Bootstrap from a Private Container Registry¶

You can bootstrap controller-0 from a private container registry when your server is isolated from the public Internet.

Note

The private container registry name must not end with “.local” to ensure that the system properly resolves the domain name using external DNS.

Procedure

Update your /home/sysadmin/localhost.yml bootstrap overrides file with the following lines to use a private container registry pre-populated from the StarlingX container registry:

docker_registries:
  k8s.gcr.io:
    url: <my-registry.io>/k8s.gcr.io
  gcr.io:
    url: <my-registry.io>/gcr.io
  ghcr.io:
    url: <my-registry.io>/ghcr.io
  quay.io:
    url: <my-registry.io>/quay.io
  docker.io:
    url: <my-registry.io>/docker.io
  docker.elastic.co:
    url: <my-registry.io>/docker.elastic.co
  registry.k8s.io:
    url: <my-registry.io>/registry.k8s.io
  icr.io:
    url: <my-registry.io>/icr.io
defaults:
    type: docker
    username: <your_my-registry.io_username>
    password: <your_my-registry.io_password>

Where <your_my-registry.io_username> and <your_my-registry.io_password> are your login credentials for the <my-registry.io> private container registry.

Note

<my-registry.io> must be a DNS name resolvable by the dns servers configured in the dns_servers: structure of the Ansible bootstrap override file /home/sysadmin/localhost.yml.

If a firewall is blocking access to your container image registry (for example, Docker Hub or a private registry) from your StarlingX deployment, add the following lines in $HOME/localhost.yml. For more information, see Docker Proxy Configuration.
```
# Add these lines to configure Docker to use a proxy server
docker_http_proxy: http://my.proxy.com:1080
docker_https_proxy: https://my.proxy.com:1443
docker_no_proxy:
   - 1.2.3.4
```
Configure system_local_ca_cert, system_local_ca_key and system_root_ca_cert to setup a local intermediate CA (signed by an external Root CA) for managing / signing all of the StarlingX Certificates. See Platform Issuer (system-local-ca) for more details.
Add the CA certificate that signed myprivateregistry.abc.com’s certificate as a trusted CA:
```
ssl_ca_cert: /home/sysadmin/myprivateregistry.abc.com-ca-cert.pem
```
For any additional local registry images required, use the full image name as shown below.
```
additional_local_registry_images:
    docker.io/wind-river/<imageName>:<tag>
```