mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
63 lines
1.9 KiB
Plaintext
63 lines
1.9 KiB
Plaintext
:_mod-docs-content-type: PROCEDURE
|
|
[id="hcp-ibm-z-update-registry-ca_{context}"]
|
|
= Update the registry certificate authority in the AgentServiceConfig resource with the mirror registry
|
|
|
|
When you use a mirror registry for images, agents need to trust the registry's certificate to securely pull images. You can add the certificate authority of the mirror registry to the `AgentServiceConfig` custom resource by creating a `ConfigMap`.
|
|
|
|
.Prerequisites
|
|
|
|
* You must have installed {mce}.
|
|
|
|
.Procedure
|
|
|
|
. In the same namespace where you installed {mce-short}, create a `ConfigMap` resource with the mirror registry details. This `ConfigMap` resource ensures that you grant the hosted cluster workers the capability to retrieve images from the mirror registry.
|
|
+
|
|
.Example ConfigMap file
|
|
[source,yaml]
|
|
----
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: mirror-config
|
|
namespace: multicluster-engine
|
|
labels:
|
|
app: assisted-service
|
|
data:
|
|
ca-bundle.crt: |
|
|
-----BEGIN CERTIFICATE-----
|
|
-----END CERTIFICATE-----
|
|
registries.conf: |
|
|
|
|
[[registry]]
|
|
location = "registry.stage.redhat.io"
|
|
insecure = false
|
|
blocked = false
|
|
mirror-by-digest-only = true
|
|
prefix = ""
|
|
|
|
[[registry.mirror]]
|
|
location = "<mirror_registry>"
|
|
insecure = false
|
|
|
|
[[registry]]
|
|
location = "registry.redhat.io/multicluster-engine"
|
|
insecure = false
|
|
blocked = false
|
|
mirror-by-digest-only = true
|
|
prefix = ""
|
|
|
|
[[registry.mirror]]
|
|
location = "<mirror_registry>/multicluster-engine" # <1>
|
|
insecure = false
|
|
----
|
|
+
|
|
<1> Where: `<mirror_registry>` is the name of the mirror registry.
|
|
|
|
. Patch the `AgentServiceConfig` resource to include the `ConfigMap` resource that you created. If the `AgentServiceConfig` resource is not present, create the `AgentServiceConfig` resource with the following content embedded into it:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
spec:
|
|
mirrorRegistryRef:
|
|
name: mirror-config
|
|
---- |