support using the OpenShift container registry

[jstrachan]

it would be awesome if we could switch from the github container registry to use the OpenShift Container Registry.

The following changes to jx-requiremnents.yml will switch over...

cluster:
  dockerRegistryOrg: jx
  registry: image-registry.openshift-image-registry.svc:5000

you then also need to add this command to your pipelines (or .jx/variables.sh)

export KANIKO_FLAGS="--insecure"

Then pipelines correctly push to the images of the form image-registry.openshift-image-registry.svc:5000/jx/myapp:1.2.3 and create a Promote PR nicely.

However the staging namespace fails to deploy the application (since the image is in project jx not jx-staging).

You get errors like:

Failed to pull image "image-registry.openshift-image-registry.svc:5000/jx/nodey540:1.0.7": rpc error: code = Unknown desc = Error reading manifest 1.0.7 in image-registry.openshift-image-registry.svc:5000/jx/nodey540: unauthorized: authentication required

I tried to follow these instructions but they didn't make any difference.

I guess because we're not using image streams we need to generate some kind of image pull secret or something?

[troyhart]

What we've done for our current system that uses classic Jenkins is we have the following ClusterRoleBinding resource that we apply to each namespace so that deployments can pull the needed images:

apiVersion: v1
groupNames: null
kind: ClusterRoleBinding
metadata:
  creationTimestamp: null
  name: image-puller
roleRef:
  name: system:image-puller
subjects:
- kind: ServiceAccount
  name: jenkins
  namespace: infra
userNames:
- system:serviceaccount:infra:jenkins

[troyhart]

Which is effectively consistent with the instruction you referenced