Bug 1377480

Document URL: 

https://access.redhat.com/documentation/en/openshift-enterprise/version-3.2/installation-and-configuration/#install-config-install-docker-registry

Section Number and Name: 

2.7.2.2.1



Describe the issue: 


Or, to attach an existing NFS volume to the registry:

oc volume deploymentconfigs/docker-registry \
     --add --overwrite --name=registry-storage --mount-path=/registry \
     --source='{"nfs": { "server": "<fqdn>", "path": "/path/to/export"}}'


When you try to do this without adding scc privileges the docker registry fails without any real good reason why.

Suggestions for improvement: 

After the Or line noted above suggesting adding something like.

Note: Mounting an nfs share requires privileged security context to be set on the registry

oadm policy add-scc-to-user privileged system:serviceaccount:default:registry

Additional information: 

Seems like the oc volume command should do that for us automatically maybe.

Regardless seems like an error should be logged to better help determine the underlying issue.

Two scripts to create/delete registry.

Note you might have to edit scc 

oc edit scc privileged #for full cleanup

[root@m01-useast1a-c001 ~]# cat create_registry.sh 
#!/bin/bash

echo '{"kind":"ServiceAccount","apiVersion":"v1","metadata":{"name":"registry"}}' | oc create -n default -f - 


#oadm policy add-scc-to-user privileged registry
oadm policy add-scc-to-user privileged system:serviceaccount:default:registry

oadm registry --config=/etc/origin/master/admin.kubeconfig \
    --service-account=registry \
    --images='registry.access.redhat.com/openshift3/ose-${component}:${version}' \
    --selector='region=primary,zone=east' 

oc volume deploymentconfigs/docker-registry \
     --add --overwrite --name=registry-storage --mount-path=/registry \
     --source='{"nfs": { "server": "10.0.2.172", "path": "/"}}'

[root@m01-useast1a-c001 ~]# cat delete_registry.sh 
oc delete dc/docker-registry
oc delete svc/docker-registry
oc delete sa/registry
for i in $(oc get secrets | grep registry | awk '{print $1}')
do 
  echo "deleting secret/$i"
  oc delete secret/$i
done