Chapter 3. Setting up and configuring the registry

1. Set up a Bucket Lifecycle Policy to abort incomplete multipart uploads that are one day old.

2. Fill in the storage configuration in configs.imageregistry.operator.openshift.io/cluster:

   $ oc edit configs.imageregistry.operator.openshift.io/cluster

   Example configuration

   storage:
     s3:
       bucket: <bucket-name>
       region: <region-name>

Procedure

1. Set up an Object Lifecycle Management policy to abort incomplete multipart uploads that are one day old.

2. Fill in the storage configuration in configs.imageregistry.operator.openshift.io/cluster:

   $ oc edit configs.imageregistry.operator.openshift.io/cluster

   Example configuration

   # ...
   storage:
     gcs:
       bucket: <bucket-name>
       projectID: <project-id>
       region: <region-name>
   # ...

Procedure

1. Create an Azure storage container.

2. Fill in the storage configuration in configs.imageregistry.operator.openshift.io/cluster:

   $ oc edit configs.imageregistry.operator.openshift.io/cluster

   Example configuration

   storage:
     azure:
       accountName: <storage-account-name>
       container: <container-name>

Procedure

1. Create an Azure storage container.

2. Fill in the storage configuration in configs.imageregistry.operator.openshift.io/cluster:

   $ oc edit configs.imageregistry.operator.openshift.io/cluster

   Example configuration

   storage:
     azure:
       accountName: <storage-account-name>
       container: <container-name>
       cloudName: AzureUSGovernmentCloud 1

   1

   cloudName is the name of the Azure cloud environment, which can be used to configure the Azure SDK with the appropriate Azure API endpoints. Defaults to AzurePublicCloud. You can also set cloudName to AzureUSGovernmentCloud, AzureChinaCloud, or AzureGermanCloud with sufficient credentials.

Procedure

1. Create a YAML file that specifies the storage class and availability zone to use. For example:

   apiVersion: storage.k8s.io/v1
   kind: StorageClass
   metadata:
     name: custom-csi-storageclass
   provisioner: cinder.csi.openstack.org
   volumeBindingMode: WaitForFirstConsumer
   allowVolumeExpansion: true
   parameters:
     availability: <availability_zone_name>

   Note

   OpenShift Container Platform does not verify the existence of the availability zone you choose. Verify the name of the availability zone before you apply the configuration.

2. From a command line, apply the configuration:

   $ oc apply -f <storage_class_file_name>

   Example output

   storageclass.storage.k8s.io/custom-csi-storageclass created

3. Create a YAML file that specifies a persistent volume claim (PVC) that uses your storage class and the openshift-image-registry namespace. For example:

   apiVersion: v1
   kind: PersistentVolumeClaim
   metadata:
     name: csi-pvc-imageregistry
     namespace: openshift-image-registry 1
     annotations:
       imageregistry.openshift.io: "true"
   spec:
     accessModes:
     - ReadWriteOnce
     volumeMode: Filesystem
     resources:
       requests:
         storage: 100Gi 2
     storageClassName: <your_custom_storage_class> 3

   1

   Enter the namespace openshift-image-registry. This namespace allows the Cluster Image Registry Operator to consume the PVC.

   2

   Optional: Adjust the volume size.

   3

   Enter the name of the storage class that you created.

4. From a command line, apply the configuration:

   $ oc apply -f <pvc_file_name>

   Example output

   persistentvolumeclaim/csi-pvc-imageregistry created

5. Replace the original persistent volume claim in the image registry configuration with the new claim:

   $ oc patch configs.imageregistry.operator.openshift.io/cluster --type 'json' -p='[{"op": "replace", "path": "/spec/storage/pvc/claim", "value": "csi-pvc-imageregistry"}]'

   Example output

   config.imageregistry.operator.openshift.io/cluster patched

   Over the next several minutes, the configuration is updated.

1. Verify that the PVC claim value is identical to the name that you provided in your PVC definition:

   $ oc get configs.imageregistry.operator.openshift.io/cluster -o yaml

   Example output

   ...
   status:
       ...
       managementState: Managed
       pvc:
         claim: csi-pvc-imageregistry
   ...

2. Verify that the status of the PVC is Bound:

   $ oc get pvc -n openshift-image-registry csi-pvc-imageregistry

   Example output

   NAME                   STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS             AGE
   csi-pvc-imageregistry  Bound    pvc-72a8f9c9-f462-11e8-b6b6-fa163e18b7b5   100Gi      RWO            custom-csi-storageclass  11m

Procedure

1. To configure your registry to use storage, change the spec.storage.pvc in the configs.imageregistry/cluster resource.

   Note

   When using shared storage, review your security settings to prevent outside access.

2. Verify that you do not have a registry pod:

   $ oc get pod -n openshift-image-registry -l docker-registry=default

   Example output

   No resourses found in openshift-image-registry namespace

   Note

   If you do have a registry pod in your output, you do not need to continue with this procedure.

3. Check the registry configuration:

   $ oc edit configs.imageregistry.operator.openshift.io

   Example output

   storage:
     pvc:
       claim:

   Leave the claim field blank to allow the automatic creation of an image-registry-storage PVC.

4. Check the clusteroperator status:

   $ oc get clusteroperator image-registry

   Example output

   NAME             VERSION              AVAILABLE   PROGRESSING   DEGRADED   SINCE   MESSAGE
   image-registry   4.10                 True        False         False      6h50m

5. Ensure that your registry is set to managed to enable building and pushing of images.

   • Run:

     $ oc edit configs.imageregistry/cluster

     Then, change the line

     managementState: Removed

     to

     managementState: Managed

Procedure

1. To set the image registry storage as a block storage type, patch the registry so that it uses the Recreate rollout strategy and runs with only one (1) replica:

   $ oc patch config.imageregistry.operator.openshift.io/cluster --type=merge -p '{"spec":{"rolloutStrategy":"Recreate","replicas":1}}'

2. Provision the PV for the block storage device, and create a PVC for that volume. The requested block volume uses the ReadWriteOnce (RWO) access mode.
3. Edit the registry configuration so that it references the correct PVC.

Procedure

1. To configure your registry to use storage, change the spec.storage.pvc in the configs.imageregistry/cluster resource.

   Note

   When using shared storage, review your security settings to prevent outside access.

2. Verify that you do not have a registry pod:

   $ oc get pod -n openshift-image-registry -l docker-registry=default

   Example output

   No resourses found in openshift-image-registry namespace

   Note

   If you do have a registry pod in your output, you do not need to continue with this procedure.

3. Check the registry configuration:

   $ oc edit configs.imageregistry.operator.openshift.io

   Example output

   storage:
     pvc:
       claim: 1

   1

   Leave the claim field blank to allow the automatic creation of an image-registry-storage persistent volume claim (PVC). The PVC is generated based on the default storage class. However, be aware that the default storage class might provide ReadWriteOnce (RWO) volumes, such as a RADOS Block Device (RBD), which can cause issues when replicating to more than one replica.

4. Check the clusteroperator status:

   $ oc get clusteroperator image-registry

   Example output

   NAME             VERSION                              AVAILABLE   PROGRESSING   DEGRADED   SINCE   MESSAGE
   image-registry   4.7                                  True        False         False      6h50m

Procedure

1. To set the image registry storage as a block storage type, patch the registry so that it uses the Recreate rollout strategy and runs with only 1 replica:

   $ oc patch config.imageregistry.operator.openshift.io/cluster --type=merge -p '{"spec":{"rolloutStrategy":"Recreate","replicas":1}}'

2. Provision the PV for the block storage device, and create a PVC for that volume. The requested block volume uses the ReadWriteOnce (RWO) access mode.

   1. Create a pvc.yaml file with the following contents to define a VMware vSphere PersistentVolumeClaim object:

      kind: PersistentVolumeClaim
      apiVersion: v1
      metadata:
        name: image-registry-storage 1
        namespace: openshift-image-registry 2
      spec:
        accessModes:
        - ReadWriteOnce 3
        resources:
          requests:
            storage: 100Gi 4

      1

      A unique name that represents the PersistentVolumeClaim object.

      2

      The namespace for the PersistentVolumeClaim object, which is openshift-image-registry.

      3

      The access mode of the persistent volume claim. With ReadWriteOnce, the volume can be mounted with read and write permissions by a single node.

      4

      The size of the persistent volume claim.

   2. Create the PersistentVolumeClaim object from the file:

      $ oc create -f pvc.yaml -n openshift-image-registry

3. Edit the registry configuration so that it references the correct PVC:

   $ oc edit config.imageregistry.operator.openshift.io -o yaml

   Example output

   storage:
     pvc:
       claim: 1

   1

   Creating a custom PVC allows you to leave the claim field blank for the default automatic creation of an image-registry-storage PVC.