<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
a:link, span.MsoHyperlink
{color:#0563C1;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:#954F72;
text-decoration:underline}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
span.EmailStyle17
{font-family:"Calibri",sans-serif;
color:windowtext}
span.EmailStyle18
{font-family:"Calibri",sans-serif;
color:#1F497D}
.MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.WordSection1
{}
-->
</style><style type="text/css" id="owaParaStyle"></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="" fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Thanks for this update Jerry. I’ll add this to our docs team agenda today.</span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="color:#1F497D">-- Mike</span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><a name="_MailOriginal"></a><a name="_____replyseparator"></a><span style=""><b><span style="">From:</span></b></span><span style=""><span style=""> Sun, Yicheng (Jerry) [mailto:Jerry.Sun@windriver.com]
<br>
<b>Sent:</b> Wednesday, July 17, 2019 8:33 AM<br>
<b>To:</b> starlingx-discuss@lists.starlingx.io<br>
<b>Subject:</b> [Starlingx-discuss] [docs] Controller Docker Registry</span></span></p>
</div>
</div>
<p class="MsoNormal"><span style=""> </span></p>
<p class="MsoNormal"><span style=""><span lang="EN-CA" style="">Hi Docs Team,</span></span></p>
<p class="MsoNormal"><span style=""><span lang="EN-CA" style=""> </span></span></p>
<p class="MsoNormal"><span style=""><span lang="EN-CA" style="">I don’t think I ever sent an email here about the Docker registry on the controller. This is for story 2002840</span></span></p>
<p class="MsoNormal"><span style=""><span lang="EN-CA" style=""> </span></span></p>
<p class="MsoNormal"><span style=""><span lang="EN-CA" style="">A docker registry is now deployed on the management network. You can interact with the registry through the address "registry.local:9001". For example, "docker login registry.local:9001" Please
refer to upstream docker registry documentation for full list of commands.</span></span></p>
<p class="MsoNormal"><span style=""><span lang="EN-CA" style=""> </span></span></p>
<p class="MsoNormal"><span style=""><span lang="EN-CA" style="">The docker registry deployed on the controllers are now authenticated with the same credentials as the platform keystone. Before pushing and pulling images, please run "docker login registry.local:9001"
with your platform keystone credentials.</span></span></p>
<p class="MsoNormal"><span style=""><span lang="EN-CA" style=""> </span></span></p>
<p class="MsoNormal"><span style=""><span lang="EN-CA" style="">The authorization rules for the docker registry is that admin can perform any action while regular users can only interact with their own repo. For example, only "admin" and "testuser" can push/pull
to registry.local:9001/testuser/busybox:latest.</span></span></p>
<p class="MsoNormal"><span style=""><span lang="EN-CA" style=""> </span></span></p>
<p class="MsoNormal"><span style=""><span lang="EN-CA" style="">Note: an unfortunate side effect of tieing docker registry auth to keystone is that there needs to be a keystone user in all lowercase to be used with the registry. Docker registry does not allow
repos to be in caps (registry.local:9001/TESTUSER/busybox:latest) so the user might need to create a separate keystone user in all lower case.</span></span></p>
<p class="MsoNormal"><span style=""><span lang="EN-CA" style=""> </span></span></p>
<p class="MsoNormal"><span style=""><span lang="EN-CA" style="">The command "system certificate-install" now supports updating the certificate used by all docker registry communication. This is done through the docker_registry mode (system certificate-install
-m/--mode docker_registry path_to_cert)</span></span></p>
<p class="MsoNormal"><span style=""><span lang="EN-CA" style=""> </span></span></p>
<p class="MsoNormal"><span style=""><span lang="EN-CA" style="">Thanks,</span></span></p>
<p class="MsoNormal"><span style=""><span lang="EN-CA" style="">Jerry</span></span><span lang="EN-CA" style=""></span></p>
</div>
</div>
</body>
</html>