Closed sourcedelica closed 3 years ago
Even though the docs for the Default Registry say that
In this example RKE will use
registry.com
as the default registry for all system images, e.g.rancher/rke-tools:v0.1.14
will becomeregistry.com/rancher/rke-tools:v0.1.14
and Air-gapped Setups says
Prior to v0.1.10, you had to configure your private registry credentials and update the names of all the system images in the
cluster.yml
so that the image names would have the private registry URL appended before each image name.
That does not work.
If I change the name of the images in cluster.yml
to prepend my private registry then it does work.
@sourcedelica I didn't understand either, then I checked the source code..
If you have system_images
filled with images, rke will use them, just as they appear there, and doesn't care about private_registry
.
So if you use this:
system_images:
rancher/coreos-etcd:v3.4.3-rancher1
It will pull it from docker.io regardless of private_registry
.
If you remove all system images
from cluster.yml and define private_registry
rke will pull the default (rke config --system-images
) images from your registry.
So we can't use non-default images from private registry with private_registry
.
If you want to use different images from private registry you have to put them into system_images
with full path, like:
my.private.registry/rancher/coreos-etcd:v3.4.3-rancher1
The documentation then is really confusing... In my current setup I have a Foreman server acting as the registry. First I configured the Foreman server as the private registry and edited the system-images to contain the naming schedule Foreman uses, but I kept getting errors about the image either didn't exist of the registry required authentication.
@papdaniel @sourcedelica your comments actually helped me get it up and running, thanks!
But either the docs need to be fixed, or the code :-)
EDIT: oh, and it also seems pulling from authenticated private repos does not work then...
Maybe related to https://github.com/rancher/rke/issues/2228 ?
This issue/PR has been automatically marked as stale because it has not had activity (commit/comment/label) for 60 days. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.
@Thulium-Drake, @carloscarnero and @papdaniel, may I ask if reached full understanding how private registry works in air-gapped environment? I've been studying the documentation and its current version says:
Default Registry As of v0.1.10, RKE supports specifying a default registry from the list of private registries to be used with all system images. In this example, RKE will use registry.com as the default registry for all system images, e.g. rancher/rke-tools:v0.1.14 will become registry.com/rancher/rke-tools:v0.1.14.
Air-gapped Setups By default, all system images are being pulled from DockerHub. If you are on a system that does not have access to DockerHub, you will need to create a private registry that is populated with all the required system images.
As of v0.1.10, you have to configure your private registry credentials, but you can specify this registry as a default registry so that all system images are pulled from the designated private registry. You can use the command rke config --system-images to get the list of default system images to populate your private registry.
That gave me impression that I don't have to adjust section system-images
in my cluster.yml
. But when I examine docker inspect
and kubectl get po -o yaml
in recently deployed cluster they don't mention my registry anywhere.
So, I'm perplexed if have to explicitly point to my registry or I'm merely missing an obvious some command line parameter to address such case? BTW, I've got a couple of other questions.
insecure-registries
sufficient here?
RKE version: v1.0.0
Docker version: (
docker version
,docker info
preferred)Operating system and kernel: (
cat /etc/os-release
,uname -r
preferred)Type/provider of hosts: (VirtualBox/Bare-metal/AWS/GCE/DO) Bare-metal
cluster.yml file:
Steps to Reproduce:
rke up
with givencluster.yml
withprivate_registries
is_default: true
.Results: Ignores private registry, tries to pull from
docker.io
instead. This environment does not have access to outside world.