search

BCDevOps / OpenShift4-Migration

Scripts and info for Ministry teams migration from OpenShift 3.11 to 4.x
Apache License 2.0
3 stars 0 forks source link

Cluster registry name change #14

Closed StevenBarre closed 3 years ago

StevenBarre commented 4 years ago

Need to know

The URL/name for the cluster registry has changed in OpenShift 4. When migrating existing manifests or pipeline steps that reference the internal cluster registry, you will want to double-check your registry URL.

Internal name (accessing from a deployment manifest): image-registry.openshift-image-registry.svc:5000 External name (accessing from an external service or workstation): https://image-registry.apps.silver.devops.gov.bc.ca

common errors

Mistakenly using an external name in your deployment manifest

The in-cluster service accounts have default access tokens configured for the internal registry, but this does not include automatically logging into the external name. Errors like the following indicate that you will want to change your registry reference in your deployment manifest to the internal name instead of the external route.

Failed to pull image "image-registry.apps.silver.devops.gov.bc.ca/e52f12-dev/patroni:v10-stable": rpc error: code = Unknown 
desc = Error reading manifest v10-stable in image-registry.apps.silver.devops.gov.bc.ca/e52f12-dev/patroni: unauthorized: 
authentication required

Hard-coded registry name not changed during migration

Some deployment manifests and templates may still reference the OpenShift 3 registry DNS. Check your manifest file for things like docker-registry.default.svc:5000 or even an IP address like: 172.50.0.2:5000. If you see these in your manifests, you'll want to replace them with the internal name.

StevenBarre commented 4 years ago

The image registry in OCP4 is available internally via image-registry.openshift-image-registry.svc:5000 and externally via image-registry.apps.silver.devops.gov.bc.ca:443.

It appears that internal access works with local service accounts including the default image-puller and builder SAs out of the box. You should use this by default.

External access should be used with newly created service account when accessing the cluster from some other system.

garywong-bc commented 3 years ago

OCP3 names were: Internal name: docker-registry.default.svc:5000 External name: docker-registry.pathfinder.gov.bc.ca

Documenting here so that searches on the old names will return this issue.