Chapter 4. Accessing the registry

Procedure

1. Access the node by getting its name:

   $ oc get nodes

   $ oc debug nodes/<node_name>

2. To enable access to tools such as oc and podman on the node, change your root directory to /host. Successful output on running the commands states Login Succeeded!.

   sh-4.2# chroot /host

3. Log in to the container image registry by using your access token:

   sh-4.2# oc login -u kubeadmin -p <password_from_install_log> https://api-int.<cluster_name>.<base_domain>:6443

   sh-4.2# podman login -u kubeadmin -p $(oc whoami -t) image-registry.openshift-image-registry.svc:5000

   Note

   You can pass almost any value for the user name. The token contains all necessary information. Passing a user name that contains colons results in a login failure.

   The Image Registry Operator creates the route, such as default-route-openshift-image-registry.<cluster_name>.

4. Perform podman pull and podman push operations against your registry. The following example commands demonstrate these operations.

   1. Pull an arbitrary image:

      sh-4.2# podman pull <name.io>/<image>

      Important

      You can pull arbitrary images, but if you have the system:registry role added, you can only push images to the registry in your project.

   2. Tag the new image with the form <registry_ip>:<port>/<project>/<image>. For example, 172.30.124.220:5000/openshift/image. The project name must show in the pull specification for OpenShift Container Platform to correctly place and later access the image in the registry.

      sh-4.2# podman tag <name.io>/<image> image-registry.openshift-image-registry.svc:5000/openshift/<image>

      Note

      You must have the system:image-builder role for the specified project, which allows the user to write or push an image. Otherwise, the podman push in the next step will fail. To test, you can create a new project to push the image.

   3. Push the newly tagged image to your registry:

      sh-4.2# podman push image-registry.openshift-image-registry.svc:5000/openshift/<image>

      Note

      When pushing images to the internal registry, the repository name must use the <project>/<name> format. Using multiple project levels in the repository name results in an authentication error.

Procedure

1. Create a cluster role if you do not already have one to access the metrics:

   $ cat <<EOF | oc create -f -
   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: prometheus-scraper
   rules:
   - apiGroups:
     - image.openshift.io
     resources:
     - registry/metrics
     verbs:
     - get
   EOF

2. Add the cluster role to a user account by entering the following command:

   $ oc adm policy add-cluster-role-to-user prometheus-scraper <username>

3. For the metrics query, get the user token.

   openshift:
   $ oc whoami -t

4. Run a metrics query in node or inside a pod. The following example command and output demonstrate this task.

   $ curl --insecure -s -u <user>:<secret> \ 

   1

   
       https://image-registry.openshift-image-registry.svc:5000/extensions/v2/metrics | grep imageregistry | head -n 20

   • <user>:<secret>: The <user> object can be arbitrary, but <secret> tag must use the user token.

     # HELP imageregistry_build_info A metric with a constant '1' value labeled by major, minor, git commit & git version from which the image registry was built.
     # TYPE imageregistry_build_info gauge
     imageregistry_build_info{gitCommit="9f72191",gitVersion="v3.11.0+9f72191-135-dirty",major="3",minor="11+"} 1
     # HELP imageregistry_digest_cache_requests_total Total number of requests without scope to the digest cache.
     # TYPE imageregistry_digest_cache_requests_total counter
     imageregistry_digest_cache_requests_total{type="Hit"} 5
     imageregistry_digest_cache_requests_total{type="Miss"} 24
     # HELP imageregistry_digest_cache_scoped_requests_total Total number of scoped requests to the digest cache.
     # TYPE imageregistry_digest_cache_scoped_requests_total counter
     imageregistry_digest_cache_scoped_requests_total{type="Hit"} 33
     imageregistry_digest_cache_scoped_requests_total{type="Miss"} 44
     # HELP imageregistry_http_in_flight_requests A gauge of requests currently being served by the registry.
     # TYPE imageregistry_http_in_flight_requests gauge
     imageregistry_http_in_flight_requests 1
     # HELP imageregistry_http_request_duration_seconds A histogram of latencies for requests to the registry.
     # TYPE imageregistry_http_request_duration_seconds summary
     imageregistry_http_request_duration_seconds{method="get",quantile="0.5"} 0.01296087
     imageregistry_http_request_duration_seconds{method="get",quantile="0.9"} 0.014847248
     imageregistry_http_request_duration_seconds{method="get",quantile="0.99"} 0.015981195
     imageregistry_http_request_duration_seconds_sum{method="get"} 12.260727916000022