OpenShift 4 - 向OpenShift内部Image Registry推送Image

最新推荐文章于 2022-04-15 09:56:39 发布

dawnsky.liu

最新推荐文章于 2022-04-15 09:56:39 发布

阅读量2.4k

点赞数 1

本文链接：https://blog.csdn.net/weixin_43902588/article/details/106149568

版权

Image 同时被 3 个专栏收录

14 篇文章 1 订阅

订阅专栏

podman

11 篇文章 2 订阅

订阅专栏

ImageStream

4 篇文章 0 订阅

订阅专栏

《OpenShift 4.x HOL教程汇总》
说明：本文已经在OpenShift 4.6环境中验证

了解OpenShift内部Image Registry

OpenShift容器平台提供了一个内置的Container Image Registry，该Image Registry用户提供了一个开箱即用的解决方案来管理运行OpenShift工作负载所用到的Image。Image Registry可以像其他任何集群工作负载一样扩展，不需要特定的基础设施配置。此外，它集成到了集群用户认证和授权系统中，这意味着通过定义Image资源的用户权限来控制创建和检索Image的访问。

Image Registry Operator在 openshift-image-registry 命名空间中运行，并在该位置管理Image Registry实例。Image Registry的所有配置和工作负载资源都位于该命名空间中。Image数据存储在两个位置。实际的Image数据存储在可配置的存储位置，如云存储或文件系统卷等。Image元数据被存储为标准的API资源，这些API资源包括Image和ImageStream。

当使用podman工具向OpenShift内部Image Registry推送Image的时候，OpenShift会自动为Image创建对应的ImageStream，这样在OpenShift中就可以使用ImageStream访问这些保存在本地的Image了。

podman push命令会将外部Image传到内部Image Registry中并保存，并根据Image的元数据生成对应的ImageStream对象；而oc import-image命令只是根据外部镜像的元数据生成ImageStream对象，ImageSteam还是指向外部镜像。

向内部Image Registry推送Image

登录OpenShift

执行命令，用集群管理员（例如admin）登录OpenShift。

$ oc login -u admin -p <password> https://api-int.<cluster_name>.<base_domain>:6443

执行命令，查看该用户登录的“TOKEN”。

$ oc whoami -t
jbwPGpIzDra8XCNIrBjsWkKhdHEEugBpuqNUHLVVH00

为podman的pull/push操作赋权

为了能操作内部Image Registry，首先要有权限。用OpenShift集群管理员（例如admin）登录后执行命令，为自己赋权

$ oc policy add-role-to-user registry-viewer $(oc whoami)
$ oc policy add-role-to-user registry-editor $(oc whoami)

新建测试项目

本文未来手动导入到内部Image Registry的Image是被放在以下命令新建的特定的新建项目中。其实导入的Image也可放在所有用户都可访问的公共项目OpenShift中。

$ oc new-project myproject

Pull Image/Push Image

方法1：用podman在集群节点内部操作

进入OpenShift集群内部

首先需要进入的某个OpenShift节点，这样我们就可以用OpenShift集群内部地址访问Image Registry了。

查看集群节点名称

$ oc get nodes
NAME                           STATUS   ROLES    AGE    VERSION
ip-10-0-133-204.ec2.internal   Ready    master   3d8h   v1.17.1
ip-10-0-134-17.ec2.internal    Ready    worker   3d7h   v1.17.1
ip-10-0-147-125.ec2.internal   Ready    master   3d8h   v1.17.1
ip-10-0-154-19.ec2.internal    Ready    worker   3d7h   v1.17.1
ip-10-0-161-178.ec2.internal   Ready    master   3d8h   v1.17.1

使用节点名称进入一个节点，例如第一个master节点。

$ oc debug nodes/ip-10-0-133-204.ec2.internal
Starting pod/ip-10-0-133-204ec2internal-debug ...
To use host binaries, run `chroot /host`
Pod IP: 10.0.133.204
If you don't see a command prompt, try pressing enter.

为了运行可执行程序，要先执行以下命令。

sh-4.2# chroot /host

Pull Image/Push Image

执行podman pull命令，将远程Image拉到本地。

sh-4.4#  podman pull openshift/hello-openshift
Trying to pull registry.access.redhat.com/openshift/hello-openshift...
  name unknown: Repo not found
Trying to pull docker.io/openshift/hello-openshift...
Getting image source signatures
Copying blob 4f4fb700ef54 done
Copying blob 8b32988996c5 done
Copying config 7af3297a3f done
Writing manifest to image destination
Storing signatures
7af3297a3fb4487b740ed6798163f618e6eddea1ee5fa0ba340329fcae31c8f6

确认本地已有该openshift/hello-openshift镜像。

sh-4.4# podman images | grep hello-openshift
docker.io/openshift/hello-openshift                        latest       7af3297a3fb4   2 years ago     6.1 MB

对本地的镜像重新打tag标签。注意：在Image的新标签中使用了名为myproject的项目名作为Image Repository。

sh-4.4# podman tag docker.io/openshift/hello-openshift:latest image-registry.openshift-image-registry.svc:5000/myproject/hello-openshift-1:latest

再次查看本地镜像，确认hello-openshift镜像已经有新标签了。

sh-4.4# podman images | grep hello-openshift
image-registry.openshift-image-registry.svc:5000/myproject/hello-openshift-1                latest       7af3297a3fb4   2 years ago     6.1 MB
docker.io/openshift/hello-openshift                                                         latest       7af3297a3fb4   2 years ago     6.1 MB

用admin用户和对应的“TOKEN”登录内部的Registry。

sh-4.4# podman login image-registry.openshift-image-registry.svc:5000 -u admin -p <TOKEN>
Login Succeeded!

把打过新标签的Image推送到OpenShift内部Image Registry，其中myproject是上面创建的项目。

sh-4.4# podman push image-registry.openshift-image-registry.svc:5000/myproject/hello-openshift-1:latest
Getting image source signatures
Copying blob 5f70bf18a086 skipped: already exists
Copying blob da0e4d9121c7 [--------------------------------------] 0.0b / 0.0b
Copying config 7af3297a3f [--------------------------------------] 0.0b / 1.3KiB
Writing manifest to image destination
Storing signatures

查询内部镜像仓库

使用“TOKEN”查询OpenShift内部Registry中的Repositries。确认返回结果中包含“myproject/hello-openshift-1”。

sh-4.4# curl -s -k -H "Authorization: Bearer <TOKEN>" https://image-registry.openshift-image-registry.svc:5000/v2/_catalog | jq
{
  "repositories": [
    "myproject/hello-openshift-1",
    "openshift/apicast-gateway",
    "openshift/apicurito-ui",
    "openshift/cli",
    "openshift/cli-artifacts",
    "openshift/dotnet",
    "openshift/dotnet-runtime",
    "openshift/eap-cd-openshift",
    "openshift/fis-java-openshift",
    "openshift/fis-karaf-openshift",
    "openshift/fuse-apicurito-generator",
    "openshift/fuse7-console",
    "openshift/fuse7-eap-openshift",
    "openshift/fuse7-java-openshift",
。。。

使用“TOKEN”查询myproject/hello-openshift-1。返回结果中第一个是“myproject/hello-openshift-1”。

sh-4.4#curl -s -k -H "Authorization: Bearer <TOKEN>" https://image-registry.openshift-image-registry.svc:5000/v2/myproject/hello-openshift-1/manifests/latest | jq
{
  "schemaVersion": 1,
  "name": "myproject/hello-openshift-1",
  "tag": "latest",
  "architecture": "amd64",
  "fsLayers": [
    {
      "blobSum": "sha256:ffbad57ff065cbecdd369f56b40d42e3434ecc70d048f57a7391000911ebd7a7"
    },
    {
      "blobSum": "sha256:ff53f95d20d5f6ca55d46980861da4798ee325927876aa53bfc5e2a32a864dc7"
    }
  ],
  "history": [
    {
      "v1Compatibility": "{\"architecture\":\"amd64\",\"author\":\"Jessica Forrester \\u003cjforrest@redhat.com\\u003e\",\"config\":{\"Hostname\":\"\",\"Domainname\":\"\",\"User\":\"1001\",\"AttachStdin\":false,\"AttachStdout\":false,\"AttachStderr\":false,\"ExposedPorts\":{\"8080/tcp\":{},\"8888/tcp\":{}},\"Tty\":false,\"OpenStdin\":false,\"StdinOnce\":false,\"Env\":[\"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"],\"Cmd\":null,\"Image\":\"\",\"Volumes\":null,\"WorkingDir\":\"\",\"Entrypoint\":[\"/hello-openshift\"],\"OnBuild\":null,\"Labels\":{}},\"container\":\"64ede50d59ead12e9e867f6c48681b3cde9e0c920db433666fc20cd7c322de02\",\"container_config\":{\"Hostname\":\"64ede50d59ea\",\"Domainname\":\"\",\"User\":\"\",\"AttachStdin\":false,\"AttachStdout\":false,\"AttachStderr\":false,\"Tty\":false,\"OpenStdin\":false,\"StdinOnce\":false,\"Env\":null,\"Cmd\":null,\"Image\":\"scratchljl6nbgci72oxgam2jh83pe3\",\"Volumes\":null,\"WorkingDir\":\"\",\"Entrypoint\":[\"/bin/sh\",\"-c\",\"# NOP\"],\"OnBuild\":null,\"Labels\":{}},\"created\":\"2018-04-18T10:38:59.552935845Z\",\"docker_version\":\"1.13.1\",\"id\":\"a510d6aa46bf3dbf2fa761156d12d79e3d1b44f2bda36fb7e8b9c23c7bdb41de\",\"os\":\"linux\",\"parent\":\"a5d5ba10159cb80b424cb96a62c273468b681298895860aa2ac28e62f0ae6d6f\"}"
    },
    {
      "v1Compatibility": "{\"id\":\"a5d5ba10159cb80b424cb96a62c273468b681298895860aa2ac28e62f0ae6d6f\",\"comment\":\"Imported from -\",\"created\":\"2018-04-18T10:38:57.341799685Z\",\"container_config\":{\"Cmd\":[\"\"]}}"
    }
  ],
  "signatures": [
    {
      "header": {
        "jwk": {
          "crv": "P-256",
          "kid": "EQAM:NVI4:I73M:JKBT:VO3P:QXMN:WVTW:5CNZ:QIZ5:2I3M:EFYN:PGTF",
          "kty": "EC",
          "x": "cRUOvyQ4YmzipMvs0HFx6u_mSJ0lh77CVTo4JWfZy_Q",
          "y": "t1FC6F3k0KvVAcjvpHPQ7WW0QdrLWtfp3qSt7tkq8O8"
        },
        "alg": "ES256"
      },
      "signature": "k_pNCjBHQZBn9ssK76DWIYQVB7zjwGZ5Qgqwe49Nb-MbewZJNqVdkV2eD7rFh2WmwQVqV1pVps0ZKT6r9-Ux_w",
      "protected": "eyJmb3JtYXRMZW5ndGgiOjE5NDcsImZvcm1hdFRhaWwiOiJDbjAiLCJ0aW1lIjoiMjAyMC0wNy0wN1QxNTo0MDowMVoifQ"
    }
  ]
}

方法2：用podman在集群节点外部操作

本方法是将OpenShift内部镜像Registry通过Route暴露出来，可以从集群外部访直接问到内部镜像Registry。
操作前确保已经在集群外部的执行节点中安装了podman。

允许在集群外登录内部Image Registry

首先允许通过OpenShift的DefaultRoute访问内部Image Registry。

$ oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge
config.imageregistry.operator.openshift.io/cluster patched

获得OpenShift内部Image Registry对外的访问主机。

$ REGISTRY=$(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')

执行命令，查看内部Image Registry的Repository镜像。确认有上一步刚刚导入的myproject/hello-openshift-1镜像。

$ curl -s -k -H "Authorization: Bearer $(oc whoami -t) " https://$REGISTRY/v2/_catalog | jq
{
  "repositories": [
    "myproject/hello-openshift-1",
    "openshift/apicast-gateway",
    "openshift/apicurito-ui",
    "openshift/cli",
    "openshift/cli-artifacts",
    。。。

4.还可执行以下命令查看其它Image信息。

$ export IMAGE=openshift/python
$ curl -s -k -H "Authorization: Bearer $(oc whoami -t) " https://$REGISTRY/v2/$IMAGE/tags/list
$ curl -s -k -H "Authorization: Bearer $(oc whoami -t) " https://$REGISTRY/v2/$IMAGE/manifests/latest

使用podman登录Image Registry对外的访问地址。注意：登录成功后会将认证信息通过“–authfile”参数放到指定“$HOME/registry-secret.json”文件中以在本文后面使用。如果只是用podman登录Registry，可以不需要指定“–authfile”参数。

$ sudo podman login -u $(oc whoami) -p $(oc whoami -t) --tls-verify=false --authfile=$HOME/registry-secret.json ${REGISTRY} 
Login Succeeded!

Pull Image/Push Image

执行podman pull命令，将远程Image拉到本地。说明：我们可以从返回结果看到，由于pull命令中没有提供完整的外部Registry地址，因此podman命令首先去registry.access.redhat.com、registry.fedoraproject.org和registry.centos.org查找镜像，最后在docker.io查找到openshift/hello-openshift，然后pull到本地。

$ sudo podman pull openshift/hello-openshift
Trying to pull registry.access.redhat.com/openshift/hello-openshift...
  name unknown: Repo not found
Trying to pull registry.fedoraproject.org/openshift/hello-openshift...
  manifest unknown: manifest unknown
Trying to pull registry.centos.org/openshift/hello-openshift...
  manifest unknown: manifest unknown
Trying to pull docker.io/openshift/hello-openshift...
Getting image source signatures
Copying blob 4f4fb700ef54 done
Copying blob 8b32988996c5 done
Copying config 7af3297a3f done
Writing manifest to image destination
Storing signatures
7af3297a3fb4487b740ed6798163f618e6eddea1ee5fa0ba340329fcae31c8f6

确认本地已有该openshift/hello-openshift镜像。

$ sudo podman images | grep hello-openshift
docker.io/openshift/hello-openshift   latest   7af3297a3fb4   2 years ago   6.1 MB

对本地的镜像重新打tag标签。注意：在Image的新标签中使用了名为myproject的项目名作为Image Repository。

$ sudo podman tag docker.io/openshift/hello-openshift:latest ${REGISTRY}/myproject/hello-openshift-2:latest

再次查看本地镜像，确认hello-openshift镜像已经有新标签了。

$ sudo podman images | grep hello-openshift
default-route-openshift-image-registry.apps.cluster-beijing-1374.beijing-1374.example.opentlc.com/myproject/hello-openshift-2   latest   7af3297a3fb4   2 years ago   6.1 MB
docker.io/openshift/hello-openshift                                                                                             latest   7af3297a3fb4   2 years ago   6.1 MB

把打过新标签的Image推送到OpenShift内部Image Registry，其中myproject是上面创建的项目。

$ sudo podman push ${REGISTRY}/myproject/hello-openshift-2:latest --tls-verify=false --authfile=$HOME/registry-secret.json
Getting image source signatures
Copying blob da0e4d9121c7 done
Copying blob 5f70bf18a086 done
Copying config 7af3297a3f done
Writing manifest to image destination
Storing signatures

查询内部镜像仓库

执行命令查询镜像仓库中所有的镜像列表，确认已经有了myproject/hello-openshift-2镜像。

$ curl -k -H "Authorization: Bearer $(oc whoami -t)" https://${REGISTRY}/v2/_catalog | jq
{
  "repositories": [
    "myproject/hello-openshift-1",
    "myproject/hello-openshift-2",
    "openshift/apicast-gateway",
    "openshift/apicurito-ui",
    "openshift/cli",
    "openshift/cli-artifacts",
    。。。
  ]
}

执行命令，查询openshift/dotnet镜像的信息。

$ curl -k -H "Authorization: Bearer $(oc whoami -t)" https://${REGISTRY}/v2/openshift/dotnet/tags/list
{"name":"openshift/dotnet","tags":["2.1","2.1-el7","2.1-ubi8","3.1","3.1-el7","3.1-ubi8","latest"]}
 
$ curl -k -H "Authorization: Bearer $(oc whoami -t)" https://${REGISTRY}/v2/openshift/dotnet/manifests/latest
{
   "schemaVersion": 1,
   "name": "openshift/dotnet",
   "tag": "latest",
   "architecture": "amd64",
   "fsLayers": [
      {
         "blobSum": "sha256:052baad69940cbd05bf4d96c1294ece0f7a46d51feec6ddb433484ad02890256"
      },
      {
         "blobSum": "sha256:37bc9f2a67ce21d557f8cecf46b5d6d58e41d033f994f42a5fbbdd070dbf48d6"
      },
      {
         "blobSum": "sha256:6500ac87b29ffd00c8655be65a6824dfcf9fc0accc625158ef1060bcedc84ca8"
      },
      {
         "blobSum": "sha256:1b8dabac56ed728c17a670d327474ab87dc392dc17721854ea599a7753326579"
      }
   ],
   "history": [
      {
   ....

方法3：用skopeo在集群节点外部操作

注意：需要先完成“方法2“中的”允许在集群外登录内部Image Registry”操作。

执行skopeo命令，把docker.io/openshift/hello-openshift镜像直接复制到OpenShift的myproject项目中。

$ skopeo copy --dest-creds=$(oc whoami):$(oc whoami -t) --dest-tls-verify=false docker://docker.io/openshift/hello-openshift docker://${REGISTRY}/myproject/hello-openshift-skopeo
Getting image source signatures
Copying blob 4f4fb700ef54 done
Copying blob 8b32988996c5 done
Copying config 7af3297a3f done
Writing manifest to image destination
Storing signatures

确认hello-openshift-skopeo镜像已经在OpenShift内部Registry中了。

$ curl -k -H "Authorization: Bearer $(oc whoami -t)" https://${REGISTRY}/v2/_catalog | jq | grep hello-openshift-skopeo
    "myproject/hello-openshift-skopeo",

方法4：用oc在集群节点外部操作

注意：需要先完成“方法2“中的”允许在集群外登录内部Image Registry”操作。

执行命令，将Image复制到OpenShift内部的Image Registry。注意：在命令中“-a $HOME/registry-secret.json”使用的是前面用“podman login”登录内部Image Registry生成的登录凭证文件。

$ oc new-project myproject
$ oc image mirror -a $HOME/registry-secret.json --insecure=true \
     docker.io/openshift/hello-openshift:latest \
     ${REGISTRY}/myproject/hello-openshift:latest
default-route-openshift-image-registry.apps.cluster-beijing-f5b3.beijing-f5b3.sandbox1120.opentlc.com/
  myproject/hello-openshift
    blobs:
      docker.io/openshift/hello-openshift sha256:4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1 32B
      docker.io/openshift/hello-openshift sha256:7af3297a3fb4487b740ed6798163f618e6eddea1ee5fa0ba340329fcae31c8f6 1.336KiB
      docker.io/openshift/hello-openshift sha256:8b32988996c5d776076ea3cd672855f6d0faac87510064a15cce4bd02cdc9d13 2.067MiB
    manifests:
      sha256:aaea76ff622d2f8bcb32e538e7b3cd0ef6d291953f3e7c9f556c1ba5baf47e2e -> latest
  stats: shared=0 unique=3 size=2.068MiB ratio=1.00
 
phase 0:
  default-route-openshift-image-registry.apps.cluster-beijing-f5b3.beijing-f5b3.sandbox1120.opentlc.com myproject/hello-openshift blobs=3 mounts=0 manifests=1 shared=0
 
info: Planning completed in 3.28s
uploading: default-route-openshift-image-registry.apps.cluster-beijing-f5b3.beijing-f5b3.sandbox1120.opentlc.com/myproject/hello-openshift sha256:8b32988996c5d776076ea3cd672855f6d0faac87510064a15cce4bd02cdc9d13 2.067MiB
sha256:aaea76ff622d2f8bcb32e538e7b3cd0ef6d291953f3e7c9f556c1ba5baf47e2e default-route-openshift-image-registry.apps.cluster-beijing-f5b3.beijing-f5b3.sandbox1120.opentlc.com/myproject/hello-openshift:latest
info: Mirroring completed in 2.16s (1.003MB/s)

确认hello-openshift-mirror镜像已经在OpenShift内部Registry中了。

$ curl -k -H "Authorization: Bearer $(oc whoami -t)" https://${REGISTRY}/v2/_catalog | jq | grep hello-openshift-mirror
    "myproject/hello-openshift-mirror",

验证推送的Image

以下从OpenShift集群外部的节点操作。

查看OpenShift的myproject项目中是否有名为hello-openshift的Image。

$ oc get image -n myproject | grep hello-openshift
sha256:a79c6182e8581564bcdd6c6c91e3a9bfe5acc3e48903a1640f6effe12243cb7f   image-registry.openshift-image-registry.svc:5000/myproject/hello-openshift-1@sha256:a79c6182e8581564bcdd6c6c91e3a9bfe5acc3e48903a1640f6effe12243cb7f
sha256:03e2cf83f6ec05a187a86bbbde9a2d47f62463ace5308a2446b828b2aeefe04e   image-registry.openshift-image-registry.svc:5000/myproject/hello-openshift-2@sha256:03e2cf83f6ec05a187a86bbbde9a2d47f62463ace5308a2446b828b2aeefe04e

查看OpenShift的myproject项目中已经有了ImageStream。说明：这说明OpenShift会根据Push到Image Registry的Image自动创建ImageStream对象。

$ oc get is -n myproject
NAME              IMAGE REPOSITORY                                                                                                                TAGS     UPDATED
hello-openshift-1   default-route-openshift-image-registry.apps.cluster-beijing-1374.beijing-1374.example.opentlc.com/myproject/hello-openshift-1   latest   11 seconds ago
hello-openshift-2   default-route-openshift-image-registry.apps.cluster-beijing-fd91.beijing-fd91.example.opentlc.com/myproject/hello-openshift-2   latest   About a minute ago

基于名为hello-openshift-1的Image或名为hello-openshift-2的ImageSteam，部署podhello-openshift-1和podhello-openshift-2应用。

$ oc new-app hello-openshift-1 --docker-image=image-registry.openshift-image-registry.svc:5000/myproject/hello-openshift-1:latest
$ oc new-app hello-openshift-2 --image-stream=myproject/hello-openshift-2:latest

根据Service生成Route

$ oc expose svc hello-openshift-1
$ oc expose svc hello-openshift-2

最后访问hello-openshift-1和hello-openshift-2的route查看结果

$ curl $(oc get route hello-openshift-1 -o template --template '{{.spec.host}}')
Hello OpenShift!
$ curl $(oc get route hello-openshift-2 -o template --template '{{.spec.host}}')
Hello OpenShift!

参考

https://www.gnulinuxmate.com/posts/2021/05/02/explore-openshift-4-x-internal-registry/

dawnsky.liu

关注

1
点赞
踩
6

收藏

觉得还不错? 一键收藏
0
评论
OpenShift 4 - 向OpenShift内部Image Registry推送Image

文章目录为podman的pull/push操作赋权新建项目进入OpenShift集群内部为podman的pull/push操作赋权为了能操作内部Image Registry，首先要有权限。用OpenShift集群管理员（例如admin）登录后执行命令，为自己赋权$ oc policy add-role-to-user registry-viewer $(oc whoami)$ oc policy add-role-to-user registry-editor $(oc whoami)新建项目
复制链接

扫一扫