OpenShift Container Platform

Add specific registries to an allowlist

You can add an allowlist of registries, or an individual repository, within a registry for image pull and push actions by editing the image.config.openshift.io/cluster custom resource (CR).

OpenShift Container Platform applies the changes to this CR to all nodes in the cluster.

When pulling or pushing images, the container runtime searches the registries listed under the registrySources parameter in the image.config.openshift.io/cluster CR. If you created a list of registries under the allowedRegistries parameter, the container runtime searches only those registries. Registries not in your allowlist are blocked.

When you define the allowedRegistries parameter, all registries, including registry.redhat.io, quay.io, and the default OpenShift image registry, are blocked unless explicitly listed. You must add all of the registries that your payload images require to the allowedRegistries list. For example, list registry.redhat.io, quay.io, and the internalRegistryHostname registries. For disconnected clusters, you must also add your mirror registries. Otherwise, you risk pod failure.

Procedure

Edit the image.config.openshift.io/cluster custom resource by running the following command:

$ oc edit image.config.openshift.io/cluster

The following is an example image.config.openshift.io/cluster CR with an allowed list:

apiVersion: config.openshift.io/v1
kind: Image
metadata:
  annotations:
    release.openshift.io/create-only: "true"
  creationTimestamp: "2019-05-17T13:44:26Z"
  generation: 1
  name: cluster
  resourceVersion: "8302"
  selfLink: /apis/config.openshift.io/v1/images/cluster
  uid: e34555da-78a9-11e9-b92b-06d6c7da38dc
spec:
  registrySources:
    allowedRegistries:
    - example.com
    - quay.io
    - registry.redhat.io
    - reg1.io/myrepo/myapp:latest
    - image-registry.openshift-image-registry.svc:5000
status:
  internalRegistryHostname: image-registry.openshift-image-registry.svc:5000

After you make your configuration updates, list your nodes by running the following command:

$ oc get nodes

Example output

NAME               STATUS   ROLES                  AGE   VERSION
<node_name>        Ready    control-plane,master   37m   v1.27.8+4fab27b

Enter debug mode on the node by running the following command:
```
$ oc debug node/<node_name>
```
Replace <node_name> with the name of your node.
When prompted, enter chroot /host into the terminal:
```
sh-4.4# chroot /host
```

Verification

Check that the registries are in the policy file by running the following command:

sh-5.1# cat /etc/containers/policy.json | jq '.'

The following policy indicates that only images from the example.com, quay.io, and registry.redhat.io registries are accessible for image pulls and pushes:

Example image signature policy file

{
   "default":[
      {
         "type":"reject"
      }
   ],
   "transports":{
      "atomic":{
         "example.com":[
            {
               "type":"insecureAcceptAnything"
            }
         ],
         "image-registry.openshift-image-registry.svc:5000":[
            {
               "type":"insecureAcceptAnything"
            }
         ],
         "insecure.com":[
            {
               "type":"insecureAcceptAnything"
            }
         ],
         "quay.io":[
            {
               "type":"insecureAcceptAnything"
            }
         ],
         "reg4.io/myrepo/myapp:latest":[
            {
               "type":"insecureAcceptAnything"
            }
         ],
         "registry.redhat.io":[
            {
               "type":"insecureAcceptAnything"
            }
         ]
      },
      "docker":{
         "example.com":[
            {
               "type":"insecureAcceptAnything"
            }
         ],
         "image-registry.openshift-image-registry.svc:5000":[
            {
               "type":"insecureAcceptAnything"
            }
         ],
         "insecure.com":[
            {
               "type":"insecureAcceptAnything"
            }
         ],
         "quay.io":[
            {
               "type":"insecureAcceptAnything"
            }
         ],
         "reg4.io/myrepo/myapp:latest":[
            {
               "type":"insecureAcceptAnything"
            }
         ],
         "registry.redhat.io":[
            {
               "type":"insecureAcceptAnything"
            }
         ]
      },
      "docker-daemon":{
         "":[
            {
               "type":"insecureAcceptAnything"
            }
         ]
      }
   }
}

If your cluster uses the registrySources.insecureRegistries parameter, ensure that any insecure registries are included in the allowed list.

For example:

spec:
  registrySources:
    insecureRegistries:
    - insecure.com
    allowedRegistries:
    - example.com
    - quay.io
    - registry.redhat.io
    - insecure.com
    - image-registry.openshift-image-registry.svc:5000