mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
38 lines
2.1 KiB
Plaintext
38 lines
2.1 KiB
Plaintext
|
|
||
|
|
// Module included in the following assemblies:
|
||
|
|
//
|
||
|
|
// * openshift_images/image-configuration.adoc
|
||
|
|
|
||
|
|
:_mod-docs-content-type: CONCEPT
|
||
|
|
[id="images-configuration-mco-and-registry-changes_{context}"]
|
||
|
|
= Machine Config Operator behavior and registry changes
|
||
|
|
|
||
|
|
[role="_abstract"]
|
||
|
|
The Machine Config Operator (MCO) watches the `image.config.openshift.io/cluster` custom resource (CR) for any changes to registries and takes specific steps when the registry changes.
|
||
|
|
|
||
|
|
When changes to the registry are applied to the `image.config.openshift.io/cluster` CR, the MCO performs the following sequential actions:
|
||
|
|
|
||
|
|
. Cordons the node; certain parameters result in drained nodes, and others do not
|
||
|
|
. Applies changes by restarting CRI-O
|
||
|
|
. Uncordons the node
|
||
|
|
+
|
||
|
|
[NOTE]
|
||
|
|
====
|
||
|
|
The MCO does not restart nodes when it detects changes. During this period, you might experience service unavailability.
|
||
|
|
====
|
||
|
|
|
||
|
|
[id="images-configuration-mco-and-blocking-registry-sources_{context}"]
|
||
|
|
== When allowing and blocking registry sources
|
||
|
|
|
||
|
|
The MCO watches the `image.config.openshift.io/cluster` resource for any changes to the registries. When the MCO detects a change, it triggers a rollout on nodes in machine config pool (MCP). The allowed registries list is used to update the image signature policy in the `/etc/containers/policy.json` file on each node. Changes to the `/etc/containers/policy.json` file do not require the node to drain.
|
||
|
|
|
||
|
|
[id="images-configuration-mco-and-shortnames_{context}"]
|
||
|
|
== When using the containerRuntimeSearchRegistries parameter
|
||
|
|
|
||
|
|
After the nodes return to the `Ready` state, if the `containerRuntimeSearchRegistries` parameter is added, the MCO creates a file in the `/etc/containers/registries.conf.d` directory on each node with the listed registries. The file overrides the default list of unqualified search registries in the `/etc/containers/registries.conf` file. There is no way to fall back to the default list of unqualified search registries.
|
||
|
|
|
||
|
|
[IMPORTANT]
|
||
|
|
====
|
||
|
|
The `containerRuntimeSearchRegistries` parameter works only with the Podman and CRI-O container engines. The registries in the list can be used only in pod specs, not in builds and image streams.
|
||
|
|
====
|