Page Comparison

This page is intended for discussions on the various ways of hosting the docker images locally and addressing the problem of re-pulling the images from the public ONAP nexus proxy every time ONAP OOM is installed. This would provide a local caching of images, minimizing the pod synchronization issues faced in a multi-node k8s setup which often prevents them from running successfully.

...

$ mkdir -p certs

$ openssl req \
  -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key \
  -x509 -days 365 -out certs/domain.crt

Make sure to enter the correct hostname of the registry host as canonical name, rest all questions can be skipped. In this example I have kept the hostname of the registry VM as "myregistryregistry"

Pull and run the registry pointing to public ONAP nexus proxy:

$ docker run -d \
 --restart=unless-stopped \
 --name myregistryregistry \
 -v `pwd`/certs:/certs \
 -e REGISTRY_HTTP_ADDR=0.0.0.0:5000 \
 -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
 -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
 -e REGISTRY_PROXY_REMOTEURL=https://nexus3.onap.org:10001 \
 -p 5000:5000 \
 registry:2

...

On each VM (Rancher and all k8s nodes) add the "myregistryregistry" hostname and IP address in /etc/hosts file

Also make following directory on each node

/etc/docker/certs.d/myregistryregistry:5000 

copy domain.crt generated on the "myregistryregistry" host to this directory and re-name it as ca.crt

...

$ helm install local/onap -n onap --namespace onap --set global.repository=myregistryregistry:5000

This will point to the local registry and start pulling the images from there. The local registry will in turn pull the images from external nexus proxy on the first attempt which will be then cached locally for any subsequent image pulls. 

To see if the registry is getting populated with the images, invoke following on the registry VM: 

curl --cacert certs/domain.crt -X GET https://registry:5000/v2/_catalog