Skip to content

Commit 406c4b0

Browse files
EricPonvelleEricPonvelle
authored
Merge pull request #83499 from fmcdonal/OSDOCS-12307
OSDOCS-12307: CA Parameters Image registry config to customers
2 parents 6a10edd + 00027e9 commit 406c4b0

5 files changed

+51
-21
lines changed

‎modules/images-configuration-image-registry-settings-hcp.adoc

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -96,17 +96,25 @@ Audit Log Forwarding: Disabled
9696
External Authentication: Disabled
9797
Etcd Encryption: Disabled
9898
Registry Configuration:
99-
- Allowed Registries: <allowed_registry> <1>
100-
- Insecure Registries: <insecure_registry> <2>
101-
- Allowed Registries for Import: <3>
102-
- Domain Name: <domain_name> <4>
103-
- Insecure: true <5>
99+
- Allowed Registries: <allowed_registry> <1> <2>
100+
- Insecure Registries: <insecure_registry> <3>
101+
- Allowed Registries for Import: <4>
102+
- Domain Name: <domain_name> <5>
103+
- Insecure: true <6>
104+
- Platform Allowlist: <platform_allowlist_id> <7>
105+
- Registries: <list_of_registries> <8>
106+
- Additional Trusted CA: <9>
107+
- <registry_name> : REDACTED
104108
----
105109
<1> `Allowed Registries`: A comma-separated list of registries for which image pull and push actions are allowed.
106-
<2> `Insecure Registries`: A comma-separated list of registries which do not have a valid TLS certificate or only support HTTP connections.
107-
<3> `Allowed Registries for Import`: Limits the container image registries from which normal users can import images. The format should be a comma-separated list of `domainName:insecure`.
108-
<4> `domainName`: Specifies a domain name for the registry.
109-
<5> `insecure`: Indicates whether the registry is secure or insecure.
110+
<2> `Blocked Registries`: A comma-separated list of registries for which image pull and push actions are blocked. Parameters `allowedRegistries`, `blockedRegistries` are mutually exclusive.
111+
<3> `Insecure Registries`: A comma-separated list of registries which do not have a valid TLS certificate or only support HTTP connections.
112+
<4> `Allowed Registries for Import`: Limits the container image registries from which normal users can import images. The format should be a comma-separated list of `domainName:insecure`.
113+
<5> `domainName`: Specifies a domain name for the registry.
114+
<6> `insecure`: Indicates whether the registry is secure or insecure.
115+
<7> `Platform Allowlist`: A reference to the id of the list of registries that needs to be whitelisted for the platform to work.
116+
<8> `Registries`: The list of registries that needs to be whitelisted for the platform to work.
117+
<9> `Additional Trusted CA`: A JSON file containing the registry hostname as the key, and the PEM-encoded certificate as the value, for each additional registry CA to trust.
110118

111119
. List your nodes to check the applied changes by running the following command:
112120
+

‎modules/images-configuration-parameters-hcp.adoc

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,6 @@ Parameters such as `DisableScheduledImport`, `MaxImagesBulkImportedPerRepository
3232
|`registry-config-additional-trusted-ca`
3333
|A JSON file containing the registry hostname as the key, and the PEM-encoded certificate as the value, for each additional registry CA to trust.
3434

35-
|`registry-config-platform-allowlist`
36-
|A list of Red{nbsp}Hat registries is automatically allowed. This list can be periodically updated and impacted clusters will receive a notification with the new allowlist ID. In such cases, the user must use this parameter to update from the previous expected ID to the newly expected ID.
37-
3835
|===
3936

4037
[WARNING]

‎modules/images-editing-image-registry-settings-hcp.adoc

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -104,14 +104,22 @@ Audit Log Forwarding: Disabled
104104
External Authentication: Disabled
105105
Etcd Encryption: Disabled
106106
Registry Configuration:
107-
- Allowed Registries: <allowed_registry> <1>
108-
- Insecure Registries: <insecure_registry> <2>
109-
- Allowed Registries for Import: <3>
110-
- Domain Name: <domain_name> <4>
111-
- Insecure: true <5>
107+
- Allowed Registries: <allowed_registry> <1> <2>
108+
- Insecure Registries: <insecure_registry> <3>
109+
- Allowed Registries for Import: <4>
110+
- Domain Name: <domain_name> <5>
111+
- Insecure: true <6>
112+
- Platform Allowlist: <platform_allowlist_id> <7>
113+
- Registries: <list_of_registries> <8>
114+
- Additional Trusted CA: <9>
115+
- <registry_name> : REDACTED
112116
----
113117
<1> `Allowed Registries`: A comma-separated list of registries for which image pull and push actions are allowed.
114-
<2> `Insecure Registries`: A comma-separated list of registries which do not have a valid TLS certificate or only support HTTP connections.
115-
<3> `Allowed Registries for Import`: Limits the container image registries from which normal users can import images. The format should be a comma-separated list of `domainName:insecure`.
116-
<4> `domainName`: Specifies a domain name for the registry.
117-
<5> `insecure`: Indicates whether the registry is secure or insecure.
118+
<2> `Blocked Registries`: A comma-separated list of registries for which image pull and push actions are blocked. Parameters `allowedRegistries`, `blockedRegistries` are mutually exclusive.
119+
<3> `Insecure Registries`: A comma-separated list of registries which do not have a valid TLS certificate or only support HTTP connections.
120+
<4> `Allowed Registries for Import`: Limits the container image registries from which normal users can import images. The format should be a comma-separated list of `domainName:insecure`.
121+
<5> `domainName`: Specifies a domain name for the registry.
122+
<6> `insecure`: Indicates whether the registry is secure or insecure.
123+
<7> `Platform Allowlist`: A reference to the id of the list of registries that needs to be whitelisted for the platform to work.
124+
<8> `Registries`: The list of registries that needs to be whitelisted for the platform to work.
125+
<9> `Additional Trusted CA`: A JSON file containing the registry hostname as the key, and the PEM-encoded certificate as the value, for each additional registry CA to trust.

‎modules/images-updating-platform-allowlist-hcp.adoc

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * openshift_images/image-configuration-hcp.adoc
4+
// * post_installation_configuration/preparing-for-users.adoc
5+
6+
:_mod-docs-content-type: PROCEDURE
7+
[id="images-updating-platform-allowlist-hcp_{context}"]
8+
= Updating platform allowlist for {hcp-title}
9+
10+
A list of Red Hat registries is automatically allowed and it is visible when running rosa describe cluster. This list can be periodically updated to ensure platform can be operated correctly. Impacted clusters will receive a notification with the new allowlist ID. In such cases, the user must use this parameter to update from the previous expected ID to the newly expected ID. Update or edit the image registry for the cluster by running the following command:
11+
12+
[source,terminal]
13+
----
14+
$ rosa edit cluster --registry-config-platform-allowlist <newID>
15+
----

‎openshift_images/image-configuration-hcp.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ include::modules/images-configuration-image-registry-settings-hcp.adoc[leveloffs
1717

1818
include::modules/images-editing-image-registry-settings-hcp.adoc[leveloffset=+1]
1919

20+
include::modules/images-updating-platform-allowlist-hcp.adoc[leveloffset=+2]
21+
2022
ifndef::openshift-rosa,openshift-dedicated,openshift-rosa-hcp[]
2123
[role="_additional-resources"]
2224
.Additional resources

0 commit comments

Comments
 (0)