_install_log> https://api-int.<cluster_name>.<base_domain>:6443

   sh-4.2# podman login -u kubeadmin -p $(oc whoami -t) image-registry.openshift-image-registry.svc:5000

   You should see a message confirming login, such as:

   Login Succeeded!

   Note

   You can pass any value for the user name; the token contains all necessary information. Passing a user name that contains colons will result in a login failure.

   Since the Image Registry Operator creates the route, it will likely be similar to default-route-openshift-image-registry.<cluster_name>.

4. Perform podman pull and podman push operations against your registry:

   Important

   You can pull arbitrary images, but if you have the system:registry role added, you can only push images to the registry in your project.

   In the following examples, use:

   Component	Value
   <registry_ip>	172.30.124.220
   <port>	5000
   <project>	openshift
   <image>	image
   <tag>	omitted (defaults to latest)

   1. Pull an arbitrary image:

      sh-4.2# podman pull name.io/image

   2. Tag the new image with the form <registry_ip>:<port>/<project>/<image>. The project name must appear in this pull specification for OpenShift Container Platform to correctly place and later access the image in the registry:

      sh-4.2# podman tag name.io/image image-registry.openshift-image-registry.svc:5000/openshift/image

      Note

      You must have the system:image-builder role for the specified project, which allows the user to write or push an image. Otherwise, the podman push in the next step will fail. To test, you can create a new project to push the image.

   3. Push the newly tagged image to your registry:

      sh-4.2# podman push image-registry.openshift-image-registry.svc:5000/openshift/image

Procedure

1. List the pods in the openshift-image-registry project and view their status:

   $ oc get pods -n openshift-image-registry

   Example output

   NAME READY STATUS RESTARTS AGE
   cluster-image-registry-operator-764bd7f846-qqtpb 1/1 Running 0 78m
   image-registry-79fb4469f6-llrln 1/1 Running 0 77m
   node-ca-hjksc 1/1 Running 0 73m
   node-ca-tftj6 1/1 Running 0 77m
   node-ca-wb6ht 1/1 Running 0 77m
   node-ca-zvt9q 1/1 Running 0 74m

Procedure

1. Use the oc logs command with deployments to view the logs for the container image registry:

   $ oc logs deployments/image-registry -n openshift-image-registry

   Example output

   2015-05-01T19:48:36.300593110Z time="2015-05-01T19:48:36Z" level=info msg="version=v2.0.0+unknown"
   2015-05-01T19:48:36.303294724Z time="2015-05-01T19:48:36Z" level=info msg="redis not configured" instance.id=9ed6c43d-23ee-453f-9a4b-031fea646002
   2015-05-01T19:48:36.303422845Z time="2015-05-01T19:48:36Z" level=info msg="using inmemory layerinfo cache" instance.id=9ed6c43d-23ee-453f-9a4b-031fea646002
   2015-05-01T19:48:36.303433991Z time="2015-05-01T19:48:36Z" level=info msg="Using OpenShift Auth handler"
   2015-05-01T19:48:36.303439084Z time="2015-05-01T19:48:36Z" level=info msg="listening on :5000" instance.id=9ed6c43d-23ee-453f-9a4b-031fea646002

1. Run a metrics query, for example:

   $ curl --insecure -s -u <user>:<secret> \ 1
       https://image-registry.openshift-image-registry.svc:5000/extensions/v2/metrics | grep imageregistry | head -n 20

   Example output

   # HELP imageregistry_build_info A metric with a constant '1' value labeled by major, minor, git commit & git version from which the image registry was built.
   # TYPE imageregistry_build_info gauge
   imageregistry_build_info{gitCommit="9f72191",gitVersion="v3.11.0+9f72191-135-dirty",major="3",minor="11+"} 1
   # HELP imageregistry_digest_cache_requests_total Total number of requests without scope to the digest cache.
   # TYPE imageregistry_digest_cache_requests_total counter
   imageregistry_digest_cache_requests_total{type="Hit"} 5
   imageregistry_digest_cache_requests_total{type="Miss"} 24
   # HELP imageregistry_digest_cache_scoped_requests_total Total number of scoped requests to the digest cache.
   # TYPE imageregistry_digest_cache_scoped_requests_total counter
   imageregistry_digest_cache_scoped_requests_total{type="Hit"} 33
   imageregistry_digest_cache_scoped_requests_total{type="Miss"} 44
   # HELP imageregistry_http_in_flight_requests A gauge of requests currently being served by the registry.
   # TYPE imageregistry_http_in_flight_requests gauge
   imageregistry_http_in_flight_requests 1
   # HELP imageregistry_http_request_duration_seconds A histogram of latencies for requests to the registry.
   # TYPE imageregistry_http_request_duration_seconds summary
   imageregistry_http_request_duration_seconds{method="get",quantile="0.5"} 0.01296087
   imageregistry_http_request_duration_seconds{method="get",quantile="0.9"} 0.014847248
   imageregistry_http_request_duration_seconds{method="get",quantile="0.99"} 0.015981195
   imageregistry_http_request_duration_seconds_sum{method="get"} 12.260727916000022

   1

   <user> can be arbitrary, but <secret> must match the value specified in the registry configuration.

1. Create a cluster role if you do not already have one to access the metrics:

   $ cat <<EOF | oc create -f -
   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: prometheus-scraper
   rules:
   - apiGroups:
     - image.openshift.io
     resources:
     - registry/metrics
     verbs:
     - get
   EOF

2. Add this role to a user, run the following command:

   $ oc adm policy add-cluster-role-to-user prometheus-scraper <username>

3. Access the metrics using cluster role. The part of the configuration file responsible for metrics should look like this:

   openshift:
     version: 1.0
     metrics:
       enabled: true
   ...

1. Set defaultRoute to true:

   $ oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge

2. Get the default registry route:

   $ HOST=$(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')

3. Get the certificate of the Ingress Operator:

   $ oc get secret -n openshift-ingress  router-certs-default -o go-template='{{index .data "tls.crt"}}' | base64 -d | sudo tee /etc/pki/ca-trust/source/anchors/${HOST}.crt  > /dev/null

4. Enable the cluster’s default certificate to trust the route using the following commands:

   $ sudo update-ca-trust enable

5. Log in with podman using the default route:

   $ sudo podman login -u kubeadmin -p $(oc whoami -t) $HOST

1. Set DefaultRoute to True:

   $ oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge

2. Log in with podman:

   $ HOST=$(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')

   $ podman login -u kubeadmin -p $(oc whoami -t) --tls-verify=false $HOST 1

   1

   --tls-verify=false is needed if the cluster’s default certificate for routes is untrusted. You can set a custom, trusted certificate as the default certificate with the Ingress Operator.

1. Create a secret with your route’s TLS keys:

   $ oc create secret tls public-route-tls \
       -n openshift-image-registry \
       --cert=</path/to/tls.crt> \
       --key=</path/to/tls.key>

   This step is optional. If you do not create a secret, the route uses the default TLS configuration from the Ingress Operator.

2. On the Registry Operator:

   spec:
     routes:
       - name: public-routes
         hostname: myregistry.mycorp.organization
         secretName: public-route-tls
   ...

   Note

   Only set secretName if you are providing a custom TLS configuration for the registry’s route.