Chapter 20. Configuring for Amazon Web Services (AWS)

Procedure

1. Export the current config.yml:

   $ oc get secret registry-config \
       -o jsonpath='{.data.config\.yml}' -n default | base64 -d \
     >> config.yml.old

2. Create a new configuration file from the old config.yml:

   $ cp config.yml.old config.yml

3. Edit the file to include the S3 parameters. Specify the accountname, accountkey, container, and realm in the storage section of a registry’s configuration file:

   storage:
     delete:
       enabled: true
     cache:
       blobdescriptor: inmemory
     s3:
       accesskey: AKIAJ6VLREDHATSPBUA 1
       secretkey: g/8PmTYDQVGssFWWFvfawHpDbZyGkjGNZhbWQpjH 2
       region: us-east-1 3
       bucket: openshift-registry-storage 4
       encrypt: False
       secure: true
       v4auth: true
       rootdirectory: /registry 5
       chunksize: "26214400"

   1

   Replace with an AWS access key that is authorized to access the S3 bucket.

   2

   The secret key that corresponds to the defined AWS access key.

   3

   The name of the S3 bucket to be used as the registry.

   4

   The location in which the registry will store images and metadata. (Default is /registry)

4. Delete the registry-config secret:

   $ oc delete secret registry-config -n default

5. Recreate the secret to reference the updated configuration file:

   $ oc create secret generic registry-config \
       --from-file=config.yml -n default

6. Redeploy the registry to read the updated configuration:

   $ oc rollout latest docker-registry -n default

Procedure

1. After a successful registry deployment, the registry deploymentconfig describes registry-storage as emptydir instead of AWS S3 but the configuration for the AWS S3 bucket resides in the secret docker-config. The docker-config secret mounts to REGISTRY_CONFIGURATION_PATH which provides all of the paramaters when using AWS S3 for the registry object storage.

   $ oc describe dc docker-registry -n default
   ...
       Environment:
         REGISTRY_HTTP_ADDR:					:5000
         REGISTRY_HTTP_NET:					tcp
         REGISTRY_HTTP_SECRET:					SPLR83SDsPaGbGuwSMDfnDwrDRvGf6YXl4h9JQrToQU=
         REGISTRY_MIDDLEWARE_REPOSITORY_OPENSHIFT_ENFORCEQUOTA:	false
         REGISTRY_HTTP_TLS_KEY:					/etc/secrets/registry.key
         OPENSHIFT_DEFAULT_REGISTRY:				docker-registry.default.svc:5000
         REGISTRY_CONFIGURATION_PATH:				/etc/registry/config.yml
         REGISTRY_OPENSHIFT_SERVER_ADDR:				docker-registry.default.svc:5000
         REGISTRY_HTTP_TLS_CERTIFICATE:				/etc/secrets/registry.crt
       Mounts:
         /etc/registry from docker-config (rw)
         /etc/secrets from registry-certificates (rw)
         /registry from registry-storage (rw)
     Volumes:
      registry-storage:
       Type:	EmptyDir (a temporary directory that shares a pod's lifetime) 1
       Medium:
      registry-certificates:
       Type:	Secret (a volume populated by a Secret)
       SecretName:	registry-certificates
       Optional:	false
      docker-config:
       Type:	Secret (a volume populated by a Secret)
       SecretName:	registry-config
       Optional:	false
   ....

   1

   The temporary directory that shares a pod’s lifetime.

2. Ensure that the /registry mountpoint is empty:

   $ oc exec \
       $(oc get pod -l deploymentconfig=docker-registry \
       -o=jsonpath='{.items[0].metadata.name}')  -i -t -- ls -l /registry
   total 0

   If it is empty, it is because the S3 configuration is defined in the registry-config secret:

   $ oc describe secret registry-config
   Name:         registry-config
   Namespace:    default
   Labels:       <none>
   Annotations:  <none>
   
   Type:  Opaque
   
   Data
   ====
   config.yml:  398 bytes

3. The installer creates a config.yml file with the desired configuration using the extended registry capabilities as seen in Storage in the installation documentation. To view the configuration file, including the storage section where the storage bucket configuration is stored:

   $ oc exec \
       $(oc get pod -l deploymentconfig=docker-registry \
         -o=jsonpath='{.items[0].metadata.name}') \
     cat /etc/registry/config.yml
   
     version: 0.1
     log:
       level: debug
     http:
       addr: :5000
     storage:
       delete:
         enabled: true
       cache:
         blobdescriptor: inmemory
       s3:
         accesskey: AKIAJ6VLREDHATSPBUA
         secretkey: g/8PmTYDQVGssFWWFvfawHpDbZyGkjGNZhbWQpjH
         region: us-east-1
         bucket: openshift-registry-storage
         encrypt: False
         secure: true
         v4auth: true
         rootdirectory: /registry
         chunksize: "26214400"
     auth:
       openshift:
         realm: openshift
     middleware:
       registry:
       - name: openshift
       repository:
       - name: openshift
         options:
           pullthrough: true
           acceptschema2: true
           enforcequota: true
       storage:
       - name: openshift

   Alternatively, you can view the secret:

   $ oc get secret registry-config -o jsonpath='{.data.config\.yml}' | base64 -d
   version: 0.1
   log:
     level: debug
   http:
     addr: :5000
     storage:
       delete:
         enabled: true
       cache:
         blobdescriptor: inmemory
       s3:
         accesskey: AKIAJ6VLREDHATSPBUA
         secretkey: g/8PmTYDQVGssFWWFvfawHpDbZyGkjGNZhbWQpjH
         region: us-east-1
         bucket: openshift-registry-storage
         encrypt: False
         secure: true
         v4auth: true
         rootdirectory: /registry
         chunksize: "26214400"
   auth:
     openshift:
       realm: openshift
   middleware:
     registry:
     - name: openshift
     repository:
     - name: openshift
     options:
       pullthrough: true
       acceptschema2: true
       enforcequota: true
     storage:
     - name: openshift