1、創建registry服務器
(1)安裝需要的包
<code>yum -y install podman httpd-tools/<code>
(2)創建registry目錄
<code>mkdir -p /opt/registry/{auth,certs,data}/<code>
(3)生成registry服務器證書 注意文件名不能更改改成其他名字,registry pod啟動時會找不到
<code>cd /opt/registry/certsopenssl req -newkey rsa:4096 -nodes -sha256 -keyout domain.key -x509 -days 365 -out domain.crt/<code>
(4)生成bcrpt格式的密碼
<code>htpasswd -bBc /opt/registry/auth/htpasswd root Scwang18/<code>
(5)創建mirror-registry容器
<code>podman run --name mirror-registry -p 5000:5000 \\ -v /opt/registry/data:/var/lib/registry:z \\ -v /opt/registry/auth:/auth:z \\ -e "REGISTRY_AUTH=htpasswd" \\ -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \\ -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \\ -v /opt/registry/certs:/certs:z \\ -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \\ -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \\ -d docker.io/library/registry:2/<code>
(6)添加防火牆端口
<code>firewall-cmd --add-port=5000/tcp --zone=internal --permanent firewall-cmd --add-port=5000/tcp --zone=public --permanent firewall-cmd --reload/<code>
(7)添加簽名簽名證書到受信證書列表
<code>cp /opt/registry/certs/domain.crt /etc/pki/ca-trust/source/anchors/update-ca-trust/<code>
(8)測試registry是否可用
<code>curl -u root:xxxx -k https://registry.ipincloud.com:5000/v2/_catalog/<code>
2、修改pullsecret
在受限網絡安裝OCP,需要將私有鏡像registry的相關信息更新到pullsecret。
(1)從https://cloud.redhat.com/openshift/install/pull-secret下載pullsecret
<code>cat << 'EOF' > /opt/registry/certs/pull-secret.txt{"auths":{"cloud.openshift.com":{省略}}}EOF/<code>
(2)將1步創建registry服務時使用的用戶名\\密碼轉換成base64編碼的token
<code>[root@misc certs]# echo -n 'root:Scwang18' | base64 -w0cm9vdDpTY3dhbmcxOA==[root@misc certs]#/<code>
(3)將pullsecret格式轉換成json,便於增加自己的私有registrt
<code>cat ./pull-secret.txt | jq . > ./pull-secret.json/<code>
(4)將私有mirror registry添加到pull-secret.json
<code>[root@misc certs]# cat pull-secret.json{ "auths": { "cloud.openshift.com": { "auth": "省略", "email": "省略" }, "quay.io": { "auth": "省略", "email": "省略" }, "registry.connect.redhat.com": { "auth": "省略", "email": "省略" }, "registry.redhat.io": { "auth": "省略", "email": "[email protected]" }, "registry.ipincloud.com:5000": { "auth": "cm9vdDpTY3dhbmcxOA==", "email": "[email protected]" } }}[root@misc certs]#/<code>
3、同步ocp鏡像倉庫到私有registry
(1)設置registry環境變量
<code>export OCP_RELEASE=4.3.0export LOCAL_REGISTRY='registry.ipincloud.com:5000' export LOCAL_REPOSITORY='ocp4/openshift4' export PRODUCT_REPO='openshift-release-dev' export LOCAL_SECRET_JSON='/opt/registry/certs/pull-secret.json' export RELEASE_NAME="ocp-release" /<code>
(2)開始鏡像
<code>oc adm release mirror -a ${LOCAL_SECRET_JSON} \\ --from=quay.io/${PRODUCT_REPO}/${RELEASE_NAME}:${OCP_RELEASE}-x86_64 \\ --to=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY} \\ --to-release-image=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY}:${OCP_RELEASE} oc adm release mirror -a /opt/registry/certs/pull-secret.json --from=quay.io/openshift-release-dev/ocp-release:4.3.0-x86_64 --to-release-image=registry.ipincloud.com:5000/ocp4/openshift4:4.3.0 --to=registry.ipincloud.com:5000/ocp4/openshift4 /<code>
(3)同步完成後,記錄完成信息,在集群中使用
4、完成
閱讀更多 雲原生學習班 的文章