Skip to content

Commit 0a025a8

Browse files
aweitekaaweiteka
committed
atomic-registry via systemd
1 parent 01ad56a commit 0a025a8

14 files changed

+2767
-0
lines changed

‎examples/atomic-registry/systemd/Dockerfile

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#FROM registry.access.redhat.com/openshift3/ose
2+
FROM openshift/origin
3+
4+
LABEL name="projectatomic/atomic-registry-install" \
5+
vendor="Project Atomic" \
6+
url="https://projectatomic.io/registry" \
7+
summary="Systemd installation container for Atomic Registry" \
8+
description="This image installs Atomic Registry on a single host as systemd unit files. Atomic Registry is an open source enterprise registry solution based on the Origin project featuring single sign-on (SSO) user experience, a robust web interface and advanced role-based access control (RBAC)." \
9+
INSTALL='docker run -it --rm \
10+
--privileged \
11+
--net=host \
12+
-v /etc/atomic-registry/:/etc/atomic-registry/ \
13+
-v /var/lib/atomic-registry/:/var/lib/atomic-registry/ \
14+
-v /:/host \
15+
--entrypoint /usr/bin/install.sh \
16+
$IMAGE' \
17+
UNINSTALL='docker run -it --rm \
18+
--privileged \
19+
-v /:/host \
20+
--entrypoint /usr/bin/uninstall.sh \
21+
$IMAGE'
22+
23+
ADD services/ templates/ setup-atomic-registry.sh /exports/
24+
ADD install.sh uninstall.sh /usr/bin/

‎examples/atomic-registry/systemd/README.md

+104
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# Atomic Registry managed by systemd
2+
3+
http://docs.projectatomic.io/registry/
4+
5+
## Installation
6+
7+
1. Install
8+
9+
sudo atomic install projectatomic/atomic-registry-install <hostname>
10+
11+
1. Start system services
12+
13+
sudo systemctl start atomic-registry-master.service
14+
15+
1. Setup the registry. This script creates the oauth client so the web console can connect. It also configures the registry service account so it can connect to the API master.
16+
17+
sudo /var/run/setup-atomic-registry.sh <hostname>
18+
19+
1. Until the registry is secured with TLS certificates, configure client docker daemon to **--insecure-registry** and restart.
20+
21+
/etc/sysconfig/docker
22+
sudo systemctl restart docker.service
23+
24+
**Optional post-install configuration:**
25+
* configure authentication provider. **NOTE**: by default *ANY* username and password will authenticate users.
26+
* configure storage
27+
* mount local storage **/var/lib/atomic-registry/registry** or
28+
* configure cloud storage in **/etc/atomic-registry/registry/config.yml**
29+
* add TLS certificates to services (see below)
30+
31+
## Uninstall
32+
33+
* Uninstall but **retain data** in /var/lib/atomic-registry. This will remove all configuration changes, etc. You can run install steps again and existing data will be available in the new deployment configuration.
34+
35+
sudo atomic install projectatomic/atomic-registry-install
36+
* Uninstall and **remove data** in /var/lib/atomic-registry. This will remove all images and the datastore. This will completely clean up the environment.
37+
38+
sudo atomic install projectatomic/atomic-registry-install --remove-data
39+
40+
## Services
41+
42+
| Service and container name | Role | Configuration | Data | Port |
43+
| -------------------------- | ---- | ------------- | ---- | ---- |
44+
| atomic-registry-master | auth, datastore, API | General config, incl auth: /etc/atomic-registry/master/master-config.yaml, Log level: /etc/sysconfig/atomic-registry-master | datastore: /var/lib/atomic-registry/etcd | 8443 |
45+
| atomic-registry | docker registry | /etc/sysconfig/atomic-registry, /etc/atomic-registry/registry/config.yml | images: /var/lib/atomic-registry/registry | 5000 |
46+
| atomic-registry-console | web console | /etc/sysconfig/atomic-registry-console | none (stateless) | 9090 |
47+
48+
## Changing configuration
49+
50+
1. Edit appropriate configuration file(s) on host
51+
1. Restart service via systemd
52+
53+
sudo systemctl restart <service_name>
54+
55+
## Updating
56+
57+
As a microservice application the three services may theoretically be updated independently. However, it is strongly recommended that the services be updated together to ensure you are deploying a tested configuration.
58+
59+
1. Pull the updated images
60+
61+
sudo docker pull openshift/origin
62+
sudo docker pull openshift/origin-docker-registry
63+
sudo docker pull cockpit/kubernetes
64+
1. Restart the services
65+
66+
sudo systemctl restart atomic-registry-console
67+
sudo systemctl restart atomic-registry-master
68+
sudo systemctl restart atomic-registry
69+
70+
## Data persistence and backup
71+
72+
The data that should be persisted is the configuration, image data and the registry database. These are mounted on the host. See Service table above for specific paths.
73+
74+
## Secure Registry endpoint
75+
76+
Here we create a self-signed certificate so docker clients can connect using TLS. While other tools like openssl may be used to create certificates, the master API provides a tool that may also be used.
77+
78+
1. `sudo docker exec -it atomic-registry-master bash`
79+
1. `cd /etc/atomic-registry/master`
80+
1. `oadm ca create-server-cert --signer-cert=ca.crt --signer-key=ca.key --signer-serial=ca.serial.txt --hostnames='<hostname(s)>' --cert=registry.crt --key=registry.key`
81+
1. `exit`
82+
1. `sudo cp /etc/atomic-registry/master/registry.* /etc/atomic-registry/registry/`
83+
1. `sudo chown -R 1001:root /etc/atomic-registry/registry/`
84+
1. Edit `/etc/sysconfig/atomic-registry`, uncomment environment variables *REGISTRY_HTTP_TLS_CERTIFICATE* and *REGISTRY_HTTP_TLS_KEY*.
85+
1. `sudo systemctl restart atomic-registry`
86+
87+
### Serving the certificate for docker clients
88+
89+
If you're creating a self-signed certificate key pair you want to make the public CA certificate available to end-users so they don't have to put docker into insecure mode.
90+
91+
1. Edit `/etc/atomic-registry/master/master-config.yaml` and add the following extension.
92+
93+
assetConfig:
94+
...
95+
extensions:
96+
- name: certs
97+
sourceDirectory: /etc/atomic-registry/master/site
98+
1. `sudo cp /etc/atomic-registry/master/ca.crt /etc/atomic-registry/master/site/`
99+
1. `sudo systemctl restart atomic-registry-master`
100+
1. Clients may then save this cert into their docker client and restart the docker daemon
101+
102+
curl --insecure -O https://<registry_hostname>:8443/console/extensions/certs/ca.crt
103+
sudo cp ca.crt /etc/docker/certs.d/<registry_hostname>:5000/.
104+
sudo systemctl restart docker.service

‎examples/atomic-registry/systemd/install.sh

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
#!/bin/bash
2+
3+
INSTALL_HOST=${1:-`hostname`}
4+
echo "Installing using hostname ${INSTALL_HOST}"
5+
6+
# write out configuration
7+
openshift start master --write-config /etc/atomic-registry/master \
8+
--etcd-dir /var/lib/atomic-registry/etcd \
9+
--public-master ${INSTALL_HOST} \
10+
--master https://localhost:8443
11+
12+
echo "Copy files to host"
13+
14+
set -x
15+
mkdir -p /etc/atomic-registry/master/site
16+
mkdir -p /etc/atomic-registry/registry
17+
mkdir -p /etc/atomic-registry/serviceaccount
18+
mkdir -p /host/var/lib/atomic-registry/registry
19+
20+
cp /exports/unit_files/* /host/etc/systemd/system/
21+
cp /exports/config/* /host/etc/sysconfig/
22+
cp /exports/oauthclient.yaml /etc/atomic-registry/master/
23+
cp /exports/setup-atomic-registry.sh /host/var/run/
24+
cp /exports/registry-login-template.html /host/etc/atomic-registry/master/site/
25+
26+
chown -R 1001:root /host/var/lib/atomic-registry/registry
27+
chown -R 1001:root /etc/atomic-registry/registry
28+
29+
set +x
30+
echo "Add serviceaccount token and certificate to registry configuration"
31+
ln /etc/atomic-registry/master/ca.crt /etc/atomic-registry/serviceaccount/ca.crt
32+
echo "default" >> /etc/atomic-registry/serviceaccount/namespace
33+
echo "This directory stores the service account token, namespace text file and certificate to enable the registry to connect to the API master." \
34+
>> /etc/atomic-registry/serviceaccount/README
35+
cat /etc/atomic-registry/master/ca.crt > /etc/atomic-registry/serviceaccount/service-ca.crt
36+
cat /etc/atomic-registry/master/service-signer.crt >> /etc/atomic-registry/serviceaccount/service-ca.crt
37+
38+
echo "This directory stores the docker/distribution registry configuration file. To secure the service add TLS certificates here and reference them as environment variables." \
39+
>> /etc/atomic-registry/registry/README
40+
echo "This directory stores configuration and certificates for the API master." \
41+
>> /etc/atomic-registry/master/README
42+
43+
set -x
44+
45+
# add OpenShift API master URL to web console env file
46+
echo "OPENSHIFT_OAUTH_PROVIDER_URL=https://${INSTALL_HOST}:8443" >> /host/etc/sysconfig/atomic-registry-console
47+
echo "REGISTRY_HOST=${INSTALL_HOST}:5000" >> /host/etc/sysconfig/atomic-registry-console
48+
# generate random secret for multi-registry shared storage deployment
49+
echo "REGISTRY_HTTP_SECRET=`date | md5sum`" >> /host/etc/sysconfig/atomic-registry
50+
51+
# load updated systemd unit files
52+
chroot /host systemctl daemon-reload
53+
54+
set +x
55+
56+
echo "Updating login template"
57+
sed -i 's/ templates: null$/ templates:\n login: site\/registry-login-template.html/' /etc/atomic-registry/master/master-config.yaml
58+
59+
echo "Optionally edit configuration file authentication /etc/atomic-registry/master/master-config.yaml,"
60+
echo "and/or add certificates to /etc/atomic-registry/master,"
61+
echo "then enable and start services:"
62+
echo " sudo systemctl enable --now atomic-registry-master.service"
63+
echo "Once all 3 containers are running (docker ps), run the setup script"
64+
echo "(you can run it again if it is run early and fails)"
65+
echo " sudo /var/run/setup-atomic-registry.sh ${INSTALL_HOST}"

‎examples/atomic-registry/systemd/services/config/atomic-registry

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
REGISTRY_HTTP_ADDR=:5000
2+
REGISTRY_HTTP_NET=tcp
3+
KUBERNETES_SERVICE_PORT=8443
4+
KUBERNETES_SERVICE_HOST=localhost
5+
KUBERNETES_PORT_8443_TCP_PROTO=tcp
6+
KUBERNETES_SERVICE_PORT_HTTPS=8443
7+
KUBERNETES_PORT_8443_TCP_ADDR=localhost
8+
KUBERNETES_PORT_8443_TCP=tcp://localhost:8443
9+
REGISTRY_MIDDLEWARE_REPOSITORY_OPENSHIFT_ENFORCEQUOTA=true
10+
11+
# To secure the registry, drop the certificates here, uncomment and restart service
12+
#REGISTRY_HTTP_TLS_CERTIFICATE=/etc/atomic-registry/registry/registry.crt
13+
#REGISTRY_HTTP_TLS_KEY=/etc/atomic-registry/registry/registry.key

‎examples/atomic-registry/systemd/services/config/atomic-registry-console

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Uncomment to enable debug messages
2+
#G_MESSAGES_DEBUG=cockpit-ws,cockpit-wrapper,cockpit-bridge
3+
KUBERNETES_SERVICE_HOST=localhost
4+
KUBERNETES_SERVICE_PORT=8443
5+
REGISTRY_ONLY=true
6+
OPENSHIFT_OAUTH_CLIENT_ID=cockpit-oauth-client
7+
KUBERNETES_INSECURE=true

‎examples/atomic-registry/systemd/services/config/atomic-registry-master

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# loglevel 1-5
2+
OPTIONS=--loglevel=1
3+
CONFIG_FILE=/etc/atomic-registry/master/master-config.yaml
4+
KUBECONFIG=/etc/atomic-registry/master/admin.kubeconfig

‎examples/atomic-registry/systemd/services/unit_files/atomic-registry-console.service

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
[Unit]
2+
Description=Atomic Registry Console
3+
Documentation=https://github.com/cockpit-project/cockpit
4+
After=docker.service
5+
Requires=docker.service
6+
7+
[Service]
8+
Environment=GOTRACEBACK=crash
9+
ExecStartPre=-/usr/bin/docker rm -f atomic-registry-console
10+
ExecStart=/usr/bin/docker run --rm --env-file=/etc/sysconfig/atomic-registry-console --name atomic-registry-console -p 9090:9090 --net=host -u 1001 cockpit/kubernetes
11+
ExecStop=/usr/bin/docker stop atomic-registry-console
12+
LimitNOFILE=131072
13+
LimitCORE=infinity
14+
SyslogIdentifier=atomic-registry-console
15+
Restart=always
16+
RestartSec=5s
17+
18+
[Install]
19+
WantedBy=multi-user.target

‎examples/atomic-registry/systemd/services/unit_files/atomic-registry-master.service

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
[Unit]
2+
Description=Atomic Registry Master
3+
Documentation=https://github.com/openshift/origin
4+
After=docker.service
5+
Requires=docker.service
6+
Wants=atomic-registry-console.service
7+
Wants=atomic-registry.service
8+
9+
[Service]
10+
EnvironmentFile=/etc/sysconfig/atomic-registry-master
11+
Environment=GOTRACEBACK=crash
12+
ExecStartPre=-/usr/bin/docker rm -f atomic-registry-master
13+
ExecStart=/usr/bin/docker run --rm --privileged --name atomic-registry-master -p 8443:8443 --net=host --env-file=/etc/sysconfig/atomic-registry-master -v /var/lib/atomic-registry/etcd:/var/lib/atomic-registry/etcd -v /etc/atomic-registry/:/etc/atomic-registry/ openshift/origin start master --config=/etc/atomic-registry/master/master-config.yaml $OPTIONS
14+
ExecStop=/usr/bin/docker stop atomic-registry-master
15+
LimitNOFILE=131072
16+
LimitCORE=infinity
17+
WorkingDirectory=/var/lib/atomic-registry/
18+
SyslogIdentifier=atomic-registry-master
19+
Restart=always
20+
RestartSec=5s
21+
22+
[Install]
23+
WantedBy=multi-user.target
24+
Also=atomic-registry.service
25+
Also=atomic-registry-console.service

‎examples/atomic-registry/systemd/services/unit_files/atomic-registry.service

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
[Unit]
2+
Description=Atomic Registry
3+
Documentation=https://github.com/docker/distribution
4+
After=docker.service
5+
Requires=docker.service
6+
7+
[Service]
8+
ExecStartPre=-/usr/bin/docker rm -f atomic-registry
9+
ExecStart=/usr/bin/docker run --rm --env-file=/etc/sysconfig/atomic-registry --name atomic-registry -p 5000:5000 --net=host -v /var/lib/atomic-registry/registry:/registry:Z -v /etc/atomic-registry/registry:/etc/atomic-registry/registry -v /etc/atomic-registry/serviceaccount:/var/run/secrets/kubernetes.io/serviceaccount -u 1001 openshift/origin-docker-registry
10+
ExecStop=/usr/bin/docker stop atomic-registry
11+
LimitNOFILE=131072
12+
LimitCORE=infinity
13+
SyslogIdentifier=atomic-registry
14+
Restart=always
15+
RestartSec=5s
16+
17+
[Install]
18+
WantedBy=multi-user.target

‎examples/atomic-registry/systemd/setup-atomic-registry.sh

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/bin/bash
2+
3+
# we need the hostname the web console is coming from to whitelist oauth requests
4+
INSTALL_HOST=${1:-`hostname`}
5+
# we're running this on the host
6+
# the commands will be exec'd in the master container that has the oc client
7+
CMD="docker exec -it"
8+
9+
# boostrap the registry components using the supported command
10+
# we'll delete the dc and service components later
11+
$CMD atomic-registry-master oadm registry
12+
13+
# pause for components to create
14+
sleep 3
15+
# we don't need the kubernetes components created during bootstrapping
16+
$CMD atomic-registry-master oc delete dc,service docker-registry
17+
# Get the service account token for registry to connect to master API
18+
set -x
19+
TOKEN_NAME=$($CMD atomic-registry-master oc get sa registry --template '{{ $secret := index .secrets 0 }} {{ $secret.name }}')
20+
$CMD atomic-registry-master oc get secret ${TOKEN_NAME} --template '{{ .data.token }}' | base64 -d > /etc/atomic-registry/serviceaccount/token
21+
22+
# write registry config to host and reference bindmounted host file
23+
$CMD atomic-registry cat /config.yml > /etc/atomic-registry/registry/config.yml
24+
echo "REGISTRY_CONFIGURATION_PATH=/etc/atomic-registry/registry/config.yml" >> /etc/sysconfig/atomic-registry
25+
26+
# Create oauthclient for web console. required for web console to delegate auth
27+
$CMD atomic-registry-master oc new-app --file=/etc/atomic-registry/master/oauthclient.yaml --param=COCKPIT_KUBE_URL=https://${INSTALL_HOST}:9090
28+
29+
# restart with these changes
30+
systemctl restart atomic-registry.service
31+
set +x
32+
echo "Launch web console in browser at https://${INSTALL_HOST}:9090"
33+
echo "By default, ANY username and ANY password will successfully authenticate."

‎examples/atomic-registry/systemd/templates/oauthclient.yaml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
kind: "Template"
2+
apiVersion: "v1"
3+
metadata:
4+
name: "cockpit-openshift-template"
5+
labels:
6+
createdBy: "cockpit-openshift-template"
7+
parameters:
8+
- description: "The public url for the Openshift OAuth Provider"
9+
name: "COCKPIT_KUBE_URL"
10+
required: true
11+
- description: "Oauth client secret"
12+
name: "OPENSHIFT_OAUTH_CLIENT_SECRET"
13+
from: "user[a-zA-Z0-9]{64}"
14+
generate: "expression"
15+
- description: "Oauth client id"
16+
name: "OPENSHIFT_OAUTH_CLIENT_ID"
17+
value: "cockpit-oauth-client"
18+
objects:
19+
- kind: "OAuthClient"
20+
apiVersion: "v1"
21+
metadata:
22+
name: "${OPENSHIFT_OAUTH_CLIENT_ID}"
23+
respondWithChallenges: false
24+
secret: "${OPENSHIFT_OAUTH_CLIENT_SECRET}"
25+
allowAnyScope: true
26+
redirectURIs:
27+
- "${COCKPIT_KUBE_URL}"

0 commit comments

Comments
 (0)