Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -7,13 +7,14 @@
[id="registry-configuring-registry-storage-swift-trust_{context}"]
= Configuring Image Registry Operator redirects

[role="_abstract"]
By disabling redirects, you can configure the Image Registry Operator to control whether clients such as {product-title} cluster builds or external systems like developer machines are redirected to pull images directly from {rh-openstack-first} Swift storage. This configuration is optional and depends on whether the clients trust the storage's SSL/TLS certificates.

[NOTE]
====
In situations where clients to not trust the storage certificate, setting the `disableRedirect` option can be set to `true` proxies traffic through the image registry. Consequently, however, the image registry might require more resources, especially network bandwidth, to handle the increased load.
In situations where clients to not trust the storage certificate, setting the `disableRedirect` option can be set to `true` proxies traffic through the image registry. Consequently, however, the image registry might require more resources, especially network bandwidth, to handle the increased load.

Alternatively, if clients trust the storage certificate, the registry can allow redirects. This reduces resource demand on the registry itself.
Alternatively, if clients trust the storage certificate, the registry can allow redirects. This reduces resource demand on the registry itself.

Some users might prefer to configure their clients to trust their self-signed certificate authorities (CAs) instead of disabling redirects. If you are using a self-signed CA, you must decide between trusting the custom CAs or disabling redirects.
====
Expand Down
36 changes: 18 additions & 18 deletions modules/registry-configuring-storage-aws-user-infra.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -8,12 +8,16 @@
[id="registry-configuring-storage-aws-user-infra_{context}"]
= Configuring registry storage for AWS with user-provisioned infrastructure

During installation, your cloud credentials are sufficient to create an Amazon S3 bucket
and the Registry Operator will automatically configure storage.
[role="_abstract"]
During installation, your cloud credentials are sufficient to create an Amazon S3 bucket and the Registry Operator will automatically configure storage.

If the Registry Operator cannot create an S3 bucket and automatically configure
storage, you can create an S3 bucket and configure storage with the following
procedure.
If the Registry Operator cannot create an S3 bucket and automatically configure storage, you can create an S3 bucket and configure storage with the following procedure.

[WARNING]
====
To secure your registry images in AWS, link:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-publicaccessblockconfiguration.html[block public access]
to the S3 bucket.
====

.Prerequisites

Expand All @@ -24,9 +28,6 @@ procedure.

.Procedure

Use the following procedure if the Registry Operator cannot create an S3 bucket
and automatically configure storage.

. Set up a link:https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuoverview.html#mpu-abort-incomplete-mpu-lifecycle-config[Bucket Lifecycle Policy]
to abort incomplete multipart uploads that are one day old.

Expand All @@ -41,14 +42,13 @@ $ oc edit configs.imageregistry.operator.openshift.io/cluster
.Example configuration
[source,yaml]
----
storage:
s3:
bucket: <bucket-name>
region: <region-name>
apiVersion: imageregistry.operator.openshift.io/v1
kind: Config
metadata:
name: cluster
spec:
storage:
s3:
bucket: <bucket-name>
region: <region-name>
----

[WARNING]
====
To secure your registry images in AWS, link:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-publicaccessblockconfiguration.html[block public access]
to the S3 bucket.
====
1 change: 1 addition & 0 deletions modules/registry-configuring-storage-azure-gov-cloud.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
[id="registry-configuring-storage-azure-gov-cloud_{context}"]
= Configuring registry storage for Azure Government

[role="_abstract"]
During installation, your cloud credentials are sufficient to create Azure Blob
Storage, and the Registry Operator automatically configures storage.

Expand Down
14 changes: 10 additions & 4 deletions modules/registry-configuring-storage-azure-user-infra.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
[id="registry-configuring-storage-azure-user-infra_{context}"]
= Configuring registry storage for Azure

[role="_abstract"]
During installation, your cloud credentials are sufficient to create Azure Blob
Storage, and the Registry Operator automatically configures storage.

Expand All @@ -31,8 +32,13 @@ $ oc edit configs.imageregistry.operator.openshift.io/cluster
.Example configuration
[source,yaml]
----
storage:
azure:
accountName: <storage-account-name>
container: <container-name>
apiVersion: imageregistry.operator.openshift.io/v1
kind: Config
metadata:
name: cluster
spec:
storage:
azure:
accountName: <storage-account-name>
container: <container-name>
----
28 changes: 16 additions & 12 deletions modules/registry-configuring-storage-gcp-user-infra.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
[id="registry-configuring-storage-gcp-user-infra_{context}"]
= Configuring the registry storage for {gcp-short} with user-provisioned infrastructure

[role="_abstract"]
If the Registry Operator cannot create a {gcp-first} bucket, you must set up the storage medium manually and configure the settings in the registry custom resource (CR).

.Prerequisites
Expand All @@ -17,6 +18,11 @@ cloud credentials.
contents of a credentials file provided by {gcp-short}:
** `REGISTRY_STORAGE_GCS_KEYFILE`

[WARNING]
====
You can secure your registry images that use a {gcp-full} Storage bucket by setting link:https://cloud.google.com/storage/docs/using-public-access-prevention[public access prevention].
====

.Procedure

. Set up an link:https://cloud.google.com/storage/docs/lifecycle[Object Lifecycle Management policy] to abort incomplete multipart uploads that are one day old.
Expand All @@ -31,16 +37,14 @@ $ oc edit configs.imageregistry.operator.openshift.io/cluster
.Example configuration
[source,yaml]
----
# ...
storage:
gcs:
bucket: <bucket-name>
projectID: <project-id>
region: <region-name>
# ...
apiVersion: imageregistry.operator.openshift.io/v1
kind: Config
metadata:
name: cluster
spec:
storage:
gcs:
bucket: <bucket-name>
projectID: <project-id>
region: <region-name>
----

[WARNING]
====
You can secure your registry images that use a {gcp-full} Storage bucket by setting link:https://cloud.google.com/storage/docs/using-public-access-prevention[public access prevention].
====
14 changes: 9 additions & 5 deletions modules/registry-configuring-storage-openstack-user-infra.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
[id="registry-configuring-storage-openstack-user-infra_{context}"]
= Registry storage for {rh-openstack} with user-provisioned infrastructure

[role="_abstract"]
If the Registry Operator cannot create a Swift bucket, you must set up the storage medium manually and configure the settings in the registry custom resource (CR).

.Prerequisites
Expand All @@ -30,9 +31,12 @@ $ oc edit configs.imageregistry.operator.openshift.io/cluster
.Example configuration
[source,yaml]
----
# ...
storage:
swift:
container: <container-id>
# ...
apiVersion: imageregistry.operator.openshift.io/v1
kind: Config
metadata:
name: cluster
spec:
storage:
swift:
container: <container-id>
----
2 changes: 2 additions & 0 deletions modules/registry-operator-config-resources-secret-aws.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,8 @@
[id="registry-operator-config-resources-secret-aws_{context}"]
= Configuring a secret for the Image Registry Operator


[role="_abstract"]
In addition to the `configs.imageregistry.operator.openshift.io` and ConfigMap
resources, configuration is provided to the Operator by a separate secret
resource located within the `openshift-image-registry` namespace.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
[id="registry-operator-config-resources-secret-azure_{context}"]
= Configuring a secret for the Image Registry Operator

[role="_abstract"]
In addition to the `configs.imageregistry.operator.openshift.io` and ConfigMap
resources, configuration is provided to the Operator by a separate secret
resource located within the `openshift-image-registry` namespace.
Expand Down
1 change: 1 addition & 0 deletions modules/registry-operator-config-resources-secret-gcp.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
[id="registry-operator-config-resources-secret-gcp_{context}"]
= Configuring a secret for the Image Registry Operator

[role="_abstract"]
In addition to the `configs.imageregistry.operator.openshift.io` and ConfigMap
resources, configuration is provided to the Operator by a separate secret
resource located within the `openshift-image-registry` namespace.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
[id="registry-operator-config-resources-secret-openstack_{context}"]
= Configuring a secret for the Image Registry Operator

[role="_abstract"]
In addition to the `configs.imageregistry.operator.openshift.io` and ConfigMap
resources, configuration is provided to the Operator by a separate secret
resource located within the `openshift-image-registry` namespace.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
[id="registry-operator-configuration-resource-overview-aws-s3_{context}"]
= Image Registry Operator configuration parameters for AWS S3

[role="_abstract"]
The following configuration parameters are available for AWS S3 registry storage.

The image registry `spec.storage.s3` configuration parameter holds the information to configure the registry to use the AWS S3 service for back-end storage. See the link:https://docs.docker.com/registry/storage-drivers/s3/[S3 storage driver documentation] for more information.
Expand All @@ -20,7 +21,7 @@ It is optional and is generated if not provided.

|`chunkSizeMiB`
|ChunkSizeMiB is the size of the multipart upload chunks of the S3 API.
The default is `10` MiB with a minimum of `5` MiB.
The default is `10` MiB with a minimum of `5` MiB.

|`region`
|Region is the AWS region in which your bucket exists. It is optional and is
Expand Down Expand Up @@ -48,7 +49,7 @@ true, or this parameter is ignored.
It is optional.

|`trustedCA`
|The namespace for the config map referenced by `trustedCA` is `openshift-config`. The key for the bundle in the config map is `ca-bundle.crt`. It is optional.
|The namespace for the config map referenced by `trustedCA` is `openshift-config`. The key for the bundle in the config map is `ca-bundle.crt`. It is optional.
|===

[NOTE]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,8 @@
[id="registry-operator-configuration-resource-overview-gcp-gcs_{context}"]
= Image Registry Operator configuration parameters for {gcp-short} GCS

The following configuration parameters are available for {gcp-short} GCS registry storage.
[role="_abstract"]
The following parameters configure are available to configure your {gcp-short} GCS registry storage.

[cols="3a,8a",options="header"]
|===
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,8 @@
[id="registry-operator-configuration-resource-overview-openstack-swift_{context}"]
= Image Registry Operator configuration parameters for {rh-openstack} Swift

The following configuration parameters are available for {rh-openstack-first} Swift
[role="_abstract"]
The following parameters are available for you to configure your {rh-openstack-first} Swift
registry storage.

[cols="3a,8a",options="header"]
Expand Down
Original file line number Diff line number Diff line change
@@ -1,12 +1,15 @@
:_mod-docs-content-type: ASSEMBLY
[id="configuring-registry-storage-aws-user-infrastructure"]
= Configuring the registry for AWS user-provisioned infrastructure

include::_attributes/common-attributes.adoc[]

:context: configuring-registry-storage-aws-user-infrastructure

toc::[]

:FILE: REGISTRY_STORAGE_S3_ACCESSKEY=
[role="_abstract"]
Save your container images to a durable storage location by configuring the built-in image registry to use dedicated {gcp-short} storage. This setup provides persistent scalable storage for your registry, separate from ephemeral cluster storage.

include::modules/registry-operator-config-resources-secret-aws.adoc[leveloffset=+1]

Expand Down
Original file line number Diff line number Diff line change
@@ -1,11 +1,16 @@
:_mod-docs-content-type: ASSEMBLY
[id="configuring-registry-storage-azure-user-infrastructure"]
= Configuring the registry for Azure user-provisioned infrastructure

include::_attributes/common-attributes.adoc[]

:context: configuring-registry-storage-azure-user-infrastructure

toc::[]

[role="_abstract"]
Save your container images to a durable storage location by configuring the built-in image registry to use dedicated Azure storage. This setup provides persistent scalable storage for your registry, separate from ephemeral cluster storage.


include::modules/registry-operator-config-resources-secret-azure.adoc[leveloffset=+1]

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,8 @@ include::_attributes/common-attributes.adoc[]

toc::[]

:FILE: gcp=
[role="_abstract"]
Save your container images to a durable storage location by configuring the built-in image registry to use dedicated {gcp-short} storage. This setup provides persistent scalable storage for your registry, separate from ephemeral cluster storage.

include::modules/registry-operator-config-resources-secret-gcp.adoc[leveloffset=+1]

Expand Down
Original file line number Diff line number Diff line change
@@ -1,11 +1,14 @@
:_mod-docs-content-type: ASSEMBLY
[id="configuring-registry-storage-openstack-user-infrastructure"]
= Configuring the registry for OpenStack user-provisioned infrastructure

include::_attributes/common-attributes.adoc[]

:context: configuring-registry-storage-openstack-user-infrastructure

toc::[]

[role="_abstract"]
You can configure the registry of a cluster that runs on your own {rh-openstack-first} infrastructure.

include::modules/registry-configuring-registry-storage-swift-trust.adoc[leveloffset=+1]
Expand Down