#Add External Address for Built-in Registry

#Overview

When the global cluster uses the Platform Built-in registry, workload clusters typically also use this registry to pull images. The registry not only serves components within the global cluster but must also be accessible to workload cluster nodes.

In certain scenarios, workload cluster nodes cannot directly access the global cluster's registry address - for example, when the global cluster is in a private data center while workload clusters are in public clouds or edge environments.

This guide explains how to configure an externally accessible address for the platform's default registry to allow workload clusters to pull images.

#Prerequisites

Before you begin, prepare the following:

• A domain name accessible by workload cluster nodes
• The IP address that the domain name points to
• A valid SSL certificate for the domain name

#Procedure

#Configure Certificate and Routing Rules for the Platform Registry

1. Copy the domain's valid certificate to any control plane node of the global cluster

2. Create a TLS secret containing the domain certificate:

   kubectl create secret tls registry-address.tls --cert=<certificate-filename> --key=<key-filename> -n kube-system

   Example:

   kubectl create secret tls registry-address.tls --cert=custom.crt --key=custom.key -n kube-system

   Note: After creating the certificate, monitor the expiration date of the registry-address.tls secret in the kube-system namespace of the global cluster. Replace the certificate before it expires.

3. Create ingress rules on any control plane node of the global cluster:

   REGISTRY_DOMAIN_NAME=<www.registry.com> # Replace with your accessible domain name
   cat << EOF | kubectl create -f -
   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     annotations:
       nginx.ingress.kubernetes.io/backend-protocol: HTTPS
     name: registry-address
     namespace: kube-system
     labels:
       service_name: registry
   spec:
     rules:
       - host: $REGISTRY_DOMAIN_NAME
         http:
           paths:
             - backend:
                 service:
                   name: registry
                   port:
                     number: 443
               path: /v2/
               pathType: ImplementationSpecific
             - backend:
                 service:
                   name: registry
                   port:
                     number: 443
               path: /v2/_catalog
               pathType: ImplementationSpecific
             - backend:
                 service:
                   name: registry
                   port:
                     number: 443
               path: /v2/.+/tags/list
               pathType: ImplementationSpecific
             - backend:
                 service:
                   name: registry
                   port:
                     number: 443
               path: /v2/.+/manifests/[A-Za-z0-9_+.-:]+
               pathType: ImplementationSpecific
             - backend:
                 service:
                   name: registry
                   port:
                     number: 443
               path: /v2/.+/blobls/[A-Za-z0-9-:]+
               pathType: ImplementationSpecific
             - backend:
                 service:
                   name: registry
                   port:
                     number: 443
               path: /v2/.+/blobls/uploads/[A-Za-z0-9-:]+
               pathType: ImplementationSpecific
             - backend:
                 service:
                   name: registry
                   port:
                     number: 443
               path: /auth/token
               pathType: ImplementationSpecific
     tls:
       - secretName: registry-address.tls
         hosts:
           - $REGISTRY_DOMAIN_NAME
   EOF

   A response similar to ... created indicates successful ingress creation.

4. Check if a Registry Service resource exists:

   kubectl -n kube-system get svc | grep registry

   If the Service doesn't exist, create it with:

   cat << EOF | kubectl create -f -
   apiVersion: v1
   kind: Service
   metadata:
     labels:
       name: registry
       service_name: registry
     name: registry
     namespace: kube-system
   spec:
     ports:
       - protocol: TCP
         port: 443
         targetPort: 60080
     selector:
       component: registry
     type: ClusterIP
   EOF

5. Test the configuration by pulling an image from the registry using the domain name:

   crictl pull <registry-domain-name>/automation/qaimages:helloworld

   Or

   podman pull <registry-domain-name>/automation/qaimages:helloworld