9.2. 配置镜像 registry 设置

流程

1. 编辑 image.config.openshift.io/cluster CR:

   $ oc edit image.config.openshift.io/cluster

   以下是一个带有允许列表的 image.config.openshift.io/cluster CR 示例：

   apiVersion: config.openshift.io/v1
   kind: Image
   metadata:
     annotations:
       release.openshift.io/create-only: "true"
     creationTimestamp: "2019-05-17T13:44:26Z"
     generation: 1
     name: cluster
     resourceVersion: "8302"
     selfLink: /apis/config.openshift.io/v1/images/cluster
     uid: e34555da-78a9-11e9-b92b-06d6c7da38dc
   spec:
     registrySources: 1
       allowedRegistries: 2
       - example.com
       - quay.io
       - registry.redhat.io
       - reg1.io
       - image-registry.openshift-image-registry.svc:5000
   status:
     internalRegistryHostname: image-registry.openshift-image-registry.svc:5000

   1

   registrySources：包含用于决定容器运行时在访问构建和 pod 的镜像时应如何处理个别 registry 的配置。它不包含内部集群 registry 的配置。

   2

   allowedRegistries：用于镜像拉取（pull）和推送（push）操作的 registry。阻止所有其他 registry。

   注意

   可以设置 allowedRegistries 参数或 blockedRegistries 参数，但不能同时设置这两个参数。

   Machine Config Operator（MCO）会监控 image.config.openshift.io/cluster 资源以了解对 registry 的任何更改。当 MCO 检测到更改时，它会排空节点，应用更改，并对节点进行 uncordon 处理。节点返回 Ready 状态后，允许的 registry 列表用于更新每个节点上的 /host/etc/containers/policy.json 文件中的镜像签名策略。

2. 要检查 registry 是否已添加到策略文件中，请在节点上使用以下命令：

   $ cat /host/etc/containers/policy.json

   以下策略表示，仅允许来自 example.com、quay.io 和 registry.redhat.io registry 中的镜像拉取和推送镜像：

   例 9.1. 镜像签名策略文件示例

   {
      "default":[
         {
            "type":"reject"
         }
      ],
      "transports":{
         "atomic":{
            "example.com":[
               {
                  "type":"insecureAcceptAnything"
               }
            ],
            "image-registry.openshift-image-registry.svc:5000":[
               {
                  "type":"insecureAcceptAnything"
               }
            ],
            "insecure.com":[
               {
                  "type":"insecureAcceptAnything"
               }
            ],
            "quay.io":[
               {
                  "type":"insecureAcceptAnything"
               }
            ],
            "reg4.io/myrepo/myapp:latest":[
               {
                  "type":"insecureAcceptAnything"
               }
            ],
            "registry.redhat.io":[
               {
                  "type":"insecureAcceptAnything"
               }
            ]
         },
         "docker":{
            "example.com":[
               {
                  "type":"insecureAcceptAnything"
               }
            ],
            "image-registry.openshift-image-registry.svc:5000":[
               {
                  "type":"insecureAcceptAnything"
               }
            ],
            "insecure.com":[
               {
                  "type":"insecureAcceptAnything"
               }
            ],
            "quay.io":[
               {
                  "type":"insecureAcceptAnything"
               }
            ],
            "reg4.io/myrepo/myapp:latest":[
               {
                  "type":"insecureAcceptAnything"
               }
            ],
            "registry.redhat.io":[
               {
                  "type":"insecureAcceptAnything"
               }
            ]
         },
         "docker-daemon":{
            "":[
               {
                  "type":"insecureAcceptAnything"
               }
            ]
         }
      }
   }