Chapter 9. Image configuration resources

Procedure

• Create Red Hat OpenShift Service on AWS clusters with image registry by running the following command:

  $ rosa create cluster —cluster-name=<cluster_name> --sts --mode=auto \
     --hosted-cp --operator-roles-prefix <operator_role_prefix> \
     --oidc-config-id <id_of_oidc_configuration> \
     --subnet-ids=<public_subnet_id>,<private_subnet_id> \
     --registry-config-insecure-registries <insecure_registries> \
     --registry-config-allowed-registries <allowed_registries> \
     --registry-config-allowed-registries-for-import <registry_name:insecure> \
     --registry-config-additional-trusted-ca <additional_trusted_ca_file>

  Copy to Clipboard Toggle word wrap
  Note

  When using the allowedRegistries, blockedRegistries, or insecureRegistries parameter, you can specify an individual repository within a registry. For example: reg1.io/myrepo/myapp:latest.

  Avoid insecure external registries to reduce possible security risks. Parameters allowedRegistries, blockedRegistries are mutually exclusive.

Procedure

• Update or edit the image registry for the cluster by running the following command:

  $ rosa edit cluster --registry-config-insecure-registries <insecure_registries> \
     --registry-config-allowed-registries <allowed_registries> \
     --registry-config-allowed-registries-for-import <registry_name:insecure> \
     --registry-config-additional-trusted-ca <additional_trusted_ca_file>

  Copy to Clipboard Toggle word wrap

  Example output

  ? Changing any registry related parameter will trigger a rollout across all machinepools
  (all machinepool nodes will be recreated, following pod draining from each node).
  Do you want to proceed? Yes
  I: Updated cluster '<cluster_name>'

  Copy to Clipboard Toggle word wrap

Verification

• Run the rosa describe command again, to see if the changes you made to your image registry updated by running the following command:

  $ rosa describe cluster --cluster=<cluster_name>

  Copy to Clipboard Toggle word wrap

  Example output

  Name:                       rosa-hcp-test
  Domain Prefix:              rosa-hcp-test
  Display Name:               rosa-hcp-test
  ID:                         <cluster_hcp_id>
  External ID:                <cluster_hcp_id>
  Control Plane:              ROSA Service Hosted
  OpenShift Version:          4.Y.Z
  Channel Group:              stable
  DNS:                        <dns>
  AWS Account:                <aws_id>
  AWS Billing Account:        <aws_id>
  API URL:                    <ocm_api>
  Console URL:
  Region:                     us-east-1
  Availability:
   - Control Plane:           MultiAZ
   - Data Plane:              SingleAZ
  
  Nodes:
   - Compute (desired):       2
   - Compute (current):       2
  Network:
   - Type:                    OVNKubernetes
   - Service CIDR:            <service_cidr>
   - Machine CIDR:            <machine_cidr>
   - Pod CIDR:                <pod_cidr>
   - Host Prefix:             /23
   - Subnets:                 <subnet_ids>
  EC2 Metadata Http Tokens:   optional
  Role (STS) ARN:             arn:aws:iam::<aws_id>:role/<account_roles_prefix>-HCP-ROSA-Installer-Role
  Support Role ARN:           arn:aws:iam::<aws_id>:role/<account_roles_prefix>-HCP-ROSA-Support-Role
  Instance IAM Roles:
   - Worker:                  arn:aws:iam::<aws_id>:role/<account_roles_prefix>-HCP-ROSA-Worker-Role
  Operator IAM Roles:
   - arn:aws:iam::<aws_id>:role/<operator_roles_prefix>-kube-system-capa-controller-manager
   - arn:aws:iam::<aws_id>:role/<operator_roles_prefix>-kube-system-control-plane-operator
   - arn:aws:iam::<aws_id>:role/<operator_roles_prefix>-kube-system-kms-provider
   - arn:aws:iam::<aws_id>:role/<operator_roles_prefix>-openshift-image-registry-installer-cloud-cred
   - arn:aws:iam::<aws_id>:role/<operator_roles_prefix>-openshift-ingress-operator-cloud-credentials
   - arn:aws:iam::<aws_id>:role/<operator_roles_prefix>-openshift-cluster-csi-drivers-ebs-cloud-credent
   - arn:aws:iam::<aws_id>:role/<operator_roles_prefix>-openshift-cloud-network-config-controller-cloud
  Managed Policies:           Yes
  State:                      ready
  Private:                    No
  Delete Protection:          Disabled
  Created:                    Oct 01 2030 09:48:52 UTC
  User Workload Monitoring:   Enabled
  OIDC Endpoint URL:          https://<endpoint> (Managed)
  Audit Log Forwarding:       Disabled
  External Authentication:    Disabled
  Etcd Encryption:            Disabled
  Registry Configuration:
   - Allowed Registries: <allowed_registry>
   - Insecure Registries: <insecure_registry>
   - Allowed Registries for Import:
      - Domain Name: <domain_name>
      - Insecure: true
   - Platform Allowlist: <platform_allowlist_id>
      - Registries:      <list_of_registries>
   - Additional Trusted CA:
      - <registry_name> : REDACTED

  Copy to Clipboard Toggle word wrap

  where:

  Allowed Registries

  A comma-separated list of registries for which image pull and push actions are allowed.

  Blocked Registries

  A comma-separated list of registries for which image pull and push actions are blocked. Parameters allowedRegistries, blockedRegistries are mutually exclusive.

  Insecure Registries

  A comma-separated list of registries which do not have a valid TLS certificate or only support HTTP connections.

  Allowed Registries for Import

  Limits the container image registries from which normal users can import images. The format should be a comma-separated list of domainName:insecure.

  domainName

  Specifies a domain name for the registry.

  insecure

  Indicates whether the registry is secure or insecure.

  Platform Allowlist

  A reference to the id of the list of registries that needs to be whitelisted for the platform to work.

  Registries

  The list of registries that needs to be whitelisted for the platform to work.

  Additional Trusted CA

  A JSON file containing the registry hostname as the key, and the PEM-encoded certificate as the value, for each additional registry CA to trust.

• You have installed and configured the latest ROSA command-line interface (CLI) (rosa) on your installation host.
• You have installed a Red Hat OpenShift Service on AWS cluster.
• The Red Hat OpenShift Service on AWS cluster must be in a Ready state to create, edit, list, or delete image mirrors.
• You have access to the mirror registries you want to configure.
• You have the required IAM permissions to manage cluster configurations. For more information, see "About IAM resources" in the Additional resources section.

• Enhanced Security: By forcing image pulls from a private, mirrored registry, you can scan and approve all images for vulnerabilities before they ever enter your cluster.
• Improved Cluster Reliability: A local mirror guarantees stable and predictable cluster performance by eliminating reliance on public internet pathways.
• Guaranteed Image Consistency: IDMS uses image digests to reference images, which ensures that every node in the cluster pulls the same version of an image, preventing inconsistencies which could lead to deployment failures.