5.4. Image configuration resources

1. To configure an additional CA:

   $ oc create configmap registry-config --from-file=<external_registry_address>=ca.crt -n openshift-config

   $ oc edit image.config.openshift.io cluster

   spec:
     additionalTrustedCA:
       name: registry-config

Procedure

1. Edit the image.config.openshift.io/cluster CR:

   $ oc edit image.config.openshift.io/cluster

   The following is an example image.config.openshift.io/cluster CR with an insecure registries list:

   apiVersion: config.openshift.io/v1
   kind: Image
   metadata:
     annotations:
       release.openshift.io/create-only: "true"
     creationTimestamp: "2019-05-17T13:44:26Z"
     generation: 1
     name: cluster
     resourceVersion: "8302"
     selfLink: /apis/config.openshift.io/v1/images/cluster
     uid: e34555da-78a9-11e9-b92b-06d6c7da38dc
   spec:
     registrySources: 1
       insecureRegistries: 2
       - insecure.com
       allowedRegistries:
       - example.com
       - quay.io
       - registry.redhat.io
       - insecure.com 3
   status:
     internalRegistryHostname: image-registry.openshift-image-registry.svc:5000

   1

   registrySources: Contains configurations that determine how the container runtime should treat individual registries when accessing images for builds and pods. It does not contain configuration for the internal cluster registry.

   2

   Specify an insecure registry.

   3

   Ensure that any insecure registries are included in the allowedRegistries list.

   注意

   When the allowedRegistries parameter is defined, all registries, including the registry.redhat.io and quay.io registries, are blocked unless explicitly listed. If you use the parameter, to prevent pod failure, you must add registry.redhat.io and quay.io to the allowedRegistries list, as they are required by payload images within your environment. Do not add the registry.redhat.io and quay.io registries to the blockedRegistries list.

   The Machine Config Operator (MCO) watches the image.config.openshift.io/cluster CR for any changes to registries and reboots the nodes when it detects changes. Changes to the insecure and blocked registries appear in the /etc/containers/registries.conf file on each node.

2. To check that the registries have been added to the policy file, use the following command on a node:

   $ cat /host/etc/containers/registries.conf

   The following example indicates that images from the insecure.com registry is insecure and is allowed for image pulls and pushes.

   Example output

   unqualified-search-registries = ["registry.access.redhat.com", "docker.io"]
   
   [[registry]]
     prefix = ""
     location = "insecure.com"
     insecure = true

Procedure

1. Configure mirrored repositories, by either:

   • Setting up a mirrored repository with Red Hat Quay, as described in Red Hat Quay Repository Mirroring. Using Red Hat Quay allows you to copy images from one repository to another and also automatically sync those repositories repeatedly over time.

   • Using a tool such as skopeo to copy images manually from the source directory to the mirrored repository.

     For example, after installing the skopeo RPM package on a Red Hat Enterprise Linux (RHEL) 7 or RHEL 8 system, use the skopeo command as shown in this example:

     $ skopeo copy \
     docker://registry.access.redhat.com/ubi8/ubi-minimal@sha256:5cfbaf45ca96806917830c183e9f37df2e913b187adb32e89fd83fa455ebaa6 \
     docker://example.io/example/ubi-minimal

     In this example, you have a container image registry that is named example.io with an image repository named example to which you want to copy the ubi8/ubi-minimal image from registry.access.redhat.com. After you create the registry, you can configure your OpenShift Container Platform cluster to redirect requests made of the source repository to the mirrored repository.

2. Log in to your OpenShift Container Platform cluster.

3. Create an ImageContentSourcePolicy file (for example, registryrepomirror.yaml), replacing the source and mirrors with your own registry and repository pairs and images:

   apiVersion: operator.openshift.io/v1alpha1
   kind: ImageContentSourcePolicy
   metadata:
     name: ubi8repo
   spec:
     repositoryDigestMirrors:
     - mirrors:
       - example.io/example/ubi-minimal 1
       source: registry.access.redhat.com/ubi8/ubi-minimal 2
     - mirrors:
       - example.com/example/ubi-minimal
       source: registry.access.redhat.com/ubi8/ubi-minimal

   1

   Indicates the name of the image registry and repository.

   2

   Indicates the registry and repository containing the content that is mirrored.

4. Create the new ImageContentSourcePolicy object:

   $ oc create -f registryrepomirror.yaml

   After the ImageContentSourcePolicy object is created, the new settings are deployed to each node and the cluster starts using the mirrored repository for requests to the source repository.

5. To check that the mirrored configuration settings, are applied, do the following on one of the nodes.

   1. List your nodes:

      $ oc get node

      Example output

      NAME                           STATUS                     ROLES    AGE  VERSION
      ip-10-0-137-44.ec2.internal    Ready                      worker   7m   v1.18.3
      ip-10-0-138-148.ec2.internal   Ready                      master   11m  v1.18.3
      ip-10-0-139-122.ec2.internal   Ready                      master   11m  v1.18.3
      ip-10-0-147-35.ec2.internal    Ready,SchedulingDisabled   worker   7m   v1.18.3
      ip-10-0-153-12.ec2.internal    Ready                      worker   7m   v1.18.3
      ip-10-0-154-10.ec2.internal    Ready                      master   11m  v1.18.3

      You can see that scheduling on each worker node is disabled as the change is being applied.

   2. Start the debugging process to access the node:

      $ oc debug node/ip-10-0-147-35.ec2.internal

      Example output

      Starting pod/ip-10-0-147-35ec2internal-debug ...
      To use host binaries, run `chroot /host`

   3. Access the node’s files:

      sh-4.2# chroot /host

   4. Check the /etc/containers/registries.conf file to make sure the changes were made:

      sh-4.2# cat /etc/containers/registries.conf

      Example output

      unqualified-search-registries = ["registry.access.redhat.com", "docker.io"]
      [[registry]]
        location = "registry.access.redhat.com/ubi8/"
        insecure = false
        blocked = false
        mirror-by-digest-only = true
        prefix = ""
      
        [[registry.mirror]]
          location = "example.io/example/ubi8-minimal"
          insecure = false
      
        [[registry.mirror]]
          location = "example.com/example/ubi8-minimal"
          insecure = false

   5. Pull an image digest to the node from the source and check if it is resolved by the mirror. ImageContentSourcePolicy objects support image digests only, not image tags.

      sh-4.2# podman pull --log-level=debug registry.access.redhat.com/ubi8/ubi-minimal@sha256:5cfbaf45ca96806917830c183e9f37df2e913b187adb32e89fd83fa455ebaa6