标签：下载   相关信息   环境变量   shift   main   文件   tps   rom   更新   

1、创建registry服务器

（1）安装需要的包

yum -y install podman httpd-tools

（2）创建registry目录

mkdir -p /opt/registry/{auth,certs,data}

（3）生成registry服务器证书 注意文件名不能更改改成其他名字，registry pod启动时会找不到

cd /opt/registry/certs
openssl req -newkey rsa:4096 -nodes -sha256 -keyout domain.key -x509 -days 365 -out domain.crt

（4）生成bcrpt格式的密码

htpasswd -bBc /opt/registry/auth/htpasswd root Scwang18

（5）创建mirror-registry容器

podman run --name mirror-registry -p 5000:5000      -v /opt/registry/data:/var/lib/registry:z      -v /opt/registry/auth:/auth:z      -e "REGISTRY_AUTH=htpasswd"      -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm"      -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd      -v /opt/registry/certs:/certs:z      -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt      -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key      -d docker.io/library/registry:2

（6）添加防火墙端口

firewall-cmd --add-port=5000/tcp --zone=internal --permanent 
firewall-cmd --add-port=5000/tcp --zone=public   --permanent 
firewall-cmd --reload

（7）添加签名签名证书到受信证书列表

cp /opt/registry/certs/domain.crt /etc/pki/ca-trust/source/anchors/
update-ca-trust

（8）测试registry是否可用

curl -u root:xxxx -k https://registry.ipincloud.com:5000/v2/_catalog

2、修改pullsecret

在受限网络安装OCP，需要将私有镜像registry的相关信息更新到pullsecret。

（1）从https://cloud.redhat.com/openshift/install/pull-secret下载pullsecret

cat << 'EOF' > /opt/registry/certs/pull-secret.txt
{"auths":{"cloud.openshift.com":{省略}}}
EOF

（2）将1步创建registry服务时使用的用户名\密码转换成base64编码的token

[root@misc certs]# echo -n 'root:Scwang18' | base64 -w0
cm9vdDpTY3dhbmcxOA==
[root@misc certs]#

（3）将pullsecret格式转换成json，便于增加自己的私有registrt

cat ./pull-secret.txt | jq .  > ./pull-secret.json

（4）将私有mirror registry添加到pull-secret.json

[root@misc certs]# cat pull-secret.json
{
  "auths": {
    "cloud.openshift.com": {      
      "auth": "省略",
      "email": "省略"
    },
    "quay.io": {      
      "auth": "省略",
      "email": "省略"

    },
    "registry.connect.redhat.com": {
      "auth": "省略",
      "email": "省略"

    },
    "registry.redhat.io": {
      "auth": "省略",
      "email": "scwang18@163.com"
    },
    "registry.ipincloud.com:5000": {
      "auth": "cm9vdDpTY3dhbmcxOA==",
      "email": "scwang18@163.com"
    }
  }
}
[root@misc certs]#

3、同步ocp镜像仓库到私有registry

（1）设置registry环境变量

export OCP_RELEASE=4.3.0
export LOCAL_REGISTRY='registry.ipincloud.com:5000' 
export LOCAL_REPOSITORY='ocp4/openshift4' 
export PRODUCT_REPO='openshift-release-dev' 
export LOCAL_SECRET_JSON='/opt/registry/certs/pull-secret.json' 
export RELEASE_NAME="ocp-release" 

（2）开始镜像

oc adm release mirror -a ${LOCAL_SECRET_JSON}      --from=quay.io/${PRODUCT_REPO}/${RELEASE_NAME}:${OCP_RELEASE}-x86_64      --to=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY}      --to-release-image=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY}:${OCP_RELEASE}
     
oc adm release mirror -a /opt/registry/certs/pull-secret.json --from=quay.io/openshift-release-dev/ocp-release:4.3.0-x86_64 --to-release-image=registry.ipincloud.com:5000/ocp4/openshift4:4.3.0 --to=registry.ipincloud.com:5000/ocp4/openshift4     

（3）同步完成后，记录完成信息，在集群中使用

4、完成

openshift搭建私有registry

标签：下载   相关信息   环境变量   shift   main   文件   tps   rom   更新   

原文地址：https://www.cnblogs.com/myocp/p/12283351.html