OpenShift docker registry can't pull an image from registry-1.docker.io

user_1731513 0
Viewed 3206

I'm working with OpenShift version:

oc v3.10.0+dd10d17
kubernetes v1.10.0+b81c8f8
features: Basic-Auth GSSAPI Kerberos SPNEGO

Server https://127.0.0.1:8443
openshift v3.10.0+e3465d0-44
kubernetes v1.10.0+b81c8f8

My docker version is:

Client:
  Version:           18.06.1-ce
  API version:       1.38
  Go version:        go1.10.3
  Git commit:        e68fc7a
  Built:             Tue Aug 21 17:24:56 2018
  OS/Arch:           linux/amd64
  Experimental:      false

Server:
  Engine:
  Version:          18.06.1-ce
  API version:      1.38 (minimum version 1.12)
  Go version:       go1.10.3
  Git commit:       e68fc7a
  Built:            Tue Aug 21 17:23:21 2018
  OS/Arch:          linux/amd64
  Experimental:     false

To start the local OpenShift cluster on my computer I followed steps: https://github.com/openshift/origin/blob/master/docs/cluster_up_down.md#linux

I wanted to deploy a Redis instance and since there is no default Redis template (there are 20 default templates), I loaded it as a JSON template from the URL: https://github.com/openshift/origin/blob/master/examples/db-templates/redis-ephemeral-template.json

When creating the app from this template, the Redis pod cannot start up and signals a following error:

Failed to pull image "172.30.1.1:5000/openshift/redis@sha256:0cf7163e0589baab918b1d70cd1ed4c711e2430c618c672b9121f1fd35cf562a": rpc error: code = Unknown desc = Error response from daemon: unknown: unable to pull manifest from docker.io/centos/redis-32-centos7:latest: Get https://registry-1.docker.io/v2/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)

When I'm deploying the app by providing a docker image openshiftroadshow/parksmap-katacoda:1.0.0 - it's being pulled and deployed successfully.

I have logged into the container published at 172.30.1.1:5000 that hosts a docker registry for the OpenShift and there is clearly a problem with resolving registry-1.docker.io domain:

bash-4.2$ nslookup registry-1.docker.io
;; connection timed out; no servers could be reached

If I specify 8.8.8.8 DNS, everything is fine:

bash-4.2$ nslookup registry-1.docker.io 8.8.8.8
Server:     8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
Name:   registry-1.docker.io
Address: 52.22.67.152
....

So I looked into /etc/resolv.conf file and here is its content:

bash-4.2$ cat /etc/resolv.conf 
nameserver 172.30.0.2
search default.svc.cluster.local svc.cluster.local cluster.local home
options ndots:5

My questions are:

  1. Is OpenShift using some internal DNS solution? If so, should I tweak its configuration?
  2. Who (and where) is responsible for configuring the content of the resolv.conf file?
  3. Is there anything wrong with Redis template I'm using?
  4. Is it a good practice to add missing templates one-by-one and is it possible to add whole bunch of useful templates that are missing at once?
  5. What should I do to make my example work?

I'd be fully appreciate for your help and time!

openshift-origin docker-registry openshift docker redis
1 Answers

The template at line:

has:

    {
        "description": "The OpenShift Namespace where the ImageStream resides.",
        "displayName": "Namespace",
        "name": "NAMESPACE",
        "value": "openshift"
    },

and uses the NAMESPACE value at:

with:

                        "from": {
                            "kind": "ImageStreamTag",
                            "name": "redis:${REDIS_VERSION}",
                            "namespace": "${NAMESPACE}"
                        },

So the template by default expects the ImageStream for the redis image to be in the openshift project. This template is itself usually loaded into the openshift project through:

having been loaded into the openshift cluster when created.

So check whether the image stream definitions for the redis image are in fact loaded into the openshift project using:

oc get is/redis -n openshift --as system:admin

or:

oc login -u system:admin
oc get is/redis -n openshift

Which depends on how oc cluster up is set up. By default the first may not work.

So ascertain if that image stream for redis exists first.

user_1281410
Related