Chapter 5. Exposing the registry By default, the OpenShift image registry is secured during cluster installation so that it serves traffic through TLS. Unlike versions of OpenShift Container Platform, the registry is not exposed outside of the cluster at the time of installation. 5.1. Exposing a default registry manually Instead of logging in to the default OpenShift image registry from within the cluster, you can gain external access to it by exposing it with a route. This external access enables you to log in to the registry from outside the cluster using the route address and to tag and push images to an existing project by using the route host. Prerequisites The following prerequisites are automatically performed: Deploy the Registry Operator. Deploy the Ingress Operator. You have access to the cluster as a user with the cluster-admin role. Procedure You can expose the route by using the defaultRoute parameter in the configs.imageregistry.operator.openshift.io resource. To expose the registry using the defaultRoute : Set defaultRoute to true by running the following command: USD oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge Get the default registry route by running the following command: USD HOST=USD(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}') Get the certificate of the Ingress Operator by running the following command: USD oc extract secret/USD(oc get ingresscontroller -n openshift-ingress-operator default -o json | jq '.spec.defaultCertificate.name // "router-certs-default"' -r) -n openshift-ingress --confirm Move the extracted certificate to the system's trusted CA directory by running the following command: USD sudo mv tls.crt /etc/pki/ca-trust/source/anchors/ Enable the cluster's default certificate to trust the route by running the following command: USD sudo update-ca-trust enable Log in with podman using the default route by running the following command: USD sudo podman login -u kubeadmin -p USD(oc whoami -t) USDHOST 5.2. Exposing a secure registry manually Instead of logging in to the OpenShift image registry from within the cluster, you can gain external access to it by exposing it with a route. This allows you to log in to the registry from outside the cluster using the route address, and to tag and push images to an existing project by using the route host. Prerequisites The following prerequisites are automatically performed: Deploy the Registry Operator. Deploy the Ingress Operator. You have access to the cluster as a user with the cluster-admin role. Procedure You can expose the route by using DefaultRoute parameter in the configs.imageregistry.operator.openshift.io resource or by using custom routes. To expose the registry using DefaultRoute : Set DefaultRoute to True : USD oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge Log in with podman : USD HOST=USD(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}') USD podman login -u kubeadmin -p USD(oc whoami -t) --tls-verify=false USDHOST 1 1 --tls-verify=false is needed if the cluster's default certificate for routes is untrusted. You can set a custom, trusted certificate as the default certificate with the Ingress Operator. To expose the registry using custom routes: Create a secret with your route's TLS keys: USD oc create secret tls public-route-tls \ -n openshift-image-registry \ --cert=</path/to/tls.crt> \ --key=</path/to/tls.key> This step is optional. If you do not create a secret, the route uses the default TLS configuration from the Ingress Operator. On the Registry Operator: USD oc edit configs.imageregistry.operator.openshift.io/cluster spec: routes: - name: public-routes hostname: myregistry.mycorp.organization secretName: public-route-tls ... Note Only set secretName if you are providing a custom TLS configuration for the registry's route. Troubleshooting Error creating TLS secret

Commands:
oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge
HOST=USD(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')
oc extract secret/USD(oc get ingresscontroller -n openshift-ingress-operator default -o json | jq '.spec.defaultCertificate.name // "router-certs-default"' -r) -n openshift-ingress --confirm
sudo mv tls.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust enable
sudo podman login -u kubeadmin -p USD(oc whoami -t) USDHOST
oc patch configs.imageregistry.operator.openshift.io/cluster --patch '{"spec":{"defaultRoute":true}}' --type=merge
HOST=USD(oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}')
podman login -u kubeadmin -p USD(oc whoami -t) --tls-verify=false USDHOST 1
oc create secret tls public-route-tls -n openshift-image-registry --cert=</path/to/tls.crt> --key=</path/to/tls.key>
oc edit configs.imageregistry.operator.openshift.io/cluster
spec: routes: - name: public-routes hostname: myregistry.mycorp.organization secretName: public-route-tls