You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Configure built-in container registry for Azure Red Hat OpenShift 4
10
+
# Configure the built-in container registry for Azure Red Hat OpenShift 4
11
11
12
-
Azure Red Hat OpenShift provides an integrated container image registry called [OpenShift Container Registry (OCR)](https://docs.openshift.com/container-platform/4.5/registry/architecture-component-imageregistry.html) that adds the ability to automatically provision new image repositories on demand. This provides users with a built-in location for their application builds to push the resulting images.
12
+
Azure Red Hat OpenShift provides an [integrated container image registry](https://docs.openshift.com/container-platform/4.9/registry/index.html) that adds the ability to automatically provision new image repositories on demand. This provides users with a built-in location for their application builds to push the resulting images.
13
13
14
14
In this article, you'll configure the built-in container image registry for an Azure Red Hat OpenShift (ARO) 4 cluster. You'll learn how to:
15
15
16
16
> [!div class="checklist"]
17
-
> *Set up Azure AD
18
-
> *Set up OpenID Connect
19
-
> * Access the built-in container image registry
17
+
> *Authorize an identity to access to the registry
18
+
> *Access the built-in container image registry from inside the cluster
19
+
> * Access the built-in container image registry from outside the cluster
20
20
21
21
## Before you begin
22
22
23
-
This article assumed you have an existing ARO cluster. If you need an ARO cluster, see the ARO tutorial, [Create an Azure Red Hat OpenShift 4 cluster](./tutorial-create-cluster.md). Make sure to create the cluster with the `--pull-secret` argument to `az aro create`. This is necessary to configure Azure Active Directory authentication and the built-in container registry.
23
+
This article assumes you have an existing ARO cluster (see [Create an Azure Red Hat OpenShift 4 cluster](./tutorial-create-cluster.md)). If you would like to configure Azure AD integeration, make sure to create the cluster with the `--pull-secret` argument to `az aro create`.
24
24
25
-
Once you have your cluster, connect to the cluster by following the steps in [Connect to an Azure Red Hat OpenShift 4 cluster](./tutorial-connect-cluster.md).
26
-
* Be sure to follow the steps in "Install the OpenShift CLI" because we'll use the `oc` command later in this article.
27
-
* Make note of the cluster console URL, which looks like `https://console-openshift-console.apps.<random>.<region>.aroapp.io/`. The values for `<random>` and `<region>` will be used later in this article.
28
-
* Note the `kubeadmin` credentials. They will also be used later in this article.
25
+
> [!NOTE]
26
+
> [Configuring Azure AD Authentication](./configure-azure-ad-ui.md#configure-openshift-openid-authentication) for your cluster is the easiest way to interact with the internal registry from outside the cluster.
29
27
30
-
### Configure Azure Active Directory authentication
28
+
Once you have your cluster, [connect to the cluster](./tutorial-connect-cluster.md) by authenticating as the `kubeadmin` user.
31
29
32
-
Azure Active Directory (Azure AD) implements OpenID Connect (OIDC). OIDC lets you use Azure AD to sign in to the ARO cluster. Follow the steps in [Configure Azure Active Directory authentication](configure-azure-ad-cli.md) to set up your cluster.
30
+
## Configure authentication to the registry
33
31
34
-
## Access the built-in container image registry
32
+
For any identity (a cluster user, Azure AD user, or ServiceAccount) to access the internal registry, it must be granted permissions inside the cluster:
35
33
36
-
Now that you've set up the authentication methods to the ARO cluster, let's enable access to the built-in registry.
37
-
38
-
#### Define the Azure AD user to be an administrator
39
-
40
-
1. Sign in to the OpenShift web console from your browser using the credentials of an Azure AD user. We'll leverage the OpenShift OpenID authentication against Azure Active Directory to use OpenID to define the administrator.
41
-
42
-
1. Use an InPrivate, Incognito or other equivalent browser window feature to sign in to the console. The window will look different after having enabled OIDC.
43
-
44
-
:::image type="content" source="media/built-in-container-registry/oidc-enabled-login-window.png" alt-text="OpenID Connect enabled sign in window.":::
45
-
1. Select **AAD**
46
-
47
-
> [!NOTE]
48
-
> Take note of the username and password you use to sign in here. This username and password will function as an administrator for other actions in this and other articles.
49
-
2. Sign in with the OpenShift CLI by using the following steps. For discussion, this process is known as `oc login`.
50
-
1. At the right-top of the web console, expand the context menu of the signed-in user, then select **Copy Login Command**.
51
-
2. Sign in to a new tab window with the same user if necessary.
52
-
3. Select **Display Token**.
53
-
4. Copy the value listed below **Login with this token** to the clipboard and run it in a shell, as shown here.
34
+
As `kubeadmin`, execute the following commands:
35
+
```bash
36
+
# Note: replace "<user>" with the identity you need to access the registry
Logged into "https://api.aqlm62xm.rnfghf.aroapp.io:6443" as "kube:admin" using the token provided.
41
+
> [!Note]
42
+
> For cluster users and Azure AD users - this will be the same name you use to authenticate into the cluster. For OpenShift ServiceAccounts, format the name as `system:serviceaccount:<project>:<name>`
58
43
59
-
You have access to 57 projects, the list has been suppressed. You can list all projects with 'oc projects'
44
+
## Access the registry
60
45
61
-
Using project "default".
62
-
```
46
+
Now that you've configured authentication for the registry, you can interact with it:
63
47
64
-
3. Run `oc whoami`in the console and note the output as **\<aad-user>**. We'll use this value later in the article.
65
-
4. Sign out of the OpenShift web console. Select the button in the top right of the browser window labeled as the **\<aad-user>** and choose **Log Out**.
48
+
### From inside the cluster
66
49
50
+
If you need to access the registry from inside the cluster (e.g. you are running a CI/CD platform as Pods that will push/pull images to the registry), you can access the registry via its [ClusterIP Service](https://docs.openshift.com/container-platform/4.9/rest_api/network_apis/service-core-v1.html) at the fully qualified domain name `image-registry.openshift-image-registry.svc.cluster.local:5000`, which is accessible to all Pods within the cluster.
67
51
68
-
#### Grant the Azure AD user the necessary roles for registry interaction
52
+
###From outside the cluster
69
53
70
-
1. Sign in to the OpenShift web console from your browser using the `kubeadmin` credentials.
71
-
1. Sign in to the OpenShift CLI with the token for `kubeadmin` by following the steps for `oc login` above, but do them after signing in to the web console with `kubeadmin`.
72
-
1. Execute the following commands to enable the access to the built-in registry for the **aad-user**.
54
+
If your workflows require you access the internal registry from outside the cluster (e.g. you want to push/pull images from a developer's laptop, external CI/CD platform, and/or a different ARO cluster), you will need to perform a few additional steps:
73
55
56
+
As `kubeadmin`, execute the following commands to expose the built-in registry outside the cluster via a [Route](https://docs.openshift.com/container-platform/4.9/rest_api/network_apis/route-route-openshift-io-v1.html):
74
57
```bash
75
-
# Switch to project "openshift-image-registry"
76
-
oc project openshift-image-registry
77
-
78
-
# Output should look similar to the following.
79
-
# Now using project "openshift-image-registry" on server "https://api.x8xl3f4y.eastus.aroapp.io:6443".
oc get route -n openshift-image-registry default-route --template='{{ .spec.host }}'
103
67
```
104
68
105
-
#### Obtain the container registry URL
106
-
107
-
Use the `oc get route` command as shown next to get the container registry URL.
108
-
109
-
```bash
110
-
# Note: the value of "Container Registry URL" in the output is the fully qualified registry name.
111
-
HOST=$(oc get route default-route --template='{{ .spec.host }}')
112
-
echo "Container Registry URL: $HOST"
113
-
```
114
-
115
-
> [!NOTE]
116
-
> Note the console output of **Container Registry URL**. It will be used as the fully qualified registry name for this guide and subsequent ones.
117
-
118
69
## Next steps
119
70
120
71
Now that you've set up the built-in container image registry, you can get started by deploying an application on OpenShift. For Java applications, check out [Deploy a Java application with Open Liberty/WebSphere Liberty on an Azure Red Hat OpenShift 4 cluster](howto-deploy-java-liberty-app.md).
0 commit comments