app-pipeline "Dev - Build Image" needs option for insecure registry push

[thomasmckay]

The registry specified in group_vars/all.yml as central_registry_hostname needs an insecure option or the build will fail in this case.

If this is meant to be the internal registry then perhaps should default to the ip address and port? Having insecure option for this would still be useful when customizing setup.

[logs:build/nodejs-mongo-persistent-1] Pushing image docker-registry.192.168.42.213.nip.io/registry/nodejs-mongo-persistent:1.0-1 ...
[logs:build/nodejs-mongo-persistent-1] error: build error: Failed to push image: Get https://docker-registry.192.168.42.213.nip.io/v1/_ping: x509: certificate signed by unknown authority
[logs:build/nodejs-mongo-persistent-1] 

[jcpowermac]

@thomasmckay I ran into this as well with oc cluster up. The ImageStream is already configured for insecure - which apparently is ignored. In a OCP multinode cluster all I needed to do was add the certificate to /etc/docker/certs.d. In oc cluster up v3.7.0 RC0 it requires additional steps:

1. Add the certificate to /etc/pki/ca-trust/source/anchors

/etc/pki/ca-trust/source/anchors             
└── registry.crt      

2. update-ca-trust extract

3. Add certificate under /etc/docker/certs.d

/etc/docker/certs.d/docker-registry-default.apps.registry-cluster.virtomation.com
└── ca.crt

4. Modify /var/lib/origin/openshift.local.config/master/master-config.yaml

imagePolicyConfig:
  allowedRegistriesForImport:
  - domainName: docker.io
  - domainName: '*.docker.io'
  - domainName: '*.redhat.com'
  - domainName: gcr.io
  - domainName: quay.io
  - domainName: '*.amazonaws.com'
  - domainName: '*.virtomation.com'
  - domainName: 'docker-registry-default.apps.registry-cluster.virtomation.com:80'

5. Reboot
6. Run with existing config option e.g. oc cluster up --public-hostname="10.53.252.73.nip.io" --routing-suffix="apps.10.53.252.73.nip.io" --use-existing-config

[codificat]

@thomasmckay many thanks for your feedback, and apologies for the slow updates here...

We believe that this is an issue with [lack of] documentation and I'm trying to address that. One of the reasons of the slow progress is that I have not hit the issue as described...

The bottom line though is that image push/pull is actually performed by the container runtime in the node, and therefore settings on the refarch playbooks are not enough to enable insecure registries, as they don't touch node configuration. You'll have to adjust the nodes' configuration accordingly - that's one of the things I'm adding to the docs.

@jcpowermac 's steps explain how to turn an insecure registry into a secure one. A simpler (but less secure) option is to configure docker to let it know it's an insecure registry. How to do this depends on the OS and version you're using.

As a side note though: if you are using the internal registry you might want to refer to it as docker-registry.default.svc instead of using an external route...