Make mirror-by-digest-only option configurable through ImageContentSourcePolicy

[mvazquezc]

When working with disconnected environments, sometimes you need to define multiple ImageContentSourcePolicies, some of them are used by apps / manifests that don't use digests when pulling the images.

Currently, all configurations are added with mirror-by-digest-only property set to true. It will be nice if this property could be configured using the ImageContentSourcePolicy.

Thanks,

[jparrill]

Some examples of this method:

• As you could see, there are already applied some ICSP already on the current cluster:

[kni@bm-cluster-1-hyper ipv6]$ oc get imagecontentsourcepolicy
NAME                      AGE
community-operators       62m
image-policy-0            62m
image-policy-1            62m
open-cluster-management   62m
redhat-operators          62m

In a Master, by default you will have this config (head -10 of the /etc/containers/registries.conf file):

[root@openshift-master-0 core]# cat /etc/containers/registries.conf | head -10
unqualified-search-registries = ["registry.access.redhat.com", "docker.io"]

[[registry]]
  prefix = ""
  location = "docker.io/apache/camel-k"
  mirror-by-digest-only = true

  [[registry.mirror]]
    location = "bm-cluster-1-hyper.e2e.bos.redhat.com:5000/apache/camel-k"
...
...
...

And as you see on every entry from oc release mirror... command will include the attribute mirror-by-digest-only = true and also is included in the main section called [registries], the thing is, if you add a separated ICSP this option will be included by default and there is not any way via API to configure this parameter.

The use case is easy, think in a non-released product (ACM) and on a disconnected deployment. We need to provide a way through the API to configure these parameters in order to avoid access the nodes by ssh and modify the file manually.

[jianzhangbjz]

/cc

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[openshift-bot]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

[a-dawg]

I am having the same issue, this would be very useful when using internal image registries. There is no other way to bypass the machineconfig cluster operator and degraded it...

[openshift-bot]

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

[openshift-ci-robot]

@openshift-bot: Closing this issue.

Details

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[reggie-k]

High priority for our org as well.
Any updates?