Chapter 3. Manage containers in private automation hub

Procedure

1. Log in to Podman with your registry.redhat.io credentials:

   $ podman login registry.redhat.io

   Copy to Clipboard Toggle word wrap

2. Pull an execution environment:

   $ podman pull registry.redhat.io/<ee_name>:<tag>

   Copy to Clipboard Toggle word wrap

1. List the images in local storage:

   $ podman images

   Copy to Clipboard Toggle word wrap
2. Check the execution environment name, and verify that the tag is correct.

Verification

1. List the images in local storage:

   $ podman images

   Copy to Clipboard Toggle word wrap
2. Verify that the execution environment you tagged with your automation hub information is contained in the list.

Procedure

1. Log in to Podman using your Ansible Automation Platform location and credentials:

   $ podman login -u=<username> -p=<password> <aap_url>

   Copy to Clipboard Toggle word wrap
   Warning

   Let Podman prompt you for your password when you log in. Entering your password at the same time as your username can expose your password to the shell history.

2. Push your execution environment to your automation hub remote registry:

   $ podman push <automation_hub_url>/<ee_name>

   Copy to Clipboard Toggle word wrap

Verification

1. Log in to your Ansible Automation Platform.
2. Navigate to Automation Content Execution Environments.
3. Locate the container in the container repository list.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content Execution Environments.
3. Select your execution environment.
4. On the Detail tab, click Add.
5. In the Raw Markdown text field, enter your README text in Markdown.
6. Click Save when you are finished.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content Execution Environments.
3. Select your automation execution environment.
4. From the Team Access tab, click Add roles.
5. Select the team or teams to which you want to grant access and click Next.
6. Select the roles that you want to add to this execution environment and click Next.
7. Click Finish.

Procedure

1. From the navigation panel, select Automation Content Execution Environments.
2. Select your automation execution environments.
3. Click the Images tab.
4. Click the More Actions icon ⋮, and click Manage tags.
5. Add a new tag in the text field and click Add.
6. Optional: Remove current tags by clicking x on any of the tags for that image.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Execution Infrastructure Credentials.
3. Click Create credential to create a new credential.
4. Enter an authorization Name, Description, and Organization.
5. In the Credential Type drop-down, select Container Registry.
6. Enter the Authentication URL. This is the remote registry address.
7. Enter the Username and Password or Token required to log in to the remote registry.
8. Optional: To enable SSL verification, select Verify SSL.
9. Click Create credential.

Procedure

1. From the navigation panel, select Automation Content Execution Environments.
2. Select your automation execution environments.
3. In the Pull this image entry, click Copy to clipboard.
4. Paste and run the command in your terminal.

Procedure

1. From the navigation panel, select Automation Content Execution Environments.
2. Add https://registry.redhat.io to the registry.

3. Add any required credentials to authenticate.

   Note

   Some remote registries are aggressive with rate limiting. Set a rate limit under Advanced Options.

4. From the navigation panel, select Automation Content Execution Environments.
5. Click Create execution environment in the page header.

6. Select the registry you want to pull from. The Name field displays the name of the automation execution environments displayed on your local registry.

   Note

   The Upstream name field is the name of the image on the remote server. For example, if the upstream name is set to "alpine" and the Name field is "local/alpine", the alpine image is downloaded from the remote and renamed to "local/alpine".

7. Set a list of tags to include or exclude. Note that syncing automation execution environments with a large number of tags is time consuming and uses a lot of disk space.

Procedure

1. From a terminal, create a signing script, and pass the script path as an installer parameter.

   Example:

   #!/usr/bin/env bash
   
   # pulp_container SigningService will pass the next 4 variables to the script.
   MANIFEST_PATH=$1
   FINGERPRINT="$PULP_SIGNING_KEY_FINGERPRINT"
   IMAGE_REFERENCE="$REFERENCE"
   SIGNATURE_PATH="$SIG_PATH"
   
   # Create container signature using skopeo
   skopeo standalone-sign \
     $MANIFEST_PATH \
     $IMAGE_REFERENCE \
     $FINGERPRINT \
     --output $SIGNATURE_PATH
   
   # Optionally pass the passphrase to the key if password protected.
   # --passphrase-file /path/to/key_password.txt
   
   # Check the exit status
   STATUS=$?
   if [ $STATUS -eq 0 ]; then
     echo {\"signature_path\": \"$SIGNATURE_PATH\"}
   else
     exit $STATUS
   fi

   Copy to Clipboard Toggle word wrap

2. Review the Ansible Automation Platform installer inventory file for options for container signing that begin with automationhub_*.

   [all:vars]
   .
   .
   .
   
   automationhub_create_default_container_signing_service = True
   automationhub_container_signing_service_key = /absolute/path/to/key/to/sign
   automationhub_container_signing_service_script = /absolute/path/to/script/that/signs

   Copy to Clipboard Toggle word wrap

3. Once installation is complete, log in to Ansible Automation Platform and navigate to Automation Content Signature Keys.

   Note

   The container-default service is created by the Ansible Automation Platform installer.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content Remote Registries.

3. Click Create remote registry.

   • In the Name field, enter the name of the registry where the container resides.
   • In the URL field, enter the URL of the registry where the container resides.
   • In the Username field, enter the username if necessary.
   • In the Password field, enter the password if necessary.
   • Click Create remote registry.

Procedure

1. From the navigation panel, select Automation Content Execution Environments.

2. Click Create execution environment and enter the relevant information in the fields that appear.

   1. The Name field displays the name of the execution environment on your local registry.
   2. The Upstream name field is the name of the image on the remote server.
   3. Under Registry, select the name of the registry from the drop-down menu.
   4. Optional: Enter tags in the Add tag(s) to include field. If the field is blank, all the tags are passed. You must specify which repository-specific tags to pass.
   5. Optional: Enter tags to exclude in the Add tag(s) to exclude field.
3. Click Create execution environment. You should see your new execution environment in the list that appears.

4. Sync and sign your new automation execution environment.

   1. Click the More Actions icon ⋮ and select Sync execution environment.
   2. Click the More Actions icon ⋮ and select Sign execution environment.
5. Click on your new execution environment. On the Details page, find the Signed label to determine that your execution environment has been signed.

Procedure

1. From a terminal, log in to Podman, or any container client currently in use, and pull the execution environment you want to sign.

    podman pull <container-name>

   Copy to Clipboard Toggle word wrap

2. After the execution environment is pulled, add tags (for example: latest, rc, beta, or version numbers, such as 1.0, 2.3, and so on):

    podman tag <container-name> <server-address>/<container-name>:<tag name>

   Copy to Clipboard Toggle word wrap

3. Sign the execution environment after changes have been made, and push it back up to the automation hub registry:

    podman push <server-address>/<container-name>:<tag name> --tls-verify=false --sign-by <reference to the gpg key on your local>

   Copy to Clipboard Toggle word wrap

   If the execution environment is not signed, it can only be pushed with any current signature embedded. Alternatively, you can use the following script to push the execution environment without signing it:

    podman push <server-address>/<container-name>:<tag name> --tls-verify=false

   Copy to Clipboard Toggle word wrap
4. After the execution environment has been pushed, navigate to Automation Content Execution Environments.
5. To display the new execution environment, click the Refresh icon.
6. Click the name of the image to view your pushed image.

1. Click the execution environment name to navigate to the details page.

2. Click the More Actions icon ⋮. Three options are available:

   • Sign execution environment
   • Use in Controller
   • Delete execution environment
3. Click Sign execution environment from the drop-down menu.

Procedure

1. From the navigation panel, select Automation Content Signature Keys.
2. Click the Download key icon next to the signature that you are using. A new window should open to indicate you have downloaded the key.

Procedure

1. Open your terminal and use the following command:

   sudo <name of editor> /etc/containers/policy.json

   Copy to Clipboard Toggle word wrap

   The file that is displayed is similar to this:

   {
     "default": [{"type": "reject"}],
     "transports": {
     	"docker": {
       	"quay.io": [{"type": "insecureAcceptAnything"}],
       	"docker.io": [{"type": "insecureAcceptAnything"}],
       	"<server-address>": [
         	{
             	    "type": "signedBy",
             	    "keyType": "GPGKeys",
             	    "keyPath": "/tmp/containersig.txt"
         	}]
     	}
     }
   }

   Copy to Clipboard Toggle word wrap

   This file shows that neither quay.io, or docker.io will perform the verification, because the type is insecureAcceptAnything which overrides the default type of reject. However, <server-address> will perform the verification, because the parameter type is set to "signedBy".

   Note

   The only keyType currently supported is GPG keys.

2. Under the <server-address> entry, modify the keyPath <1> to include the name of your key file.

   {
       	"default": [{"type": "reject"}],
       	"transports": {
           	"docker": {
             	  "quay.io": [{"type": "insecureAcceptAnything"}],
             	  "docker.io": [{"type": "insecureAcceptAnything"}],
             	  "<server-address>": [{
                   	"type": "signedBy",
                   	"keyType": "GPGKeys",
                   	"keyPath": "/tmp/<key file name>",
                   	"signedIdentity": {
                     	  "type": "matchExact"
                       }
               	  }]
               }
       	}
   }

   Copy to Clipboard Toggle word wrap
3. Save and close the file.

Procedure

1. Log in to Ansible Automation Platform.
2. From the navigation panel, select Automation Content Execution Environments.
3. On the container repository that you want to delete, click the More Actions icon ⋮, and click Delete execution environment.
4. When the confirmation message is displayed, click the checkbox and click Delete execution environment.