Chapter 3. Manage containers in private automation hub

Procedure

1. If you need to access your manifest for your container images log in to Red Hat Console.
2. Click the three-dot menu for the manifest you need for your execution environments, and click Export manifest.

3. Log in to Podman by using your registry.redhat.io credentials:

   $ podman login registry.redhat.io

4. Enter your username and password.

5. Pull an execution environment:

   $ podman pull registry.redhat.io/<ee_name>:<tag>

1. List the images in local storage:

   $ podman images

2. Check the execution environment name, and verify that the tag is correct.

Verification

1. List the images in local storage:

   $ podman images

2. Verify that the execution environment you recently tagged with your automation hub information is contained in the list.

Procedure

1. Log in to Podman using your automation hub location and credentials:

   $ podman login -u=<username> -p=<password> <automation_hub_url>

   Warning

   Let Podman prompt you for your password when you log in. Entering your password at the same time as your username can expose your password to the shell history.

2. Push your execution environment to your automation hub remote registry:

   $ podman push <automation_hub_url>/<ee_name>

Verification

1. Log in to your Ansible Automation Platform.
2. Navigate to Automation Content Remote Registries.
3. Locate the container in the container repository list.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content Execution Environments.
3. Select your container repository.
4. On the Detail tab, click Add.
5. In the Raw Markdown text field, enter your README text in Markdown.
6. Click Save when you are finished.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content Execution Environments.
3. Select your automation execution environments.
4. From the Team Access tab, click Add roles.
5. Select the team or teams to which you want to grant access and click Next.
6. Select the roles that you want to add to this execution environment and click Next.
7. Click Finish.

Procedure

1. From the navigation panel, select Automation Content Execution Environments.
2. Select automation execution environments.
3. Click the Images tab.
4. Click the More Actions icon ⋮, and click Manage tags.
5. Add a new tag in the text field and click Add.
6. Optional: Remove current tags by clicking x on any of the tags for that image.
7. Click Save.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Execution Infrastructure Credentials.
3. Click Add to create a new credential.
4. Enter an authorization Name, Description, and Organization.
5. Select the Credential Type.
6. Enter the Authentication URL. This is the remote registry address.
7. Enter the Username and Password or Token required to log in to the remote registry.
8. Optional: To enable SSL verification, select Verify SSL.
9. Click Save.

Procedure

1. If you are pulling automation execution environmentss from a password or token-protected registry, create a credential before pulling the automation execution environments.
2. From the navigation panel, select Automation Content Execution Environments.
3. Select your automation execution environments.
4. In the Pull this image entry, click Copy to clipboard.
5. Paste and run the command in your terminal.

Procedure

1. From the navigation panel, select Automation Content Execution Environments.
2. Add https://registry.redhat.io to the registry.

3. Add any required credentials to authenticate.

   Note

   Some remote registries are aggressive with rate limiting. Set a rate limit under Advanced Options.

4. From the navigation panel, select Automation Content Execution Environments.
5. Click Add execution environment in the page header.

6. Select the registry you want to pull from. The Name field displays the name of the automation execution environments displayed on your local registry.

   Note

   The Upstream name field is the name of the image on the remote server. For example, if the upstream name is set to "alpine" and the Name field is "local/alpine", the alpine image is downloaded from the remote and renamed to "local/alpine".

7. Set a list of tags to include or exclude. Syncing automation execution environmentss with a large number of tags is time consuming and uses a lot of disk space.

Procedure

1. From a terminal, create a signing script, and pass the script path as an installer parameter.

   Example:

   #!/usr/bin/env bash
   
   # pulp_container SigningService will pass the next 4 variables to the script.
   MANIFEST_PATH=$1
   FINGERPRINT="$PULP_SIGNING_KEY_FINGERPRINT"
   IMAGE_REFERENCE="$REFERENCE"
   SIGNATURE_PATH="$SIG_PATH"
   
   # Create container signature using skopeo
   skopeo standalone-sign \
     $MANIFEST_PATH \
     $IMAGE_REFERENCE \
     $FINGERPRINT \
     --output $SIGNATURE_PATH
   
   # Optionally pass the passphrase to the key if password protected.
   # --passphrase-file /path/to/key_password.txt
   
   # Check the exit status
   STATUS=$?
   if [ $STATUS -eq 0 ]; then
     echo {\"signature_path\": \"$SIGNATURE_PATH\"}
   else
     exit $STATUS
   fi

2. Review the Ansible Automation Platform installer inventory file for options for container signing that begin with automationhub_*.

   [all:vars]
   .
   .
   .
   
   automationhub_create_default_container_signing_service = True
   automationhub_container_signing_service_key = /absolute/path/to/key/to/sign
   automationhub_container_signing_service_script = /absolute/path/to/script/that/signs

3. Once installation is complete, log in to Ansible Automation Platform and navigate to Automation Content Signature Keys.
4. Ensure that you have a key titled container-default, or container-anyname.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content Remote Registries.

3. Click Create remote registry.

   • In the Name field, enter the name of the registry where the container resides.
   • In the URL field, enter the URL of the registry where the container resides.
   • In the Username field, enter the username if necessary.
   • In the Password field, enter the password if necessary.
   • Click Create remote registry.

Procedure

1. From the navigation panel, select Automation Content Execution Environments.
2. Click Create execution environment.
3. Enter the name of the execution environment.
4. Enter the upstream name.
5. Under Registry, select the name of the registry from the drop-down menu.
6. Enter tags in the Add tag(s) to include field. If the field is blank, all the tags are passed. You must specify which repository-specific tags to pass.
7. Optional: Enter tags to exclude in Add tag(s) to exclude.
8. Click Create automation execution environments.
9. Synchronize the image.

Procedure

1. From a terminal, log in to Podman, or any container client currently in use:

   > podman pull <container-name>

2. After the automation execution environments is pulled, add tags (for example: latest, rc, beta, or version numbers, such as 1.0; 2.3, and so on):

   > podman tag <container-name> <server-address>/<container-name>:<tag name>

3. Sign the automation execution environments after changes have been made, and push it back up to the automation hub registry:

   > podman push <server-address>/<container-name>:<tag name> --tls-verify=false --sign-by <reference to the gpg key on your local>

   If the automation execution environments is not signed, it can only be pushed with any current signature embedded. Alternatively, you can use the following script to push the automation execution environments without signing it:

   > podman push <server-address>/<container-name>:<tag name> --tls-verify=false

4. Once the automation execution environments has been pushed, navigate to Automation Content Execution Environments.
5. To display the new execution environment, click the Refresh icon.
6. Click the name of the image to view your pushed image.

1. Click the automation execution environments name to navigate to the details page.

2. Click the More Actions icon ⋮. Three options are available:

   • Use in Controller
   • Delete
   • Sign
3. Click Sign from the drop-down menu.

Procedure

1. From the navigation panel, select Automation Content Signature Keys.
2. Click the Download key icon next to the signature that you are using. A new window should open to indicate you have downloaded the key.

Procedure

1. Open your terminal and use the following command:

   >  sudo <name of editor> /etc/containers/policy.json

   The file that is displayed is similar to this:

   {
     "default": [{"type": "reject"}],
     "transports": {
     	"docker": {
       	"quay.io": [{"type": "insecureAcceptAnything"}],
       	"docker.io": [{"type": "insecureAcceptAnything"}],
       	"<server-address>": [
         	{
             	    "type": "signedBy",
             	    "keyType": "GPGKeys",
             	    "keyPath": "/tmp/containersig.txt"
         	}]
     	}
     }
   }

   This file shows that neither quay.io, or docker.io will perform the verification, because the type is insecureAcceptAnything which overrides the default type of reject. However, <server-address> will perform the verification, because the parameter type is set to "signedBy".

   Note

   The only keyType currently supported is GPG keys.

2. Under the <server-address> entry, modify the keyPath <1> to include the name of your key file.

   {
       	"default": [{"type": "reject"}],
       	"transports": {
           	"docker": {
             	  "quay.io": [{"type": "insecureAcceptAnything"}],
             	  "docker.io": [{"type": "insecureAcceptAnything"}],
             	  "<server-address>": [{
                   	"type": "signedBy",
                   	"keyType": "GPGKeys",
                   	"keyPath": "/tmp/<key file name>",
                   	"signedIdentity": {
                     	  "type": "matchExact"
                       }
               	  }]
               }
       	}
   }

3. Save and close the file.