Add auth for registry.redhat.io in baremetal proxy cluster #58855
Conversation
xiuwang
force-pushed
the
add-redhat-registry-auth
branch
from
dba99c3 to
7e44a2d
Compare
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: xiuwang The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
| function add_redhat_registry_auth () { | ||
| # get the registry configures of the cluster | ||
| run_command "oc extract secret/pull-secret -n openshift-config --confirm --to /tmp"; ret=$? | ||
| if [[ $ret -eq 0 ]]; then | ||
| redhat_auth_user=$(cat "/var/run/vault/mirror-registry/registry_redhat.json" | jq -r '.user') | ||
| redhat_auth_password=$(cat "/var/run/vault/mirror-registry/registry_redhat.json" | jq -r '.password') | ||
| registry_cred=`echo $redhat_auth_user:$redhat_auth_password | base64 -w 0` | ||
|
|
There was a problem hiding this comment.
Maybe it's better to set registry url for a parameter in function add_redhat_registry_auth, so next time it's easy to add other registry.
| @@ -4,6 +4,7 @@ workflow: | |||
| pre: | |||
| - chain: baremetal-lab-upi-conf-disconnected-proxy | |||
| - chain: baremetal-lab-upi-install | |||
| - ref: add-redhat-registry-auth | |||
There was a problem hiding this comment.
I have no much objection on this.
The only concern is why the disconnected install run mirror images, then enable proxy together. Compared with other platforms, generally if we mirrored images, we would not enable proxy any more, the install chain would mirror openshift imagestream in mirror-images-tag-images, so do not need to update cluster pull-secret.
I would leave this to metal team to review. cc @jadhaj @mhanss @pamoedom
There was a problem hiding this comment.
Firewall is setup for disconnected environment before mirroring step.
https://github.com/openshift/release/blob/master/ci-operator/step-registry/baremetal/lab/pre/firewall/baremetal-lab-pre-firewall-commands.sh#L16
There was a problem hiding this comment.
"cluster proxy + disconnected network" v.s "mirror-images + disconnected network", I meant, if this install workflow is for "mirror-images + disconnected network", in theory, no need to enable cluster proxy. That is my concern.
There was a problem hiding this comment.
I am working on removing the cluster wide proxy in this PR #59178
There was a problem hiding this comment.
I will close this pr after #59178 merged
There was a problem hiding this comment.
@sgoveas now the cluster is a disconnected cluster, should have no such issuse.
I will get you know if I meet it again, thanks
|
/pj-rehearse periodic-ci-openshift-openshift-tests-private-release-4.18-multi-nightly-baremetal-upi-ovn-ipv4-disconnected-proxy-arm-f14 |
|
@xiuwang: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@xiuwang: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
https://reportportal-openshift.apps.ocp-c1.prod.psi.redhat.com/ui/#prow/launches/1630/645728 set proxy cluster from disconnect state, so there is no registry.redhat.io auth for openshift imagestream in openshift-config/pull-secret. Add step for such profile.
@jianlinliu @wewang58 Could you help to review this?
Thanks