《OpenShift 4.x HOL教程汇总》
说明：本文已经在OpenShift 4.8环境中验证

文章目录

什么是ImageStream
从Image生成ImageStream
ImageStream的操作
生成ImageStream过程的选项
常见问题

什么是ImageStream

ImageStream是OpenShift中的一种对象，它并不是用来存储Image的，而是用来记录并管理Image信息的。它就像是所有Image的虚拟视图，可以通过它统一访问存放在不同Image Registry（OpenShift外部独立运行的Registry、或是OpenShift内置的Registry）上的Image。通过这个视图可以简化对那些来自不同Registry的Image的访问。

ImageStream使用访问标签（ImageStreamTag）和指向信息（ImageStreamImage）记录这种对应关系。

ImageStreamTag：是由用户指定的、有意义的字符串，可用它来表示一个特定Image，我们可以把它想象成DNS的域名地址。
ImageStreamImage：一串基于sha256的无意义的字符创，可用它来表示一个特定Image，我们可以把它想象成DNS的IP地址。

当我们使用ImageStreamTag访问一个Image的时候，其实OpenShift最终会识别出ImageStreamTag对应的ImageStreamImage（就像我们使用DNS域名访问一个地址时，系统需要将其翻译成IP地址访问目标）。ImageStreamTag和ImageStreamImage的这种对应关系可以通过2种方式被解析：

在ImageStream记录了ImageStreamTag和ImageStreamImage这种对应关系。当使用ImageStreamTag访问Image的时候，OpenShift实际是使用ImageStreamImage访问该Image。（这种情况类似DNS解析使用的本地hosts文件实现的）
在ImageStream不记录ImageStreamTag和ImageStreamImage这种对应关系，而只记录ImageStreamTag信息。因此每次通过ImageStreamTag访问Image的时候，OpenShift需要直接向Registry询问这个ImageStreamTag对应是哪个ImageStreamImage，然后才能访问该Image。（这种情况类似每次DNS解析使用的都是远程DNS服务实现的）

根据ImageStream所在项目，可将其分为集群级和项目级的ImageStream。无论当前在哪个项目中，任何用户都可访问到集群级的ImageStream；而项目级ImageStream只能该项目用户或被授权用户才可访问。

从Image生成ImageStream

如果我们跟随《OpenShift 4 Hands-on Lab (1) - 部署应用》成功创建应用后可以通过以下命令发现OpenShift会自动生成ImageStream对象，这就说明在运行应用前，OpenShift要创建ImageStream并建立App Image的指向关系。

$ oc get is

OpenShift除了可以自动创建ImageStream外，我们还可以从定义ImageStream的YAML文件创建它，但是我们通常用以下两种方法手工从Image生成ImageStream：

首选创建名为imagestream-lab1的OpenShift项目，以下所有操作都缺省在该项目中进行。

$ export USER_ID=YOUR-USER-ID
$ oc new-project ${USER_ID}-imagestream-lab1

通过import-image导入镜像的信息并生成ImageStream。以下将docker.io/openshift/deployment-example:v1的镜像信息导入到名为is-example的ImageStream中，并用v1指向该远程镜像。

$ oc import-image --from=docker.io/openshift/deployment-example:v1 is-example:v1 --confirm -n ${USER_ID}-imagestream-lab1
Name:                   is-example
Namespace:              user1-imagestream-lab1
Created:                Less than a second ago
Labels:                 <none>
Annotations:            openshift.io/image.dockerRepositoryCheck=2020-02-02T04:27:15Z
Image Repository:       image-registry.openshift-image-registry.svc:5000/user1-imagestream-lab1/is-example
Image Lookup:           local=false
Unique Images:          1
Tags:                   1v1tagged from docker.io/openshift/deployment-example:v1* docker.io/openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284bLess than a second agoImage Name:     is-example:v1
Docker Image:   docker.io/openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b
Name:           sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b
Created:        Less than a second ago
Annotations:    image.openshift.io/dockerLayersOrder=ascending
Image Size:     5.77MB in 6 layers
Layers:         0B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d45.77MB  sha256:50438f3701c47319ff1c8189ff19f5a8c779f2479aa2066979b930c7dbb3bde80B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d40B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d40B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d40B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Image Created:  4 years ago
Author:         Clayton Coleman <ccoleman@redhat.com>
Arch:           amd64
Entrypoint:     /deployment v1
Working Dir:    <none>
User:           <none>
Exposes Ports:  8080/tcp
Docker Labels:  <none>
Environment:    COLOR=#006e9c

使用tag对镜像打标签。下面是将docker.io上的openshift/deployment-example:v2打标签为v2，并保存到名为is-example的ImageStream中。

$ oc tag --source=docker openshift/deployment-example:v2 is-example:v2 -n ${USER_ID}-imagestream-lab1
Tag is-example:v2 set to openshift/deployment-example:v2.

为了在后面证明tag命令的“–source=docker”选项会使用“docker.io”上的镜像，我们执行以下命令，其中“openshift/deployment-example-test:v2”的镜像实际在“docker.io”上并不存在。

$ oc tag --source=docker docker.io/openshift/deployment-example:v2 is-example:v3 -n ${USER_ID}-imagestream-lab1
$ oc tag --source=docker openshift/deployment-example-test:v2 is-example:v4 -n ${USER_ID}-imagestream-lab1

ImageStream的操作

查看ImageStream列表，注意TAGS部分的“v3,v2,v1,v4”。

$ oc get is -n ${USER_ID}-imagestream-lab1
NAME         IMAGE REPOSITORY                                                                     TAGS          UPDATED
is-example   image-registry.openshift-image-registry.svc:5000/user1-imagestream-lab1/is-example   v3,v2,v1,v4   42 minutes ago

查看名为is-example的ImageStream配置。注意：名为v2和v3的ImageStreamTag都指向ImageStreamImage为“sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b”的镜像；另外，在v4部分提示无法访问“docker.io/openshift/deployment-example-test:v2”，这说明“oc tag”命令的“–source=docker”选项是从“docker.io”获取镜像。

$ oc describe is is-example -n ${USER_ID}-imagestream-lab1
Name:                   is-example
Namespace:              user1-imagestream-lab1
Created:                2 hours ago
Labels:                 <none>
Annotations:            openshift.io/image.dockerRepositoryCheck=2020-12-08T14:58:12Z
Image Repository:       image-registry.openshift-image-registry.svc:5000/user1-imagestream-lab1/is-example
Image Lookup:           local=false
Unique Images:          2
Tags:                   4v1tagged from docker.io/openshift/deployment-example:v1* docker.io/openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b2 hours agov2tagged from openshift/deployment-example:v2* openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b2 hours agov3tagged from docker.io/openshift/deployment-example:v2* docker.io/openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b37 minutes agov4tagged from openshift/deployment-example-test:v2! error: Import failed (Unauthorized): you may not have access to the container image "docker.io/openshift/deployment-example-test:v2"5 seconds ago

$ oc get is is-example -o yaml -n ${USER_ID}-imagestream-lab1
apiVersion: image.openshift.io/v1
kind: ImageStream
metadata:annotations:openshift.io/image.dockerRepositoryCheck: "2020-12-08T13:03:59Z"creationTimestamp: "2020-12-08T12:59:18Z"generation: 3name: is-examplenamespace: user1-imagestream-lab1resourceVersion: "232297"selfLink: /apis/image.openshift.io/v1/namespaces/user1-imagestream-lab1/imagestreams/is-exampleuid: dd1f8458-3043-4791-b5da-2930ff3524c5
spec:lookupPolicy:local: falsetags:- annotations: nullfrom:kind: DockerImagename: docker.io/openshift/deployment-example:v1generation: 1importPolicy: {}name: v1referencePolicy:type: Source- annotations: nullfrom:kind: DockerImagename: openshift/deployment-example:v2generation: 3importPolicy: {}name: v2referencePolicy:type: Source- annotations: nullfrom:kind: DockerImagename: docker.io/openshift/deployment-example:v2generation: 5importPolicy: {}name: v3referencePolicy:type: Source- annotations: nullfrom:kind: DockerImagename: openshift/deployment-example-test:v2generation: 9importPolicy: {}name: v4referencePolicy:type: Source
status:dockerImageRepository: image-registry.openshift-image-registry.svc:5000/user1-imagestream-lab1/is-exampletags:- items:- created: "2020-12-08T12:59:18Z"dockerImageReference: docker.io/openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284bgeneration: 1image: sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284btag: v1- items:- created: "2020-12-08T13:03:59Z"dockerImageReference: openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472bgeneration: 3image: sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472btag: v2- items:- created: "2020-12-08T14:20:41Z"dockerImageReference: docker.io/openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472bgeneration: 5image: sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472btag: v3- conditions:- generation: 9lastTransitionTime: "2020-12-08T14:58:12Z"message: you may not have access to the container image "docker.io/openshift/deployment-example-test:v2"reason: Unauthorizedstatus: "False"type: ImportSuccessitems: nulltag: v4

查看ImageStreamTag列表，确认没有“is-example:v4”的ImageStreamTag。这说明名为v4的ImageStreamTag没有创建成功。

$ oc get istag -n ${USER_ID}-imagestream-lab1
NAME            IMAGE REFERENCE                                                                                                  UPDATED
is-example:v1   docker.io/openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b   2 hours ago
is-example:v2   openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b             2 hours ago
is-example:v3   docker.io/openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b   About an hour ago

查看ImageStreamTag配置

$ oc describe istag is-example:v1 -n ${USER_ID}-imagestream-lab1
Image Name:     sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b
Docker Image:   docker.io/openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b
Name:           sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b
Created:        2 hours ago
Annotations:    image.openshift.io/dockerLayersOrder=ascending
Image Size:     5.77MB in 6 layers
Layers:         0B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d45.77MB  sha256:50438f3701c47319ff1c8189ff19f5a8c779f2479aa2066979b930c7dbb3bde80B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d40B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d40B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d40B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Image Created:  4 years ago
Author:         Clayton Coleman <ccoleman@redhat.com>
Arch:           amd64
Entrypoint:     /deployment v1
Working Dir:    <none>
User:           <none>
Exposes Ports:  8080/tcp
Docker Labels:  <none>
Environment:    COLOR=#006e9c

按大小排序查看USER-ID-imagestream-lab1项目中的imagestreams。注意，下面命令必须有“ -n USER-ID-imagestream-lab1”部分来指定查看的项目，否则看到的是“openshift”项目中的imagestreams。

$ oc adm top imagestreams -n ${USER_ID}-imagestream-lab1
NAME                                STORAGE  IMAGES LAYERS
USER-ID-imagestream-lab1/is-example 5.503MiB 2      12

执行命令，将“is-example:v1”指向docker.io网站的“openshift/deployment-example:v2”

$ oc tag --source=docker openshift/deployment-example:v2 is-example:v1 -n ${USER_ID}-imagestream-lab1

查看名为is-example的ImageStream，其中v1的指向的ImageStreamImage记录为2条，当前v1和v2指向的是同一个Image。而v1以前指向的是另一个Image。

$ oc describe is is-example -n ${USER_ID}-imagestream-lab1
Name:                   is-example
Namespace:              USER-ID-imagestream-lab1
Created:                4 minutes ago
Labels:                 <none>
Annotations:            openshift.io/image.dockerRepositoryCheck=2020-02-02T14:07:48Z
Image Repository:       default-route-openshift-image-registry.apps.cluster-beijing-c70a.beijing-c70a.example.opentlc.com/USER-ID-imagestream-lab1/is-example
Image Lookup:           local=false
Unique Images:          2
Tags:                   2v1tagged from openshift/deployment-example:v2* openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b26 seconds agodocker.io/openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b3 hours agov2tagged from openshift/deployment-example:v2* openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b3 hours agov3tagged from docker.io/openshift/deployment-example:v2* docker.io/openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472bAbout an hour agov4tagged from openshift/deployment-example-test:v2! error: Import failed (Unauthorized): you may not have access to the container image "docker.io/openshift/deployment-example-test:v2"37 minutes ago

删除名为“is-example:v2”的ImageStreamTag

$ oc delete istag/is-example:v2 -n ${USER_ID}-imagestream-lab1

生成ImageStream过程的选项

在使用“oc tag”和“oc import-image”命令生成ImageStream的时候，可以使用参数“–reference-policy=local”让OpenShift只在本地（其内部的Image Registry）找镜像；另外还可以用“–reference”参数让OpenShift只创建一个非导入的ImageStreamTag，即不导入目标Image的元数据。下面我们看看这两个选项对ImageStream有什么影响？

新建imagestream-lab2项目。

$ oc new-project ${USER_ID}-imagestream-lab2

执行以下命令，使用不同选项生从“openshift/deployment-example:v1”成相关ImageStream资源。

$ oc tag --source=docker openshift/deployment-example:v1 is-example:v1 -n ${USER_ID}-imagestream-lab2
$ oc tag --source=docker openshift/deployment-example:v1 is-example:v2 --reference-policy=local -n ${USER_ID}-imagestream-lab2
$ oc tag --source=docker openshift/deployment-example:v1 is-example:v3 --reference=true -n ${USER_ID}-imagestream-lab2

查看ImageStream的信息，注意3个Tags它们之间的差异，其中v3没有相应的镜像ID（说明当使用–reference=true，OpenShift不会主动获取镜像元数据）。

$ oc describe is is-example -n ${USER_ID}-imagestream-lab2
Name:                   is-example
Namespace:              imagestream-lab2
Created:                2 minutes ago
Labels:                 <none>
Annotations:            openshift.io/image.dockerRepositoryCheck=2020-02-02T11:14:02Z
Image Repository:       default-route-openshift-image-registry.apps.cluster-beijing-c70a.beijing-c70a.example.opentlc.com/USER-ID-imagestream-lab2/is-example
Image Lookup:           local=false
Unique Images:          2
Tags:                   3v1tagged from openshift/deployment-example:v1* openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b2 minutes agov2tagged from openshift/deployment-example:v1prefer registry pullthrough when referencing this tag* openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b2 minutes agov3reference to registry openshift/deployment-example:v1* openshift/deployment-example:v12 minutes ago

查看ImageStreamTag列表。确认“is-example:v2”和“is-example:v2”指向的是同一个sha256的ImageStreamImage，但是镜像所在位置不同，前者指向是远程“docker.io”上的镜像，后者则是指向是已经在OpenShift内部Registry的镜像。另外还确认istag列表中没有“is-example:v3”，说明它是无效的。

$ oc get istag -n ${USER_ID}-imagestream-lab2
NAME            IMAGE REF                                                                                                                                             UPDATED
is-example:v1   openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b                                                  2 minutes ago
is-example:v2   image-registry.openshift-image-registry.svc:5000/USER-ID-imagestream-lab2/is-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b   2 minutes ago

在OpenShift控制台也可看到名为is-example的ImageStream的“is-example:v3”的Tag提示以下错误。
执行以下命令，根据已有的ImageSteamTag生成新的ImageSteamTag，这次使用了“–reference=true”参数。

$ oc tag --source=istag is-example:v1 is-example:v4 --reference=true -n ${USER_ID}-imagestream-lab2

再次查看ImageStreamTag，确认“is-example:v4”是正常的。虽然这次使用了“–reference=true”参数，即OpenShift不会主动获取镜像元数据，但是由于使用的是“–source=istag”，因此ImageStreamImage信息已经在本地有了（是在创建“is-example:v1”的步骤获取到的）。

$ oc get istag -n ${USER_ID}-imagestream-lab2
NAME            IMAGE REF                                                                                                                                             UPDATED
is-example:v1   openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b                                                  22 minutes ago
is-example:v2   image-registry.openshift-image-registry.svc:5000/USER-ID-imagestream-lab2/is-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b   22 minutes ago
is-example:v4   openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b                                                  About a minute ago

常见问题

根据远程的Image创建ImageStream的时候，Image是否会下载到本地？
说明：不会。只有第一次基于这个Image运行应用的时候才去下载这个Image。
当使用“–reference-policy=local”参数和不使用它的时候，对使用Image有什么影响？
说明：当使用“–reference-policy=local”后，OpenShift就不会访问其外部的Registry获得Image了，只会使用其内置的Registry获取Image了。因此需要手动将Image提前push到其内置的Registry才可使用这些Image。
删除了ImageStreamTag后，对应的本地Image有影响么？
说明：没有。两者是若关联关系，删除任何一个不会自动删除相关的另一方。

OpenShift 4 Hands-on Lab (4) - 用ImageStream操作Image相关推荐

OpenShift 之 Image Registry、Image 和 ImageStream 概念和相关操作
概念篇 1. Container Image(容器镜像) 不用再解释了,就是容器镜像.以前叫Docker Image,现在叫Container Image更准确些,因为有了OCI容器规范后,容器不再是 ...
OpenShift 4 - Fedora CoreOS (5) - CoreOS的常规操作
<OpenShift 4.x HOL教程汇总> 文章目录常规操作查看CoreOS操作系统信息查看网络配置修改IP Docker 环境 podman 使用toolbox 什么是too ...
openshift开启anyuid-pod未使用应用指定账户操作，无权限问题
经常遇到有应用报镜像部署的时候报权限不够,或者应用部署后发现某个功能没权限执行,这是因为openshift默认会分配一个 uid 1000920000的用户作为应用运行的账户,如果需要使用指定的账户运 ...
OpenShift 4 概念 - OpenShift是如何通过ImageStream访问Image的
<OpenShift 4.x HOL教程汇总> 说明:本文已经在OpenShift 4.6环境中验证文章目录 ImageStream基本概念 Internal Image 和 Exter ...
OpenShift / RHEL / DevSecOps 汇总目录
文章目录 OpenShift / RHEL / DevSecOps 汇总目录 OpenShift 入门 OpenShift 安装免费线上环境 CRC单机环境 MicroShift Online安装 ...
OpenShift 4 之 Image Registry、Image 和 ImageStream 概念和相关操作
<OpenShift 4.x HOL教程汇总> OpenShift 4 之 Image Registry.Image 和 ImageStream 概念和相关操作概念篇 1. Contai ...
OpenShift 4 - 定制 RHCOS Linux的Kernal参数
<OpenShift 4.x Hands-on Lab> 文章目录关闭节点的SELinux 启动节点的实时kernel 关闭节点的SELinux 虽不建议在生产环境关闭SELinux, ...
OpenShift 4 - 用Pull Secret访问红帽官方或其他外部Registry的Image
<OpenShift 4.x HOL教程汇总> 文章目录 OpenShift如何访问外部Registry的Image 全局ImageStream 本地ImageStream 通过opens ...
OpenShift 4 - 为Serivce Account赋权
<OpenShift 4.x HOL教程汇总> 什么是ServiceAccount 当你通过oc命令访问OpenShift集群时,你会被apiserver认证为一个特定的用户账户(User ...

OpenShift 4 Hands-on Lab (4) - 用ImageStream操作Image