redhat 镜像_关于Openshift镜像仓库的进一步解释

在前述章节中，通过离线安装方式Openshift4支持在线升级。

具体链接：

https://mp.weixin.qq.com/s/vlpmDINHCRMckiy_2hakcg

在升级4.5.11过程中，发现系统升级报错，具体表现为镜像拉取失败。

初步分析原因怀疑出在本地镜像仓库上，在本次集群安装过程中，选择了适合企业大部分场景下的离线安装方式。

点火配置中所填的是本地仓库地址registry.cj.io:5000，而本地仓库只有当初离线安装的4.5.6OCP镜像，而无4.5.11版本的OCP核心镜像。

为了把问题说清楚，在此将Openshift镜像仓库的进一步解释。具体总结成下图。

开始进行实际操作，直接从远端镜像拉取4.5.11至本地镜像。

oc adm release mirror -a /data/OCP-Install/ocp/secret/redhat-secret.json --from=quay.io/openshift-release-dev/ocp-release:4.5.11-x86_64 --to=registry.cj.io:5000/ocp4/openshift4 --to-release-image=registry.cj.io:5000/ocp4/openshift4:4.5.11-x86_64

# 第一阶段，从quay.io拉取镜像实际操作正确

info: Mirroring 110 images to registry.cj.io:5000/ocp4/openshift4 ...
registry.cj.io:5000/
  ocp4/openshift4
    blobs:
      quay.io/openshift-release-dev/ocp-release sha256:88393751a73925792309cd9b7a0a42d76aaa8b436a544a98c03fa0db65a8c222 1.648KiB
      quay.io/openshift-release-dev/ocp-release sha256:74cbb6607642df5f9f70e8588e3c56d6de795d1a9af22866ea4cc82f2dad4f14 1.68KiB
      quay.io/openshift-release-dev/ocp-release sha256:ba39e3a683d0cd66eb9f8d9c388bd98b030185ba1b8cb51f08c070cb7bd0b9a5 278.8KiB
      quay.io/openshift-release-dev/ocp-release sha256:9ebdc795180d997ec9611acb8a453717f63fa2227b003db6c7cc911482e3e43d 3.347MiB
      quay.io/openshift-release-dev/ocp-release sha256:4406a9beeab462c05c8e03f0c6eccd2902cb4cde00caee21cf13ff6dfaab53f4 9.145MiB
      quay.io/openshift-release-dev/ocp-release sha256:012ac4d0928c5518903573d7665e38c8a9d6e3a8db89539eaff4601e3ad25589 18.65MiB
      quay.io/openshift-release-dev/ocp-release sha256:c9fa7d57b9028d4bd02b51cef3c3039fa7b23a8b2d9d26a6ce66b3428f6e2457 72.71MiB
    blobs:
      quay.io/openshift-release-dev/ocp-v4.0-art-dev sha256:4caa313f42d5b2412ef3f474957509b4d9f880d0fd789ae92996406b47cfbaa0 629B
      quay.io/openshift-release-dev/ocp-v4.0-art-dev sha256:47db82df7f3f4393c1f19c362a2db2c47ca049b6fb20bef041dfc9bdb12a4504 1.678KiB
      quay.io/openshift-release-dev/ocp-v4.0-art-dev sha256:74cbb6607642df5f9f70e8588e3c56d6de795d1a9af22866ea4cc82f2dad4f14 1.68KiB
      quay.io/openshift-release-dev/ocp-v4.0-art-dev sha256:e7021e0589e97471d99c4265b7c8e64da328e48f116b5f260353b2e0a2adb373 1.703KiB
# 第二阶段，在上传镜像仓库时候出现无法将镜像推送到本地仓库
error: unable to upload blob sha256:ca6c623df44fe7cb973ad3ce9d441dacd57525173353435df0e9be90e8a824d7 to registry.cj.io:5000/ocp4/openshift4: Post https://registry.cj.io:5000/v2/ocp4/openshift4/blobs/uploads/: no basic auth credentials
error: unable to push quay.io/openshift-release-dev/ocp-v4.0-art-dev: failed to upload blob sha256:7052c10be709245ff26386283d72e9da6fe23f07765d11ca43bd2547a803a0ee: Post https://registry.cj.io:5000/v2/ocp4/openshift4/blobs/uploads/: no basic auth credentials

上述问题在于本地镜像仓库的登录凭证上，上个命令的登录凭证是选择了redhat-secret.json，显然无法访问本地仓库。

事实上，按照前述章节，本地已有两个登录凭证，

[root@support secret]$ll /data/OCP-Install/ocp/secret/
total 12
-rw-r--r--. 1 root root 2719 Oct  3 23:20 pull-secret.txt
-rwx---r-x. 1 root root 2835 Oct  3 23:20 redhat-secret.json
-rwxr-xr-x. 1 root root   87 Oct  3 16:27 registry-secret.json

redhat-secret.json是通过pull-secret.txt序列化后，用于访问quay.io远端仓库，registry-secret.json是本地仓库的访问凭证。

[root@support ~]$cat /data/OCP-Install/ocp/secret/redhat-secret.json 
{
  "auths": {
    "cloud.openshift.com": {
      "auth": "b3BlbnNoaWZ0LXJlbGVhc2UtZGV2K29jbV9hY2Nlc3NfNzI5MzAyNjA4OTc4NGMxNTlmMzE4NTUwOWY0ODk1NmY6RE1XSlYyRTdYMTNNMTFKUThHNzY4VEdLSEY5WlhDSk9VUUpNQ1A2QldFRzhDMkMzVUFBTDdLTDI0Q0tVMjROWA==",
      "email": "21802259@qq.com"
    },
    "quay.io": {
      "auth": "b3BlbnNoaWZ0LXJlbGVhc2UtZGV2K29jbV9hY2Nlc3NfNzI5MzAyNjA4OTc4NGMxNTlmMzE4NTUwOWY0ODk1NmY6RE1XSlYyRTdYMTNNMTFKUThHNzY4VEdLSEY5WlhDSk9VUUpNQ1A2QldFRzhDMkMzVUFBTDdLTDI0Q0tVMjROWA==",
      "email": "21802259@qq.com"
    },
    "registry.connect.redhat.com": {
      "auth": "fHVoYy0xaGpKb0JuWTd3OHFGQzZtNmNGUXJ0UmY1VXk6ZXlKaGJHY2lPaUpTVXpVeE1pSjkuZXlKemRXSWlPaUkxTkRVMFltUmtNR1UzWlRjME1EQmpZalpqWkRSaU1ETmhPR0ZsWVRCa01DSjkuanZGZ3c2bnVaVnNpUlZlMXhnaWgxR3ZuMjJoZVozRGdHcF94UnVaLWRMQlVHSFdyRWNYM2h0bWdmN2xJYXFtWTllZ09LVmlyWFBUaEI5RTFVLTJSbzNUa0RXM0NWcDNQUFpBelRSam90alFYeE1zX09YRE9zb0M1elNMYXNxTHB2VUpsVFY0MWRYWHNsOVBoMDA1SHY1RjlCeVd6ZEhnWU8zakhFTFhDOWpPeUlmRG5CZlhBbFdzclRORllEM19Jd3BzZFZpcDlUV1ZQemtTMUM3UFhYbldnamFILW9ZNVl6UHhLN3FLblRfQU5IbWVBYmNZcWxMVWZYTEg3U3VtSzg5T0dYZ0oyNXdOTXJLc2JMcHM4bTl2RnRxcm9ZclQ5V1o5R3EzTXJyck5iemRFUHNSbkRwOXZTc3ZYcDgxSFZfRmVuVVBJVGIxMjJGRWRKTW9LY2dyMGd2U3A2dzVCbGhLYVpYZVcwRVVESW9VdjVzRGdNdHNoWVlBUUthQjRhRlVzdGJGMm1iZUlhWl96M1V0aEFiRUtVUjA2Vm16QUV4NFl1S0ptb0pxRmJUSGkyMTVzS216b081VHJpVVdhVTBHMnZBNWx3bUp2aFc4UkNBR3I4OFhUTDBFNGowMC14cXpZVkhzdHduZWI4Uk5BQXBHQ0c4ZjRNLXBEQVFWVGdGbTNaRzE5R0pPM3N1TFFYUmFNS3pCS1JMdmMyUm5OYXRxRmlOYlBONlQ4dEx6UWtQcGpuMG9neU5vdE9xb1l1cUg2ODhpWV8tdjFOOXV1NDFZSEdheUM5T0NFQ3ZzQmVfS0V6b1UyUkJ0WVlsSmlaZTVaTVVwb2IxS3VTNTl4UVQzR3gyMWhLVkdjOXFNNlFpVGhrVEVyeGVlUENXYTVRa1ZSVUVFREpPUms=",
      "email": "21802259@qq.com"
    },
    "registry.redhat.io": {
      "auth": "fHVoYy0xaGpKb0JuWTd3OHFGQzZtNmNGUXJ0UmY1VXk6ZXlKaGJHY2lPaUpTVXpVeE1pSjkuZXlKemRXSWlPaUkxTkRVMFltUmtNR1UzWlRjME1EQmpZalpqWkRSaU1ETmhPR0ZsWVRCa01DSjkuanZGZ3c2bnVaVnNpUlZlMXhnaWgxR3ZuMjJoZVozRGdHcF94UnVaLWRMQlVHSFdyRWNYM2h0bWdmN2xJYXFtWTllZ09LVmlyWFBUaEI5RTFVLTJSbzNUa0RXM0NWcDNQUFpBelRSam90alFYeE1zX09YRE9zb0M1elNMYXNxTHB2VUpsVFY0MWRYWHNsOVBoMDA1SHY1RjlCeVd6ZEhnWU8zakhFTFhDOWpPeUlmRG5CZlhBbFdzclRORllEM19Jd3BzZFZpcDlUV1ZQemtTMUM3UFhYbldnamFILW9ZNVl6UHhLN3FLblRfQU5IbWVBYmNZcWxMVWZYTEg3U3VtSzg5T0dYZ0oyNXdOTXJLc2JMcHM4bTl2RnRxcm9ZclQ5V1o5R3EzTXJyck5iemRFUHNSbkRwOXZTc3ZYcDgxSFZfRmVuVVBJVGIxMjJGRWRKTW9LY2dyMGd2U3A2dzVCbGhLYVpYZVcwRVVESW9VdjVzRGdNdHNoWVlBUUthQjRhRlVzdGJGMm1iZUlhWl96M1V0aEFiRUtVUjA2Vm16QUV4NFl1S0ptb0pxRmJUSGkyMTVzS216b081VHJpVVdhVTBHMnZBNWx3bUp2aFc4UkNBR3I4OFhUTDBFNGowMC14cXpZVkhzdHduZWI4Uk5BQXBHQ0c4ZjRNLXBEQVFWVGdGbTNaRzE5R0pPM3N1TFFYUmFNS3pCS1JMdmMyUm5OYXRxRmlOYlBONlQ4dEx6UWtQcGpuMG9neU5vdE9xb1l1cUg2ODhpWV8tdjFOOXV1NDFZSEdheUM5T0NFQ3ZzQmVfS0V6b1UyUkJ0WVlsSmlaZTVaTVVwb2IxS3VTNTl4UVQzR3gyMWhLVkdjOXFNNlFpVGhrVEVyeGVlUENXYTVRa1ZSVUVFREpPUms=",
      "email": "21802259@qq.com"
    }
  }
}

[root@support ~]$cat /data/OCP-Install/ocp/secret/registry-secret.json 
{
        "auths": {
                "registry.cj.io:5000": {
                        "auth": "b3BlbnNoaWZ0OnJlZGhhdA=="
                }
        }
}

如果采用直接将远端镜像仓库拉取到本地的操作，需要合并两个访问凭证。

# 拷贝
[root@support ~]$cp /data/OCP-Install/ocp/secret/redhat-secret.json all-sercret.json
# 编辑
[root@support ~]$vi /data/OCP-Install/ocp/secret/all-sercret.json

将其中registry-secret.json的"auths"字段添加到all-sercret.json即可。

【-a /data/OCP-Install/ocp/secret/all-secret.json，这里参数输入是all-secret.json文件，就是合并后的登录凭证】

【这里直接用了最新的4.5.13版本进行升级，用于测试】

oc adm release mirror -a /data/OCP-Install/ocp/secret/all-secret.json --from=quay.io/openshift-release-dev/ocp-release:4.5.13-x86_64 --to=registry.cj.io:5000/ocp4/openshift4 --to-release-image=registry.cj.io:5000/ocp4/openshift4:4.5.13-x86_64

# 正常执行了，一共110个镜像
phase 0:
  registry.cj.io:5000 ocp4/openshift4 blobs=241 mounts=0 manifests=110 shared=5

info: Planning completed in 21.73s
uploading: registry.cj.io:5000/ocp4/openshift4 sha256:9ebdc795180d997ec9611acb8a453717f63fa2227b003db6c7cc911482e3e43d 3.347MiB
uploading: registry.cj.io:5000/ocp4/openshift4 sha256:012ac4d0928c5518903573d7665e38c8a9d6e3a8db89539eaff4601e3ad25589 18.65MiB
uploading: registry.cj.io:5000/ocp4/openshift4 sha256:4406a9beeab462c05c8e03f0c6eccd2902cb4cde00caee21cf13ff6dfaab53f4 9.145MiB
uploading: registry.cj.io:5000/ocp4/openshift4 sha256:ba39e3a683d0cd66eb9f8d9c388bd98b030185ba1b8cb51f08c070cb7bd0b9a5 278.8KiB


Success
Update image:  registry.cj.io:5000/ocp4/openshift4:4.5.11-x86_64
Mirror prefix: registry.cj.io:5000/ocp4/openshift4

To use the new mirrored repository to install, add the following section to the install-config.yaml:

imageContentSources:
- mirrors:
  - registry.cj.io:5000/ocp4/openshift4
  source: quay.io/openshift-release-dev/ocp-release
- mirrors:
  - registry.cj.io:5000/ocp4/openshift4
  source: quay.io/openshift-release-dev/ocp-v4.0-art-dev


To use the new mirrored repository for upgrades, use the following to create an ImageContentSourcePolicy:

apiVersion: operator.openshift.io/v1alpha1
kind: ImageContentSourcePolicy
metadata:
  name: example
spec:
  repositoryDigestMirrors:
  - mirrors:
    - registry.cj.io:5000/ocp4/openshift4
    source: quay.io/openshift-release-dev/ocp-release
  - mirrors:
    - registry.cj.io:5000/ocp4/openshift4
    source: quay.io/openshift-release-dev/ocp-v4.0-art-dev

【上述返回，注意查看Success后的信息】

升级过程中，如果遇到image-registry状态为Degraded，需要进行处理具体如下：

oc patch imagepruner.imageregistry/cluster --patch '{"spec":{"suspend":true}}' --type=merge 
oc -n openshift-image-registry delete jobs --all

升级进一步继续，DNS pod升级

最后一步

升级完毕

验证

[root@support ~]$oc get clusterversion
NAME      VERSION   AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.5.13    True        False         118m    Error while reconciling 4.5.13: the cluster operator openshift-samples is degraded

但是openshift-samples的状态仍是Degraded，虽然不影响集群状态。