Setting up the private registry

A private image registry must be used to store all images in your local environment. Create a registry and make sure that it meets the requirements. It must be available and accessible from the Kubernetes cluster nodes.

About this task

Make sure that your image registry meets the following requirements:

Supports Docker Manifest V2, Schema 2 .
Supports multi-architecture images.

Note: Do not use the Kubernetes image registry as your private registry. The Kubernetes registry does not support multi-architecture images.
Is accessible from both the host and your Kubernetes cluster nodes.
Has the username and password of a user who can write to the target registry from the host.
Has the username and password of a user who can read from the target registry that is on the Kubernetes cluster nodes.
Allows path separators in the image name.

For Rancher, configure a private registry. For example:

mirrors:
  "icr.io":
    endpoint:
      - "https://my-private-registry.com"
    rewrite:
      "^(.+)": "bai2600/${1}"

  "cp.icr.io":
    endpoint:
      - "https://my-private-registry.com"
    rewrite:
      "^(.+)": "bai2600/${1}"

configs:
  "my-private-registry.com":
    auth:
      username: "<username>"
      password: "<password>"
    tls:
      cert_file:            # path to the cert file used to authenticate to the registry
      key_file:             # path to the key file for the certificate used to authenticate to the registry
      ca_file:              # path to the ca file used to verify the registry's certificate
      insecure_skip_verify: # may be set to true to skip verifying the registry's certificate

For specific instructions on how to configure private registries, see Registries Configuration File

Note: bai2600 is the namespace name created in your local private registry.

Important: If you are going to use a user that does not have permission to create namespaces in the local private registry, then you need to perform these steps with your administrator before you start the mirroring process.

Procedure

Create a namespace in your local private registry to mirror product-specific images such as "bai2600" for this version. For example my-private-registry.com/bai2600.

Note: Use specific namespace for each version so that you can remove the unused namespace later. For example: my-private-registry.com/bai2600 for 26.0.0-IF001
Create a sub-folder called ibmcom under the created namespace in Step 1 in your local private registry to mirror the images from the IBM® Entitled Registry icr.io/ibmcom. For example: my-private-registry.com/bai2600/cpopen.
The cpopen namespace is for publicly available images that are hosted by IBM that do not require credentials to pull.
Note: The local private registry user must have read, write and create repositories permission in order to mirror the images as it will create other sub-folders during the mirroring process.

What to do next

Important: Verify that each namespace meets the following requirements:

Supports auto-repository creation.
Has credentials of a user who can write and create repositories. The host uses these credentials.
Has credentials of a user who can read all repositories. The Kubernetes cluster uses these credentials.

You can now set up the image inventory. For more information, see Downloading the CASE files.