Bug Clarify "Mirror Registry Configuration" doc
Documentation now states how configuring the mirror registry
affects the discovery image's ignition config and the
install-config.yaml file used to install a cluster.
The limitation where the registries.conf mirroring must be repo
scope and not registry scope is explained.
Closes:
@@ -220,17 +220,21 @@ oc rollout restart deployment/assisted-service
### Mirror Registry Configuration
-In case user wants to create an installation that uses mirror registry, the following must be executed:
-1. Create and upload a ConfigMap that will include the following keys:
- ca-bundle.crt - contents of the certificate for accessing the mirror registry. I may be a certificate bundle, but it is still one string
- registries.conf - contents of the registries.conf file that configures mapping to the mirror registry.
+A ConfigMap can be used to configure assisted service to create installations using a mirror registry. The ConfigMap contains two keys:
+
+- *ca-bundle.crt* - This key contains the contents of the certificate for accessing the mirror registry. It may be a certificate bundle and is defined as a single string.
+- *registries.conf* - This key contains the contents of the registries.conf file that configures mappings to the mirror registry.
+
+The mirror registry configuration changes the discovery image's ignition config, with *ca-bundle.crt* written out to */etc/pki/ca-trust/source/anchors/domain.crt* and with *registries.conf* written out to */etc/containers/registries.conf*. The configuration also changes the *install-config.yaml* file used to install a new cluster, with the contents of *ca-bundle.crt* added to *additionalTrustBundle* and with the registries defined *registries.conf* added to *imageContentSources* as mirrors.
+
+1. To configure the mirror registry, first create and upload the ConfigMap containing the *ca-bundle.crt* and *registries.conf* keys.
``` bash
cat <<EOF | kubectl create -f -
apiVersion: v1
kind: ConfigMap
metadata:
- name: mirror-registry-ca
+ name: mirror-registry-config-map
namespace: "assisted-installer"
labels:
app: assisted-service
@@ -249,15 +253,30 @@ data:
mirror-by-digest-only = false
[[registry.mirror]]
- location = "bm-cluster-1-hyper.e2e.bos.redhat.com:5000/ocpmetal"
+ location = "mirror1.registry.corp.com:5000/ocpmetal"
EOF
```
- Note1: ConfigMap should be installed in the same namespace as the assisted-service-operator (ie. `assisted-installer`).
+**NOTE**
+
+The ConfigMap should be installed in the same namespace as the assisted-service-operator (ie. `assisted-installer`).
+
+Registries defined in the *registries.conf* file should use "mirror-by-digest-only = false" mode.
+
+Registries defined in the *registries.conf* must be scoped by repository and not by registry. In the above example, *quay.io/ocpmetal* and *mirror1.registry.corp.com:5000/ocpmetal* are both scoped by the *ocpmetal* repository and this is a valid configuration. In the example below, removing the repository *ocpmetal* from location is an invalid configuration and will not pass openshift-installer validation:
- Note2: registry.conf supplied should use "mirror-by-digest-only = false" mode
+```
+# invalid configuration
+ [[registry]]
+ prefix = ""
+ location = "quay.io"
+ mirror-by-digest-only = false
+
+ [[registry.mirror]]
+ location = "mirror1.registry.corp.com:5000"
+```
-2. set the mirrorRegistryRef in the spec of AgentServiceConfig to the name of uploaded ConfigMap. Example:
+2. Then set the mirrorRegistryRef in the spec of AgentServiceConfig to the name of uploaded ConfigMap. Example:
``` bash
cat <<EOF | kubectl apply -f -
@@ -279,7 +298,7 @@ spec:
requests:
storage: 20Gi
mirrorRegistryRef:
- name: mirrorRegistyMap
+ name: mirror-registry-config-map
EOF
```
