OpenShift image registry 訪問鏡像

---

1. OpenShift 內部 image registry

Openshift 自帶內部 image registry，可通過 podman 實現 image 的 pull 和 push 操作。

對不同操作，需要給用戶指定相應的 role：

// podman pull 
oc policy add-role-to-user registry-viewer <user_name>

// podman push
oc policy add-role-to-user registry-editor <user_name>

使用用戶名 + token 的方式 login 內部 image registry:

$ podman login -u $(oc whoami) -p $(oc whoami -t) --tls-verify=false image-registry.openshift-image-registry.svc:5000
Login Succeeded!

通過 podman pull 拉取遠端 registy image(這里直接拉取的內部 registry image):

$ podman pull image-registry.openshift-image-registry.svc:5000/default/xxx:0.4.1

podman images 查看是否拉取 image 到本地:

$ podman images | grep default/lcmaas-engine
image-registry.openshift-image-registry.svc:5000/default/xxx   0.4.1    f7b265fd6c39  3 weeks ago    64.9 MB

對本地的 image 打 tag 並且 push 到內部 image registry：

$ podman tag image-registry.openshift-image-registry.svc:5000/default/xxx:0.4.1 image-registry.openshift-image-registry.svc:5000/luban/xxx:0.4.1

$ podman push image-registry.openshift-image-registry.svc:5000/luban/xxx:0.4.1

注意 podman images 看不到內部 image registry 存儲的 image，查看內部 image registry 存儲的 image 可通過 curl registry url 的方式查看：

$ curl -s -k -H "Authorization: Bearer $(oc whoami -t)" https://image-registry.openshift-image-registry.svc:5000/v2/_catalog | jq

$ env | grep http
https_proxy=http://10.158.xxx.xxx:8080/
http_proxy=http://10.158.xxx.xxx:8080/
$ unset https_proxy
$ unset http_proxy

$ curl -s -k -H "Authorization: Bearer $(oc whoami -t)" https://image-registry.openshift-image-registry.svc:5000/v2/_catalog | jq
{
  "repositories": [
    "luban/xxx1",
    "luban/xxx2",
	...

這里要注意 curl 訪問的是本地內部image registry 不需要走代理，如果設置了代理的話需要取消代理。

2. OpenShift 內部 insecure image registry

上節介紹的 image registry 是內部 secure 的，當訪問內部 insecure image registry 時會報錯 x509: certificate signed by unknown authority：

$ podman pull default-route-openshift-image-registry.apps.xxx.net/default/xxx-0.4.1:latest
Trying to pull default-route-openshift-image-registry.apps.xxx.net/default/xxx-0.4.1:latest...
Error: Error initializing source docker://default-route-openshift-image-registry.apps.xxx.net/default/xxx-0.4.1:latest: 
error pinging docker registry default-route-openshift-image-registry.xxx.net: 
Get "https://default-route-openshift-image-registry.apps.xxx.net/v2/": x509: certificate signed by unknown authority

解決方法可以從兩個角度入手：

1. 將 image registry 置為 secure。
2. 忽視 insecure 的證書檢查。

這里實踐了第二種將 registry 配成 insecure 。
在 /etc/containers/registries.conf 文件下，添加如下 registry field:

[[registry]]
location = "default-route-openshift-image-registry.apps.xxx.net"
insecure = true 

表示 location 定義的 registry 允許不安全的 HTTP 拉取。

詳細解釋可看 Podman添加私有鏡像源配置 registries.conf

繼續執行 podman pull insecure image registry：

$ podman pull default-route-openshift-image-registry.apps.xxx.net/default/xxx:0.4.1
Trying to pull default-route-openshift-image-registry.apps.xxx.net/default/xxx:0.4.1...
Getting image source signatures
Copying blob 298d29d50a74 [--------------------------------------] 0.0b / 0.0b
Copying config f7b265fd6c done
Writing manifest to image destination
Storing signatures
f7b265fd6c39b522c6c606eb49a124def7ff8bce8560ba83dfc83982eac00d53

拉取成功！

使用 kubernetes 部署 pod 並且指定 insecure image registry 看是否能拉取成功：

Events:
  Type     Reason                  Age                   From                     Message
  ----     ------                  ----                  ----                     -------
  Warning  Failed                  5m48s (x6 over 7m5s)  kubelet                  Error: ImagePullBackOff
  Normal   Pulling                 5m35s (x4 over 7m6s)  kubelet                  Pulling image "default-route-openshift-image-registry.apps.xxx.net/default/xxx:0.250.3554"
  Warning  Failed                  5m35s (x4 over 7m6s)  kubelet                  Failed to pull image "default-route-openshift-image-registry.apps.xxx.net/default/xxx:0.250.3554": rpc error: code = Unknown desc = pinging container registry default-route-openshift-image-registry.apps.xxx.net: Get "https://default-route-openshift-image-registry.apps.xxx.net/v2/": x509: certificate signed by unknown authority
  Warning  Failed                  5m35s (x4 over 7m6s)  kubelet                  Error: ErrImagePull
  Normal   BackOff                 114s (x22 over 7m5s)  kubelet                  Back-off pulling image "default-route-openshift-image-registry.apps.xxx.net/default/xxx:0.250.3554"

還是報 x509: certificate signed by unknown authority 錯誤。
猜測 containerd(OpenShift 安裝的 containerd 是 oci-o) 在 pull image 時報錯，解決方式應該是類似的，在 containerd 的配置文件中添加 insecure registry。這里就不繼續實踐了。

3. 參考文章

1. Trouble with insecure_registries
2. https://docs.docker.com/registry/insecure/
3. Failed to pull image with "x509: certificate signed by unknown authority" error
4. Accessing the registry
5. 向OpenShift內部Image Registry推送Image

---