84 lines
4.0 KiB
Plaintext
84 lines
4.0 KiB
Plaintext
---
|
|
title: Deploying a mirror registry
|
|
exercise: 4
|
|
date: '2023-12-20'
|
|
tags: ['openshift','containers','kubernetes','disconnected']
|
|
draft: false
|
|
authors: ['default']
|
|
summary: "Let's start mirroring some content on our high side!"
|
|
---
|
|
|
|
Images used by operators and platform components must be mirrored from upstream sources into a container registry that is accessible by the **High side**. You can use any registry you like for this as long as it supports Docker `v2-2`, such as:
|
|
- Red Hat Quay
|
|
- JFrog Artifactory
|
|
- Sonatype Nexus Repository
|
|
- Harbor
|
|
|
|
An OpenShift subscription includes access to the [mirror registry](https://docs.openshift.com/container-platform/4.14/installing/disconnected_install/installing-mirroring-creating-registry.html#installing-mirroring-creating-registry) for Red Hat OpenShift, which is a small-scale container registry designed specifically for mirroring images in disconnected installations. We'll make use of this option in this lab.
|
|
|
|
Mirroring all release and operator images can take awhile depending on the network bandwidth. For this lab, recall that we're going to mirror just the release images to save time and resources.
|
|
|
|
We should have the `mirror-registry` binary along with the required container images available on the bastion in `/mnt/high-side`. The `50GB` volume we created should be enough to hold our mirror (without operators) and binaries.
|
|
|
|
|
|
## 4.1 - Opening mirror registry port ingress
|
|
|
|
We are getting close to deploying a disconnected OpenShift cluster that will be spread across multiple machines which are in turn spread across our three private subnets.
|
|
|
|
Each of the machines in those private subnets will need to talk back to our mirror registry on port `8443` so let's quickly update our aws security group to ensure this will work.
|
|
|
|
> Note: We're going to allow traffic from all sources for simplicity (`0.0.0.0/0`), but this is likely to be more restrictive in real world environments:
|
|
|
|
```bash
|
|
SG_ID=$(aws ec2 describe-security-groups --filters "Name=tag:Name,Values=disco-sg" | jq -r '.SecurityGroups[0].GroupId')
|
|
|
|
aws ec2 authorize-security-group-ingress --group-id $SG_ID --protocol tcp --port 8443 --cidr 0.0.0.0/0
|
|
```
|
|
|
|
|
|
## 4.2 - Running the registry install
|
|
|
|
First, let's `ssh` back into the bastion:
|
|
|
|
```bash
|
|
ssh -t -i disco_key ec2-user@$PREP_SYSTEM_IP "ssh -t -i disco_key ec2-user@$HIGHSIDE_BASTION_IP"
|
|
```
|
|
|
|
And then we can kick off our install:
|
|
|
|
```bash
|
|
cd /mnt/high-side
|
|
./mirror-registry install --quayHostname $(hostname) --quayRoot /mnt/high-side/quay/quay-install --quayStorage /mnt/high-side/quay/quay-storage --pgStorage /mnt/high-side/quay/pg-data --initPassword discopass
|
|
```
|
|
|
|
If all goes well, you should see something like:
|
|
|
|
```text
|
|
INFO[2023-07-06 15:43:41] Quay installed successfully, config data is stored in /mnt/quay/quay-install
|
|
INFO[2023-07-06 15:43:41] Quay is available at https://ip-10-0-51-47.ec2.internal:8443 with credentials (init, discopass)
|
|
```
|
|
|
|
<Zoom>
|
|
| |
|
|
|:-----------------------------------------------------------------------------:|
|
|
| *Running the mirror-registry installer* |
|
|
</Zoom>
|
|
|
|
|
|
## 4.3 Logging into the mirror registry
|
|
|
|
Now that our registry is running let's login with `podman` which will generate an auth file at `/run/user/1000/containers/auth.json`.
|
|
|
|
```bash
|
|
podman login -u init -p discopass --tls-verify=false $(hostname):8443
|
|
```
|
|
> Note: We pass `--tls-verify=false` here for simplicity during this workshop, but you can optionally add `/mnt/high-side/quay/quay-install/quay-rootCA/rootCA.pem` to the system trust store by following the guide in the Quay documentation [here](https://access.redhat.com/documentation/en-us/red_hat_quay/3/html/manage_red_hat_quay/using-ssl-to-protect-quay?extIdCarryOver=true&sc_cid=701f2000001OH74AAG#configuring_the_system_to_trust_the_certificate_authority).
|
|
|
|
|
|
## 4.4 Pushing content into mirror registry
|
|
|
|
Now we're ready to mirror images from disk into the registry. Let's add oc and `oc-mirror` to the path:
|
|
|
|
|
|
|