Skip to content

Commit 67a7c45

Browse files
mburke5678mburke5678
authored
Merge pull request #33046 from mburke5678/BZ-1959599
BZ1959599: Imagepull errors rejected by policy while deploying application through catalog
2 parents 7bbd94e + af0e48a commit 67a7c45

File tree

5 files changed

+97
-46
lines changed

5 files changed

+97
-46
lines changed

‎modules/images-configuration-allowed.adoc‎

Lines changed: 81 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ When pulling or pushing images, the container runtime searches the registries li
1212

1313
[WARNING]
1414
====
15-
When the `allowedRegistries` parameter is defined, all registries, including the `registry.redhat.io` and `quay.io` registries, are blocked unless explicitly listed. If you use the parameter, to prevent pod failure, you must add `registry.redhat.io` and `quay.io` to the `allowedRegistries` list, as they are required by payload images within your environment. For disconnected clusters, mirror registries must also be added.
15+
When the `allowedRegistries` parameter is defined, all registries, including the `registry.redhat.io` and `quay.io` registries and the default internal image registry, are blocked unless explicitly listed. If you use the parameter, to prevent pod failure, add the `registry.redhat.io` and `quay.io` registries and the `internalRegistryHostname` to the `allowedRegistries` list, as they are required by payload images within your environment. For disconnected clusters, mirror registries should also be added.
1616
====
1717

1818
.Procedure
@@ -46,6 +46,7 @@ spec:
4646
- quay.io
4747
- registry.redhat.io
4848
- reg1.io/myrepo/myapp:latest
49+
- image-registry.openshift-image-registry.svc:5000
4950
status:
5051
internalRegistryHostname: image-registry.openshift-image-registry.svc:5000
5152
----
@@ -74,38 +75,84 @@ The following policy indicates that only images from the example.com, quay.io, a
7475
[source,terminal]
7576
----
7677
{
77-
"default": [{
78-
"type": "reject"
79-
}],
80-
"transports": {
81-
"atomic": {
82-
"example.com": [{
83-
"type": "insecureAcceptAnything"
84-
}],
85-
"quay.io": [{
86-
"type": "insecureAcceptAnything"
87-
}],
88-
"registry.redhat.io": [{
89-
"type": "insecureAcceptAnything"
90-
}]
91-
},
92-
"docker": {
93-
"example.com": [{
94-
"type": "insecureAcceptAnything"
95-
}],
96-
"quay.io": [{
97-
"type": "insecureAcceptAnything"
98-
}],
99-
"registry.redhat.io": [{
100-
"type": "insecureAcceptAnything"
101-
}]
102-
},
103-
"docker-daemon": {
104-
"": [{
105-
"type": "insecureAcceptAnything"
106-
}]
107-
}
108-
}
78+
"default":[
79+
{
80+
"type":"reject"
81+
}
82+
],
83+
"transports":{
84+
"atomic":{
85+
"example.com":[
86+
{
87+
"type":"insecureAcceptAnything"
88+
}
89+
],
90+
"image-registry.openshift-image-registry.svc:5000":[
91+
{
92+
"type":"insecureAcceptAnything"
93+
}
94+
],
95+
"insecure.com":[
96+
{
97+
"type":"insecureAcceptAnything"
98+
}
99+
],
100+
"quay.io":[
101+
{
102+
"type":"insecureAcceptAnything"
103+
}
104+
],
105+
"reg4.io/myrepo/myapp:latest":[
106+
{
107+
"type":"insecureAcceptAnything"
108+
}
109+
],
110+
"registry.redhat.io":[
111+
{
112+
"type":"insecureAcceptAnything"
113+
}
114+
]
115+
},
116+
"docker":{
117+
"example.com":[
118+
{
119+
"type":"insecureAcceptAnything"
120+
}
121+
],
122+
"image-registry.openshift-image-registry.svc:5000":[
123+
{
124+
"type":"insecureAcceptAnything"
125+
}
126+
],
127+
"insecure.com":[
128+
{
129+
"type":"insecureAcceptAnything"
130+
}
131+
],
132+
"quay.io":[
133+
{
134+
"type":"insecureAcceptAnything"
135+
}
136+
],
137+
"reg4.io/myrepo/myapp:latest":[
138+
{
139+
"type":"insecureAcceptAnything"
140+
}
141+
],
142+
"registry.redhat.io":[
143+
{
144+
"type":"insecureAcceptAnything"
145+
}
146+
]
147+
},
148+
"docker-daemon":{
149+
"":[
150+
{
151+
"type":"insecureAcceptAnything"
152+
}
153+
]
154+
}
155+
}
109156
}
110157
----
111158
====
@@ -127,5 +174,6 @@ spec:
127174
- quay.io
128175
- registry.redhat.io
129176
- insecure.com
177+
- image-registry.openshift-image-registry.svc:5000
130178
----
131179
====

‎modules/images-configuration-file.adoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ spec:
4343
- example.com
4444
- quay.io
4545
- registry.redhat.io
46+
- image-registry.openshift-image-registry.svc:5000
4647
insecureRegistries:
4748
- insecure.com
4849
status:

‎modules/images-configuration-insecure.adoc‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,16 +50,17 @@ spec:
5050
- registry.redhat.io
5151
- insecure.com <3>
5252
- reg4.io/myrepo/myapp:latest
53+
- image-registry.openshift-image-registry.svc:5000
5354
status:
5455
internalRegistryHostname: image-registry.openshift-image-registry.svc:5000
5556
----
5657
<1> Contains configurations that determine how the container runtime should treat individual registries when accessing images for builds and pods. It does not contain configuration for the internal cluster registry.
57-
<2> Specify an insecure registry, or optionally a repository in that regisstry.
58+
<2> Specify an insecure registry. You can specify a repository in that registry.
5859
<3> Ensure that any insecure registries are included in the `allowedRegistries` list.
5960
+
6061
[NOTE]
6162
====
62-
When the `allowedRegistries` parameter is defined, all registries, including the registry.redhat.io and quay.io registries, are blocked unless explicitly listed. If you use the parameter, to prevent pod failure, you must add `registry.redhat.io` and `quay.io` to the `allowedRegistries` list, as they are required by payload images within your environment. Do not add the `registry.redhat.io` and `quay.io` registries to the `blockedRegistries` list.
63+
When the `allowedRegistries` parameter is defined, all registries, including the registry.redhat.io and quay.io registries and the default internal image registry, are blocked unless explicitly listed. If you use the parameter, to prevent pod failure, add all registries including the `registry.redhat.io` and `quay.io` registries and the `internalRegistryHostname` to the `allowedRegistries` list, as they are required by payload images within your environment. For disconnected clusters, mirror registries should also be added.
6364
====
6465
+
6566
The Machine Config Operator (MCO) watches the `image.config.openshift.io/cluster` CR for any changes to the registries, then drains and uncordons the nodes when it detects changes. After the nodes return to the `Ready` state, changes to the insecure and blocked registries appear in the `/etc/containers/registries.conf` file on each node.

‎modules/images-configuration-parameters.adoc‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ Every element of this list contains a location of the registry specified by the
2727
The namespace for this config map is `openshift-config`. The format of the config map is to use the registry hostname as the key, and the PEM-encoded certificate as the value, for each additional registry CA to trust.
2828

2929
|`externalRegistryHostnames`
30-
|Provides the hostnames for the default external image registry. The external hostname should be set only when the image registry is exposed externally. The first value is used in `publicDockerImageRepository` field in image streams. The value must be in `hostname[:port]` format.
30+
|Provides the host names for the default external image registry. The external hostname should be set only when the image registry is exposed externally. The first value is used in `publicDockerImageRepository` field in image streams. The value must be in `hostname[:port]` format.
3131

3232
|`registrySources`
3333
|Contains configuration that determines how the container runtime should treat individual registries when accessing images for builds and
@@ -47,7 +47,7 @@ Either `blockedRegistries` or `allowedRegistries` can be set, but not both.
4747

4848
[WARNING]
4949
====
50-
When the `allowedRegistries` parameter is defined, all registries, including the `registry.redhat.io` and `quay.io` registries, are blocked unless explicitly listed. When using the parameter, to prevent pod failure, you must add `registry.redhat.io` and `quay.io` to the `allowedRegistries` list, as they are required by payload images within your environment. Do not add the `registry.redhat.io` and `quay.io` registries to the `blockedRegistries` list. For disconnected clusters, mirror registries must also be added.
50+
When the `allowedRegistries` parameter is defined, all registries, including `registry.redhat.io` and `quay.io` registries and the default internal image registry, are blocked unless explicitly listed. When using the parameter, to prevent pod failure, add all registries including the `registry.redhat.io` and `quay.io` registries and the `internalRegistryHostname` to the `allowedRegistries` list, as they are required by payload images within your environment. For disconnected clusters, mirror registries should also be added.
5151
====
5252

5353
The `status` field of the `image.config.openshift.io/cluster` resource holds observed values from the cluster.
@@ -60,6 +60,6 @@ The `status` field of the `image.config.openshift.io/cluster` resource holds obs
6060
|Set by the Image Registry Operator, which controls the `internalRegistryHostname`. It sets the hostname for the default internal image registry. The value must be in `hostname[:port]` format. For backward compatibility, you can still use the `OPENSHIFT_DEFAULT_REGISTRY` environment variable, but this setting overrides the environment variable.
6161

6262
|`externalRegistryHostnames`
63-
|Set by the Image Registry Operator, provides the external hostnames for the image registry when it is exposed externally. The first value is used in `publicDockerImageRepository` field in image streams. The values must be in `hostname[:port]` format.
63+
|Set by the Image Registry Operator, provides the external host names for the image registry when it is exposed externally. The first value is used in `publicDockerImageRepository` field in image streams. The values must be in `hostname[:port]` format.
6464

6565
|===

‎modules/images-configuration-shortname.adoc‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -57,16 +57,17 @@ spec:
5757
name: myconfigmap
5858
registrySources:
5959
containerRuntimeSearchRegistries: <1>
60-
- "reg1.io"
61-
- "reg2.io"
62-
- "reg3.io"
60+
- reg1.io
61+
- reg2.io
62+
- reg3.io
6363
allowedRegistries: <2>
6464
- example.com
6565
- quay.io
6666
- registry.redhat.io
67-
- "reg1.io"
68-
- "reg2.io"
69-
- "reg3.io"
67+
- reg1.io
68+
- reg2.io
69+
- reg3.io
70+
- image-registry.openshift-image-registry.svc:5000
7071
...
7172
status:
7273
internalRegistryHostname: image-registry.openshift-image-registry.svc:5000
@@ -76,10 +77,10 @@ status:
7677
+
7778
[NOTE]
7879
====
79-
When the `allowedRegistries` parameter is defined, all registries, including the `registry.redhat.io` and `quay.io` registries, are blocked unless explicitly listed. If you use this parameter, to prevent pod failure, you must add `registry.redhat.io` and `quay.io` to the `allowedRegistries` list, as they are required by payload images within your environment. Do not add the `registry.redhat.io` and `quay.io` registries to the `blockedRegistries` list.
80+
When the `allowedRegistries` parameter is defined, all registries, including the `registry.redhat.io` and `quay.io` registries and the default internal image registry, are blocked unless explicitly listed. If you use this parameter, to prevent pod failure, add all registries including the `registry.redhat.io` and `quay.io` registries and the `internalRegistryHostname` to the `allowedRegistries` list, as they are required by payload images within your environment. For disconnected clusters, mirror registries should also be added.
8081
====
8182

82-
. To check that the registries have been added, use the following command on a node:
83+
. To check that the registries have been added, when a node returns to the `Ready` state, use the following command on the node:
8384
+
8485
[source,terminal]
8586
----

0 commit comments

Comments
 (0)