From acfc4fd26acd007a72061adc97c9c62c06bab86b Mon Sep 17 00:00:00 2001 From: Kevin Tibi Date: Wed, 13 Jun 2018 10:25:33 +0200 Subject: [PATCH] Option for enable SSL verification on docker registry By default, kolla configure docker to use an insecure connection with the private registry. If we want to use SSL verification we need to add an option. Change-Id: Id1805c9cfeb499da9bb56c70028f14c6f8bb20b6 --- ansible/group_vars/all.yml | 1 + ansible/roles/baremetal/templates/docker_systemd_service.j2 | 2 +- .../notes/docker_insecure_registry-857bfb9c760aa3bf.yaml | 6 ++++++ 3 files changed, 8 insertions(+), 1 deletion(-) create mode 100644 releasenotes/notes/docker_insecure_registry-857bfb9c760aa3bf.yaml diff --git a/ansible/group_vars/all.yml b/ansible/group_vars/all.yml index 10b29c889b..581ecf0530 100644 --- a/ansible/group_vars/all.yml +++ b/ansible/group_vars/all.yml @@ -89,6 +89,7 @@ docker_registry_email: docker_registry: docker_namespace: "kolla" docker_registry_username: +docker_registry_insecure: "{{ 'yes' if docker_registry else 'no' }}" # Valid options are [ never, on-failure, always, unless-stopped ] docker_restart_policy: "unless-stopped" diff --git a/ansible/roles/baremetal/templates/docker_systemd_service.j2 b/ansible/roles/baremetal/templates/docker_systemd_service.j2 index e9b89384c3..31b9ef5032 100644 --- a/ansible/roles/baremetal/templates/docker_systemd_service.j2 +++ b/ansible/roles/baremetal/templates/docker_systemd_service.j2 @@ -1,4 +1,4 @@ [Service] MountFlags=shared ExecStart= -ExecStart=/usr/bin/{{ docker_binary_name|default("docker daemon", true) }}{% if docker_registry %} --insecure-registry {{ docker_registry }}{% endif %}{% if docker_storage_driver %} --storage-driver {{ docker_storage_driver }}{% endif %}{% if docker_runtime_directory %} --graph {{ docker_runtime_directory }}{% endif %}{% if docker_custom_option %} {{ docker_custom_option }}{% endif %} +ExecStart=/usr/bin/{{ docker_binary_name|default("docker daemon", true) }}{% if docker_registry_insecure | bool %} --insecure-registry {{ docker_registry }}{% endif %}{% if docker_storage_driver %} --storage-driver {{ docker_storage_driver }}{% endif %}{% if docker_runtime_directory %} --graph {{ docker_runtime_directory }}{% endif %}{% if docker_custom_option %} {{ docker_custom_option }}{% endif %} diff --git a/releasenotes/notes/docker_insecure_registry-857bfb9c760aa3bf.yaml b/releasenotes/notes/docker_insecure_registry-857bfb9c760aa3bf.yaml new file mode 100644 index 0000000000..f65b7d4d52 --- /dev/null +++ b/releasenotes/notes/docker_insecure_registry-857bfb9c760aa3bf.yaml @@ -0,0 +1,6 @@ +--- +upgrade: + - | + Add option `docker_registry_insecure` to enable the SSL verification + for the docker registry. Default value is true when a private + registry is defined.