在 OpenShift Container Platform 上部署 Red Hat Quay Operator

流程

1. 在控制台的 Storage → Object Bucket Claims 中创建 NooBaa Object Bucket Claim。
2. 检索 Object Bucket Claim 数据详细信息，包括 Access Key、Bucket Name、Endpoint (hostname) 和 Secret Key。

3. 使用 Object Bucket Claim 的信息创建 config.yaml 配置文件。例如：

   DISTRIBUTED_STORAGE_CONFIG:
     default:
       - RHOCSStorage
       - access_key: WmrXtSGk8B3nABCDEFGH
         bucket_name: my-noobaa-bucket-claim-8b844191-dc6c-444e-9ea4-87ece0abcdef
         hostname: s3.openshift-storage.svc.cluster.local
         is_secure: true
         port: "443"
         secret_key: X9P5SDGJtmSuHFCMSLMbdNCMfUABCDEFGH+C5QD
         storage_path: /datastorage/registry
   DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
   DISTRIBUTED_STORAGE_PREFERENCE:
     - default

流程

1. 使用以下 Redis 字段创建 config.yaml 文件：

   # ...
   BUILDLOGS_REDIS:
       host: <quay-server.example.com>
       port: 6379
       ssl: false
   # ...
   USER_EVENTS_REDIS:
       host: <quay-server.example.com>
       port: 6379
       ssl: false
   # ...

2. 输入以下命令使用配置文件创建 secret：

   $ oc create secret generic --from-file config.yaml=./config.yaml config-bundle-secret

3. 创建一个 quayregistry.yaml 文件，将 Redis 组件设置为 非受管 组件并引用所创建的 secret：

   apiVersion: quay.redhat.com/v1
   kind: QuayRegistry
   metadata:
     name: example-registry
     namespace: quay-enterprise
   spec:
     configBundleSecret: config-bundle-secret
     components:
       - kind: redis
         managed: false
   # ...

4. 部署 Red Hat Quay registry。

流程

1. 在 quayregistry.yaml 文件中将组件设置为 managed: false ：

   apiVersion: quay.redhat.com/v1
   kind: QuayRegistry
   metadata:
     name: example-registry
     namespace: quay-enterprise
   spec:
     components:
       - kind: route
         managed: false

2. 编辑 config.yaml 文件，以指定 Red Hat Quay 处理 SSL/TLS。例如：

   # ...
   EXTERNAL_TLS_TERMINATION: false
   # ...
   SERVER_HOSTNAME: example-registry-quay-quay-enterprise.apps.user1.example.com
   # ...
   PREFERRED_URL_SCHEME: https
   # ...

   如果没有正确配置非受管路由，则会返回以下错误：

   {
     {
       "kind":"QuayRegistry",
       "namespace":"quay-enterprise",
       "name":"example-registry",
       "uid":"d5879ba5-cc92-406c-ba62-8b19cf56d4aa",
       "apiVersion":"quay.redhat.com/v1",
       "resourceVersion":"2418527"
     },
     "reason":"ConfigInvalid",
     "message":"required component `route` marked as unmanaged, but `configBundleSecret` is missing necessary fields"
   }

1. 打开 Red Hat Quay 配置文件并更新以下配置字段：

   FEATURE_USER_INITIALIZE: true
   SUPER_USERS:
        -  quayadmin

2. 输入以下命令停止 Red Hat Quay 服务：

   $ sudo podman stop quay

3. 输入以下命令启动 Red Hat Quay 服务：

   $ sudo podman run -d -p 80:8080 -p 443:8443 --name=quay -v $QUAY/config:/conf/stack:Z  -v $QUAY/storage:/datastorage:Z {productrepo}/{quayimage}:{productminv}

4. 运行以下 CURL 命令，以使用用户名、密码、电子邮件和访问令牌生成新用户：

   $ curl -X POST -k  http://quay-server.example.com/api/v1/user/initialize --header 'Content-Type: application/json' --data '{ "username": "quayadmin", "password":"quaypass12345", "email": "quayadmin@example.com", "access_token": true}'

   如果成功，命令会返回带有用户名、电子邮件和加密密码的对象。例如：

   {"access_token":"6B4QTRSTSD1HMIG915VPX7BMEZBVB9GPNY2FC2ED", "email":"quayadmin@example.com","encrypted_password":"1nZMLH57RIE5UGdL/yYpDOHLqiNCgimb6W9kfF8MjZ1xrfDpRyRs9NUnUuNuAitW","username":"quayadmin"} # gitleaks:allow

   如果用户存在于数据库中，则返回错误：

   {"message":"Cannot initialize user in a non-empty database"}

   如果您的密码至少没有 8 个字符或包含空格，则返回错误：

   {"message":"Failed to initialize user: Invalid password, password must be at least 8 characters and contain no whitespace."}

5. 输入以下命令登录到 Red Hat Quay 部署：

   $ sudo podman login -u quayadmin -p quaypass12345 http://quay-server.example.com --tls-verify=false

   输出示例

   Login Succeeded!

流程

1. 输入以下命令查看部署的组件：

   $ oc get pods -n quay-enterprise

   输出示例

   NAME                                                   READY   STATUS      RESTARTS   AGE
   example-registry-clair-app-5ffc9f77d6-jwr9s            1/1     Running     0          3m42s
   example-registry-clair-app-5ffc9f77d6-wgp7d            1/1     Running     0          3m41s
   example-registry-clair-postgres-54956d6d9c-rgs8l       1/1     Running     0          3m5s
   example-registry-quay-app-79c6b86c7b-8qnr2             1/1     Running     4          3m42s
   example-registry-quay-app-79c6b86c7b-xk85f             1/1     Running     4          3m41s
   example-registry-quay-app-upgrade-5kl5r                0/1     Completed   4          3m50s
   example-registry-quay-database-b466fc4d7-tfrnx         1/1     Running     2          3m42s
   example-registry-quay-mirror-6d9bd78756-6lj6p          1/1     Running     0          2m58s
   example-registry-quay-mirror-6d9bd78756-bv6gq          1/1     Running     0          2m58s
   example-registry-quay-postgres-init-dzbmx              0/1     Completed   0          3m43s
   example-registry-quay-redis-8bd67b647-skgqx            1/1     Running     0          3m42s

流程

1. 输入以下命令检查部署的状态：

   $ oc get quayregistry -n quay-enterprise -o yaml

   输出示例

   部署后，Quay Registry 对象将显示基本配置：

   apiVersion: v1
   items:
   - apiVersion: quay.redhat.com/v1
     kind: QuayRegistry
     metadata:
       creationTimestamp: "2021-09-14T10:51:22Z"
       generation: 3
       name: example-registry
       namespace: quay-enterprise
       resourceVersion: "50147"
       selfLink: /apis/quay.redhat.com/v1/namespaces/quay-enterprise/quayregistries/example-registry
       uid: e3fc82ba-e716-4646-bb0f-63c26d05e00e
     spec:
       components:
       - kind: postgres
         managed: true
       - kind: clair
         managed: true
       - kind: redis
         managed: true
       - kind: horizontalpodautoscaler
         managed: true
       - kind: objectstorage
         managed: true
       - kind: route
         managed: true
       - kind: mirror
         managed: true
       - kind: monitoring
         managed: true
       - kind: tls
         managed: true
       - kind: clairpostgres
         managed: true
       configBundleSecret: example-registry-config-bundle-kt55s
   kind: List
   metadata:
     resourceVersion: ""
     selfLink: ""

2. 使用 oc get pods 命令查看部署组件的当前状态：

   $ oc get pods -n quay-enterprise

   输出示例

   NAME                                                   READY   STATUS              RESTARTS   AGE
   example-registry-clair-app-86554c6b49-ds7bl            0/1     ContainerCreating   0          2s
   example-registry-clair-app-86554c6b49-hxp5s            0/1     Running             1          17s
   example-registry-clair-postgres-68d8857899-lbc5n       0/1     ContainerCreating   0          17s
   example-registry-quay-app-upgrade-h2v7h                0/1     ContainerCreating   0          9s
   example-registry-quay-database-66f495c9bc-wqsjf        0/1     ContainerCreating   0          17s
   example-registry-quay-mirror-854c88457b-d845g          0/1     Init:0/1            0          2s
   example-registry-quay-mirror-854c88457b-fghxv          0/1     Init:0/1            0          17s
   example-registry-quay-postgres-init-bktdt              0/1     Terminating         0          17s
   example-registry-quay-redis-f9b9d44bf-4htpz            0/1     ContainerCreating   0          17s

3. 在部署进行过程中，Quay Registry 对象将显示当前状态。在这个实例中，数据库迁移会发生，其他组件会在完成前等待：

     status:
       conditions:
       - lastTransitionTime: "2021-09-14T10:52:04Z"
         lastUpdateTime: "2021-09-14T10:52:04Z"
         message: all objects created/updated successfully
         reason: ComponentsCreationSuccess
         status: "False"
         type: RolloutBlocked
       - lastTransitionTime: "2021-09-14T10:52:05Z"
         lastUpdateTime: "2021-09-14T10:52:05Z"
         message: running database migrations
         reason: MigrationsInProgress
         status: "False"
         type: Available
       lastUpdated: 2021-09-14 10:52:05.371425635 +0000 UTC
       unhealthyComponents:
         clair:
         - lastTransitionTime: "2021-09-14T10:51:32Z"
           lastUpdateTime: "2021-09-14T10:51:32Z"
           message: 'Deployment example-registry-clair-postgres: Deployment does not have minimum availability.'
           reason: MinimumReplicasUnavailable
           status: "False"
           type: Available
         - lastTransitionTime: "2021-09-14T10:51:32Z"
           lastUpdateTime: "2021-09-14T10:51:32Z"
           message: 'Deployment example-registry-clair-app: Deployment does not have minimum availability.'
           reason: MinimumReplicasUnavailable
           status: "False"
           type: Available
         mirror:
         - lastTransitionTime: "2021-09-14T10:51:32Z"
           lastUpdateTime: "2021-09-14T10:51:32Z"
           message: 'Deployment example-registry-quay-mirror: Deployment does not have minimum availability.'
           reason: MinimumReplicasUnavailable
           status: "False"
           type: Available

4. 当部署过程成功完成时，QuayRegistry 对象中的状态不会显示不健康的组件：

     status:
       conditions:
       - lastTransitionTime: "2021-09-14T10:52:36Z"
         lastUpdateTime: "2021-09-14T10:52:36Z"
         message: all registry component healthchecks passing
         reason: HealthChecksPassing
         status: "True"
         type: Available
       - lastTransitionTime: "2021-09-14T10:52:46Z"
         lastUpdateTime: "2021-09-14T10:52:46Z"
         message: all objects created/updated successfully
         reason: ComponentsCreationSuccess
         status: "False"
         type: RolloutBlocked
       currentVersion: {producty}
       lastUpdated: 2021-09-14 10:52:46.104181633 +0000 UTC
       registryEndpoint: https://example-registry-quay-quay-enterprise.apps.docs.quayteam.org
       unhealthyComponents: {}

流程

1. 在 OpenShift Container Platform 控制台中，使用适当的命名空间 / 项目进入到 Operators → Installed Operators。

2. 单击新安装的 QuayRegistry 对象以查看详细信息。例如：

   

3. 在 Registry Endpoint 具有值后，在浏览器中导航到此 URL。

4. 在 Red Hat Quay registry UI 中，选择 Create Account 来创建用户。例如：

   

5. 输入用户名、密码、电子邮件 的详细信息，然后单击 创建帐户。例如：

   

流程

1. 输入以下命令描述 QuayRegistry 资源：

   $ oc describe quayregistry -n <quay_namespace>

   # ...
     Config Bundle Secret:  example-registry-config-bundle-v123x
   # ...

2. 输入以下命令来获取 secret 数据：

   $ oc get secret -n <quay_namespace> <example-registry-config-bundle-v123x> -o jsonpath='{.data}'

   输出示例

   {
       "config.yaml": "RkVBVFVSRV9VU0 ... MDAwMAo="
   }

3. 输入以下命令解码数据：

   $ echo 'RkVBVFVSRV9VU0 ... MDAwMAo=' | base64 --decode

   输出示例

   FEATURE_USER_INITIALIZE: true
   BROWSER_API_CALLS_XHR_ONLY: false
   SUPER_USERS:
   - quayadmin
   FEATURE_USER_CREATION: false
   FEATURE_QUOTA_MANAGEMENT: true
   FEATURE_PROXY_CACHE: true
   FEATURE_BUILD_SUPPORT: true
   DEFAULT_SYSTEM_REJECT_QUOTA_BYTES: 102400000

4. 可选。您可以通过传递 >> config.yaml 标志，将数据导出到当前目录中。例如：

   $ echo 'RkVBVFVSRV9VU0 ... MDAwMAo=' | base64 --decode >> config.yaml

流程

1. 输入以下命令生成服务器密钥：

   $ openssl genrsa -out ssl.key 2048

2. 输入以下命令生成签名请求：

   $ openssl req -new -key ssl.key -out ssl.csr

3. 输入要合并到证书请求中的信息，包括服务器主机名，例如：

   Country Name (2 letter code) [XX]:IE
   State or Province Name (full name) []:GALWAY
   Locality Name (eg, city) [Default City]:GALWAY
   Organization Name (eg, company) [Default Company Ltd]:QUAY
   Organizational Unit Name (eg, section) []:DOCS
   Common Name (eg, your name or your server's hostname) []:quay-server.example.com
   Email Address []:

4. 创建配置文件 openssl.cnf，指定服务器主机名，例如：

   openssl.cnf

   [req]
   req_extensions = v3_req
   distinguished_name = req_distinguished_name
   [req_distinguished_name]
   [ v3_req ]
   basicConstraints = CA:FALSE
   keyUsage = nonRepudiation, digitalSignature, keyEncipherment
   subjectAltName = @alt_names
   [alt_names]
   DNS.1 = <quay-server.example.com>
   IP.1 = 192.168.1.112

5. 使用配置文件生成证书 ssl.cert ：

   $ openssl x509 -req -in ssl.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out ssl.cert -days 356 -extensions v3_req -extfile openssl.cnf