Platform Center
Home / Platform management / Clusters / Clusters / FAQ / Configure the Platform Default Mirror Repository for External Network Access to the Business Cluster

Configure the Platform Default Mirror Repository for External Network Access to the Business Cluster

When creating or connecting a cluster on the platform, the nodes in the cluster need to access the platform’s default repository (configured during global deployment) to obtain the required component images.

If the nodes in the cluster cannot access the platform’s default repository, you can refer to this document to configure an address that the cluster can access for the platform’s default repository. By setting the repository parameter during cluster creation or connection, ensure that the nodes in the cluster can access the platform’s default repository through this address.

Example Scenario

During platform deployment, global is deployed using an intranet address. During platform operation, when it is necessary to connect an external network cluster (e.g., public cloud Kubernetes cluster, other edge clusters) to Platform Management, the cluster can only access the platform’s default repository through the public network to obtain the required component images.

In this scenario, you can refer to the solution provided in this document to add an external network-accessible address to the platform’s default repository. This allows external network clusters to access the platform’s default repository while avoiding the cost and risk of redeploying the platform or modifying the platform repository address.

Prerequisites

Please prepare in advance the Domains that the cluster can access, the IP address pointed to by the domain, and a valid certificate for the corresponding domain.

Note:

Configure certificates and routing rules for the platform default mirror repository

  1. Copy the valid certificate of the domain to any control node of global.

  2. Execute the following command to create a certificate on the platform that contains the valid certificate of the domain (registry-address.tls).

    kubectl create secret tls registry-address.tls --cert=<domain certificate name> --key=<domain certificate key> -n kube-system

    Example:

    kubectl create secret tls registry-address.tls --cert=custom.crt --key=custom.key -n kube-system

    Tip: After successfully creating the certificate, monitor the validity period of the registry-address.tls certificate in the kube-system namespace of global. Please replace the certificate before it expires.

  3. On any control node of global, execute the following command to create an ingress rule.

    REGISTRY_DOMAIN_NAME=<www.registry.com> #Needs to be replaced with a domain name that is accessible to the cluster
cat << EOF | kubectl create -f -
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
  name: registry-address
  namespace: kube-system
  labels:
    service_name: registry
spec:
  rules:
    - host: $REGISTRY_DOMAIN_NAME
      http:
        paths:
          - backend:
              service:
                name: registry
                port:
                  number: 443
            path: /v2/
            pathType: ImplementationSpecific
          - backend:
              service:
                name: registry
                port:
                  number: 443
            path: /v2/_catalog
            pathType: ImplementationSpecific
          - backend:
              service:
                name: registry
                port:
                  number: 443
            path: /v2/.+/tags/list
            pathType: ImplementationSpecific
          - backend:
              service:
                name: registry
                port:
                  number: 443
            path: /v2/.+/manifests/[A-Za-z0-9_+.-:]+
            pathType: ImplementationSpecific
          - backend:
              service:
                name: registry
                port:
                  number: 443
            path: /v2/.+/blobls/[A-Za-z0-9-:]+
            pathType: ImplementationSpecific
          - backend:
              service:
                name: registry
                port:
                  number: 443
            path: /v2/.+/blobls/uploads/[A-Za-z0-9-:]+
            pathType: ImplementationSpecific
          - backend:
              service:
                name: registry
                port:
                  number: 443
            path: /auth/token
            pathType: ImplementationSpecific
  tls:
    - secretName: registry-address.tls
      hosts:
        - $REGISTRY_DOMAIN_NAME
EOF

    Tip: When you get a display like the one in the following example, the ingress was created successfully.

    ... created

  4. On one of the master nodes of global, execute the following command to check for the existence of the Registry’s Service resource

    kubectl -n kube-system get svc |grep registry

    If the Service does not exist, use the following command to create the Service.

    cat << EOF | kubectl create -f -
apiVersion: v1
kind: Service
metadata:
  labels:
    name: registry
    service_name: registry
  name: registry
  namespace: kube-system
spec:
  ports:
    - protocol: TCP
      port: 443
      targetPort: 60080
  selector:
    component: registry
  type: ClusterIP
EOF

  5. Please replace the <repository domain> parameter with the actual domain name and test pulling images by logging into the repository using the domain name from any node.

    crictl pull <repository domain>/automation/qaimages:helloworld

    or

    docker pull <repository domain>/automation/qaimages:helloworld

Configure the mirror repository for the business cluster

After configuring the certificate and routing rules for the repository, the repository is ready. Depending on the scenario, you can add this repository to a cluster when creating/connecting it or configure the repository for an already created cluster.