《OpenShift 4.x HOL教程汇总》

文章目录

对独立的Docker Registry操作
- 查看Registry上的Image信息
- 在2个Registry之间复制Image
对OpenShift内置Registry操作
- 允许从外部访问OpenShift的内置Registry
- 用skopeo对OpenShift内置Registry操作
- - 查看OpenShift内部Registry的Image信息
  - 向OpenShift内置Registry复制镜像
参考

说明：由于本文会使用本地的Container Registry，因此在开始本章前，建议先完成《容器入门（1） - 安装和使用Docker Registry》

Skopeo是用来对Registry的Images操作的工具，它主要功能包括：查看Registry上的镜像信息、在Registry之间或Registry和本地之间复制镜像、删除Registry上的镜像。

对独立的Docker Registry操作

查看Registry上的Image信息

$ skopeo inspect docker://${REGISTRY_DOMAIN}:5000/busybox:latest
{"Name": "registry.domain.com:5000/busybox","Digest": "sha256:a6b9238ceed3894db3327cfe00672971b799ed6ade8dce3637c6dce007863fec","RepoTags": ["latest"],"Created": "2020-06-29T20:21:41.42102751Z","DockerVersion": "18.09.7","Labels": null,"Architecture": "amd64","Os": "linux","Layers": ["sha256:74f990a74a8f68958f7ad85ecb9cd091670a0cc4b8560f7ac0712d057052cf84"],"Env": ["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"]
}$ skopeo inspect docker://quay.io/buildah/stable
{"Name": "quay.io/buildah/stable","Digest": "sha256:a742091c1297f02d4130d74c2828e7a494cde37f756d5c1244cf7afe1c0994f3","RepoTags": ["v1.9.0","v1.9.1","v1.9.2","v1.10.1","v1.11.2","v1.11.1","v1.11.0","v1.11.3","v1.11.4","v1.11.6","v1.12.0","auto","v1.14.0","v1.14.3","v1.14.8","master","latest"],"Created": "2020-07-02T14:26:28.466661245Z","DockerVersion": "18.02.0-ce","Labels": {"license": "MIT","name": "fedora","vendor": "Fedora Project","version": "32"},"Architecture": "amd64","Os": "linux","Layers": ["sha256:03c837e31708e15035b6c6f9a7a4b78b64f6bc10e6daec01684c077655becf95","sha256:a5b63bb008e83e62d4cedf329c2a790a325ff6482c8b0547ddccdf17487f50c6","sha256:369a1989bb0cf5707b1a856680573c8778b96dcb3e4d21bbfb2995af6b485e1e","sha256:1b9ca1b83456cc585de4bacf62e9199357d0437efa5d01671543653a701ccd88","sha256:756a6ab6d2f5b8b08e5dee6d585c165de8ba3b1084ac329929da8ad44b590988"],"Env": ["DISTTAG=f32container","FGC=f32","container=oci","PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","BUILDAH_ISOLATION=chroot"]
}

在2个Registry之间复制Image

$ skopeo copy docker://quay.io/buildah/stable docker://${REGISTRY_DOMAIN}:5000/buildah
Getting image source signatures
Copying blob 369a1989bb0c done
Copying blob a5b63bb008e8 done
Copying blob 756a6ab6d2f5 done
Copying blob 03c837e31708 done
Copying blob 1b9ca1b83456 done
Copying config 5ab6da8e5b done
Writing manifest to image destination
Storing signatures$ curl -u user1:password1 https://${REGISTRY_DOMAIN}:5000/v2/_catalog
{"repositories":["buildah","busybox"]}

对OpenShift内置Registry操作

允许从外部访问OpenShift的内置Registry

允许通过OpenShift的DefaultRoute访问内部镜像Registry。

$ oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge
$ REGISTRY_DOMAIN=$(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')

用skopeo对OpenShift内置Registry操作

查看OpenShift内部Registry的Image信息

在default项目中创建名为skopeo的serviceaccount，并获得它的Token。

$ oc create serviceaccount skopeo -n default
$ TOKEN=$(oc get secrets -n default -o jsonpath='{range .items[?(@.metadata.annotations.kubernetes\.io/service-account\.name=="skopeo")]}{.metadata.annotations.openshift\.io/token-secret\.value}{end}')

查看OpenShift内置的openshift/nodejs镜像信息。

$ skopeo inspect --creds="skopeo:${TOKEN}" --tls-verify=false docker://${REGISTRY_DOMAIN}/openshift/nodejs
{"Name": "default-route-openshift-image-registry.apps.cluster-beijing-959a.beijing-959a.example.opentlc.com/openshift/nodejs","Digest": "sha256:aefd611dcbd4a3fce3ebc5e021092ed793a341d4940be63b51a8a94ce2670dd9","RepoTags": ["12","latest","10"],"Created": "2020-07-13T11:13:38.827037Z","DockerVersion": "1.13.1","Labels": {"architecture": "x86_64","build-date": "2020-07-13T11:11:59.320502","com.redhat.build-host": "cpt-1004.osbs.prod.upshift.rdu2.redhat.com","com.redhat.component": "rh-nodejs12-container","com.redhat.deployments-dir": "/opt/app-root/src","com.redhat.dev-mode": "DEV_MODE:false","com.redhat.dev-mode.port": "DEBUG_PORT:5858","com.redhat.license_terms": "https://www.redhat.com/en/about/red-hat-end-user-license-agreements#UBI","description": "Node.js 12 available as container is a base platform for building and running various Node.js 12 applications and frameworks. Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.",
。。。

向OpenShift内置Registry复制镜像

方法一：使用管理员用户操作

$ skopeo copy --dest-creds=$(oc whoami):$(oc whoami -t) --dest-tls-verify=false docker://docker.io/openshift/hello-openshift docker://$REGISTRY_DOMAIN/my-images/hello-openshift
Getting image source signatures
Copying blob 8b32988996c5 skipped: already exists
Copying blob 4f4fb700ef54 skipped: already exists
Copying config 7af3297a3f done
Writing manifest to image destination
Storing signatures

2. 方法二：使用SerivceAccount操作（目前有问题，没有成功）

$ oc new-project my-images
$ oc create serviceaccount skopeo
$ TOKEN=$(oc get secrets -o jsonpath='{range .items[?(@.metadata.annotations.kubernetes\.io/service-account\.name=="skopeo")]}{.metadata.annotations.openshift\.io/token-secret\.value}{end}')
$ oc adm policy add-role-to-user system:image-builder -n my-images system:serviceaccount:admin:skopeo
$ skopeo copy --dest-creds=skopeo:$TOKEN --dest-tls-verify=false docker://docker.io/openshift/hello-openshift docker://$REGISTRY_DOMAIN/my-images/hello-openshift

参考

1.https://github.com/nmasse-itix/OpenShift-Examples/blob/master/Using-Skopeo/README.md

容器入门（4） - skopeo相关推荐

Tomcat容器入门介绍
Tomcat容器入门介绍 Tomcat环境配置 PS:JDK的安装这里就不讲了,找到安装包直接下一步下一步就行了. 1.配置JDK 在Windows10下,找到环境变量在环境变量中添加JDK主目录 ...
容器入门(6) - 获取访问Docker Registry的公钥证书
<OpenShift 4.x HOL教程汇总> 获取问Docker Registry的证书在根据<容器入门(1) - 安装和使用Docker Registry>,我们可以使用 ...
容器入门（3） - docker
<OpenShift 4.x HOL教程汇总> 文章目录安装Docker客户端客户端配置文件登录/登出Container Registry 登录身份凭证查询镜像 pull/push ...
容器入门（2） - podman
<OpenShift 4.x HOL教程汇总> 文章目录安装Podman环境运行配置文件登录/登出Container Registry 利用登录凭证免密操作查询镜像 pull/pu ...
Docker容器入门及网易最佳实践
文章目录第一节 Docker容器入门 1.1.1 基础概念 1. Docker是什么 2. Docker和传统虚拟机的对比 3. 为什么要使用Docker 4. Docker架构 5. Docker ...
亚马逊云科技——云原生主题容器入门笔记
嗨,大家好,我是异星球的小怪同志一个想法有点乱七八糟的小怪如果觉得对你有帮助,请支持一波. 希望未来可以一起学习交流. 目录一.容器入门课程二.容器入门课堂笔记 1.容器背后的发展历史 2.区 ...
自动化集成：Docker容器入门简介
前言:该系列文章,围绕持续集成:Jenkins+Docker+K8S相关组件,实现自动化管理源码编译.打包.镜像构建.部署等操作:本篇文章主要描述Docker基础用法. 一.Docker简介 1.基础 ...
容器技术第一讲：容器入门篇
女主宣言容器作为Paas的一种体现,越来越受到广大程序员的喜爱.本文作为容器的入门篇,对Docker的原理和主要技术进行了初步的介绍. PS:丰富的一线技术.多元化的表现形式,尽在"HUL ...
容器入门（5）- 在Registry之间复制镜像
<OpenShift 4.x HOL教程汇总> 通过oc命令复制镜像 Openshift的客户端工具oc命令提供了镜像mirror功能,可用来在2个Container Registry之间 ...

容器入门（4） - skopeo