Thanks for this update Jerry. I’ll add this to our docs team agenda today.

 

-- Mike

 

 

Hi Docs Team,

 

I don’t think I ever sent an email here about the Docker registry on the controller. This is for story 2002840

 

A docker registry is now deployed on the management network. You can interact with the registry through the address "registry.local:9001". For example, "docker login registry.local:9001" Please refer to upstream docker registry documentation for full list of commands.

 

The docker registry deployed on the controllers are now authenticated with the same credentials as the platform keystone. Before pushing and pulling images, please run "docker login registry.local:9001" with your platform keystone credentials.

 

The authorization rules for the docker registry is that admin can perform any action while regular users can only interact with their own repo. For example, only "admin" and "testuser" can push/pull to registry.local:9001/testuser/busybox:latest.

 

Note: an unfortunate side effect of tieing docker registry auth to keystone is that there needs to be a keystone user in all lowercase to be used with the registry. Docker registry does not allow repos to be in caps (registry.local:9001/TESTUSER/busybox:latest) so the user might need to create a separate keystone user in all lower case.

 

The command "system certificate-install" now supports updating the certificate used by all docker registry communication. This is done through the docker_registry mode (system certificate-install -m/--mode docker_registry path_to_cert)

 

Thanks,

Jerry