Chapter 2. Obtaining and modifying container images A containerized overcloud requires access to a registry with the required container images. This chapter provides information on how to prepare the registry and your undercloud and overcloud configuration to use container images for Red Hat OpenStack Platform. 2.1. Preparing container images The overcloud configuration requires initial registry configuration to determine where to obtain images and how to store them. Complete the following steps to generate and customize an environment file that you can use to prepare your container images. Procedure Log in to your undercloud host as the stack user. Generate the default container image preparation file: This command includes the following additional options: --local-push-destination sets the registry on the undercloud as the location for container images. This means the director pulls the necessary images from the Red Hat Container Catalog and pushes them to the registry on the undercloud. The director uses this registry as the container image source. To pull directly from the Red Hat Container Catalog, omit this option. --output-env-file is an environment file name. The contents of this file include the parameters for preparing your container images. In this case, the name of the file is containers-prepare-parameter.yaml . Note You can use the same containers-prepare-parameter.yaml file to define a container image source for both the undercloud and the overcloud. Modify the containers-prepare-parameter.yaml to suit your requirements. 2.2. Container image preparation parameters The default file for preparing your containers ( containers-prepare-parameter.yaml ) contains the ContainerImagePrepare heat parameter. This parameter defines a list of strategies for preparing a set of images: Each strategy accepts a set of sub-parameters that defines which images to use and what to do with the images. The following table contains information about the sub-parameters you can use with each ContainerImagePrepare strategy: Parameter Description excludes List of regular expressions to exclude image names from a strategy. includes List of regular expressions to include in a strategy. At least one image name must match an existing image. All excludes are ignored if includes is specified. modify_append_tag String to append to the tag for the destination image. For example, if you pull an image with the tag 14.0-89 and set the modify_append_tag to -hotfix , the director tags the final image as 14.0-89-hotfix . modify_only_with_labels A dictionary of image labels that filter the images that you want to modify. If an image matches the labels defined, the director includes the image in the modification process. modify_role String of ansible role names to run during upload but before pushing the image to the destination registry. modify_vars Dictionary of variables to pass to modify_role . push_destination Defines the namespace of the registry that you want to push images to during the upload process. If set to true , the push_destination is set to the undercloud registry namespace using the hostname, which is the recommended method. If set to false , the push to a local registry does not occur and nodes pull images directly from the source. If set to a custom value, director pushes images to an external local registry. If you choose to pull container images directly from the Red Hat Container Catalog, do not set this parameter to false in production environments or else all overcloud nodes will simultaneously pull the images from the Red Hat Container Catalog over your external connection, which can cause bandwidth issues. If the push_destination parameter is set to false or is not defined and the remote registry requires authentication, set the ContainerImageRegistryLogin parameter to true and include the credentials with the ContainerImageRegistryCredentials parameter. pull_source The source registry from where to pull the original container images. set A dictionary of key: value definitions that define where to obtain the initial images. tag_from_label Use the value of specified container image labels to discover and pull the versioned tag for every image. Director inspects each container image tagged with the value that you set for tag , then uses the container image labels to construct a new tag, which director pulls from the registry. For example, if you set tag_from_label: {version}-{release} , director uses the version and release labels to construct a new tag. For one container, version might be set to 13.0 and release might be set to 34 , which results in the tag 13.0-34 . The set parameter accepts a set of key: value definitions: Key Description ceph_image The name of the Ceph Storage container image. ceph_namespace The namespace of the Ceph Storage container image. ceph_tag The tag of the Ceph Storage container image. name_prefix A prefix for each OpenStack service image. name_suffix A suffix for each OpenStack service image. namespace The namespace for each OpenStack service image. neutron_driver The driver to use to determine which OpenStack Networking (neutron) container to use. Use a null value to set to the standard neutron-server container. Set to ovn to use OVN-based containers. tag Sets the specific tag for all images from the source. If you use this option without specifying a tag_from_label value, director pulls all container images that use this tag. However, if you use this option in combination with tag_from_label value, director uses the tag as a source image to identify a specific version tag based on labels. Keep this key set to the default value, which is the Red Hat OpenStack Platform version number. Important The Red Hat Container Registry uses a specific version format to tag all Red Hat OpenStack Platform container images. This version format is {version}-{release} , which each container image stores as labels in the container metadata. This version format helps facilitate updates from one {release} to the . For this reason, you must always use the tag_from_label: {version}-{release} parameter with the ContainerImagePrepare heat parameter. Do not only use tag on its own to to pull container images. For example, using tag by itself causes problems when performing updates because director requires a change in tag to update a container image. Important The container images use multi-stream tags based on Red Hat OpenStack Platform version. This means there is no longer a latest tag. The ContainerImageRegistryCredentials parameter maps a container registry to a username and password to authenticate to that registry. If a container registry requires a username and password, you can use ContainerImageRegistryCredentials to include credentials with the following syntax: In the example, replace my_username and my_password with your authentication credentials. Instead of using your individual user credentials, Red Hat recommends creating a registry service account and using those credentials to access registry.redhat.io content. For more information, see "Red Hat Container Registry Authentication" . The ContainerImageRegistryLogin parameter is used to control the registry login on the systems being deployed. This must be set to true if push_destination is set to false or not used. 2.3. Layering image preparation entries The value of the ContainerImagePrepare parameter is a YAML list. This means that you can specify multiple entries. The following example demonstrates two entries where director uses the latest version of all images except for the nova-api image, which uses the version tagged with 16.0-44 : The includes and excludes parameters use regular expressions to control image filtering for each entry. The images that match the includes strategy take precedence over excludes matches. The image name must the includes or excludes regular expression value to be considered a match. 2.4. Modifying images during preparation It is possible to modify images during image preparation, and then immediately deploy with modified images. Scenarios for modifying images include: As part of a continuous integration pipeline where images are modified with the changes being tested before deployment. As part of a development workflow where local changes must be deployed for testing and development. When changes must be deployed but are not available through an image build pipeline. For example, adding proprietary add-ons or emergency fixes. To modify an image during preparation, invoke an Ansible role on each image that you want to modify. The role takes a source image, makes the requested changes, and tags the result. The prepare command can push the image to the destination registry and set the heat parameters to refer to the modified image. The Ansible role tripleo-modify-image conforms with the required role interface and provides the behaviour necessary for the modify use cases. Control the modification with the modify-specific keys in the ContainerImagePrepare parameter: modify_role specifies the Ansible role to invoke for each image to modify. modify_append_tag appends a string to the end of the source image tag. This makes it obvious that the resulting image has been modified. Use this parameter to skip modification if the push_destination registry already contains the modified image. Change modify_append_tag whenever you modify the image. modify_vars is a dictionary of Ansible variables to pass to the role. To select a use case that the tripleo-modify-image role handles, set the tasks_from variable to the required file in that role. While developing and testing the ContainerImagePrepare entries that modify images, run the image prepare command without any additional options to confirm that the image is modified as you expect: 2.5. Updating existing packages on container images The following example ContainerImagePrepare entry updates all packages on the images using the dnf repository configuration on the undercloud host: 2.6. Installing additional RPM files to container images You can install a directory of RPM files in your container images. This is useful for installing hotfixes, local package builds, or any package that is not available through a package repository. For example, the following ContainerImagePrepare entry installs some hotfix packages only on the nova-compute image: 2.7. Modifying container images with a custom Dockerfile For maximum flexibility, you can specify a directory containing a Dockerfile to make the required changes. When you invoke the tripleo-modify-image role, the role generates a Dockerfile.modified file that changes the FROM directive and adds extra LABEL directives. The following example runs the custom Dockerfile on the nova-compute image: The following example shows the /home/stack/nova-custom/Dockerfile file. After you run any USER root directives, you must switch back to the original image default user: 2.8. Preparing a Satellite server for container images Red Hat Satellite 6 offers registry synchronization capabilities that you can use to pull multiple images into a Satellite server and manage them as part of an application life cycle. The Satellite also acts as a registry for other container-enabled systems to use. For more information about managing container images, see "Managing Container Images" in the Red Hat Satellite 6 Content Management Guide . The examples in this procedure use the hammer command line tool for Red Hat Satellite 6 and an example organization called ACME . Substitute this organization for your own Satellite 6 organization. Note This procedure requires authentication credentials to access container images from registry.redhat.io . Instead of using your individual user credentials, Red Hat recommends creating a registry service account and using those credentials to access registry.redhat.io content. For more information, see "Red Hat Container Registry Authentication" . Procedure Create a list of all container images: Copy the satellite_images file to a system that contains the Satellite 6 hammer tool. Alternatively, use the instructions in the Hammer CLI Guide to install the hammer tool to the undercloud. Run the following hammer command to create a new product ( OSP16 Containers ) in your Satellite organization: This custom product will contain your images. Add the base container image to the product: Add the overcloud container images from the satellite_images file: Add the Ceph Storage 4 container image: Synchronize the container images: Wait for the Satellite server to complete synchronization. Note Depending on your configuration, hammer might prompt you for your Satellite server username and password. You can configure hammer to log in automatically using a configuration file. For more information, see the "Authentication" section in the Hammer CLI Guide . If your Satellite 6 server uses content views, create a new content view version to incorporate the images and promote it along environments in your application life cycle. This largely depends on how you structure your application lifecycle. For example, if you have an environment called production in your lifecycle and you want the container images to be available in that environment, create a content view that includes the container images and promote that content view to the production environment. For more information, see "Managing Content Views" . Check the available tags for the base image: This command displays tags for the OpenStack Platform container images within a content view for a particular environment. Return to the undercloud and generate a default environment file that prepares images using your Satellite server as a source. Run the following example command to generate the environment file: --output-env-file is an environment file name. The contents of this file include the parameters for preparing your container images for the undercloud. In this case, the name of the file is containers-prepare-parameter.yaml . Edit the containers-prepare-parameter.yaml file and modify the following parameters: push_destination - Set this to true or false depending on your chosen container image management strategy. If you set this parameter to false , the overcloud nodes pull images directly from the Satellite. If you set this parameter to true , the director pulls the images from the Satellite to the undercloud registry and the overcloud pulls the images from the undercloud registry. namespace - The URL and port of the registry on the Satellite server. The default registry port on Red Hat Satellite is 5000. name_prefix - The prefix is based on a Satellite 6 convention. This differs depending on whether you use content views: If you use content views, the structure is [org]-[environment]-[content view]-[product]- . For example: acme-production-myosp16-osp16_containers- . If you do not use content views, the structure is [org]-[product]- . For example: acme-osp16_containers- . ceph_namespace , ceph_image , ceph_tag - If you use Ceph Storage, include these additional parameters to define the Ceph Storage container image location. Note that ceph_image now includes a Satellite-specific prefix. This prefix is the same value as the name_prefix option. The following example environment file contains Satellite-specific parameters: You must define the containers-prepare-parameter.yaml environment file in the undercloud.conf configuration file, otherwise the undercloud uses the default values:

Commands:
openstack tripleo container image prepare default --local-push-destination --output-env-file containers-prepare-parameter.yaml
parameter_defaults: ContainerImagePrepare: - (strategy one) - (strategy two) - (strategy three)
ContainerImagePrepare: - push_destination: true set: namespace: registry.redhat.io/ ContainerImageRegistryCredentials: registry.redhat.io: my_username: my_password
ContainerImagePrepare: - set: namespace: registry.redhat.io/ ContainerImageRegistryCredentials: registry.redhat.io: my_username: my_password ContainerImageRegistryLogin: true
ContainerImagePrepare: - tag_from_label: "{version}-{release}" push_destination: true excludes: - nova-api set: namespace: registry.redhat.io/rhosp-rhel8 name_prefix: openstack- name_suffix: '' tag: 16.0 - push_destination: true includes: - nova-api set: namespace: registry.redhat.io/rhosp-rhel8 tag: 16.0-44
sudo openstack tripleo container image prepare -e ~/containers-prepare-parameter.yaml
ContainerImagePrepare: - push_destination: true modify_role: tripleo-modify-image modify_append_tag: "-updated" modify_vars: tasks_from: yum_update.yml compare_host_packages: true yum_repos_dir_path: /etc/yum.repos.d
ContainerImagePrepare: - push_destination: true includes: - nova-compute modify_role: tripleo-modify-image modify_append_tag: "-hotfix" modify_vars: tasks_from: rpm_install.yml rpms_path: /home/stack/nova-hotfix-pkgs
ContainerImagePrepare: - push_destination: true includes: - nova-compute modify_role: tripleo-modify-image modify_append_tag: "-hotfix" modify_vars: tasks_from: modify_image.yml modify_dir_path: /home/stack/nova-custom
FROM registry.redhat.io/rhosp-rhel8/openstack-nova-compute:latest USER "root" COPY customize.sh /tmp/ RUN /tmp/customize.sh USER "nova"
sudo podman search --limit 1000 "registry.redhat.io/rhosp" | grep rhosp-rhel8 | awk '{ print USD2 }' | grep -v beta | sed "s/registry.redhat.io\///g" | tail -n+2 > satellite_images
hammer product create --organization "ACME" --name "OSP16 Containers"
hammer repository create --organization "ACME" --product "OSP16 Containers" --content-type docker --url https://registry.redhat.io --docker-upstream-name rhosp-rhel8/openstack-base --upstream-username USERNAME --upstream-password PASSWORD --name base
while read IMAGE; do IMAGENAME=USD(echo USDIMAGE | cut -d"/" -f2 | sed "s/openstack-//g" | sed "s/:.*//g") ; hammer repository create --organization "ACME" --product "OSP16 Containers" --content-type docker --url https://registry.redhat.io --docker-upstream-name USDIMAGE --upstream-username USERNAME --upstream-password PASSWORD --name USDIMAGENAME ; done < satellite_images
hammer repository create --organization "ACME" --product "OSP16 Containers" --content-type docker --url https://registry.redhat.io --docker-upstream-name rhceph-beta/rhceph-4-rhel8 --upstream-username USERNAME --upstream-password PASSWORD --name rhceph-4-rhel8
hammer product synchronize --organization "ACME" --name "OSP16 Containers"
hammer docker tag list --repository "base" --organization "ACME" --lifecycle-environment "production" --content-view "myosp16" --product "OSP16 Containers"
openstack tripleo container image prepare default --output-env-file containers-prepare-parameter.yaml
parameter_defaults: ContainerImagePrepare: - push_destination: false set: ceph_image: acme-production-myosp16-osp16_containers-rhceph-4 ceph_namespace: satellite.example.com:5000 ceph_tag: latest name_prefix: acme-production-myosp16-osp16_containers- name_suffix: '' namespace: satellite.example.com:5000 neutron_driver: null tag: 16.0 tag_from_label: '{version}-{release}'
container_images_file = /home/stack/containers-prepare-parameter.yaml