antony@notes:~/openshift$ cat "Setting-up-and-configuring-the-Image-Registry-on-OpenShift.md"

Setting up and configuring the Image Registry on OpenShift

2023-12-14· openshift

Install and setup Image Registry on OpenShift and scan it with Neuvector

Preface

本篇文章會介紹，如何在 OpenShift 上安裝與設定 Image Registry，並透過 Neuvector Scan 它

可以透過點擊展開以下目錄，選擇想看的內容，跳轉至特定章節

:::warning

:::spoiler {state=“open”} 文章目錄

[TOC]

:::

Prerequisites

有一座 OpenShift Container Platform 4.12
並在 OCP 上完成布署 Neuvector 5.1.3

1. Changing the image registry’s management state

Change managementState Image Registry Operator configuration from Removed to Managed. For example:

$ oc patch configs.imageregistry.operator.openshift.io cluster --type merge --patch '{"spec":{"managementState":"Managed"}}'

2. Set the image registry storage to an empty directory

$ oc patch configs.imageregistry.operator.openshift.io cluster --type merge --patch '{"spec":{"storage":{"emptyDir":{}}}}'

Configure this option for only non-production clusters.

3. Exposing the registry

To expose the registry using the defaultRoute:

$ oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge

4. Get the default registry route:

$ HOST=$(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')

5. Accessing the registry

$ ssh core@master.ocp4.example.com

$ oc login -u kubeadmin -p bbDNC-bVPgX-Jh5Iv-ViEaa https://api-int.ocp4.example.com:6443

$ HOST=$(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')

$ podman login -u kubeadmin -p $(oc whoami -t) $HOST

6. Perform `podman pull` and `podman push` operations against your registry:

$ podman pull docker.io/library/alpine:latest

$ podman tag docker.io/library/alpine:latest default-route-openshift-image-registry.apps.ocp4.example.com/openshift/alpine:latest

$ podman push default-route-openshift-image-registry.apps.ocp4.example.com/openshift/alpine:latest

7. Neuvector Registry Scanning Configuration

7.1. Provide token of the service account which has access to all namespaces

## 1. Create service account
$ oc project default
$ oc create sa nvqa
$ oc get sa

## 2. Assign cluster admin role to service account to read all registry
$ oc adm policy add-cluster-role-to-user cluster-admin system:serviceaccount:default:nvqa

## 3. Get token for the service account
$ oc sa create token nvqa

得到的 Token 應該跟以下螢幕輸出類似 :

eyJhbGciOiJSUzI1NiIsImtpZCI6InNON1dvNG5jQjlyNXZmdV9WUER2YV9iZE40VUdCVEFPU1c5YTZiRHdaM1kifQ.eyJhdWQiOlsiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjIl0sImV4cCI6MTcwMjUyMzAzMywiaWF0IjoxNzAyNTE5NDMzLCJpc3MiOiJodHRwczovL2t1YmVybmV0ZXMuZGVmYXVsdC5zdmMiLCJrdWJlcm5ldGVzLmlvIjp7Im5hbWVzcGFjZSI6ImRlZmF1bHQiLCJzZXJ2aWNlYWNjb3VudCI6eyJuYW1lIjoibnZxYSIsInVpZCI6IjAwN2I1ZDgyLWZmNDMtNDliNi05ZDkyLTBhZjgzNjBiOTU5MCJ9fSwibmJmIjoxNzAyNTE5NDMzLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDpudnFhIn0.IgVmNC_OsTRUw2WnLv4JNfYfQEgJonTumTfi7dvBb5zNW5GQuyTrzmdT5klMqrVLpT7IFmi1IV4nM530dNY8SwXeCXwjNLdVZd8O1mNqrnkj5uLRVyF617TDVy8JjqZ1GKFWo8vfYQ-ObCOWJwsOhVpU62DKV7LOxLstT2JltqtHeuuHkadih1qoZxDp1Rpfjy4O_ywSn5vUNgvZq6bwx-DCjTbcO0hu832z3NKHWaK_hGdYDx5zusCy5_iWMR0PYTQj9mghCcvH72ID0ggr_lLKT2P6mFsNPX5YenjAlBi-rMBP8cV6tv9c98OZJs2SP7AuH-mqUc3m7-18rssfS3LGBmzF0ludAwYTIaUxXXjDeIVvVZEsypX5kaUlC_79ljnpgSOen9DJwl5Ps6LIzRktgTaVsphRiko6zNp0P38irgyXFK44SsMqHSZaAwh23hw4F3S1H6SUkzKgR5SwDhrqFFH4ZWz46Ijkd83cr5wtWrMxf8JP1SkChgYLD7CFrK-hA1fEw0c3Y4NoqVltAckBzXSkSBklsvUDAoQmhH5RsxHfcTX5loCf16xis_2u9mxmzWhdfB5F9Wl2czcZF-ij90SPGXyjbAhgyKcMOHK5CTQIkKOahSLK5Qfm8S1yU_dSPDRz30hsmgpNnXdCurp8fl_fdAwW8DxvvuY2asQ

7.2. 打開瀏覽器，並連線至 Neuvector Web UI

7.3. 新增 Image Registry

點選左側選單 “Assets” -> “Registries” -> “Add”

7.3. 輸入 Image Registry 資訊

Registry type: OpenShift Registry
Name: ocpregistry
Registry: https://default-route-openshift-image-registry.apps.ocp4.example.com
點選 Authenticated by Token
Token: 將第 7.1. 步驟產生的 Token 全部複製貼上到這個欄位中
filter: openshift/alpine:latest
點選右下角 Submit 按鈕

7.4. Start Scan OpenShift Image Registry

7.4.1. 點選 Start Scan 按鈕，開始掃描 Regstiry

7.4.2. 成功得到 Scan Image 後的結果資訊

Ref

Step by Step Install OCP 4.12 (Online)Disconnected Installation Mirroring