Chapter 5. Exposing the registry

Procedure

1. To expose the registry by using the defaultRoute parameter that exists in the configs.imageregistry.operator.openshift.io resource, set defaultRoute to true by running the following command:

   $ oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge

2. Get the default registry route by running the following command:

   $ HOST=$(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')

3. Get the certificate of the Ingress Operator by running the following command:

   $ oc extract secret/$(oc get ingresscontroller -n openshift-ingress-operator default -o json | jq '.spec.defaultCertificate.name // "router-certs-default"' -r) -n openshift-ingress --confirm

4. Move the extracted certificate to the trusted CA directory of the system by running the following command:

   $ sudo mv tls.crt /etc/pki/ca-trust/source/anchors/

5. Enable the default certificate of the cluster to trust the route by running the following command:

   $ sudo update-ca-trust enable

6. Log in with podman with the default route by running the following command:

   $ sudo podman login -u kubeadmin -p $(oc whoami -t) $HOST

Procedure

1. To expose the registry using DefaultRoute parameter, set DefaultRoute to True:

   $ oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge

2. Log in with podman by entering the following command:

   $ HOST=$(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')

   $ podman login -u kubeadmin -p $(oc whoami -t) --tls-verify=false $HOST

   • --tls-verify=false: Set this parameter to false if the default certificate of the cluster for routes is untrusted. You can set a custom, trusted certificate as the default certificate with the Ingress Operator.

3. To expose the registry using custom routes, create a secret with your route’s TLS keys. This step is optional. If you do not create a secret, the route uses the default TLS configuration from the Ingress Operator.

   $ oc create secret tls public-route-tls \
       -n openshift-image-registry \
       --cert=</path/to/tls.crt> \
       --key=</path/to/tls.key>

4. On the Registry Operator, enter the following command:

   $ oc edit configs.imageregistry.operator.openshift.io/cluster

   spec:
     routes:
       - name: public-routes
         hostname: myregistry.mycorp.organization
         secretName: public-route-tls
   ...

   Note

   Only set secretName if you are providing a custom TLS configuration for the route of the registry.