Steve is this something we can backport to OSP13?

The authentication support which has been added cannot be backported because it is podman specific and podman support was only added in OSP-15.

For OSP-13, it should be possible to make the required "docker login" calls before running "openstack overcloud container image prepare --push-destination=192.168.24.1:8787 ...". 

Other than the extra docker login calls, the flow should be the same as the documentation[1]

[1] https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/13/html/director_installation_and_usage/configuring-a-container-image-source

For the record, I've seen docker login added to a PreConfig task to have it occur prior to the deployment for the overcloud nodes. Perhaps we might need to provide a basic template for this.

(In reply to Alex Schultz from comment #5)
> For the record, I've seen docker login added to a PreConfig task to have it
> occur prior to the deployment for the overcloud nodes. Perhaps we might need
> to provide a basic template for this.

That is another option which could be considered. However it might be easier for the customer to only require docker login on the undercloud before the container prepare, because from that point on the images are served from the undercloud registry where auth isn't required for the overcloud nodes.

Yes that would be much easier to just have the user use docker login and sync to the undercloud.

To test, you can enable authentication on the undercloud after you follow the procedure to use the undercloud as a registry.  https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/13/html/director_installation_and_usage/configuring-a-container-image-source#Configuring-Registry_Details-Local

Enable auth configuration for docker-distribution:

cat <<EOF | sudo tee -a /etc/docker-distribution/registry/config.yml
auth:
    htpasswd:
       realm: basic-realm
       path: /etc/docker-distribution/auth
EOF
sudo htpasswd -Bbc /etc/docker-distribution/auth admin admin
sudo systemctl restart docker-distribution


Then enable login via parameter_default:

cat > ~/container-login.yaml <<EOF
parameter_defaults:
  ContainerImageRegistryLogin: true
  ContainerImageRegistryCredentials:
    '192.168.24.1:8787':
      admin: admin
EOF

According to our records, this should be resolved by puppet-tripleo-8.4.1-27.el7ost.  This build is available now.

According to our records, this should be resolved by openstack-tripleo-heat-templates-8.3.1-87.el7ost.  This build is available now.

Verified on 13  -p 2019-10-01.1