Fixes bugs for registry content #14986

bmcelvee · 2019-05-21T18:06:54Z

This PR addresses the following bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1704415
https://bugzilla.redhat.com/show_bug.cgi?id=1708765
https://bugzilla.redhat.com/show_bug.cgi?id=1704382
https://bugzilla.redhat.com/show_bug.cgi?id=1704381

bmcelvee · 2019-05-21T19:44:28Z

modules/registry-securing-manually.adoc

@@ -16,30 +16,30 @@ Manually secure the registry to serve traffic via TLS:
 example:


This section is currently commented out of the documentation, but I made some requested changes just in case.

I'd say we shouldn't recommend to secure the registry manually anymore. Inside the cluster it is secured by default. Outside of the cluster it can be accessed only through routes, which should have documentation about certificates and all this stuff.

Thanks, @dmage! It sounds like we might want to move the entire Securing and exposing the registry topic: https://docs.openshift.com/container-platform/4.1/registry/securing-exposing-registry.html

Is that correct?

@bmcelvee yes, the whole section of registry-securing-manually.adoc should be removed.

Thanks! I'll go ahead and remove the entire assembly.

bmcelvee · 2019-05-21T19:45:14Z

@sferich888 and @hongkailiu Please take a look, thanks!

bmcelvee · 2019-05-21T19:45:47Z

@dmage - if you have time, please take a look too.

bmcelvee · 2019-05-21T20:44:27Z

Going ahead and requesting QE review too so I can get the fixes merged sooner.

Thanks!

@wzheng1 Please take a look, thanks again!

wzheng1 · 2019-05-22T02:32:02Z

modules/registry-accessing-directly.adoc

+
+[NOTE]
+====
+Since the Image Registry Operator creates the route, it will likely be the


But operator will not enable default route by default, user should enable it :
$oc patch configs.imageregistry.operator.openshift.io cluster -p '{"spec":{"defaultRoute":true}}' --type='merge' -n openshift-image-registry

Thanks, @wzheng1! Does the user need to enable the route during install or post install? And would this procedure be part of/an update to the securing the registry procedure in the operator docs? https://docs.openshift.com/container-platform/4.1/registry/configuring-registry-operator.html#registry-operator-default-crd_configuring-registry-operator

User cannot enable it during install, can do it post install.

wzheng1 · 2019-05-22T02:33:26Z

modules/registry-accessing-directly.adoc

+[NOTE]
+====
+Since the Image Registry Operator creates the route, it will likely be the
+`default-route`.


The default route address will be like: default-route-openshift-image-registry.<cluster_name>, for example default-route-openshift-image-registry.apps.qe-521.qe.devcluster.openshift.com

wzheng1 · 2019-05-22T02:44:45Z

modules/registry-accessing-directly.adoc

 +
 ----
-$ podman-login -u openshift -p $(oc whoami -t) <registry_ip>:<port>
+$ podman login -u openshift -p $(oc whoami -t) $(oc get route -n openshift-image-registry default-route -o jsonpath='{.status.ingress[*].host}{"\n"}')


If use podman to login, I suggest to use internal registry address like before:
sh-4.4# podman login -u kubeadmin -p RDhLYKRgyw3JFpG4-9N9yBbLdGK4CtKeAc5aSjFuk3E image-registry.openshift-image-registry.svc:5000
Login Succeeded!

@dmage could you please decide which way is better about my above comment?

Above steps can be added to accessing-the-registry.adoc.

The assumptions of this article are not clear. If it assumes that all actions will be from outside of the cluster, then only external routes can be used. That's a good point that most likely the registry will have untrusted certificate.

@bmcelvee so the conclusion is user has two options to access Openshift internal registry as below:

If use internal routes, user has to be inside cluster like below:
a. Access into node:
$oc get nodes --------------this is to get node address
$oc debug nodes/<node_address>
b. Use podman command to log into internal route: image-registry.openshift-image-registry.svc:5000:
sh-4.4# podman login -u kubeadmin -p RDhLYKRgyw3JFpG4-9N9yBbLdGK4CtKeAc5aSjFuk3E image-registry.openshift-image-registry.svc:5000
Login Succeeded!
c. Then you can use $podman pull/push;

If use external routes, user need to enable defaultRoute=true first, then create a CA file to copy to local like this:
a.Get wildcard route ca
$oc get secret router-certs-default -n openshift-ingress -o yaml
$echo <tls.crt_content> | base64 -d > ca.crt
b. Trust ca in your client platform
$sudo cp ca.crt /etc/pki/ca-trust/source/anchors/<external_route>.crt
#sudo update-ca-trust enable
c. Reload docker
#sudo systemctl daemon-reload
#sudo systemctl restart docker
d.the user can use docker to login with this default address locally: default-route-openshift-image-registry.<cluster_name>

Thanks so much, @wzheng1! Wildcard routes are not supported in 4.1, so I've documented the external route method locally and can put it in the documentation if wildcard routes are offered in the future .

@bmcelvee By re-reviewing the doc registry-accessing-directly.adoc, I wanna highlight my above 2 methods are separated with each other, one is with internal route address: image-registry.openshift-image-registry.svc:5000 ; another is to login with external route address enabled by user:
$ oc get route -n openshift-image-registry default-route -o jsonpath='{.status.ingress[*].host}{"\n"}'
default-route-openshift-image-registry.apps.qe-wewang-527.qe.devcluster.openshift.com;
If user use external route address, it is OK to use docker command.

Thanks @wzheng1! So far I've only included the steps for accessing internally since wildcard routing is not supported in 4.1.

I'm a bit confused on the command we should document for the log in step, would it be better as one of the following:

$ podman login -u openshift -p $(oc whoami -t) $(oc get route -n openshift-image-registry default-route -o jsonpath='{.status.ingress[*].host}{"\n"}')

podman login -u kubeadmin -p RDhLYKRgyw3JFpG4-9N9yBbLdGK4CtKeAc5aSjFuk3E image-registry.openshift-image-registry.svc:5000

podman login -u kubeadmin -p $(oc whoami -t) image-registry.openshift-image-registry.svc:5000

I vote for item #3.

Thanks again! :) Updated.

wzheng1 · 2019-05-22T02:52:33Z

modules/registry-accessing-directly.adoc

 ----

 .. Tag the new image with the form `<registry_ip>:<port>/<project>/<image>`.
 The project name must appear in this pull specification for {product-title} to
 correctly place and later access the image in the registry:
 +
 ----
-$ podman-tag name.io/image 172.30.124.220:5000/openshift/image
+$ podman tag name.io/image 172.30.124.220:5000/openshift/image


$ podman tag name.io/image image-registry.openshift-image-registry.svc:5000/openshift/image

wzheng1 · 2019-05-22T02:52:53Z

modules/registry-accessing-directly.adoc

 to push the image.
 ====

 .. Push the newly-tagged image to your registry:
 +
 ----
-$ podman-push 172.30.124.220:5000/openshift/image
+$ podman push 172.30.124.220:5000/openshift/image


$ podman tag name.io/image image-registry.openshift-image-registry.svc:5000/openshift/image

modules/registry-securing-manually.adoc

wzheng1 · 2019-05-22T02:54:58Z

modules/registry-securing-manually.adoc

 +
 ----
 $ oc adm ca create-server-cert \
    --signer-cert=/etc/origin/master/ca.crt \
    --signer-key=/etc/origin/master/ca.key \
    --signer-serial=/etc/origin/master/ca.serial.txt \
-    --hostnames='podman-registry.default.svc.cluster.local,podman-registry.default.svc,172.30.124.220' \
+    --hostnames='openshift-image-registry.default.svc.cluster.local,openshift-image-registry.default.svc,172.30.124.220' \


wzheng1 · 2019-05-22T02:55:18Z

modules/registry-securing-manually.adoc

@@ -48,7 +48,7 @@ If the router will be exposed externally, add the public route host name in the
 `--hostnames` flag:
 +
 ----
--hostnames='mypodman-registry.example.com,podman-registry.default.svc.cluster.local,172.30.124.220 \
+--hostnames='myopenshift-image-registry.example.com,openshift-image-registry.default.svc.cluster.local,172.30.124.220 \


wzheng1 · 2019-05-22T03:30:29Z

modules/registry-securing-manually.adoc

@@ -134,7 +134,7 @@ done on all nodes in the cluster:
 ----
 $ dcertsdir=/etc/podman/certs.d
 $ destdir_addr=$dcertsdir/172.30.124.220:5000
-$ destdir_name=$dcertsdir/podman-registry.default.svc.cluster.local:5000
+$ destdir_name=$dcertsdir/openshift-image-registry.default.svc.cluster.local:5000

 $ sudo mkdir -p $destdir_addr $destdir_name
 $ sudo cp ca.crt $destdir_addr    //<1>


@dmage whether above steps works in 4.x now?

wzheng1 · 2019-05-22T03:32:07Z

@bmcelvee comments added, some of them need @dmage double confirm.

sferich888 · 2019-05-22T10:25:31Z

modules/registry-accessing-directly.adoc

-. Log in to the registry directly:
-
-.. Ensure you are logged in to {product-title} as a *regular user*:
+. Ensure you are logged in to {product-title} as a cluster administrator:
 +
 ----
 $ oc login


We should show a user how to validate they are an admin here!

dmage · 2019-05-22T12:52:48Z

modules/registry-accessing-directly.adoc

-. Log in to the registry directly:
-
-.. Ensure you are logged in to {product-title} as a *regular user*:
+. Ensure you are logged in to {product-title} as a cluster administrator:


Why does it need to be an administrator?

@dmage What level of user do you need to be in order to access the registry? (I originally brought this content forward from 3.x, and am trying to clarify/update it.)

A regular user is fine.

dmage · 2019-05-22T13:13:13Z

modules/registry-accessing-directly.adoc

 +
 ----
-$ podman-login -u openshift -p $(oc whoami -t) <registry_ip>:<port>
+$ podman login -u openshift -p $(oc whoami -t) $(oc get route -n openshift-image-registry default-route -o jsonpath='{.status.ingress[*].host}{"\n"}')


The assumptions of this article are not clear. If it assumes that all actions will be from outside of the cluster, then only external routes can be used. That's a good point that most likely the registry will have untrusted certificate.

dmage · 2019-05-22T13:20:41Z

modules/registry-securing-manually.adoc

@@ -16,30 +16,30 @@ Manually secure the registry to serve traffic via TLS:
 example:


I'd say we shouldn't recommend to secure the registry manually anymore. Inside the cluster it is secured by default. Outside of the cluster it can be accessed only through routes, which should have documentation about certificates and all this stuff.

bmcelvee · 2019-05-30T15:54:13Z

Preview build: http://file.rdu.redhat.com/~bmcelvee/20190529/registry/accessing-the-registry.html

adellape

LGTM, just some nits.

adellape · 2019-05-30T16:06:21Z

modules/registry-accessing-directly.adoc

-* For pulling images, for example when using the `podman-pull` command,
-the user must have the *registry-viewer* role. To add this role:
+. Access the node:
+.. Get the node's address:


Could this be a single step w/o a substep?

adellape · 2019-05-30T16:06:51Z

modules/registry-accessing-directly.adoc

 +
 ----
-$ oc policy add-role-to-user registry-editor <user_name>
+$ oc login -u kubeadmin -p <PASSWORD_FROM_INSTALL_LOG>


Replaceable could be lowercase.

modules/registry-accessing-directly.adoc

adellape · 2019-05-30T16:07:37Z

modules/registry-accessing-directly.adoc

 +
 ----
-$ podman-login -u openshift -p $(oc whoami -t) <registry_ip>:<port>
+Login Succeeded!
 ----
 +
 [NOTE]
 ====
 You can pass any value for the username, the token contains all necessary


s/username/user name/

x2 in this para.

Also maybe semicolon instead: "You can pass any value for the user name; the token contains all necessary information."

wzheng1 · 2019-05-31T01:52:06Z

modules/registry-accessing-directly.adoc

-...
-cf2616975b4a: Image successfully pushed
-Digest: sha256:3662dd821983bc4326bee12caec61367e7fb6f6a3ee547cbaff98f77403cab55
+$ podman push name.io/image image-registry.openshift-image-registry.svc:5000/openshift/image


This command should be:
$ podman push image-registry.openshift-image-registry.svc:5000/openshift/image

Sorry for missing it before.

Thanks so much, @wzheng1!

bmcelvee · 2019-05-31T16:58:23Z

All bugs moved to verified, and I pushed the final request. Merging the PR now, and we can make any additional edits in new PRs. Thanks!

bmcelvee added the branch/enterprise-4.1 label May 21, 2019

bmcelvee added this to the Future Release milestone May 21, 2019

openshift-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label May 21, 2019

bmcelvee force-pushed the bugs-registry-improvement branch 4 times, most recently from eacdf49 to 7bc78d0 Compare May 21, 2019 19:43

openshift-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels May 21, 2019

bmcelvee commented May 21, 2019

View reviewed changes

wzheng1 reviewed May 22, 2019

View reviewed changes

modules/registry-securing-manually.adoc Outdated Show resolved Hide resolved

wzheng1 reviewed May 22, 2019

View reviewed changes

sferich888 reviewed May 22, 2019

View reviewed changes

dmage reviewed May 22, 2019

View reviewed changes

bmcelvee force-pushed the bugs-registry-improvement branch 5 times, most recently from 0f38a72 to 1dcd584 Compare May 29, 2019 20:31

bmcelvee force-pushed the bugs-registry-improvement branch from 1dcd584 to 4d98c73 Compare May 30, 2019 13:15

adellape approved these changes May 30, 2019

View reviewed changes

adellape added the peer-review-done Signifies that the peer review team has reviewed this PR label May 30, 2019

bmcelvee force-pushed the bugs-registry-improvement branch from 4d98c73 to 975cc47 Compare May 30, 2019 17:43

wzheng1 reviewed May 31, 2019

View reviewed changes

Fixes bugs for registry content

18ee0ef

bmcelvee force-pushed the bugs-registry-improvement branch from 975cc47 to 18ee0ef Compare May 31, 2019 16:49

bmcelvee merged commit c1ea042 into openshift:enterprise-4.1 May 31, 2019

vikram-redhat modified the milestones: Future Release, OCP 4.1 GA Jun 3, 2019

		@@ -16,30 +16,30 @@ Manually secure the registry to serve traffic via TLS:
		example:

Fixes bugs for registry content #14986

Fixes bugs for registry content #14986

Conversation

bmcelvee commented May 21, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bmcelvee commented May 21, 2019

bmcelvee commented May 21, 2019 • edited Loading

bmcelvee commented May 21, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wzheng1 May 22, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wzheng1 May 23, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wzheng1 May 27, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wzheng1 commented May 22, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bmcelvee commented May 30, 2019

adellape left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wzheng1 May 31, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bmcelvee commented May 31, 2019

bmcelvee commented May 21, 2019 •

edited

Loading

wzheng1 May 22, 2019 •

edited

Loading

wzheng1 May 23, 2019 •

edited

Loading

wzheng1 May 27, 2019 •

edited

Loading

adellape left a comment •

edited

Loading

wzheng1 May 31, 2019 •

edited

Loading