AGENT-1375: Configure local registry to run without TLS certificates #616
Conversation
Removed TLS certificate generation and configuration from the local registry setup. Changes: - Remove certificate generation from setup-local-registry.sh and setup-local-registry-upgrade.sh scripts - Remove TLS certificate environment variables and volume mounts from start-local-registry.service and [email protected] - Configure registry containers to listen on HTTP (port 5000) - Mark registry mirrors as insecure in registries.conf to allow HTTP connections from container runtimes - Preserve DNS configuration for registry.appliance.openshift.com This change requires clients to use HTTP instead of HTTPS when connecting to the appliance's local registry. The registries.conf file now includes 'insecure = true' for all registry mirrors to ensure podman/skopeo/CRI-O accept HTTP connections. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Assisted-by: Claude <[email protected]>
openshift-ci-robot
added
the
jira/valid-reference
|
@rwsu: This pull request references AGENT-1375 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.21.0" version, but no target version was set. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: rwsu The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Update test expectations to include 'insecure = true' in the registries.conf output, reflecting the changes made to configure the local registry to run without TLS certificates. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Assisted-by: Claude <[email protected]>
rwsu
changed the title
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
@rwsu: all tests passed! Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/hold just to avoid getting merged until the approach will be verified via openshift/assisted-service#8455 |
openshift-ci
bot
added
the
do-not-merge/hold
|
Closing. The updated plan is to use TLS certificates. |
3 participants
Removed TLS certificate generation and configuration from the local registry setup.
Changes:
This change requires clients to use HTTP instead of HTTPS when connecting to the appliance's local registry. The registries.conf file now includes 'insecure = true' for all registry mirrors to ensure podman/skopeo/CRI-O accept HTTP connections.
🤖 Generated with Claude Code
Assisted-by: Claude [email protected]