Update Docker Registry Credentials on a Subcloud

On a subcloud that uses the systemController’s docker registry (registry.central) as its install registry, one should use the systemController’s sysinv service credentials for accessing registry.central. This makes access to registry.central independent of changes to the Distributed Cloud’s keystone admin user password.

Use the following procedure to update the install registry credentials on the subcloud to the sysinv service credentials of the systemController.

Procedure

  1. On the SystemController, get the password for the sysinv services.

    $ keyring get sysinv services
    
  2. On each subcloud, run the following script to update the docker registry credentials to sysinv:

    $ ./update_docker_registry_auth.sh sysinv <sysinv_password>
    

    Where ./update_docker_registry_auth.sh script is:

    #!/bin/bash -e
    
    USAGE="usage: ${0##*/} <username> <password>"
    
    if [ "$#" -ne 2 ]
    then
      echo Missing arguments.
      echo $USAGE
      echo
      exit
    fi
    
    NEW_CREDS="username:$1 password:$2"
    
    echo
    
    for REGISTRY in docker-registry quay-registry elastic-registry gcr-registry k8s-registry
    do
    
      echo -n "Updating" $REGISTRY "credentials ."
      SECRET_UUID=`system service-parameter-list | fgrep $REGISTRY | fgrep auth-secret | awk '{print $10}'`
      if [ -z "$SECRET_UUID" ]
      then
       echo "No $REGISTRY entry in service-parameters"
       echo
       continue
      fi
      SECRET_REF=`openstack secret list | fgrep ${SECRET_UUID} | awk '{print $2}'`
      echo -n "."
      SECRET_VALUE=`openstack secret get ${SECRET_REF} --payload -f value`
      echo -n "."
    
      openstack secret delete ${SECRET_REF} > /dev/null
      echo -n "."
      NEW_SECRET_VALUE=$NEW_CREDS
      openstack secret store -n ${REGISTRY}-secret -p "${NEW_SECRET_VALUE}" > /dev/null
      echo -n "."
      NEW_SECRET_REF=`openstack secret list | fgrep ${REGISTRY}-secret | awk '{print $2}'`
      NEW_SECRET_UUID=`echo "${NEW_SECRET_REF}" | awk -F/ '{print $6}'`
      system service-parameter-modify docker $REGISTRY auth-secret="${NEW_SECRET_UUID}" > /dev/null
      echo -n "."
      echo " done."
    
      echo -n "Validating $REGISTRY credentials updated to:  "
      SECRET_UUID=`system service-parameter-list | fgrep $REGISTRY | fgrep auth-secret | awk '{print $10}'`
      if [ -z "$SECRET_UUID" ]
      then
       continue
      fi
      SECRET_REF=`openstack secret list | fgrep ${SECRET_UUID} | awk '{print $2}'`
      SECRET_VALUE=`openstack secret get ${SECRET_REF} --payload -f value`
      echo $SECRET_VALUE
    
      echo
    
    done