Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1511656 - Document whitelist feature of local registry adapter for Ansible Service Broker
Summary: Document whitelist feature of local registry adapter for Ansible Service Broker
Keywords:
Status: NEW
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Documentation
Version: 3.7.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
: 3.7.0
Assignee: Vikram Goyal
QA Contact: Vikram Goyal
Vikram Goyal
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-11-09 19:43 UTC by Dylan Murray
Modified: 2017-11-10 15:47 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Dylan Murray 2017-11-09 19:43:02 UTC
Description of problem:

When using registry type: `local_openshift` which is configured by default downstream, the administrator will want to whitelist the APBs in the registry he wants to make accessible. By default the adapter looks in the openshift namespace but does not have a whitelist. We would recommend they set the whitelist value to ['.*-apb$'] or ['*'] so that it will look through all available images in the openshift namespace.


Version-Release number of selected component (if applicable):
3.7.0

Additional info:
Example config:


registry:
  - type: local_openshift

    name: lo
    namespaces:
      - openshift
    white_list:
      - ".*-apb$"

Comment 1 Dylan Murray 2017-11-10 15:47:11 UTC
Another thing to properly include in the documentation is why we suggest using the 'openshift' namespace. By default the 'openshift' namespace exposes all imagestreams to any authenticated user on the cluster. This is valuable to the Ansible Service Broker because we create a transient namespace when provisioning APBs and that dynamic service account needs to be able to pull images from the internal registry.

We want to encourage users to enable the openshift namespace by default and point them towards resources that will allow users to pull images from different projects here: https://docs.openshift.com/enterprise/3.2/dev_guide/managing_images.html#allowing-pods-to-reference-images-across-projects


Note You need to log in before you can comment on or make changes to this bug.