Skip to content

Commit d78ed32

Browse files
smirasmira
committed
docs: fix the docs reference to star registry redirects
Since Talos moved to new registry redirect CRI plugin format, start redirects are no longer supported in the CRI plugin (see https://github.com/containerd/containerd/blob/main/docs/hosts.md). Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
1 parent 257dfb8 commit d78ed32

File tree

5 files changed

+83
-31
lines changed

5 files changed

+83
-31
lines changed

‎pkg/machinery/config/types/v1alpha1/v1alpha1_types.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1284,7 +1284,6 @@ type RegistriesConfig struct {
12841284
//
12851285
// Registry name is the first segment of image identifier, with 'docker.io'
12861286
// being default one.
1287-
// To catch any registry names not specified explicitly, use '*'.
12881287
// examples:
12891288
// - value: machineConfigRegistryMirrorsExample
12901289
RegistryMirrors map[string]*RegistryMirrorConfig `yaml:"mirrors,omitempty"`

‎pkg/machinery/config/types/v1alpha1/v1alpha1_types_doc.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎website/content/v1.0/advanced/air-gapped.md

Lines changed: 41 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ As access to the public registries is restricted, we have to run an internal Doc
3838
In this guide, we will launch the registry on the same machine using Docker:
3939

4040
```bash
41-
$ docker run -d -p 6000:5000 --restart always --name registry-aigrapped registry:2
41+
$ docker run -d -p 6000:5000 --restart always --name registry-airgapped registry:2
4242
1bf09802bee1476bc463d972c686f90a64640d87dacce1ac8485585de69c91a5
4343
```
4444

@@ -49,17 +49,18 @@ First, we pull all the images to our local Docker daemon:
4949

5050
```bash
5151
$ for image in `talosctl images`; do docker pull $image; done
52-
v0.12.0-amd64: Pulling from coreos/flannel
53-
Digest: sha256:6d451d92c921f14bfb38196aacb6e506d4593c5b3c9d40a8b8a2506010dc3e10
52+
v0.15.1: Pulling from coreos/flannel
53+
Digest: sha256:9a296fbb67790659adc3701e287adde3c59803b7fcefe354f1fc482840cdb3d9
5454
...
5555
```
5656

5757
All images are now stored in the Docker daemon store:
5858

5959
```bash
6060
$ docker images
61-
ghcr.io/siderolabs/install-cni v0.3.0-12-g90722c3 980d36ee2ee1 5 days ago 79.7MB
62-
k8s.gcr.io/kube-proxy-amd64 v1.20.0 33c60812eab8 2 weeks ago 118MB
61+
REPOSITORY TAG IMAGE ID CREATED SIZE
62+
gcr.io/etcd-development/etcd v3.5.3 604d4f022632 6 days ago 181MB
63+
ghcr.io/siderolabs/install-cni v1.0.0-2-gc5d3ab0 4729e54f794d 6 days ago 76MB
6364
...
6465
```
6566

@@ -68,44 +69,58 @@ We are going to replace the first component of the image name (before the first
6869

6970
```bash
7071
$ for image in `talosctl images`; do \
71-
docker tag $image `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \
72+
docker tag $image `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'`; \
7273
done
7374
```
7475

7576
As the next step, we push images to the internal registry:
7677

7778
```bash
7879
$ for image in `talosctl images`; do \
79-
docker push `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \
80+
docker push `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'`; \
8081
done
8182
```
8283

8384
We can now verify that the images are pushed to the registry:
8485

8586
```bash
86-
$ curl http://127.0.0.1:6000/v2/_catalog
87-
{"repositories":["autonomy/kubelet","coredns","coreos/flannel","etcd-development/etcd","kube-apiserver-amd64","kube-controller-manager-amd64","kube-proxy-amd64","kube-scheduler-amd64","talos-systems/install-cni","talos-systems/installer"]}
87+
$ curl http://127.0.0.1:6000/v2/_catalog
88+
{"repositories":["coredns/coredns","coreos/flannel","etcd-development/etcd","kube-apiserver","kube-controller-manager","kube-proxy","kube-scheduler","pause","siderolabs/install-cni","siderolabs/installer","siderolabs/kubelet"]}
8889
```
8990

9091
> Note: images in the registry don't have the registry endpoint prefix anymore.
9192
9293
## Launching Talos in an Air-gapped Environment
9394

94-
For Talos to use the internal registry, we use the registry mirror feature to redirect all the image pull requests to the internal registry.
95+
For Talos to use the internal registry, we use the registry mirror feature to redirect all image pull requests to the internal registry.
9596
This means that the registry endpoint (as the first component of the image reference) gets ignored, and all pull requests are sent directly to the specified endpoint.
9697

9798
We are going to use a QEMU-based Talos cluster for this guide, but the same approach works with Docker-based clusters as well.
9899
As QEMU-based clusters go through the Talos install process, they can be used better to model a real air-gapped environment.
99100

101+
Identify all registry prefixes from `talosctl images`, for example:
102+
103+
- `docker.io`
104+
- `gcr.io`
105+
- `ghcr.io`
106+
- `k8s.gcr.io`
107+
- `quay.io`
108+
100109
The `talosctl cluster create` command provides conveniences for common configuration options.
101-
The only required flag for this guide is `--registry-mirror '*'=http://10.5.0.1:6000` which redirects every pull request to the internal registry.
110+
The only required flag for this guide is `--registry-mirror <endpoint>=http://10.5.0.1:6000` which redirects every pull request to the internal registry, this flag
111+
needs to be repeated for each of the identified registry prefixes above.
102112
The endpoint being used is `10.5.0.1`, as this is the default bridge interface address which will be routable from the QEMU VMs (`127.0.0.1` IP will be pointing to the VM itself).
103113

104114
```bash
105-
$ sudo -E talosctl cluster create --provisioner=qemu --registry-mirror '*'=http://10.5.0.1:6000 --install-image=ghcr.io/siderolabs/installer:{{< release >}}
115+
$ sudo -E talosctl cluster create --provisioner=qemu --install-image=ghcr.io/siderolabs/installer:{{< release >}} \
116+
--registry-mirror docker.io=http://10.5.0.1:6000 \
117+
--registry-mirror gcr.io=http://10.5.0.1:6000 \
118+
--registry-mirror ghcr.io=http://10.5.0.1:6000 \
119+
--registry-mirror k8s.gcr.io=http://10.5.0.1:6000 \
120+
--registry-mirror quay.io=http://10.5.0.1:6000
106121
validating CIDR and reserving IPs
107122
generating PKI and tokens
108-
creating state directory in "/home/smira/.talos/clusters/talos-default"
123+
creating state directory in "/home/user/.talos/clusters/talos-default"
109124
creating network talos-default
110125
creating load balancer
111126
creating dhcpd
@@ -130,7 +145,19 @@ machine:
130145
...
131146
registries:
132147
mirrors:
133-
'*':
148+
docker.io:
149+
endpoints:
150+
- http://10.5.0.1:6000/
151+
gcr.io:
152+
endpoints:
153+
- http://10.5.0.1:6000/
154+
ghcr.io:
155+
endpoints:
156+
- http://10.5.0.1:6000/
157+
k8s.gcr.io:
158+
endpoints:
159+
- http://10.5.0.1:6000/
160+
quay.io:
134161
endpoints:
135162
- http://10.5.0.1:6000/
136163
...

‎website/content/v1.1/advanced/air-gapped.md

Lines changed: 41 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ As access to the public registries is restricted, we have to run an internal Doc
3838
In this guide, we will launch the registry on the same machine using Docker:
3939

4040
```bash
41-
$ docker run -d -p 6000:5000 --restart always --name registry-aigrapped registry:2
41+
$ docker run -d -p 6000:5000 --restart always --name registry-airgapped registry:2
4242
1bf09802bee1476bc463d972c686f90a64640d87dacce1ac8485585de69c91a5
4343
```
4444

@@ -49,17 +49,18 @@ First, we pull all the images to our local Docker daemon:
4949

5050
```bash
5151
$ for image in `talosctl images`; do docker pull $image; done
52-
v0.12.0-amd64: Pulling from coreos/flannel
53-
Digest: sha256:6d451d92c921f14bfb38196aacb6e506d4593c5b3c9d40a8b8a2506010dc3e10
52+
v0.15.1: Pulling from coreos/flannel
53+
Digest: sha256:9a296fbb67790659adc3701e287adde3c59803b7fcefe354f1fc482840cdb3d9
5454
...
5555
```
5656

5757
All images are now stored in the Docker daemon store:
5858

5959
```bash
6060
$ docker images
61-
ghcr.io/siderolabs/install-cni v0.3.0-12-g90722c3 980d36ee2ee1 5 days ago 79.7MB
62-
k8s.gcr.io/kube-proxy-amd64 v1.20.0 33c60812eab8 2 weeks ago 118MB
61+
REPOSITORY TAG IMAGE ID CREATED SIZE
62+
gcr.io/etcd-development/etcd v3.5.3 604d4f022632 6 days ago 181MB
63+
ghcr.io/siderolabs/install-cni v1.0.0-2-gc5d3ab0 4729e54f794d 6 days ago 76MB
6364
...
6465
```
6566

@@ -68,44 +69,58 @@ We are going to replace the first component of the image name (before the first
6869

6970
```bash
7071
$ for image in `talosctl images`; do \
71-
docker tag $image `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \
72+
docker tag $image `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'`; \
7273
done
7374
```
7475

7576
As the next step, we push images to the internal registry:
7677

7778
```bash
7879
$ for image in `talosctl images`; do \
79-
docker push `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'` \
80+
docker push `echo $image | sed -E 's#^[^/]+/#127.0.0.1:6000/#'`; \
8081
done
8182
```
8283

8384
We can now verify that the images are pushed to the registry:
8485

8586
```bash
86-
$ curl http://127.0.0.1:6000/v2/_catalog
87-
{"repositories":["autonomy/kubelet","coredns","coreos/flannel","etcd-development/etcd","kube-apiserver-amd64","kube-controller-manager-amd64","kube-proxy-amd64","kube-scheduler-amd64","talos-systems/install-cni","talos-systems/installer"]}
87+
$ curl http://127.0.0.1:6000/v2/_catalog
88+
{"repositories":["coredns/coredns","coreos/flannel","etcd-development/etcd","kube-apiserver","kube-controller-manager","kube-proxy","kube-scheduler","pause","siderolabs/install-cni","siderolabs/installer","siderolabs/kubelet"]}
8889
```
8990

9091
> Note: images in the registry don't have the registry endpoint prefix anymore.
9192
9293
## Launching Talos in an Air-gapped Environment
9394

94-
For Talos to use the internal registry, we use the registry mirror feature to redirect all the image pull requests to the internal registry.
95+
For Talos to use the internal registry, we use the registry mirror feature to redirect all image pull requests to the internal registry.
9596
This means that the registry endpoint (as the first component of the image reference) gets ignored, and all pull requests are sent directly to the specified endpoint.
9697

9798
We are going to use a QEMU-based Talos cluster for this guide, but the same approach works with Docker-based clusters as well.
9899
As QEMU-based clusters go through the Talos install process, they can be used better to model a real air-gapped environment.
99100

101+
Identify all registry prefixes from `talosctl images`, for example:
102+
103+
- `docker.io`
104+
- `gcr.io`
105+
- `ghcr.io`
106+
- `k8s.gcr.io`
107+
- `quay.io`
108+
100109
The `talosctl cluster create` command provides conveniences for common configuration options.
101-
The only required flag for this guide is `--registry-mirror '*'=http://10.5.0.1:6000` which redirects every pull request to the internal registry.
110+
The only required flag for this guide is `--registry-mirror <endpoint>=http://10.5.0.1:6000` which redirects every pull request to the internal registry, this flag
111+
needs to be repeated for each of the identified registry prefixes above.
102112
The endpoint being used is `10.5.0.1`, as this is the default bridge interface address which will be routable from the QEMU VMs (`127.0.0.1` IP will be pointing to the VM itself).
103113

104114
```bash
105-
$ sudo -E talosctl cluster create --provisioner=qemu --registry-mirror '*'=http://10.5.0.1:6000 --install-image=ghcr.io/siderolabs/installer:{{< release >}}
115+
$ sudo -E talosctl cluster create --provisioner=qemu --install-image=ghcr.io/siderolabs/installer:{{< release >}} \
116+
--registry-mirror docker.io=http://10.5.0.1:6000 \
117+
--registry-mirror gcr.io=http://10.5.0.1:6000 \
118+
--registry-mirror ghcr.io=http://10.5.0.1:6000 \
119+
--registry-mirror k8s.gcr.io=http://10.5.0.1:6000 \
120+
--registry-mirror quay.io=http://10.5.0.1:6000
106121
validating CIDR and reserving IPs
107122
generating PKI and tokens
108-
creating state directory in "/home/smira/.talos/clusters/talos-default"
123+
creating state directory in "/home/user/.talos/clusters/talos-default"
109124
creating network talos-default
110125
creating load balancer
111126
creating dhcpd
@@ -130,7 +145,19 @@ machine:
130145
...
131146
registries:
132147
mirrors:
133-
'*':
148+
docker.io:
149+
endpoints:
150+
- http://10.5.0.1:6000/
151+
gcr.io:
152+
endpoints:
153+
- http://10.5.0.1:6000/
154+
ghcr.io:
155+
endpoints:
156+
- http://10.5.0.1:6000/
157+
k8s.gcr.io:
158+
endpoints:
159+
- http://10.5.0.1:6000/
160+
quay.io:
134161
endpoints:
135162
- http://10.5.0.1:6000/
136163
...

‎website/content/v1.1/reference/configuration.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2684,7 +2684,6 @@ air-gapped installations, etc.
26842684

26852685
Registry name is the first segment of image identifier, with 'docker.io'
26862686
being default one.
2687-
To catch any registry names not specified explicitly, use '*'.
26882687

26892688

26902689

0 commit comments

Comments
 (0)