Container Registry - Infrastructure Components | Architecture | OKD 3.11 Documentation OKD 3.11 Architecture Infrastructure Components Container Registry About Welcome What's New? Overview Applications Cartridges Versus Images Terminology Getting Started Overview Web Console Walkthrough Command-Line Walkthrough Setting Up a Cluster Architecture Overview Infrastructure Components Kubernetes Infrastructure Container Registry Web Console Core Concepts Overview Containers and Images Pods and Services Projects and Users Builds and Image Streams Deployments Additional Concepts Authentication Authorization Persistent Storage Ephemeral Storage Source Control Management Admission Controllers Custom Admission Controllers Other API Objects Networking Networking OpenShift SDN Available SDN plug-ins Available router plug-ins Port Forwarding Remote Commands Routes Service Catalog Components Service Catalog Service Catalog CLI Template Service Broker OpenShift Ansible Broker AWS Service Broker Container Security Guide Introduction Container Hosts and Multi-tenancy Container Content Registries Build Process Deployment Securing the Container Platform Network Security Attached Storage Monitoring Events and Logs Installing Clusters Planning your installation System and environment requirements Preparing your hosts Configuring Your Inventory File Example Inventory Files Installing OpenShift Installing a stand-alone deployment of OpenShift container image registry Uninstalling OpenShift Upgrading Clusters Upgrade methods and strategies In-place upgrades Blue-green upgrades Updating operating systems Configuring Clusters Overview Setting up the Registry Internal Registry Overview Deploying a Registry on Existing Clusters Accessing the Registry Securing and Exposing the Registry Extended Registry Configuration Known Issues Setting up a Router Router Overview Using the Default HAProxy Router Deploying a Customized HAProxy Router Configuring the HAProxy Router to Use the PROXY Protocol Deploying Red Hat CloudForms Introduction Requirements Configuring Role Variables Running the Installer Enabling Container Provider Integration Uninstalling Prometheus Cluster Monitoring Accessing and Configuring the Red Hat Registry Master and Node Configuration OpenShift Ansible Broker Configuration Adding Hosts to an Existing Cluster Loading the Default Image Streams and Templates Configuring Custom Certificates Redeploying Certificates Configuring Authentication and User Agent Syncing groups with LDAP Configuring LDAP failover Configuring the SDN Configuring Nuage SDN Configuring NSX-T SDN Configuring Kuryr SDN Configuring for AWS Configuring for Red Hat Virtualization Configuring for OpenStack Configuring for Google Compute Engine Configuring for Azure Configuring for VMware vSphere Configuring Local Volumes Configuring Persistent Storage Overview Using NFS Using GlusterFS Using OpenStack Cinder Using Ceph RBD Using AWS Elastic Block Store Using GCE Persistent Disk Using iSCSI Using Fibre Channel Using Azure Disk Using Azure File Using FlexVolume Using VMware vSphere volumes for persistent storage Using Local Volume Using Container Storage Interface (CSI) Using OpenStack Manila shares Dynamic Provisioning and Creating Storage Classes Volume Security Selector-Label Volume Binding Enabling Controller-managed Attachment and Detachment Persistent Volume Snapshots Using hostPath Persistent Storage Examples Overview Sharing an NFS PV Across Two Pods Using Ceph RBD for Persistent Storage Using Ceph RBD for dynamic provisioning Complete Example Using GlusterFS Complete Example Using GlusterFS for Dynamic Provisioning Mounting Volumes To Privileged Pods Mount Propagation Switching an Integrated OpenShift Container Registry to GlusterFS Binding Persistent Volumes by Label Using StorageClasses for Dynamic Provisioning Using StorageClasses for Existing Legacy Storage Configuring Azure Blob Storage for Integrated Container Image Registry Configuring Ephemeral Storage Working with HTTP Proxies Configuring Global Build Defaults and Overrides Configuring Pipeline Execution Configuring Route Timeouts Configuring Native Container Routing Routing from Edge Load Balancers Aggregating Container Logs Aggregate Logging Sizing Guidelines Enabling Cluster Metrics Customizing the Web Console Deploying External Persistent Volume Provisioners Installing the Operator Framework (Technology Preview) Uninstalling Operator Lifecycle Manager Day Two Operations Guide Overview Run-once tasks Environment health checks Creating an environment-wide backup Host-level tasks Project-level tasks Docker tasks Managing Certificates Cluster Administration Overview Managing Nodes Restoring your cluster Replacing a master host Managing Users Managing Projects Managing Pods Managing Networking Configuring Service Accounts Managing Role-based Access Control Image Policy Image Signatures Scoped Tokens Monitoring Images Managing Security Context Constraints Scheduling Overview Default Scheduling Descheduling Custom Scheduling Controlling Pod Placement Pod Priority and Preemption Advanced Scheduling Advanced Scheduling and Node Affinity Advanced Scheduling and Pod Affinity/Anti-affinity Advanced Scheduling and Node Selectors Advanced Scheduling and Taints and Tolerations Setting Quotas Setting Multi-Project Quotas Pruning objects Extending the Kubernetes API with Custom Resources Garbage Collection Allocating Node Resources Overcommitting Out of Resource Handling Setting Limit Ranges Node Problem Detector Assigning Unique External IPs for Ingress Traffic Monitoring and Debugging Routers High Availability IPtables Securing Builds by Strategy Restricting Application Capabilities Using Seccomp Sysctls Encrypting Data at Datastore Layer Encrypting traffic between nodes with IPsec Building Dependency Trees Replacing a failed etcd member Restoring etcd quorum Troubleshooting Networking Diagnostics Tool Idling Applications Analyzing Cluster Capacity Configuring the cluster auto-scaler in AWS Disabling Features using Feature Gates Kuryr SDN Administration Scaling and Performance Guide Overview Recommended Installation Practices Recommended Host Practices Optimizing Compute Resources Optimizing Persistent Storage Optimizing Ephemeral Storage Network Optimization Routing Optimization Scaling Cluster Metrics Scaling Cluster Monitoring Tested Maximums per Cluster Using Cluster Loader Using CPU Manager Managing Huge Pages Optimizing On GlusterFS Storage Developer Guide Overview Application Life Cycle Management Planning Your Development Process Creating New Applications Promoting Applications Across Environments Authentication Authorization Projects Migrating Applications Overview Database Applications Web Framework Applications QuickStart Examples Continuous Integration and Deployment Webhooks and Action Hooks S2I Tool Support Guide Tutorials Overview Quickstart Templates Ruby on Rails Setting Up a Nexus Mirror OpenShift Pipeline Builds Binary Builds Builds How Builds Work Basic Build Operations Build Inputs Build Output Build Strategy Options Build Environment Triggering Builds Build Hooks Build Run Policy Advanced Build Operations Troubleshooting Deployments How Deployments Work Basic Deployment Operations Deployment Strategies Advanced Deployment Strategies Kubernetes Deployments Support Templates Opening a Remote Shell to Containers Service Accounts Managing Images Quotas and Limit Ranges Getting Traffic into a Cluster Overview Using a Router Using a Load Balancer Using a Service ExternalIP Using a NodePort Routes Integrating External Services Using Device Manager Using Device Plug-ins Secrets ConfigMaps Downward API Projected Volumes Using Daemonsets Pod Autoscaling Managing Volumes Using Persistent Volumes Expanding Persistent Volumes Executing Remote Commands Copying Files Port Forwarding Shared Memory Application Health Events Managing Environment Variables Jobs OpenShift Pipeline Cron Jobs Create from URL Creating an object from a custom resource definition Application memory sizing Creating Images Overview Guidelines Image Metadata S2I Requirements Testing S2I Images Custom Builder Using Images Overview Source-to-Image (S2I) Overview Java Node.js Perl PHP Python Ruby Customizing S2I Images Database Images Overview MySQL PostgreSQL MongoDB MariaDB Other Images Overview Jenkins Jenkins Slaves Other Container Images CLI Reference Overview Get Started with the CLI Managing CLI Profiles Developer CLI Operations Administrator CLI Operations Differences Between oc and kubectl Extending the CLI Ansible Playbook Bundle Development Guide Introduction CLI Tooling Writing APBs Getting Started Reference Operators Getting started with the Operator SDK API reference API list Common object reference Index core About core Binding [core/v1] ComponentStatus [core/v1] ConfigMap [core/v1] Endpoints [core/v1] Event [core/v1] LimitRange [core/v1] Namespace [core/v1] Node [core/v1] PersistentVolumeClaim [core/v1] PersistentVolume [core/v1] Pod [core/v1] PodTemplate [core/v1] ReplicationController [core/v1] ResourceQuota [core/v1] Secret [core/v1] ServiceAccount [core/v1] Service [core/v1] admissionregistration.k8s.io About admissionregistration.k8s.io MutatingWebhookConfiguration [admissionregistration.k8s.io/v1beta1] ValidatingWebhookConfiguration [admissionregistration.k8s.io/v1beta1] apiregistration.k8s.io About apiregistration.k8s.io APIService [apiregistration.k8s.io/v1] apps About apps ControllerRevision [apps/v1] DaemonSet [apps/v1] Deployment [apps/v1] ReplicaSet [apps/v1] StatefulSet [apps/v1] apps.openshift.io About apps.openshift.io DeploymentConfig [apps.openshift.io/v1] authentication.k8s.io About authentication.k8s.io TokenReview [authentication.k8s.io/v1] authorization.k8s.io About authorization.k8s.io LocalSubjectAccessReview [authorization.k8s.io/v1] SelfSubjectAccessReview [authorization.k8s.io/v1] SelfSubjectRulesReview [authorization.k8s.io/v1] SubjectAccessReview [authorization.k8s.io/v1] authorization.openshift.io About authorization.openshift.io ClusterRoleBinding [authorization.openshift.io/v1] ClusterRole [authorization.openshift.io/v1] LocalResourceAccessReview [authorization.openshift.io/v1] LocalSubjectAccessReview [authorization.openshift.io/v1] ResourceAccessReview [authorization.openshift.io/v1] RoleBindingRestriction [authorization.openshift.io/v1] RoleBinding [authorization.openshift.io/v1] Role [authorization.openshift.io/v1] SelfSubjectRulesReview [authorization.openshift.io/v1] SubjectAccessReview [authorization.openshift.io/v1] SubjectRulesReview [authorization.openshift.io/v1] autoscaling About autoscaling HorizontalPodAutoscaler [autoscaling/v1] batch About batch CronJob [batch/v1beta1] Job [batch/v1] build.openshift.io About build.openshift.io BuildConfig [build.openshift.io/v1] Build [build.openshift.io/v1] certificates.k8s.io About certificates.k8s.io CertificateSigningRequest [certificates.k8s.io/v1beta1] events.k8s.io About events.k8s.io Event [events.k8s.io/v1beta1] image.openshift.io About image.openshift.io Image [image.openshift.io/v1] ImageSignature [image.openshift.io/v1] ImageStreamImage [image.openshift.io/v1] ImageStreamImport [image.openshift.io/v1] ImageStreamMapping [image.openshift.io/v1] ImageStream [image.openshift.io/v1] ImageStreamTag [image.openshift.io/v1] network.openshift.io About network.openshift.io ClusterNetwork [network.openshift.io/v1] EgressNetworkPolicy [network.openshift.io/v1] HostSubnet [network.openshift.io/v1] NetNamespace [network.openshift.io/v1] networking.k8s.io About networking.k8s.io NetworkPolicy [networking.k8s.io/v1] oauth.openshift.io About oauth.openshift.io OAuthAccessToken [oauth.openshift.io/v1] OAuthAuthorizeToken [oauth.openshift.io/v1] OAuthClientAuthorization [oauth.openshift.io/v1] OAuthClient [oauth.openshift.io/v1] policy About policy PodDisruptionBudget [policy/v1beta1] PodSecurityPolicy [policy/v1beta1] project.openshift.io About project.openshift.io ProjectRequest [project.openshift.io/v1] Project [project.openshift.io/v1] quota.openshift.io About quota.openshift.io AppliedClusterResourceQuota [quota.openshift.io/v1] ClusterResourceQuota [quota.openshift.io/v1] rbac.authorization.k8s.io About rbac.authorization.k8s.io ClusterRoleBinding [rbac.authorization.k8s.io/v1] ClusterRole [rbac.authorization.k8s.io/v1] RoleBinding [rbac.authorization.k8s.io/v1] Role [rbac.authorization.k8s.io/v1] route.openshift.io About route.openshift.io Route [route.openshift.io/v1] scheduling.k8s.io About scheduling.k8s.io PriorityClass [scheduling.k8s.io/v1beta1] security.openshift.io About security.openshift.io PodSecurityPolicyReview [security.openshift.io/v1] PodSecurityPolicySelfSubjectReview [security.openshift.io/v1] PodSecurityPolicySubjectReview [security.openshift.io/v1] RangeAllocation [security.openshift.io/v1] SecurityContextConstraints [security.openshift.io/v1] storage.k8s.io About storage.k8s.io StorageClass [storage.k8s.io/v1] VolumeAttachment [storage.k8s.io/v1beta1] template.openshift.io About template.openshift.io BrokerTemplateInstance [template.openshift.io/v1] Template [template.openshift.io/v1] TemplateInstance [template.openshift.io/v1] Template [template.openshift.io/v1] user.openshift.io About user.openshift.io Group [user.openshift.io/v1] Identity [user.openshift.io/v1] UserIdentityMapping [user.openshift.io/v1] User [user.openshift.io/v1] CRI-O Runtime Using the CRI-O Container Engine Minishift Overview Getting Started Overview Preparing to Install Minishift Setting Up the Virtualization Environment Installing Minishift Minishift Quickstart Updating Minishift Uninstalling Minishift Using Minishift Overview Basic Usage Profiles Image Caching Add-ons Host Folders Assign Static IP Address Minishift Docker Daemon Choosing the ISO Image Experimental Features Run Against An Existing Machine Interacting with OpenShift Overview Using the OpenShift Client Binary Exposing Services Accessing the OpenShift Docker Registry Troubleshooting Minishift Overview Troubleshooting Getting Started Troubleshooting Driver Plug-ins Troubleshooting Miscellaneous Contributing to Minishift Overview Developing Minishift Minishift CI Writing Documentation Releasing Minishift Command Reference minishift minishift addons minishift addons apply minishift addons disable minishift addons enable minishift addons install minishift addons list minishift addons remove minishift addons uninstall minishift completion minishift config minishift config get minishift config set minishift config unset minishift config view minishift console minishift delete minishift docker-env minishift hostfolder minishift hostfolder add minishift hostfolder list minishift hostfolder mount minishift hostfolder remove minishift hostfolder umount minishift image minishift image cache-config minishift image cache-config add minishift image cache-config remove minishift image cache-config view minishift image delete minishift image export minishift image import minishift image list minishift ip minishift logs minishift oc-env minishift openshift minishift openshift component minishift openshift component add minishift openshift component list minishift openshift config minishift openshift config set minishift openshift config view minishift openshift registry minishift openshift restart minishift openshift service minishift openshift service list minishift openshift version minishift openshift version list minishift profile minishift profile copy minishift profile delete minishift profile list minishift profile set minishift services minishift services list minishift services start minishift services stop minishift setup minishift ssh minishift start minishift status minishift stop minishift update minishift version × Show more results Container Registry Overview Integrated OpenShift Container Registry Third Party Registries Authentication Red Hat Quay Registries Authentication Enabled Red Hat Registry Overview OKD can utilize any server implementing the container image registry API as a source of images, including the Docker Hub, private registries run by third parties, and the integrated OKD registry. Integrated OpenShift Container Registry OKD provides an integrated container image registry called OpenShift Container Registry (OCR) that adds the ability to automatically provision new image repositories on demand. This provides users with a built-in location for their application builds to push the resulting images. Whenever a new image is pushed to OCR, the registry notifies OKD about the new image, passing along all the information about it, such as the namespace, name, and image metadata. Different pieces of OKD react to new images, creating new builds and deployments. OCR can also be deployed as a stand-alone component that acts solely as a container image registry, without the build and deployment integration. See Installing a Stand-alone Deployment of OpenShift Container Registry for details. Third Party Registries OKD can create containers using images from third party registries, but it is unlikely that these registries offer the same image notification support as the integrated OKD registry. In this situation OKD will fetch tags from the remote registry upon imagestream creation. Refreshing the fetched tags is as simple as running oc import-image <stream>. When new images are detected, the previously-described build and deployment reactions occur. Authentication OKD can communicate with registries to access private image repositories using credentials supplied by the user. This allows OKD to push and pull images to and from private repositories. The Authentication topic has more information. Red Hat Quay Registries If you need an enterprise-quality container image registry, Red Hat Quay is available both as a hosted service and as software you can install in your own data center or cloud environment. Advanced registry features in Red Hat Quay include geo-replication, image scanning, and the ability to roll back images. Visit the Quay.io site to set up your own hosted Quay registry account. After that, follow the Quay Tutorial to log in to the Quay registry and start managing your images. Alternatively, refer to Getting Started with Red Hat Quay for information about setting up your own Red Hat Quay registry. You can access your Red Hat Quay registry from OKD like any remote container image registry. To learn how to set up credentials to access Red Hat Quay as a secured registry, refer to Allowing Pods to Reference Images from Other Secured Registries. Authentication Enabled Red Hat Registry All container images available through the Red Hat Container Catalog are hosted on an image registry, registry.access.redhat.com. With OKD 3.11 Red Hat Container Catalog moved from registry.access.redhat.com to registry.redhat.io. The new registry, registry.redhat.io, requires authentication for access to images and hosted content on OKD. Following the move to the new registry, the existing registry will be available for a period of time. OKD pulls images from registry.redhat.io, so you must configure your cluster to use it. The new registry uses standard OAuth mechanisms for authentication, with the following methods: Authentication token. Tokens, which are generated by administrators, are service accounts that give systems the ability to authenticate against the container image registry. Service accounts are not affected by changes in user accounts, so the token authentication method is reliable and resilient. This is the only supported authentication option for production clusters. Web username and password. This is the standard set of credentials you use to log in to resources such as access.redhat.com. While it is possible to use this authentication method with OKD, it is not supported for production deployments. Restrict this authentication method to stand-alone projects outside OKD. You can use docker login with your credentials, either username and password or authentication token, to access content on the new registry. All image streams point to the new registry. Because the new registry requires authentication for access, there is a new secret in the OpenShift namespace called imagestreamsecret. You must place your credentials in two places: OpenShift namespace. Your credentials must exist in the OpenShift namespace so that the image streams in the OpenShift namespace can import. Your host. Your credentials must exist on your host because Kubernetes uses the credentials from your host when it goes to pull images. To access the new registry: Verify image import secret, imagestreamsecret, is in your OpenShift namespace. That secret has credentials that allow you to access the new registry. Verify all of your cluster nodes have a /var/lib/origin/.docker/config.json, copied from master, that allows you to access the Red Hat registry. Image attribution