Bug 1500507 - Support DockerInsecureRegistryAddress in image prepare command
Summary: Support DockerInsecureRegistryAddress in image prepare command
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: python-tripleoclient
Version: 12.0 (Pike)
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: 12.0 (Pike)
Assignee: Steve Baker
QA Contact: Alexander Chuzhoy
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-10-10 19:11 UTC by Alexander Chuzhoy
Modified: 2018-02-05 19:15 UTC (History)
11 users (show)

Fixed In Version: python-tripleoclient-7.3.3-3.el7ost
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-12-13 22:13:08 UTC
Target Upstream Version:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Launchpad 1722632 0 None None None 2017-10-10 19:31:09 UTC
OpenStack gerrit 514473 0 None MERGED Autodetect insecure registry in container image prepare 2021-02-12 10:45:54 UTC
OpenStack gerrit 516452 0 None MERGED Autodetect insecure registry in container image prepare 2021-02-12 10:45:53 UTC
Red Hat Product Errata RHEA-2017:3462 0 normal SHIPPED_LIVE Red Hat OpenStack Platform 12.0 Enhancement Advisory 2018-02-16 01:43:25 UTC

Description Alexander Chuzhoy 2017-10-10 19:11:44 UTC 
Currently we have to manually add the respective DockerInsecureRegistryAddress (when required).

It would be nice if we could use the --set argument of image prepare to configure the parameter appropriately.
Comment 1 Jon Schlueter 2017-10-12 20:40:14 UTC 
This is now implemented in at least 3 different tripleo deployment helpers repos for CI

https://review.openstack.org/#/c/509232/9/roles/overcloud-prep-containers/templates/overcloud-prep-containers.sh.j2@15

https://github.com/openstack/tripleo-quickstart-extras/search?utf8=%E2%9C%93&q=insecure&type=

https://github.com/redhat-openstack/tripleo-upgrade/search?utf8=%E2%9C%93&q=INSECURE&type=

https://github.com/redhat-openstack/infrared/search?utf8=%E2%9C%93&q=insecure&type=

Getting this functionality rolled into tripleo which can be re-used by these other projects would be helpful to reduce amount of code duplication as well as feature richness of the functionality.
Comment 2 Steve Baker 2017-10-12 22:43:00 UTC 
Rather than adding another option to the prepare command, it should just detect whether the registry is insecure by making https and http calls, then set the DockerInsecureRegistryAddress if it is not https.
Comment 3 Dan Prince 2017-10-20 12:56:37 UTC 
(In reply to Steve Baker from comment #2)
> Rather than adding another option to the prepare command, it should just
> detect whether the registry is insecure by making https and http calls, then
> set the DockerInsecureRegistryAddress if it is not https.

Having it magically enable "DockerInsecureRegistryAddress" might be perceived as security problem by some users though too. I sort of like the idea of letting insecure registry address configuration as being explicitly something you need to enable.
Comment 5 Steve Baker 2017-11-01 20:05:33 UTC 
The backport is merged in stable/pike
Comment 8 Alexander Chuzhoy 2017-11-15 15:30:16 UTC 
Verified:

Environment:
python-tripleoclient-7.3.3-3.el7ost.noarch


An https connection is made to the registry and if it returns an ssl error, then  the DockerInsecureRegistryAddress line is appended automatically.


Example of how it looks in the file:
  DockerInsecureRegistryAddress:
  - 192.168.24.1:8787
Comment 11 errata-xmlrpc 2017-12-13 22:13:08 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:3462
Note You need to log in before you can comment on or make changes to this bug.