Fixes bugs for registry content #14986

bmcelvee · 2019-05-21T18:06:54Z

This PR addresses the following bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1704415
https://bugzilla.redhat.com/show_bug.cgi?id=1708765
https://bugzilla.redhat.com/show_bug.cgi?id=1704382
https://bugzilla.redhat.com/show_bug.cgi?id=1704381

bmcelvee · 2019-05-21T19:44:28Z

modules/registry-securing-manually.adoc

This section is currently commented out of the documentation, but I made some requested changes just in case.

I'd say we shouldn't recommend to secure the registry manually anymore. Inside the cluster it is secured by default. Outside of the cluster it can be accessed only through routes, which should have documentation about certificates and all this stuff.

Thanks, @dmage! It sounds like we might want to move the entire Securing and exposing the registry topic: https://docs.openshift.com/container-platform/4.1/registry/securing-exposing-registry.html

Is that correct?

@bmcelvee yes, the whole section of registry-securing-manually.adoc should be removed.

Thanks! I'll go ahead and remove the entire assembly.

bmcelvee · 2019-05-21T19:45:14Z

@sferich888 and @hongkailiu Please take a look, thanks!

bmcelvee · 2019-05-21T19:45:47Z

@dmage - if you have time, please take a look too.

bmcelvee · 2019-05-21T20:44:27Z

Going ahead and requesting QE review too so I can get the fixes merged sooner.

Thanks!

@wzheng1 Please take a look, thanks again!

wzheng1 · 2019-05-22T02:32:02Z

modules/registry-accessing-directly.adoc

But operator will not enable default route by default, user should enable it :
$oc patch configs.imageregistry.operator.openshift.io cluster -p '{"spec":{"defaultRoute":true}}' --type='merge' -n openshift-image-registry

Thanks, @wzheng1! Does the user need to enable the route during install or post install? And would this procedure be part of/an update to the securing the registry procedure in the operator docs? https://docs.openshift.com/container-platform/4.1/registry/configuring-registry-operator.html#registry-operator-default-crd_configuring-registry-operator

User cannot enable it during install, can do it post install.

wzheng1 · 2019-05-22T02:33:26Z

modules/registry-accessing-directly.adoc

The default route address will be like: default-route-openshift-image-registry.<cluster_name>, for example default-route-openshift-image-registry.apps.qe-521.qe.devcluster.openshift.com

wzheng1 · 2019-05-22T02:44:45Z

modules/registry-accessing-directly.adoc

If use podman to login, I suggest to use internal registry address like before:
sh-4.4# podman login -u kubeadmin -p RDhLYKRgyw3JFpG4-9N9yBbLdGK4CtKeAc5aSjFuk3E image-registry.openshift-image-registry.svc:5000
Login Succeeded!

@dmage could you please decide which way is better about my above comment?

Above steps can be added to accessing-the-registry.adoc.

The assumptions of this article are not clear. If it assumes that all actions will be from outside of the cluster, then only external routes can be used. That's a good point that most likely the registry will have untrusted certificate.

@bmcelvee so the conclusion is user has two options to access Openshift internal registry as below:

If use internal routes, user has to be inside cluster like below:
a. Access into node:
$oc get nodes --------------this is to get node address
$oc debug nodes/<node_address>
b. Use podman command to log into internal route: image-registry.openshift-image-registry.svc:5000:
sh-4.4# podman login -u kubeadmin -p RDhLYKRgyw3JFpG4-9N9yBbLdGK4CtKeAc5aSjFuk3E image-registry.openshift-image-registry.svc:5000
Login Succeeded!
c. Then you can use $podman pull/push;

If use external routes, user need to enable defaultRoute=true first, then create a CA file to copy to local like this:
a.Get wildcard route ca
$oc get secret router-certs-default -n openshift-ingress -o yaml
$echo <tls.crt_content> | base64 -d > ca.crt
b. Trust ca in your client platform
$sudo cp ca.crt /etc/pki/ca-trust/source/anchors/<external_route>.crt
#sudo update-ca-trust enable
c. Reload docker
#sudo systemctl daemon-reload
#sudo systemctl restart docker
d.the user can use docker to login with this default address locally: default-route-openshift-image-registry.<cluster_name>

Thanks so much, @wzheng1! Wildcard routes are not supported in 4.1, so I've documented the external route method locally and can put it in the documentation if wildcard routes are offered in the future .

@bmcelvee By re-reviewing the doc registry-accessing-directly.adoc, I wanna highlight my above 2 methods are separated with each other, one is with internal route address: image-registry.openshift-image-registry.svc:5000 ; another is to login with external route address enabled by user:
$ oc get route -n openshift-image-registry default-route -o jsonpath='{.status.ingress[*].host}{"\n"}'
default-route-openshift-image-registry.apps.qe-wewang-527.qe.devcluster.openshift.com;
If user use external route address, it is OK to use docker command.

Thanks @wzheng1! So far I've only included the steps for accessing internally since wildcard routing is not supported in 4.1.

I'm a bit confused on the command we should document for the log in step, would it be better as one of the following:

$ podman login -u openshift -p $(oc whoami -t) $(oc get route -n openshift-image-registry default-route -o jsonpath='{.status.ingress[*].host}{"\n"}')

podman login -u kubeadmin -p RDhLYKRgyw3JFpG4-9N9yBbLdGK4CtKeAc5aSjFuk3E image-registry.openshift-image-registry.svc:5000

podman login -u kubeadmin -p $(oc whoami -t) image-registry.openshift-image-registry.svc:5000

I vote for item #3.

Thanks again! :) Updated.

wzheng1 · 2019-05-22T02:52:33Z

modules/registry-accessing-directly.adoc

$ podman tag name.io/image image-registry.openshift-image-registry.svc:5000/openshift/image

wzheng1 · 2019-05-22T02:52:53Z

modules/registry-accessing-directly.adoc

$ podman tag name.io/image image-registry.openshift-image-registry.svc:5000/openshift/image

modules/registry-securing-manually.adoc

wzheng1 · 2019-05-22T02:54:58Z

modules/registry-securing-manually.adoc

wzheng1 · 2019-05-22T02:55:18Z

modules/registry-securing-manually.adoc

wzheng1 · 2019-05-22T03:30:29Z

modules/registry-securing-manually.adoc

@dmage whether above steps works in 4.x now?

wzheng1 · 2019-05-22T03:32:07Z

@bmcelvee comments added, some of them need @dmage double confirm.

sferich888 · 2019-05-22T10:25:31Z

modules/registry-accessing-directly.adoc

We should show a user how to validate they are an admin here!

dmage · 2019-05-22T12:52:48Z

modules/registry-accessing-directly.adoc

Why does it need to be an administrator?

@dmage What level of user do you need to be in order to access the registry? (I originally brought this content forward from 3.x, and am trying to clarify/update it.)

A regular user is fine.

dmage · 2019-05-22T13:13:13Z

modules/registry-accessing-directly.adoc

The assumptions of this article are not clear. If it assumes that all actions will be from outside of the cluster, then only external routes can be used. That's a good point that most likely the registry will have untrusted certificate.

dmage · 2019-05-22T13:20:41Z

modules/registry-securing-manually.adoc

I'd say we shouldn't recommend to secure the registry manually anymore. Inside the cluster it is secured by default. Outside of the cluster it can be accessed only through routes, which should have documentation about certificates and all this stuff.

bmcelvee · 2019-05-30T15:54:13Z

Preview build: http://file.rdu.redhat.com/~bmcelvee/20190529/registry/accessing-the-registry.html

adellape

LGTM, just some nits.

adellape · 2019-05-30T16:06:21Z

modules/registry-accessing-directly.adoc

Could this be a single step w/o a substep?

adellape · 2019-05-30T16:06:51Z

modules/registry-accessing-directly.adoc

Replaceable could be lowercase.

modules/registry-accessing-directly.adoc

adellape · 2019-05-30T16:07:37Z

modules/registry-accessing-directly.adoc

s/username/user name/

x2 in this para.

Also maybe semicolon instead: "You can pass any value for the user name; the token contains all necessary information."

wzheng1 · 2019-05-31T01:52:06Z

modules/registry-accessing-directly.adoc

This command should be:
$ podman push image-registry.openshift-image-registry.svc:5000/openshift/image

Sorry for missing it before.

Thanks so much, @wzheng1!

bmcelvee · 2019-05-31T16:58:23Z

All bugs moved to verified, and I pushed the final request. Merging the PR now, and we can make any additional edits in new PRs. Thanks!

bmcelvee added the branch/enterprise-4.1 label May 21, 2019

bmcelvee added this to the Future Release milestone May 21, 2019

openshift-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label May 21, 2019

bmcelvee force-pushed the bugs-registry-improvement branch 4 times, most recently from eacdf49 to 7bc78d0 Compare May 21, 2019 19:43

openshift-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels May 21, 2019

bmcelvee commented May 21, 2019

View reviewed changes

wzheng1 reviewed May 22, 2019

View reviewed changes

modules/registry-accessing-directly.adoc Outdated

Copy link

wzheng1 May 22, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

$ podman tag name.io/image image-registry.openshift-image-registry.svc:5000/openshift/image

wzheng1 reviewed May 22, 2019

View reviewed changes

modules/registry-accessing-directly.adoc Outdated

Copy link

wzheng1 May 22, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

$ podman tag name.io/image image-registry.openshift-image-registry.svc:5000/openshift/image

wzheng1 reviewed May 22, 2019

View reviewed changes

modules/registry-securing-manually.adoc Outdated Show resolved Hide resolved

wzheng1 reviewed May 22, 2019

View reviewed changes

modules/registry-securing-manually.adoc Outdated

Copy link

wzheng1 May 22, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here

wzheng1 reviewed May 22, 2019

View reviewed changes

modules/registry-securing-manually.adoc Outdated

Copy link

wzheng1 May 22, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here

wzheng1 reviewed May 22, 2019

View reviewed changes

modules/registry-securing-manually.adoc Outdated

Copy link

wzheng1 May 22, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dmage whether above steps works in 4.x now?

sferich888 reviewed May 22, 2019

View reviewed changes

modules/registry-accessing-directly.adoc Outdated

Copy link

Contributor

sferich888 May 22, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should show a user how to validate they are an admin here!

dmage reviewed May 22, 2019

View reviewed changes

bmcelvee force-pushed the bugs-registry-improvement branch 5 times, most recently from 0f38a72 to 1dcd584 Compare May 29, 2019 20:31

bmcelvee force-pushed the bugs-registry-improvement branch from 1dcd584 to 4d98c73 Compare May 30, 2019 13:15

adellape approved these changes May 30, 2019

View reviewed changes

adellape added the peer-review-done Signifies that the peer review team has reviewed this PR label May 30, 2019

bmcelvee force-pushed the bugs-registry-improvement branch from 4d98c73 to 975cc47 Compare May 30, 2019 17:43

wzheng1 reviewed May 31, 2019

View reviewed changes

Fixes bugs for registry content

18ee0ef

bmcelvee force-pushed the bugs-registry-improvement branch from 975cc47 to 18ee0ef Compare May 31, 2019 16:49

bmcelvee merged commit c1ea042 into openshift:enterprise-4.1 May 31, 2019

vikram-redhat modified the milestones: Future Release, OCP 4.1 GA Jun 3, 2019

Fixes bugs for registry content #14986

Fixes bugs for registry content #14986

Uh oh!

Conversation

bmcelvee commented May 21, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bmcelvee commented May 21, 2019

Uh oh!

bmcelvee commented May 21, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bmcelvee commented May 21, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wzheng1 May 22, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wzheng1 May 23, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wzheng1 May 27, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wzheng1 commented May 22, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bmcelvee commented May 21, 2019 •

edited

Loading

wzheng1 May 22, 2019 •

edited

Loading

wzheng1 May 23, 2019 •

edited

Loading

wzheng1 May 27, 2019 •

edited

Loading

adellape left a comment •

edited

Loading

wzheng1 May 31, 2019 •

edited

Loading