Skip to content

Commit 582a355

Browse files
danmcpdanmcp
authored
Merge pull request #10706 from aweiteka/ar-install-port-config
refactor AR install to support params, plus help manpage
2 parents 643f3f8 + 628b10e commit 582a355

10 files changed

+211
-81
lines changed

‎examples/atomic-registry/Makefile

+5-2
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,11 @@ install-atomic:
2121
install-systemd:
2222
atomic install $(TEST_IMAGE) $(INSTALLHOST)
2323
systemctl enable --now atomic-registry-master.service
24-
sleep 10
25-
/var/run/setup-atomic-registry.sh $(INSTALLHOST)
24+
while ! /bin/curl -kfLs https://localhost:8443/healthz; do \
25+
/bin/sleep 1; \
26+
echo -n '.'; \
27+
done
28+
/var/run/setup-atomic-registry.sh
2629

2730
install-allinone:
2831
atomic install $(TEST_IMAGE) $(INSTALLHOST)

‎examples/atomic-registry/systemd/Dockerfile

+10
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,15 @@ LABEL name="projectatomic/atomic-registry-install" \
1212
-v /etc/atomic-registry/:/etc/atomic-registry/ \
1313
-v /var/lib/atomic-registry/:/var/lib/atomic-registry/ \
1414
-v /:/host \
15+
-e REGISTRYPORT \
16+
-e MASTERPORT \
17+
-e CONSOLEPORT \
18+
-e REGISTRYIMAGE \
19+
-e MASTERIMAGE \
20+
-e CONSOLEIMAGE \
21+
-e REGISTRYTAG \
22+
-e MASTERTAG \
23+
-e CONSOLETAG \
1524
--entrypoint /usr/bin/install.sh \
1625
$IMAGE' \
1726
UNINSTALL='docker run -i --rm \
@@ -20,5 +29,6 @@ LABEL name="projectatomic/atomic-registry-install" \
2029
--entrypoint /usr/bin/uninstall.sh \
2130
$IMAGE'
2231

32+
ADD help.1 /
2333
ADD services/ templates/ setup-atomic-registry.sh /exports/
2434
ADD install.sh uninstall.sh /usr/bin/

‎examples/atomic-registry/systemd/help.1

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
.\" Manpage for atomic-registry-install.
2+
.TH man 8 "17 Aug 2016" "0.1" "atomic-registry-install man page"
3+
.SH NAME
4+
atomic-registry-install \- Atomic Registry installer image
5+
.SH SYNOPSIS
6+
atomic install projectatomic/atomic-registry-install [HOSTNAME]
7+
.PP
8+
atomic uninstall projectatomic/atomic-registry-install [--remove-data]
9+
.SH DESCRIPTION
10+
A container-based installation of Atomic Registry. It installs systemd unit files, configuration and a setup script to deploy atomic registry. It supports overriding image names, tags and ports used for Atomic Registry.
11+
.SH OPTIONS
12+
.IP HOSTNAME
13+
installation hostname. By default the output of `hostname` is used.
14+
.B install
15+
only.
16+
17+
.IP --remove-data
18+
destructively remove all configuration and datastore.
19+
.B uninstall
20+
only.
21+
.SH ENVIRONMENT
22+
Installation values may be overridden by environment variable. The following variables are passed into the installation container:
23+
.IP REGISTRYPORT=5000
24+
The registry service port
25+
.IP MASTERPORT=8443
26+
The master service port
27+
.IP CONSOLEPORT=9090
28+
The console service port
29+
.IP REGISTRYIMAGE=openshift/origin-docker-registry
30+
The registry container image
31+
.IP MASTERIMAGE=openshift/origin
32+
The master container image
33+
.IP CONSOLEIMAGE=cockpit/kubernetes
34+
The console container image
35+
.IP REGISTRYTAG=latest
36+
The registry container tag
37+
.IP MASTERTAG=latest
38+
The master container tag
39+
.IP CONSOLETAG=latest
40+
The console container tag
41+
42+
.SH EXAMPLES
43+
.B Install
44+
using custom hostname and default images, tags and ports
45+
.RS
46+
sudo atomic install projectatomic/atomic-registry-install registry.example.com
47+
.RE
48+
49+
.B Install,
50+
overriding default ports and tags
51+
.RS
52+
sudo REGISTRYPORT=443 CONSOLEPORT=8080 MASTERTAG=v1.3.0-alpha.1 REGISTRYTAG=v1.3.0-alpha.1 atomic install projectatomic/atomic-registry-install
53+
.RE
54+
55+
.B Uninstall,
56+
removing configuration and datastore. This is a
57+
.B "destructive uninstall. All data will be lost."
58+
.RS
59+
sudo atomic uninstall projectatomic/atomic-registry-install --remove-data
60+
.RE
61+
62+
.SH SEE ALSO
63+
atomic-install(1), atomic-uninstall(1), docker(1)
64+
.SH AUTHOR
65+
Aaron Weitekamp ([email protected])

‎examples/atomic-registry/systemd/install.sh

+112-64
Original file line numberDiff line numberDiff line change
@@ -1,66 +1,114 @@
11
#!/bin/bash
22

3-
INSTALL_HOST=${1:-`hostname`}
4-
echo "Installing using hostname ${INSTALL_HOST}"
5-
6-
# write out configuration
7-
openshift start master --write-config /etc/atomic-registry/master \
8-
--etcd-dir /var/lib/atomic-registry/etcd \
9-
--public-master ${INSTALL_HOST} \
10-
--master https://localhost:8443
11-
12-
echo "Copy files to host"
13-
14-
set -x
15-
mkdir -p /etc/atomic-registry/master/site
16-
mkdir -p /etc/atomic-registry/registry
17-
mkdir -p /etc/atomic-registry/serviceaccount
18-
mkdir -p /host/var/lib/atomic-registry/registry
19-
20-
cp /exports/unit_files/* /host/etc/systemd/system/
21-
cp /exports/config/* /host/etc/sysconfig/
22-
cp /exports/oauthclient.yaml /etc/atomic-registry/master/
23-
cp /exports/setup-atomic-registry.sh /host/var/run/
24-
cp /exports/registry-login-template.html /host/etc/atomic-registry/master/site/
25-
26-
chown -R 1001:root /host/var/lib/atomic-registry/registry
27-
chown -R 1001:root /etc/atomic-registry/registry
28-
29-
set +x
30-
echo "Add serviceaccount token and certificate to registry configuration"
31-
ln /etc/atomic-registry/master/ca.crt /etc/atomic-registry/serviceaccount/ca.crt
32-
echo "default" >> /etc/atomic-registry/serviceaccount/namespace
33-
echo "This directory stores the service account token, namespace text file and certificate to enable the registry to connect to the API master." \
34-
>> /etc/atomic-registry/serviceaccount/README
35-
cat /etc/atomic-registry/master/ca.crt > /etc/atomic-registry/serviceaccount/service-ca.crt
36-
cat /etc/atomic-registry/master/service-signer.crt >> /etc/atomic-registry/serviceaccount/service-ca.crt
37-
38-
echo "This directory stores the docker/distribution registry configuration file. To secure the service add TLS certificates here and reference them as environment variables." \
39-
>> /etc/atomic-registry/registry/README
40-
echo "This directory stores configuration and certificates for the API master." \
41-
>> /etc/atomic-registry/master/README
42-
43-
set -x
44-
45-
# add OpenShift API master URL to web console env file
46-
echo "OPENSHIFT_OAUTH_PROVIDER_URL=https://${INSTALL_HOST}:8443" >> /host/etc/sysconfig/atomic-registry-console
47-
echo "REGISTRY_HOST=${INSTALL_HOST}:5000" >> /host/etc/sysconfig/atomic-registry-console
48-
# generate random secret for multi-registry shared storage deployment
49-
echo "REGISTRY_HTTP_SECRET=$(head -c 64 /dev/urandom | base64 -w0)" >> /host/etc/sysconfig/atomic-registry
50-
echo "DOCKER_REGISTRY_SERVICE_HOST=${INSTALL_HOST}" >> /host/etc/sysconfig/atomic-registry
51-
52-
# load updated systemd unit files
53-
chroot /host systemctl daemon-reload
54-
55-
set +x
56-
57-
echo "Updating login template"
58-
sed -i 's/ templates: null$/ templates:\n login: site\/registry-login-template.html/' /etc/atomic-registry/master/master-config.yaml
59-
60-
echo "Optionally edit configuration file authentication /etc/atomic-registry/master/master-config.yaml,"
61-
echo "and/or add certificates to /etc/atomic-registry/master,"
62-
echo "then enable and start services:"
63-
echo " sudo systemctl enable --now atomic-registry-master.service"
64-
echo "Once all 3 containers are running (docker ps), run the setup script"
65-
echo "(you can run it again if it is run early and fails)"
66-
echo " sudo /var/run/setup-atomic-registry.sh ${INSTALL_HOST}"
3+
set -o errexit
4+
set -o nounset
5+
set -o pipefail
6+
7+
installhost="${1:-"$(hostname)"}"
8+
9+
# Defaults
10+
REGISTRYPORT="${REGISTRYPORT:-5000}"
11+
MASTERPORT="${MASTERPORT:-8443}"
12+
CONSOLEPORT="${CONSOLEPORT:-9090}"
13+
REGISTRYIMAGE="${REGISTRYIMAGE:-openshift/origin-docker-registry}"
14+
MASTERIMAGE="${MASTERIMAGE:-openshift/origin}"
15+
CONSOLEIMAGE="${CONSOLEIMAGE:-cockpit/kubernetes}"
16+
REGISTRYTAG="${REGISTRYTAG:-latest}"
17+
MASTERTAG="${MASTERTAG:-latest}"
18+
CONSOLETAG="${CONSOLETAG:-latest}"
19+
20+
echo "Installing using hostname ${installhost}"
21+
22+
function write_config() {
23+
openshift start master --write-config=/etc/atomic-registry/master \
24+
--etcd-dir=/var/lib/atomic-registry/etcd \
25+
--public-master="${installhost}:${MASTERPORT}" \
26+
--master="https://localhost:${MASTERPORT}" \
27+
--listen="https://0.0.0.0:${MASTERPORT}" \
28+
--cors-allowed-origins="${installhost}:${CONSOLEPORT}"
29+
}
30+
31+
function copy_files_to_host() {
32+
echo "Copy files to host"
33+
34+
set -x
35+
mkdir -p /etc/atomic-registry/master/site
36+
mkdir -p /etc/atomic-registry/registry
37+
mkdir -p /etc/atomic-registry/serviceaccount
38+
mkdir -p /host/var/lib/atomic-registry/registry
39+
40+
cp /exports/unit_files/* /host/etc/systemd/system/
41+
cp /exports/config/* /host/etc/sysconfig/
42+
cp /exports/oauthclient.yaml /etc/atomic-registry/master/
43+
cp /exports/setup-atomic-registry.sh /host/var/run/
44+
cp /exports/registry-login-template.html /host/etc/atomic-registry/master/site/
45+
46+
chown -R 1001:root /host/var/lib/atomic-registry/registry
47+
chown -R 1001:root /etc/atomic-registry/registry
48+
49+
set +x
50+
echo "Add serviceaccount token and certificate to registry configuration"
51+
ln /etc/atomic-registry/master/ca.crt /etc/atomic-registry/serviceaccount/ca.crt
52+
echo "default" >> /etc/atomic-registry/serviceaccount/namespace
53+
echo "This directory stores the service account token, namespace text file and certificate to enable the registry to connect to the API master." \
54+
>> /etc/atomic-registry/serviceaccount/README
55+
cat /etc/atomic-registry/master/ca.crt > /etc/atomic-registry/serviceaccount/service-ca.crt
56+
cat /etc/atomic-registry/master/service-signer.crt >> /etc/atomic-registry/serviceaccount/service-ca.crt
57+
58+
echo "This directory stores the docker/distribution registry configuration file. To secure the service add TLS certificates here and reference them as environment variables." \
59+
>> /etc/atomic-registry/registry/README
60+
echo "This directory stores configuration and certificates for the API master." \
61+
>> /etc/atomic-registry/master/README
62+
}
63+
64+
function customize_config() {
65+
echo "Update custom ports, images and tags"
66+
67+
echo "REGISTRY_HTTP_SECRET=$(head -c 64 /dev/urandom | base64 -w0)" >> /host/etc/sysconfig/atomic-registry
68+
69+
sed -i "s/8443/${MASTERPORT}/g" /host/etc/sysconfig/atomic-registry
70+
71+
echo "OPENSHIFT_OAUTH_PROVIDER_URL=https://${installhost}:${MASTERPORT}" >> /host/etc/sysconfig/atomic-registry-console
72+
echo "REGISTRY_HOST=${installhost}:${REGISTRYPORT}" >> /host/etc/sysconfig/atomic-registry-console
73+
echo "DOCKER_REGISTRY_SERVICE_PORT=${REGISTRYPORT}" >> /host/etc/sysconfig/atomic-registry
74+
echo "REGISTRY_HTTP_ADDR=:${REGISTRYPORT}" >> /host/etc/sysconfig/atomic-registry
75+
echo "REGISTRYPORT=${REGISTRYPORT}" >> /host/etc/sysconfig/atomic-registry
76+
echo "REGISTRYIMAGE=${REGISTRYIMAGE}" >> /host/etc/sysconfig/atomic-registry
77+
echo "REGISTRYTAG=${REGISTRYTAG}" >> /host/etc/sysconfig/atomic-registry
78+
echo "KUBERNETES_SERVICE_HOST=${installhost}" >> /host/etc/sysconfig/atomic-registry
79+
echo "KUBERNETES_SERVICE_PORT=${MASTERPORT}" >> /host/etc/sysconfig/atomic-registry
80+
echo "MASTERPORT=${MASTERPORT}" >> /host/etc/sysconfig/atomic-registry-master
81+
echo "MASTERIMAGE=${MASTERIMAGE}" >> /host/etc/sysconfig/atomic-registry-master
82+
echo "MASTERTAG=${MASTERTAG}" >> /host/etc/sysconfig/atomic-registry-master
83+
echo "CONSOLEPORT=${CONSOLEPORT}" >> /host/etc/sysconfig/atomic-registry-console
84+
echo "CONSOLEIMAGE=${CONSOLEIMAGE}" >> /host/etc/sysconfig/atomic-registry-console
85+
echo "CONSOLETAG=${CONSOLETAG}" >> /host/etc/sysconfig/atomic-registry-console
86+
echo "KUBERNETES_SERVICE_HOST=${installhost}" >> /host/etc/sysconfig/atomic-registry-console
87+
echo "KUBERNETES_SERVICE_PORT=${MASTERPORT}" >> /host/etc/sysconfig/atomic-registry-console
88+
89+
echo "Updating login template"
90+
sed -i 's/ templates: null$/ templates:\n login: site\/registry-login-template.html/' /host/etc/atomic-registry/master/master-config.yaml
91+
92+
echo "Files updated"
93+
for file in /host/etc/sysconfig/atomic*; do
94+
echo $'\t'"${file}:"
95+
cat "${file}"
96+
echo
97+
done
98+
chroot /host systemctl daemon-reload
99+
}
100+
101+
function print_next_steps() {
102+
echo "Optionally edit configuration file authentication /etc/atomic-registry/master/master-config.yaml,"
103+
echo "and/or add certificates to /etc/atomic-registry/master,"
104+
echo "then enable and start services:"
105+
echo " sudo systemctl enable --now atomic-registry-master.service"
106+
echo "Once all 3 containers are running (docker ps), run the setup script"
107+
echo "(you can run it again if it is run early and fails)"
108+
echo " sudo /var/run/setup-atomic-registry.sh"
109+
}
110+
111+
write_config
112+
copy_files_to_host
113+
customize_config
114+
print_next_steps

‎examples/atomic-registry/systemd/services/config/atomic-registry

+4-5
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,13 @@
1-
REGISTRY_HTTP_ADDR=:5000
21
REGISTRY_HTTP_NET=tcp
3-
KUBERNETES_SERVICE_PORT=8443
4-
KUBERNETES_SERVICE_HOST=localhost
52
KUBERNETES_PORT_8443_TCP_PROTO=tcp
63
KUBERNETES_SERVICE_PORT_HTTPS=8443
74
KUBERNETES_PORT_8443_TCP_ADDR=localhost
85
KUBERNETES_PORT_8443_TCP=tcp://localhost:8443
96
REGISTRY_MIDDLEWARE_REPOSITORY_OPENSHIFT_ENFORCEQUOTA=false
10-
DOCKER_REGISTRY_SERVICE_PORT=5000
117

12-
# To secure the registry, drop the certificates here, uncomment and restart service
8+
##
9+
# To secure the registry, copy the certificates to these paths, uncomment and restart service
10+
##
1311
#REGISTRY_HTTP_TLS_CERTIFICATE=/etc/atomic-registry/registry/registry.crt
1412
#REGISTRY_HTTP_TLS_KEY=/etc/atomic-registry/registry/registry.key
13+

‎examples/atomic-registry/systemd/services/config/atomic-registry-console

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Uncomment to enable debug messages
22
#G_MESSAGES_DEBUG=cockpit-ws,cockpit-wrapper,cockpit-bridge
3-
KUBERNETES_SERVICE_HOST=localhost
4-
KUBERNETES_SERVICE_PORT=8443
53
REGISTRY_ONLY=true
64
OPENSHIFT_OAUTH_CLIENT_ID=cockpit-oauth-client
5+
6+
# Set to false to use your own SSL certificates
77
KUBERNETES_INSECURE=true

‎examples/atomic-registry/systemd/services/unit_files/atomic-registry-console.service

+2-1
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,9 @@ Requires=docker.service
66

77
[Service]
88
Environment=GOTRACEBACK=crash
9+
EnvironmentFile=/etc/sysconfig/atomic-registry-console
910
ExecStartPre=-/usr/bin/docker rm -f atomic-registry-console
10-
ExecStart=/usr/bin/docker run --rm --env-file=/etc/sysconfig/atomic-registry-console --name atomic-registry-console -p 9090:9090 --net=host -u 1001 cockpit/kubernetes
11+
ExecStart=/usr/bin/docker run --rm --env-file=/etc/sysconfig/atomic-registry-console --name atomic-registry-console -p ${CONSOLEPORT}:9090 -u 1001 ${CONSOLEIMAGE}:${CONSOLETAG}
1112
ExecStop=/usr/bin/docker stop atomic-registry-console
1213
LimitNOFILE=131072
1314
LimitCORE=infinity

‎examples/atomic-registry/systemd/services/unit_files/atomic-registry-master.service

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ Wants=atomic-registry.service
1010
EnvironmentFile=/etc/sysconfig/atomic-registry-master
1111
Environment=GOTRACEBACK=crash
1212
ExecStartPre=-/usr/bin/docker rm -f atomic-registry-master
13-
ExecStart=/usr/bin/docker run --rm --privileged --name atomic-registry-master -p 8443:8443 --net=host --env-file=/etc/sysconfig/atomic-registry-master -v /var/lib/atomic-registry/etcd:/var/lib/atomic-registry/etcd -v /etc/atomic-registry/:/etc/atomic-registry/ openshift/origin start master --config=/etc/atomic-registry/master/master-config.yaml $OPTIONS
13+
ExecStart=/usr/bin/docker run --rm --privileged --name atomic-registry-master -p ${MASTERPORT}:${MASTERPORT} --env-file=/etc/sysconfig/atomic-registry-master -v /var/lib/atomic-registry/etcd:/var/lib/atomic-registry/etcd -v /etc/atomic-registry/:/etc/atomic-registry/ ${MASTERIMAGE}:${MASTERTAG} start master --config=/etc/atomic-registry/master/master-config.yaml $OPTIONS
1414
ExecStop=/usr/bin/docker stop atomic-registry-master
1515
LimitNOFILE=131072
1616
LimitCORE=infinity

‎examples/atomic-registry/systemd/services/unit_files/atomic-registry.service

+2-1
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,9 @@ After=docker.service
55
Requires=docker.service
66

77
[Service]
8+
EnvironmentFile=/etc/sysconfig/atomic-registry
89
ExecStartPre=-/usr/bin/docker rm -f atomic-registry
9-
ExecStart=/usr/bin/docker run --rm --env-file=/etc/sysconfig/atomic-registry --name atomic-registry -p 5000:5000 --net=host -v /var/lib/atomic-registry/registry:/registry:Z -v /etc/atomic-registry/registry:/etc/atomic-registry/registry -v /etc/atomic-registry/serviceaccount:/var/run/secrets/kubernetes.io/serviceaccount -u 1001 openshift/origin-docker-registry
10+
ExecStart=/usr/bin/docker run --rm --env-file=/etc/sysconfig/atomic-registry --name atomic-registry -p ${REGISTRYPORT}:${REGISTRYPORT} --net=host -v /var/lib/atomic-registry/registry:/registry:Z -v /etc/atomic-registry/registry:/etc/atomic-registry/registry -v /etc/atomic-registry/serviceaccount:/var/run/secrets/kubernetes.io/serviceaccount -u 1001 ${REGISTRYIMAGE}:${REGISTRYTAG}
1011
ExecStop=/usr/bin/docker stop atomic-registry
1112
LimitNOFILE=131072
1213
LimitCORE=infinity

‎examples/atomic-registry/systemd/setup-atomic-registry.sh

+8-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
1-
#!/bin/bash
1+
#!/usr/bin/env bash
2+
3+
set -o pipefail
4+
5+
INSTALL_HOST=$(awk -F ' ' '/^masterPublicURL/ {print $2}' /etc/atomic-registry/master/master-config.yaml | awk '{split($0,a,":"); print a[1] ":" a[2]}')
6+
CONSOLEPORT=$(awk -F '=' '/CONSOLEPORT/ {print $2}' /etc/sysconfig/atomic-registry-console)
27

3-
# we need the hostname the web console is coming from to whitelist oauth requests
4-
INSTALL_HOST=${1:-`hostname`}
58
# we're running this on the host
69
# the commands will be exec'd in the master container that has the oc client
710
CMD="docker exec -it"
@@ -24,10 +27,10 @@ $CMD atomic-registry cat /config.yml > /etc/atomic-registry/registry/config.yml
2427
echo "REGISTRY_CONFIGURATION_PATH=/etc/atomic-registry/registry/config.yml" >> /etc/sysconfig/atomic-registry
2528

2629
# Create oauthclient for web console. required for web console to delegate auth
27-
$CMD atomic-registry-master oc new-app --file=/etc/atomic-registry/master/oauthclient.yaml --param=COCKPIT_KUBE_URL=https://${INSTALL_HOST}:9090
30+
$CMD atomic-registry-master oc new-app --file=/etc/atomic-registry/master/oauthclient.yaml --param=COCKPIT_KUBE_URL=${INSTALL_HOST}:${CONSOLEPORT}
2831

2932
# restart with these changes
3033
systemctl restart atomic-registry.service
3134
set +x
32-
echo "Launch web console in browser at https://${INSTALL_HOST}:9090"
35+
echo "Launch web console in browser at ${INSTALL_HOST}:${CONSOLEPORT}"
3336
echo "By default, ANY username and ANY password will successfully authenticate."

0 commit comments

Comments
 (0)