Skip to content

Commit 085760e

Browse files
fmcdonalfmcdonal
committed
resolved conflict
created new image registry procedure for hcp under rosa resolved new conflict in hcp topic map added conditions for hcp :# This is the commit message openshift#5: update the :context to include hcp also removed 2 modules for short names and trust stores and added conditions for hcp fixed spacing and added n to an in the classic docs applied maggie chen comments from PR applied maggie chen suggestions of new modules added places need descriptions applied PR suggestions from Maggie, deleted insecure module and integrated describe with create module added dedicated attributes to the assembly readded dedicated attributes to the assembly added attributes before heading to capture the assembly title updated quote updated note changed the * to a . in verification changed the backticks applied andrea comments replaced steps with unnumbered bullets removed ref to controlplane in example output
1 parent 1485e08 commit 085760e

9 files changed

+409
-4
lines changed

‎_topic_maps/_topic_map_rosa.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -832,9 +832,12 @@ Topics:
832832
- Name: Triggering updates on image stream changes
833833
File: triggering-updates-on-imagestream-changes
834834
Distros: openshift-rosa
835-
- Name: Image configuration resources
835+
- Name: Image configuration resources (Classic)
836836
File: image-configuration
837837
Distros: openshift-rosa
838+
- Name: Image configuration resources (HCP)
839+
File: image-configuration-hcp
840+
Distros: openshift-rosa
838841
- Name: Using templates
839842
File: using-templates
840843
- Name: Using Ruby on Rails

‎_topic_maps/_topic_map_rosa_hcp.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -781,8 +781,10 @@ Topics:
781781
# - Name: Triggering updates on image stream changes
782782
# File: triggering-updates-on-imagestream-changes
783783
# Distros: openshift-rosa-hcp
784-
# - Name: Image configuration resources
784+
# - Name: Image configuration resources (Classic)
785785
# File: image-configuration
786+
# - Name: Image configuration resources (HCP)
787+
# File: image-configuration-classic-hcp
786788
# Distros: openshift-rosa-hcp
787789
# - Name: Using templates
788790
# File: using-templates

‎modules/images-configuration-file.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ status:
6363
<1> `Image`: Holds cluster-wide information about how to handle images. The canonical, and only valid name is `cluster`.
6464
<2> `allowedRegistriesForImport`: Limits the container image registries from which normal users may import images. Set this list to the registries that you trust to contain valid images, and that you want applications to be able to import from. Users with permission to create images or `ImageStreamMappings` from the API are not affected by this policy. Typically only cluster administrators have the appropriate permissions.
6565
<3> `additionalTrustedCA`: A reference to a config map containing additional certificate authorities (CA) that are trusted during image stream import, pod image pull, `openshift-image-registry` pullthrough, and builds. The namespace for this config map is `openshift-config`. The format of the config map is to use the registry hostname as the key, and the PEM certificate as the value, for each additional registry CA to trust.
66-
<4> `registrySources`: Contains configuration that determines whether the container runtime allows or blocks individual registries when accessing images for builds and pods. Either the `allowedRegistries` parameter or the `blockedRegistries` parameter can be set, but not both. You can also define whether or not to allow access to insecure registries or registries that allow registries that use image short names. This example uses the `allowedRegistries` parameter, which defines the registries that are allowed to be used. The insecure registry `insecure.com` is also allowed. The `registrySources` parameter does not contain configuration for the internal cluster registry.
66+
<4> `registrySources`: Contains configuration that determines whether the container runtime allows or blocks individual registries when accessing images for builds and pods. Either the `allowedRegistries` parameter or the `blockedRegistries` parameter can be set, but not both. You can also define whether or not to allow access to insecure registries or registries that allow registries that use image short names. This example uses the `allowedRegistries` parameter, which defines the registries that are allowed to be used. The insecure registry `insecure.com` is also allowed. The `registrySources` parameter does not contain configuration for the internal cluster registry.
6767
+
6868
[NOTE]
6969
====

‎modules/images-configuration-image-registry-settings-hcp.adoc‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * openshift_images/image-configuration-hcp.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="images-configuring-image-registry-settings-hcp_{context}"]
7+
= Configuring image registry settings for {hcp-title}
8+
9+
You can configure image registry settings at cluster creation. The cluster's nodes will use the required configuration after creation.
10+
11+
.Procedure
12+
13+
* Create {hcp-title} clusters with image registry by running the following command:
14+
15+
+
16+
[source,terminal]
17+
----
18+
$ rosa create cluster —cluster-name=<cluster_name> --sts --mode=auto \
19+
--hosted-cp --operator-roles-prefix <operator_role_prefix> \
20+
--oidc-config-id <id_of_oidc_configuration> \
21+
--subnet-ids=<public_subnet_id>,<private_subnet_id> \
22+
--registry-config-insecure-registries <insecure_registries> \
23+
--registry-config-allowed-registries <allowed_registries> \
24+
--registry-config-allowed-registries-for-import <registry_name:insecure> \
25+
--registry-config-additional-trusted-ca <additional_trusted_ca_file>
26+
----
27+
+
28+
[NOTE]
29+
====
30+
When using the `allowedRegistries`, `blockedRegistries`, or `insecureRegistries` parameter, you can specify an individual repository within a registry. For example: `reg1.io/myrepo/myapp:latest`.
31+
32+
Avoid insecure external registries to reduce possible security risks.
33+
Parameters `allowedRegistries`, `blockedRegistries` are mutually exclusive.
34+
====
35+
36+
.Verification
37+
38+
. Run the `rosa describe` command to verify that your image registry is enabled by running the following command:
39+
+
40+
[source,terminal]
41+
----
42+
$ rosa describe cluster --cluster=<cluster_name>
43+
----
44+
+
45+
.Example output
46+
[source,terminal]
47+
----
48+
Name: rosa-hcp-test
49+
Domain Prefix: rosa-hcp-test
50+
Display Name: rosa-hcp-test
51+
ID: <cluster_hcp_id>
52+
External ID: <cluster_hcp_id>
53+
Control Plane: ROSA Service Hosted
54+
OpenShift Version: 4.Y.Z
55+
Channel Group: stable
56+
DNS: <dns>
57+
AWS Account: <AWS_id>
58+
AWS Billing Account: <AWS_id>
59+
API URL: <ocm_api>
60+
Console URL:
61+
Region: us-east-1
62+
Availability:
63+
- Control Plane: MultiAZ
64+
- Data Plane: SingleAZ
65+
Nodes:
66+
- Compute (desired): 2
67+
- Compute (current): 2
68+
Network:
69+
- Type: OVNKubernetes
70+
- Service CIDR: <service_cidr>
71+
- Machine CIDR: <machine_cidr>
72+
- Pod CIDR: <pod_cidr>
73+
- Host Prefix: /23
74+
- Subnets: <subnet_ids>
75+
EC2 Metadata Http Tokens: optional
76+
Role (STS) ARN: arn:aws:iam::<AWS_id>:role/<account_roles_prefix>-HCP-ROSA-Installer-Role
77+
Support Role ARN: arn:aws:iam::<AWS_id>:role/<account_roles_prefix>-HCP-ROSA-Support-Role
78+
Instance IAM Roles:
79+
- Worker: arn:aws:iam::<AWS_id>:role/<account_roles_prefix>-HCP-ROSA-Worker-Role
80+
Operator IAM Roles:
81+
- arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-kube-system-capa-controller-manager
82+
- arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-kube-system-control-plane-operator
83+
- arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-kube-system-kms-provider
84+
- arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-openshift-image-registry-installer-cloud-cred
85+
- arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-openshift-ingress-operator-cloud-credentials
86+
- arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-openshift-cluster-csi-drivers-ebs-cloud-credent
87+
- arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-openshift-cloud-network-config-controller-cloud
88+
Managed Policies: Yes
89+
State: ready
90+
Private: No
91+
Delete Protection: Disabled
92+
Created: Oct 01 2030 09:48:52 UTC
93+
User Workload Monitoring: Enabled
94+
OIDC Endpoint URL: https://<endpoint> (Managed)
95+
Audit Log Forwarding: Disabled
96+
External Authentication: Disabled
97+
Etcd Encryption: Disabled
98+
Registry Configuration:
99+
- Allowed Registries: <allowed_registry> <1>
100+
- Insecure Registries: <insecure_registry> <2>
101+
- Allowed Registries for Import: <3>
102+
- Domain Name: <domain_name> <4>
103+
- Insecure: true <5>
104+
----
105+
<1> `Allowed Registries`: A comma-separated list of registries for which image pull and push actions are allowed.
106+
<2> `Insecure Registries`: A comma-separated list of registries which do not have a valid TLS certificate or only support HTTP connections.
107+
<3> `Allowed Registries for Import`: Limits the container image registries from which normal users can import images. The format should be a comma-separated list of `domainName:insecure`.
108+
<4> `domainName`: Specifies a domain name for the registry.
109+
<5> `insecure`: Indicates whether the registry is secure or insecure.
110+
111+
. List your nodes to check the applied changes by running the following command:
112+
+
113+
[source,terminal]
114+
----
115+
$ oc get nodes
116+
----
117+
+
118+
.Example output
119+
[source,terminal]
120+
----
121+
NAME STATUS ROLES AGE VERSION
122+
ip-10-0-137-182.us-east-2.compute.internal Ready,SchedulingDisabled worker 65m v1.30.3
123+
ip-10-0-188-96.us-east-2.compute.internal Ready worker 65m v1.30.3
124+
ip-10-0-200-59.us-east-2.compute.internal Ready worker 63m v1.30.3
125+
----

‎modules/images-configuration-parameters-hcp.adoc‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * openshift_images/image-configuration-hcp.adoc
4+
5+
[id="images-configuration-parameters-hcp_{context}"]
6+
= Image controller configuration parameters for {hcp-title}
7+
8+
The `image.config.openshift.io/cluster` resource holds cluster-wide information about how to handle images. The resource exists, but it is read only and can only be changed through supported tools like ROSA CLI (`rosa`). The canonical, and only valid name is `cluster`. It can be configured in {product-rosa} {hcp} through ROSA CLI (`rosa`) commands.
9+
10+
11+
[NOTE]
12+
====
13+
Parameters such as `DisableScheduledImport`, `MaxImagesBulkImportedPerRepository`, `MaxScheduledImportsPerMinute`, `ScheduledImageImportMinimumIntervalSeconds`, `InternalRegistryHostname` are not configurable.
14+
====
15+
16+
[cols="3a,8a",options="header"]
17+
|===
18+
|Parameters for ROSA CLI |Description
19+
20+
|`registry-config-allowed-registries`
21+
|Registries for which image pull and push actions are allowed. To specify all subdomains, add the asterisk (`\*`) wildcard character as a prefix to the domain name. For example, `*.example.com`. You can specify an individual repository within a registry. For example: `reg1.io/myrepo/myapp:latest`. All other registries are blocked. The format should be a comma-separated list of allowed registries. For example: `allowed.io, allowed.io2`
22+
23+
|`registry-config-insecure-registries`
24+
|Registries which do not have a valid TLS certificate or only support HTTP connections. To specify all subdomains, add the asterisk (`\*`) wildcard character as a prefix to the domain name. For example, `*.example.com`. You can specify an individual repository within a registry. For example: `reg1.io/myrepo/myapp:latest`. The format should be a comma-separated list of insecure registries. For example: `insecure.io, insecure.io2`
25+
26+
|`registry-config-blocked-registries`
27+
|Registries for which image pull and push actions are denied. To specify all subdomains, add the asterisk (`\*`) wildcard character as a prefix to the domain name. For example, `*.example.com`. You can specify an individual repository within a registry. For example: `reg1.io/myrepo/myapp:latest`. All other registries are allowed. The format should be a comma-separated list of blocked registries. For example: `blocked.io, blocked.io2`
28+
29+
|`registry-config-allowed-registries-for-import`
30+
|Contains configuration that determines how the container runtime should treat individual registries when accessing images for builds and pods. For example, whether or not to allow insecure access. It does not contain configuration for the internal cluster registry. Limits the container image registries from which normal users can import images. The format should be a comma-separated list of 'domainName:insecure'. 'domainName' specifies a domain name for the registry. 'insecure' indicates whether the registry is secure or insecure.
31+
32+
|`registry-config-additional-trusted-ca`
33+
|A json file containing the registry hostname as the key, and the PEM-encoded certificate as the value, for each additional registry CA to trust.
34+
35+
|`registry-config-platform-allowlist`
36+
|A list of Red{nbsp}Hat registries is automatically allowed. This list can be periodically updated and impacted clusters will receive a notification with the new allowlist id. In such case, user needs to use this parameter to update to the expected id to the expected one.
37+
38+
|===
39+
40+
[WARNING]
41+
====
42+
When the `allowedRegistries` parameter is defined, all registries, are blocked unless explicitly listed. To prevent pod failure, a list of Red Hat registries is automatically whitelisted, as they are required by payload images within your environment. The current list consists of `image-registry.openshift-image-registry.svc:5000,quay.io,registry.redhat.io` and it is also visible when running `rosa describe cluster`.
43+
====

‎modules/images-describing-image-registry-settings-hcp.adoc‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * openshift_images/image-configuration-hcp.adoc
4+
// * post_installation_configuration/preparing-for-users.adoc
5+
6+
:_mod-docs-content-type: PROCEDURE
7+
[id="images-describing-image-registry-settings-hcp_{context}"]
8+
= Describing image registry settings for {hcp-title}
9+
10+
11+
Description needed !!!!
12+
13+
.Procedure
14+
15+
. Describe {hcp-title} clusters with image registry:
16+
+
17+
[source,terminal]
18+
----
19+
$ rosa describe cluster -c <cluster_name>
20+
----
21+
+
22+
.Example output
23+
[source,terminal]
24+
----
25+
Name: rosa-hcp-test
26+
Domain Prefix: rosa-hcp-test
27+
Display Name: rosa-hcp-test
28+
ID: <cluster_id>
29+
External ID: <cluster_hcp-id>
30+
Control Plane: ROSA Service Hosted
31+
OpenShift Version: 4.17.0
32+
Channel Group: stable
33+
DNS: <dns>
34+
AWS Account: <AWS_id>
35+
AWS Billing Account: <AWS_id>
36+
API URL: <api>
37+
Console URL:
38+
Region: us-east-1
39+
Availability:
40+
- Control Plane: MultiAZ
41+
- Data Plane: SingleAZ
42+
43+
Nodes:
44+
- Compute (desired): 2
45+
- Compute (current): 2
46+
Network:
47+
- Type: OVNKubernetes
48+
- Service CIDR: <service_cidr>
49+
- Machine CIDR: <machine_cidr>
50+
- Pod CIDR: <pod_cidr>
51+
- Host Prefix: /23
52+
- Subnets: <subnet_ids>
53+
EC2 Metadata Http Tokens: optional
54+
Role (STS) ARN: arn:aws:iam::<AWS_id>:role/<account_roles_prefix>-HCP-ROSA-Installer-Role
55+
Support Role ARN: arn:aws:iam::<AWS_id>:role/<account_roles_prefix>-HCP-ROSA-Support-Role
56+
Instance IAM Roles:
57+
- Worker: arn:aws:iam::<AWS_id>:role/<account_roles_prefix>-HCP-ROSA-Worker-Role
58+
Operator IAM Roles:
59+
- arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-kube-system-capa-controller-manager
60+
- arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-kube-system-control-plane-operator
61+
- arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-kube-system-kms-provider
62+
- arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-openshift-image-registry-installer-cloud-cred
63+
- arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-openshift-ingress-operator-cloud-credentials
64+
- arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-openshift-cluster-csi-drivers-ebs-cloud-credent
65+
- arn:aws:iam::<AWS_id>:role/<operator_roles_prefix>-openshift-cloud-network-config-controller-cloud
66+
Managed Policies: Yes
67+
State: ready
68+
Private: No
69+
Delete Protection: Disabled
70+
Created: Oct 1 2024 09:48:52 EDT
71+
User Workload Monitoring: Enabled
72+
OIDC Endpoint URL: https://<endpoint> (Managed)
73+
Audit Log Forwarding: Disabled
74+
External Authentication: Disabled
75+
Etcd Encryption: Disabled
76+
Registry Configuration:
77+
- Allowed Registries: <1>
78+
- Blocked Registries: block.com <2>
79+
- Insecure Registries: insecure.com
80+
- Allowed Registries for Import:
81+
- Domain Name: quay.io
82+
- Insecure: true
83+
- Platform Allowlist: 2e0auar98h9ajmd6ndlmlqr5lsibkm4v
84+
- Registries: image-registry.openshift-image-registry.svc:5000,quay.io,registry.redhat.io
85+
----
86+
87+
// Description needed <1> .....
88+
// Description needed <2> .....

0 commit comments

Comments
 (0)