[Starlingx-discuss] Approach for SB 2004710 support to access docker images via proxy?

Tue Jan 15 14:16:55 UTC 2019

Hello,
I also wanted to bring to your attention the following spec and storyboard.  These outline changes forthcoming for replacing config_controller.  Therefore, any changes that are introduce for config_controller should consider the impacts to this development.

https://review.openstack.org/#/c/629581/
https://storyboard.openstack.org/#!/story/2004695

From: "Qi, Mingyuan" <mingyuan.qi at intel.com>
Date: Monday, January 14, 2019 at 9:29 PM
To: Barton Wensley <Barton.Wensley at windriver.com>, "Miller, Frank" <Frank.Miller at windriver.com>, "Kung, John" <John.Kung at windriver.com>
Cc: Chris Friesen <Chris.Friesen at windriver.com>, "Church, Robert" <Robert.Church at windriver.com>, Brent Rowsell <Brent.Rowsell at windriver.com>, "Xie, Cindy" <cindy.xie at intel.com>, "Penney, Don" <Don.Penney at windriver.com>, "Peters, Matt" <Matt.Peters at windriver.com>
Subject: RE: Approach for SB 2004710 support to access docker images via proxy?

Thanks Bart, I agree with the proxy part. As for alternate docker registry I have different thinking.

The additional docker registry(or called registry mirror) is to accelerate docker image pulling from internet, not only for openstack-helm, but also for k8s/armada image. It’s slightly different from local docker registry (say controller_address:9001) while local registry is more like a cache for controller after pulling. If the registry mirror is needed for k8s/armada, it has to be set in config_controller as well. Meanwhile the registry mirror address may be in no_proxy if it’s host is within the same LAN as controller.

For the proxy SB, once which table is confirmed to store proxy info, I will finish the code for review.

Thanks,
Mingyuan

From: Wensley, Barton [mailto:Barton.Wensley at windriver.com]
Sent: Tuesday, January 15, 2019 4:58
To: Miller, Frank <Frank.Miller at windriver.com>; Qi, Mingyuan <mingyuan.qi at intel.com>; Kung, John <John.Kung at windriver.com>
Cc: Friesen, Chris <Chris.Friesen at windriver.com>; Church, Robert <Robert.Church at windriver.com>; Rowsell, Brent <Brent.Rowsell at windriver.com>; Xie, Cindy <cindy.xie at intel.com>; Penney, Don <Don.Penney at windriver.com>; Peters, Matt <Matt.Peters at windriver.com>
Subject: RE: Approach for SB 2004710 support to access docker images via proxy?

Mingyuan,

As far as the input of the new configuration goes, we typically only add configuration questions to config_controller if the data is required for the execution of config_controller. In your case, I expect the proxy configuration would be required by config_controller (in order to download the kubernetes images), but the alternate docker registry wouldn’t be required until the stx-openstack application was required.

So for the proxy configuration, we would probably add a new set of questions something like this:

Kubernetes Configuration:
-------------------------
Configure http proxy [y/N]: y
HTTP proxy URL: http://proxy.example.com:80
HTTPS proxy URL: https://proxy.example.com:443

I suspect that the NO_PROXY for the service config file can be calculated ourselves - I assume it will just have the IP of our internal docker registry?

The http proxy config would be system wide configuration value, so it wouldn’t belong in the host table. John Kung or Matt Peters can comment on which sysinv table you should use. The configuration of the http-proxy.conf file can be done in the docker.pp manifest as you suggested below. This needs to be done on both controllers.

You need input from Bob Church for the configuration of the alternate docker registry. I think the registry is currently hardcoded in sysinv. I suspect we will want a new sysinv command to specify the new docker registry, but Bob or John should comment on that.

Bart

From: Miller, Frank
Sent: January 14, 2019 2:36 PM
To: Qi, Mingyuan
Cc: Friesen, Chris; Wensley, Barton; Church, Robert; Rowsell, Brent; Xie, Cindy; Penney, Don
Subject: RE: Approach for SB 2004710 support to access docker images via proxy?

Thanks for the update Mingyuan.

Bart are you able to provide your suggestions to Mingyuan on the best approach for this?

Frank

From: Qi, Mingyuan [mailto:mingyuan.qi at intel.com]
Sent: Monday, January 14, 2019 2:38 AM
To: Miller, Frank
Cc: Friesen, Chris; Wensley, Barton; Church, Robert; Rowsell, Brent; Xie, Cindy
Subject: RE: Approach for SB 2004710 support to access docker images via proxy?

Frank,

Thanks for your note, I was just wondering how wide I should send my I thoughts for review.
Last week, I tried 2 approaches to implement proxy:

First one is following the complete mechanism of config_controller

•         collect proxy info in input_config() and treat them as host values.

•         add 3 attributes(http_proxy, https_proxy, no_proxy) to ihost of sysinv/cgts-client.

•         accordingly add 3 fields in sysinv host api/object/db.

•         add 3 params to docker puppet class and update them during pupput platform yaml file generation.

•         apply docker.pp to create http-proxy.conf with user input proxy info.
One questions about this approach:
Is ihost the suitable table for proxy info? Most likely the first controller is the only one node that docker needs proxy to access internet on, is this info redundant for each host?

Or an alternative one without adding proxy info to sysinv db is better? I did a trail but introduced a shortcut mechanism in config_controller:

•         collect proxy info in input_config() as well

•         a utility script to add proxy info to host yaml after host puppet config creation finished.

•         Same as the previous approach to apply docker puppet manifest

Same situation as the docker registry mirror, they could be done as the same approach. Really appreciate your comments.

Thanks,
Mingyuan

From: Miller, Frank [mailto:Frank.Miller at windriver.com]
Sent: Monday, January 14, 2019 6:36
To: Qi, Mingyuan <mingyuan.qi at intel.com<mailto:mingyuan.qi at intel.com>>
Cc: Friesen, Chris <Chris.Friesen at windriver.com<mailto:Chris.Friesen at windriver.com>>; Wensley, Barton <Barton.Wensley at windriver.com<mailto:Barton.Wensley at windriver.com>>; Church, Robert <Robert.Church at windriver.com<mailto:Robert.Church at windriver.com>>; Rowsell, Brent <Brent.Rowsell at windriver.com<mailto:Brent.Rowsell at windriver.com>>; Xie, Cindy <cindy.xie at intel.com<mailto:cindy.xie at intel.com>>
Subject: Approach for SB 2004710 support to access docker images via proxy?

Mingyuan:

Thank-you for taking this on.  Can you describe the code changes that you think are needed for adding support to access docker images via a proxy?  I’ve cc’d a few senior designers who can help you if required and provide initial feedback to you before you get too far into any implementation and post a gerrit review.

Frank

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20190115/61a361b6/attachment-0001.html>