第3章 レジストリーのセットアップ

oc get pods

# oc get pods

oc describe pod <pod_name>

# oc describe pod <pod_name>

＃ssh node.example.com

＃ssh node.example.com

＃docker ps --filter = name = registry_docker-registry。* _ default_

＃docker ps --filter = name = registry_docker-registry。* _ default_

oc get svc/docker-registry

$ oc get svc/docker-registry
NAME              LABELS                                    SELECTOR                  IP(S)            PORT(S)
docker-registry   docker-registry=default                   docker-registry=default   172.30.124.220   5000/TCP

oc adm ca create-server-cert \
    --signer-cert=/etc/origin/master/ca.crt \
    --signer-key=/etc/origin/master/ca.key \
    --signer-serial=/etc/origin/master/ca.serial.txt \
    --hostnames='docker-registry.default.svc.cluster.local,docker-registry.default.svc,172.30.124.220' \
    --cert=/etc/secrets/registry.crt \
    --key=/etc/secrets/registry.key

$ oc adm ca create-server-cert \
    --signer-cert=/etc/origin/master/ca.crt \
    --signer-key=/etc/origin/master/ca.key \
    --signer-serial=/etc/origin/master/ca.serial.txt \
    --hostnames='docker-registry.default.svc.cluster.local,docker-registry.default.svc,172.30.124.220' \
    --cert=/etc/secrets/registry.crt \
    --key=/etc/secrets/registry.key

--hostnames='mydocker-registry.example.com,docker-registry.default.svc.cluster.local,172.30.124.220 \

--hostnames='mydocker-registry.example.com,docker-registry.default.svc.cluster.local,172.30.124.220 \

oc create secret generic registry-certificates \
    --from-file=/etc/secrets/registry.crt \
    --from-file=/etc/secrets/registry.key

$ oc create secret generic registry-certificates \
    --from-file=/etc/secrets/registry.crt \
    --from-file=/etc/secrets/registry.key

oc secrets link registry registry-certificates
oc secrets link default  registry-certificates

$ oc secrets link registry registry-certificates
$ oc secrets link default  registry-certificates

oc rollout pause dc / docker-registry

$ oc rollout pause dc / docker-registry

oc volume dc/docker-registry --add --type=secret \
    --secret-name=registry-certificates -m /etc/secrets

$ oc volume dc/docker-registry --add --type=secret \
    --secret-name=registry-certificates -m /etc/secrets

oc set env dc/docker-registry \
    REGISTRY_HTTP_TLS_CERTIFICATE=/etc/secrets/registry.crt \
    REGISTRY_HTTP_TLS_KEY=/etc/secrets/registry.key

$ oc set env dc/docker-registry \
    REGISTRY_HTTP_TLS_CERTIFICATE=/etc/secrets/registry.crt \
    REGISTRY_HTTP_TLS_KEY=/etc/secrets/registry.key

oc patch dc/docker-registry -p '{"spec": {"template": {"spec": {"containers":[{

$ oc patch dc/docker-registry -p '{"spec": {"template": {"spec": {"containers":[{
    "name":"registry",
    "livenessProbe":  {"httpGet": {"scheme":"HTTPS"}}
  }]}}}}'

oc patch dc/docker-registry -p '{"spec": {"template": {"spec": {"containers":[{

$ oc patch dc/docker-registry -p '{"spec": {"template": {"spec": {"containers":[{
    "name":"registry",
    "readinessProbe":  {"httpGet": {"scheme":"HTTPS"}}
  }]}}}}'

oc rollout dc / docker-registryを再開する

$ oc rollout dc / docker-registryを再開する

oc logs dc/docker-registry | grep tls

$ oc logs dc/docker-registry | grep tls
time="2015-05-27T05:05:53Z" level=info msg="listening on :5000, tls" instance.id=deeba528-c478-41f5-b751-dc48e4935fc2

dcertsdir=/etc/docker/certs.d
destdir_addr=$dcertsdir/172.30.124.220:5000
destdir_name=$dcertsdir/docker-registry.default.svc.cluster.local:5000
sudo mkdir -p $destdir_addr $destdir_name
sudo cp ca.crt $destdir_addr
sudo cp ca.crt $destdir_name

$ dcertsdir=/etc/docker/certs.d
$ destdir_addr=$dcertsdir/172.30.124.220:5000
$ destdir_name=$dcertsdir/docker-registry.default.svc.cluster.local:5000

$ sudo mkdir -p $destdir_addr $destdir_name
$ sudo cp ca.crt $destdir_addr    

$ sudo cp ca.crt $destdir_name

sudo systemctl daemon-reload
sudo systemctl restart docker

$ sudo systemctl daemon-reload
$ sudo systemctl restart docker

docker tag|push <registry/image> <internal_registry/project/image>

$ docker tag|push <registry/image> <internal_registry/project/image>

docker pull busybox
docker tag docker.io/busybox 172.30.124.220:5000/openshift/busybox
docker push 172.30.124.220:5000/openshift/busybox

$ docker pull busybox
$ docker tag docker.io/busybox 172.30.124.220:5000/openshift/busybox
$ docker push 172.30.124.220:5000/openshift/busybox
...
cf2616975b4a: Image successfully pushed
Digest: sha256:3662dd821983bc4326bee12caec61367e7fb6f6a3ee547cbaff98f77403cab55

sudo mkdir -p /etc/docker/certs.d/<host>
sudo cp <ca_certificate_file> /etc/docker/certs.d/<host>
sudo systemctl restart docker

$ sudo mkdir -p /etc/docker/certs.d/<host>
$ sudo cp <ca_certificate_file> /etc/docker/certs.d/<host>
$ sudo systemctl restart docker

docker login -e user@company.com \
    -u f83j5h6 \
    -p Ju1PeM47R0B92Lk3AZp-bWJSck2F7aGCiZ66aFGZrs2 \
    <host>

# docker login -e user@company.com \
    -u f83j5h6 \
    -p Ju1PeM47R0B92Lk3AZp-bWJSck2F7aGCiZ66aFGZrs2 \
    <host>

oc get imagestreams -n test
docker pull busybox
docker tag busybox <host>/test/busybox
docker push <host>/test/busybox
docker pull <host>/test/busybox
oc get imagestreams -n test

$ oc get imagestreams -n test
NAME      DOCKER REPO   TAGS      UPDATED

$ docker pull busybox
$ docker tag busybox <host>/test/busybox
$ docker push <host>/test/busybox
The push refers to a repository [<host>/test/busybox] (len: 1)
8c2e06607696: Image already exists
6ce2e90b0bc7: Image successfully pushed
cf2616975b4a: Image successfully pushed
Digest: sha256:6c7e676d76921031532d7d9c0394d0da7c2906f4cb4c049904c4031147d8ca31

$ docker pull <host>/test/busybox
latest: Pulling from <host>/test/busybox
cf2616975b4a: Already exists
6ce2e90b0bc7: Already exists
8c2e06607696: Already exists
Digest: sha256:6c7e676d76921031532d7d9c0394d0da7c2906f4cb4c049904c4031147d8ca31
Status: Image is up to date for <host>/test/busybox:latest

$ oc get imagestreams -n test
NAME      DOCKER REPO                       TAGS      UPDATED
busybox   172.30.11.215:5000/test/busybox   latest    2 seconds ago

oc expose service docker-registry --hostname=<hostname> -n default

# oc expose service docker-registry --hostname=<hostname> -n default

apiVersion: v1
kind: Route
metadata:
  creationTimestamp: null
  labels:
    docker-registry: default
  name: docker-registry
spec:
  host: registry.example.com
  port:
    targetPort: "5000"
  to:
    kind: Service
    name: docker-registry
status: {}

apiVersion: v1
kind: Route
metadata:
  creationTimestamp: null
  labels:
    docker-registry: default
  name: docker-registry
spec:
  host: registry.example.com
  port:
    targetPort: "5000"
  to:
    kind: Service
    name: docker-registry
status: {}

oc get route

# oc get route
NAME              HOST/PORT                    PATH      SERVICE           LABELS                    INSECURE POLICY   TLS TERMINATION
docker-registry   registry.example.com            docker-registry   docker-registry=default

curl -v http://registry.example.com/healthz

$ curl -v http://registry.example.com/healthz

OPTIONS='--selinux-enabled --insecure-registry=172.30.0.0/16 --insecure-registry registry.example.com:80'

OPTIONS='--selinux-enabled --insecure-registry=172.30.0.0/16 --insecure-registry registry.example.com:80'

oc get svc/docker-registry -o yaml | grep clusterIP:

$ oc get svc/docker-registry -o yaml | grep clusterIP:

oc delete svc / docker-registry dc / docker-registry

$ oc delete svc / docker-registry dc / docker-registry

oc adm registry <options> -o yaml > registry.yaml

$ oc adm registry <options> -o yaml > registry.yaml

oc create -f registry.yaml

$ oc create -f registry.yaml

BLOCK_REGISTRY = ' - ブロックレジストリ=すべて'

BLOCK_REGISTRY = ' - ブロックレジストリ=すべて'

ADD_REGISTRY='--add-registry=<registry1> --add-registry=<registry2>'

ADD_REGISTRY='--add-registry=<registry1> --add-registry=<registry2>'

oc create configmap registry-config \
    --from-file=</path/to/custom/registry/config.yml>/

$ oc create configmap registry-config \
    --from-file=</path/to/custom/registry/config.yml>/

oc volume dc/docker-registry --add --type=configmap \
    --configmap-name=registry-config -m /etc/docker/registry/

$ oc volume dc/docker-registry --add --type=configmap \
    --configmap-name=registry-config -m /etc/docker/registry/

oc set env dc/docker-registry \
    REGISTRY_CONFIGURATION_PATH=/etc/docker/registry/config.yml

$ oc set env dc/docker-registry \
    REGISTRY_CONFIGURATION_PATH=/etc/docker/registry/config.yml

oc delete configmap registry-config

$ oc delete configmap registry-config

oc create configmap registry-config\
    --from-file=</path/to/custom/registry/config.yml>/

$ oc create configmap registry-config\
    --from-file=</path/to/custom/registry/config.yml>/

oc rollout latest docker-registry

$ oc rollout latest docker-registry

oc get svc / docker-registry --template = '{{。spec.sessionAffinity}}'

$ oc get svc / docker-registry --template = '{{。spec.sessionAffinity}}'

oc patch svc / docker-registry -p '{' spec '：{' sessionAffinity '：' ClientIP '}}'

$ oc patch svc / docker-registry -p '{' spec '：{' sessionAffinity '：' ClientIP '}}'