Crc: Exposing container image registry

[gbraad]

To push container images into the OpenShift environment of CRC, we need to expose the container registry.

Ref: https://docs.openshift.com/container-platform/4.1/registry/accessing-the-registry.html

[praveenkumar]

We are now already exposing it but need to put document around how to access it.

[Harald-U]

This does not work with CRC:

$ oc get nodes
NAME STATUS ROLES AGE VERSION
crc-2n9vw-master-0 Ready master,worker 19d v1.14.6+6ac6aa4b0

$ oc debug nodes/crc-2n9vw-master-0
error: cannot debug crc-2n9vw-master-0: unable to extract pod template from type *v1.Node

I know that this is not a CRC issue but nobody seems to take notice although an issue has been opened: https://github.com/openshift/origin/issues/23371

[bartoszmajsak]

I was about to open new issue for that, but I decided to add my input here.

Details

╰─ crc version
crc version: 1.4.0+d5bb3a3
OpenShift version: 4.2.13 (embedded in binary)

╰─ crc status
CRC VM:          Running
OpenShift:       Running (v4.2.13)
Disk Usage:      14.2GB of 32.2GB (Inside the CRC VM)
Cache Usage:     13.23GB
Cache Directory: /home/bartek/.crc/cache



md5-e05be416f307f4835500a7cf8a421fd5



Linux 5.4.10-100.fc30.x86_64 #1 SMP Thu Jan 9 20:15:55 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux



md5-88c6f5f87db5caa1acca4637ff5f437d



╰─ docker login -u $(oc whoami) -p $(oc whoami -t) default-route-openshift-image-registry.apps-crc.testing
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Error response from daemon: Get https://default-route-openshift-image-registry.apps-crc.testing/v2/: unauthorized: authentication required



md5-e05be416f307f4835500a7cf8a421fd5



╰─ oc whoami
kube:admin

Am I missing something?

[praveenkumar]

I am unable to docker login to the registry which is exposed following official docs

@bartoszmajsak so if you are using kubeadmin as user then oc whoami return kube:admin and that's the reason you get this issue. I would suggest you to try something following if you are using kubeadmin user.

$ docker login -u $(oc whoami) -p $(oc whoami -t) default-route-openshift-image-registry.apps-crc.testing
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Error response from daemon: Get https://default-route-openshift-image-registry.apps-crc.testing/v2/: unauthorized: authentication required

$ docker login -u kubeadmin -p $(oc whoami -t) default-route-openshift-image-registry.apps-crc.testing
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Login Succeeded

[bartoszmajsak]

That works, thanks.

[praveenkumar]

closing this issue since we are already exposing the registry.

[lsalotto-ingenia]

Hi, just a small comment about this: in most cases, developers who are using CRC will not want to access the registry from within the cluster, but form their own machines. Pointing to the documentation about accessing the registry from the cluster is really not that helpful. At least in my case I was looking for a quick and fast solution to build an image locally (in CRC's host machine) and push it to the OCP registry.

[praveenkumar]

@lsalotto-ingenia with exposed registry you can do that, do you mean that it should be part of the document?

[Harald-U]

I have documented external access to registry in one of my projects: https://github.com/IBM/cloud-native-starter/blob/master/documentation/OS4Requirements.md#access-the-openshift-internal-image-registry
Its a little more complicated for CRC because it uses self-signed certificates. Maybe this is helpful?

[praveenkumar]

@Harald-U Thanks for the steps you pointed out, since crc for local development you can just add that registry route default-route-openshift-image-registry.apps-crc.testing as insecure one, in podman there is already check --tls-verify which you can set to false and it works without any change, in case of docker it does require manual step to add the route as insecure registry one.