Skip to content

Commit 13481e5

Browse files
stevsmitstevsmit
authored
Merge pull request #69024 from stevsmit/OSDOCS-8925
Adds procedures for configuring private storage endpoints with Azure
2 parents 6809b88 + 741e5bc commit 13481e5

5 files changed

+349
-0
lines changed

‎modules/configuring-private-storage-endpoint-azure-user-provided-vnet-subnet.adoc

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * post_installation_configuration/configuring-private-cluster.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="configuring-private-storage-endpoint-azure-user-provided-vnet-subnet_{context}"]
7+
= Configuring a private storage endpoint on Azure with user-provided VNet and subnet names
8+
9+
Use the following procedure to configure a storage account that has public network access disabled and is exposed behind a private storage endpoint on Azure.
10+
11+
.Prerequisites
12+
13+
* You have configured the image registry to run on Azure.
14+
* You must know the VNet and subnet names used for your Azure environment.
15+
* If your network was configured in a separate resource group in Azure, you must also know its name.
16+
17+
.Procedure
18+
19+
. Edit the Image Registry Operator `config` object and configure the private endpoint using your VNet and subnet names:
20+
+
21+
[source,terminal]
22+
----
23+
$ oc edit configs.imageregistry/cluster
24+
----
25+
+
26+
[source,terminal]
27+
----
28+
# ...
29+
spec:
30+
# ...
31+
storage:
32+
azure:
33+
# ...
34+
networkAccess:
35+
type: Internal
36+
internal:
37+
subnetName: <subnet_name>
38+
vnetName: <vnet_name>
39+
networkResourceGroupName: <network_resource_group_name>
40+
# ...
41+
----
42+
43+
. Optional: Enter the following command to confirm that the Operator has completed provisioning. This might take a few minutes.
44+
+
45+
[source,terminal]
46+
----
47+
$ oc get configs.imageregistry/cluster -o=jsonpath="{.spec.storage.azure.privateEndpointName}" -w
48+
----
49+
+
50+
[NOTE]
51+
====
52+
When redirect is enabled, pulling images from outside of the cluster will not work.
53+
====
54+
55+
.Verification
56+
57+
. Fetch the registry service name by running the following command:
58+
+
59+
[source,terminal]
60+
----
61+
$ oc registry info --internal=true
62+
----
63+
+
64+
.Example output
65+
+
66+
[source,terminal]
67+
----
68+
image-registry.openshift-image-registry.svc:5000
69+
----
70+
71+
. Enter debug mode by running the following command:
72+
+
73+
[source,terminal]
74+
----
75+
$ oc debug node/<node_name>
76+
----
77+
78+
. Run the suggested `chroot` command. For example:
79+
+
80+
[source,terminal]
81+
----
82+
$ chroot /host
83+
----
84+
85+
. Enter the following command to log in to your container registry:
86+
+
87+
[source,terminal]
88+
----
89+
$ podman login --tls-verify=false -u unused -p $(oc whoami -t) image-registry.openshift-image-registry.svc:5000
90+
----
91+
+
92+
.Example output
93+
+
94+
[source,terminal]
95+
----
96+
Login Succeeded!
97+
----
98+
99+
. Enter the following command to verify that you can pull an image from the registry:
100+
+
101+
[source,terminal]
102+
----
103+
$ podman pull --tls-verify=false image-registry.openshift-image-registry.svc:5000/openshift/tools
104+
----
105+
+
106+
.Example output
107+
+
108+
[source,terminal]
109+
----
110+
Trying to pull image-registry.openshift-image-registry.svc:5000/openshift/tools/openshift/tools...
111+
Getting image source signatures
112+
Copying blob 6b245f040973 done
113+
Copying config 22667f5368 done
114+
Writing manifest to image destination
115+
Storing signatures
116+
22667f53682a2920948d19c7133ab1c9c3f745805c14125859d20cede07f11f9
117+
----

‎modules/configuring-private-storage-endpoint-azure-vnet-subnet-iro-discovery.adoc

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * post_installation_configuration/configuring-private-cluster.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="configuring-private-storage-endpoint-azure-vnet-subnet-iro-discovery_{context}"]
7+
= Configuring a private storage endpoint on Azure by enabling the Image Registry Operator to discover VNet and subnet names
8+
9+
The following procedure shows you how to set up a private storage endpoint on Azure by configuring the Image Registry Operator to discover VNet and subnet names.
10+
11+
.Prerequisites
12+
13+
* You have configured the image registry to run on Azure.
14+
* Your network has been set up using the Installer Provisioned Infrastructure installation method.
15+
+
16+
For users with a custom network setup, see "Configuring a private storage endpoint on Azure with user-provided VNet and subnet names".
17+
18+
.Procedure
19+
20+
. Edit the Image Registry Operator `config` object and set `networkAccess.type` to `Internal`:
21+
+
22+
[source,terminal]
23+
----
24+
$ oc edit configs.imageregistry/cluster
25+
----
26+
+
27+
[source,terminal]
28+
----
29+
# ...
30+
spec:
31+
# ...
32+
storage:
33+
azure:
34+
# ...
35+
networkAccess:
36+
type: Internal
37+
# ...
38+
----
39+
40+
. Optional: Enter the following command to confirm that the Operator has completed provisioning. This might take a few minutes.
41+
+
42+
[source,terminal]
43+
----
44+
$ oc get configs.imageregistry/cluster -o=jsonpath="{.spec.storage.azure.privateEndpointName}" -w
45+
----
46+
47+
. Optional: If the registry is exposed by a route, and you are configuring your storage account to be private, you must disable redirect if you want pulls external to the cluster to continue to work. Enter the following command to disable redirect on the Image Operator configuration:
48+
+
49+
[source,terminal]
50+
----
51+
$ oc patch configs.imageregistry cluster --type=merge -p '{"spec":{"disableRedirect": true}}'
52+
----
53+
+
54+
[NOTE]
55+
====
56+
When redirect is enabled, pulling images from outside of the cluster will not work.
57+
====
58+
59+
.Verification
60+
61+
. Fetch the registry service name by running the following command:
62+
+
63+
[source,terminal]
64+
----
65+
$ oc registry info --internal=true
66+
----
67+
+
68+
.Example output
69+
+
70+
[source,terminal]
71+
----
72+
image-registry.openshift-image-registry.svc:5000
73+
----
74+
75+
. Enter debug mode by running the following command:
76+
+
77+
[source,terminal]
78+
----
79+
$ oc debug node/<node_name>
80+
----
81+
82+
. Run the suggested `chroot` command. For example:
83+
+
84+
[source,terminal]
85+
----
86+
$ chroot /host
87+
----
88+
89+
. Enter the following command to log in to your container registry:
90+
+
91+
[source,terminal]
92+
----
93+
$ podman login --tls-verify=false -u unused -p $(oc whoami -t) image-registry.openshift-image-registry.svc:5000
94+
----
95+
+
96+
.Example output
97+
+
98+
[source,terminal]
99+
----
100+
Login Succeeded!
101+
----
102+
103+
. Enter the following command to verify that you can pull an image from the registry:
104+
+
105+
[source,terminal]
106+
----
107+
$ podman pull --tls-verify=false image-registry.openshift-image-registry.svc:5000/openshift/tools
108+
----
109+
+
110+
.Example output
111+
+
112+
[source,terminal]
113+
----
114+
Trying to pull image-registry.openshift-image-registry.svc:5000/openshift/tools/openshift/tools...
115+
Getting image source signatures
116+
Copying blob 6b245f040973 done
117+
Copying config 22667f5368 done
118+
Writing manifest to image destination
119+
Storing signatures
120+
22667f53682a2920948d19c7133ab1c9c3f745805c14125859d20cede07f11f9
121+
----

‎modules/disabling-redirect-private-storage-endpoint-azure.adoc

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * post_installation_configuration/configuring-private-cluster.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="disabling-redirect-private-storage-endpoint-azure_{context}"]
7+
= Optional: Disabling redirect when using a private storage endpoint on Azure
8+
9+
By default, redirect is enabled when using the image registry. Redirect allows off-loading of traffic from the registry pods into the object storage, which makes pull faster. When redirect is enabled and the storage account is private, users from outside of the cluster are unable to pull images from the registry.
10+
11+
In some cases, users might want to disable redirect so that users from outside of the cluster can pull images from the registry.
12+
13+
Use the following procedure to disable redirect.
14+
15+
.Prerequisites
16+
17+
* You have configured the image registry to run on Azure.
18+
* You have configured a route.
19+
20+
.Procedure
21+
22+
* Enter the following command to disable redirect on the image
23+
registry configuration:
24+
+
25+
[source,terminal]
26+
----
27+
$ oc patch configs.imageregistry cluster --type=merge -p '{"spec":{"disableRedirect": true}}'
28+
----
29+
30+
.Verification
31+
32+
. Fetch the registry service name by running the following command:
33+
+
34+
[source,terminal]
35+
----
36+
$ oc registry info
37+
----
38+
+
39+
.Example output
40+
+
41+
[source,terminal]
42+
----
43+
default-route-openshift-image-registry.<cluster_dns>
44+
----
45+
46+
. Enter the following command to log in to your container registry:
47+
+
48+
[source,terminal]
49+
----
50+
$ podman login --tls-verify=false -u unused -p $(oc whoami -t) default-route-openshift-image-registry.<cluster_dns>
51+
----
52+
+
53+
.Example output
54+
+
55+
[source,terminal]
56+
----
57+
Login Succeeded!
58+
----
59+
60+
. Enter the following command to verify that you can pull an image from the registry:
61+
+
62+
[source,terminal]
63+
----
64+
$ podman pull --tls-verify=false default-route-openshift-image-registry.<cluster_dns>
65+
/openshift/tools
66+
----
67+
+
68+
.Example output
69+
+
70+
[source,terminal]
71+
----
72+
Trying to pull default-route-openshift-image-registry.<cluster_dns>/openshift/tools...
73+
Getting image source signatures
74+
Copying blob 6b245f040973 done
75+
Copying config 22667f5368 done
76+
Writing manifest to image destination
77+
Storing signatures
78+
22667f53682a2920948d19c7133ab1c9c3f745805c14125859d20cede07f11f9
79+
----

‎modules/registry-configuring-private-storage-endpoint-azure.adoc

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * post_installation_configuration/configuring-private-cluster.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="registry-configuring-private-storage-endpoint-azure_{context}"]
7+
= Configuring a private storage endpoint on Azure
8+
9+
You can leverage the Image Registry Operator to use private endpoints on Azure, which enables seamless configuration of private storage accounts when {product-title} is deployed on private Azure clusters. This allows you to deploy the image registry without exposing public-facing storage endpoints.
10+
11+
You can configure the Image Registry Operator to use private storage endpoints on Azure in one of two ways:
12+
13+
* By configuring the Image Registry Operator to discover the VNet and subnet names
14+
15+
* With user-provided Azure Virtual Network (VNet) and subnet names
16+
17+
[id="limitations-configuring-private-storage-endpoint-azure"]
18+
== Limitations for configuring a private storage endpoint on Azure
19+
20+
The following limitations apply when configuring a private storage endpoint on Azure:
21+
22+
* When configuring the Image Registry Operator to use a private storage endpoint, public network access to the storage account is disabled. Consequently, pulling images from the registry outside of {product-title} only works by setting `disableRedirect: true` in the registry Operator configuration. With redirect enabled, the registry redirects the client to pull images directly from the storage account, which will no longer work due to disabled public network access. For more information, see "Disabling redirect when using a private storage endpoint on Azure".
23+
24+
* This operation cannot be undone by the Image Registry Operator.

‎post_installation_configuration/configuring-private-cluster.adoc

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,11 @@ include::modules/private-clusters-setting-ingress-private.adoc[leveloffset=+1]
1717
include::modules/private-clusters-setting-api-private.adoc[leveloffset=+1]
1818

1919
include::modules/nw-ingresscontroller-change-internal.adoc[leveloffset=+2]
20+
21+
include::modules/registry-configuring-private-storage-endpoint-azure.adoc[leveloffset=+1]
22+
23+
include::modules/configuring-private-storage-endpoint-azure-vnet-subnet-iro-discovery.adoc[leveloffset=+2]
24+
25+
include::modules/configuring-private-storage-endpoint-azure-user-provided-vnet-subnet.adoc[leveloffset=+2]
26+
27+
include::modules/disabling-redirect-private-storage-endpoint-azure.adoc[leveloffset=+2]

0 commit comments

Comments
 (0)