Red Hat OpenShift Container Platform

Configuring a private storage endpoint on Azure with user-provided VNet and subnet names

You can configure a private Azure storage endpoint for the image registry by specifying user-provided VNet and subnet names, enabling registry storage without public network access.

Use the following procedure to configure a storage account that has public network access disabled and is exposed behind a private storage endpoint on Azure.

Prerequisites

You have configured the image registry to run on Azure.
You must know the VNet and subnet names used for your Azure environment.
If your network was configured in a separate resource group in Azure, you must also know its name.

Procedure

Edit the Image Registry Operator config object and configure the private endpoint using your VNet and subnet names:

$ oc edit configs.imageregistry/cluster

# ...
spec:
  # ...
   storage:
      azure:
        # ...
        networkAccess:
          type: Internal
          internal:
            subnetName: <subnet_name>
            vnetName: <vnet_name>
            networkResourceGroupName: <network_resource_group_name>
# ...

Optional: Enter the following command to confirm that the Operator has completed provisioning. This might take a few minutes.
```
$ oc get configs.imageregistry/cluster -o=jsonpath="{.spec.storage.azure.privateEndpointName}" -w
```
When redirect is enabled, pulling images from outside of the cluster will not work.

Verification

Fetch the registry service name by running the following command:

$ oc get imagestream -n openshift

Example output

NAME   IMAGE REPOSITORY                                                 TAGS     UPDATED
cli    image-registry.openshift-image-registry.svc:5000/openshift/cli   latest   8 hours ago
...

Enter debug mode by running the following command:
```
$ oc debug node/<node_name>
```
Run the suggested chroot command. For example:
```
$ chroot /host
```

Enter the following command to log in to your container registry:

$ podman login --tls-verify=false -u unused -p $(oc whoami -t) image-registry.openshift-image-registry.svc:5000

Example output

Login Succeeded!

Enter the following command to verify that you can pull an image from the registry:

$ podman pull --tls-verify=false image-registry.openshift-image-registry.svc:5000/openshift/tools

Example output

Trying to pull image-registry.openshift-image-registry.svc:5000/openshift/tools/openshift/tools...
Getting image source signatures
Copying blob 6b245f040973 done
Copying config 22667f5368 done
Writing manifest to image destination
Storing signatures
22667f53682a2920948d19c7133ab1c9c3f745805c14125859d20cede07f11f9