Decision Management (ODM,ADS)

Decision Management (ODM, ADS)

Connect with experts and peers to elevate technical expertise, solve problems and share insights

 View Only
Expand all | Collapse all

How to copy the ODM container images from IBM's Container Registry to our corporate on-premises container registry ?

  • 1.  How to copy the ODM container images from IBM's Container Registry to our corporate on-premises container registry ?

    Posted Tue June 15, 2021 06:43 AM

    How to copy the ODM container images from IBM Container Registry (cp.icr.io) to our corporate on-premises Artifactory container registry ?

    My company has strict security policies that requires all container images to reside in a central image repository, which undergoes security scans before the containers can be used within a Kubernetes OpenShift cluster.

    Please provide the procedure and commands to accomplish this as it is not documented in the IBM Product Online Documentation.



    #OperationalDecisionManager(ODM)
    #Support
    #SupportMigration


  • 2.  RE: How to copy the ODM container images from IBM's Container Registry to our corporate on-premises container registry ?
    Best Answer

    Posted Tue June 15, 2021 04:27 PM

    One way to accomplish this is by using the skopeo command.

    See https://github.com/containers/skopeo for more details.

    If skopeo is not installed, install it along with podman:

    $ sudo yum install -y skopeo podman

    To understand the skopeo copy syntax, issue the following help cmd:

    $ sudo skopeo copy --help

    To show the local container registry is initially empty:

    $ sudo podman images

    REPOSITORY TAG IMAGE ID CREATED SIZE

    Note: your local registry may be similar to the following form, for example:

    docker://<your_registry_name>.artifactory.dev.ibm.com

    The local registry for purposes of showing cmd examples in this post is:

    docker://default-route-openshift-image-registry.apps-crc.testing

    --------

    To access the IBM Container Registry ODM images in cp.icr.io/cp/cp4a/odm,

    you need to obtain an entitlement key issued for your IBM_ID for IBM Container software library. To get a key, login with your IBM_ID here:

    https://myibm.ibm.com/products-services/containerlibrary

    First, validate your entitlement key by logging in to the IBM Container Registry (icr) as follows:

    registry: cp.icr.io

    user: cp

    password: <your_entitlement_key>

    Note: the entitlement key shown in examples cmds is not a valid key

    $ sudo podman login -u cp -p eyJhbGcmiUHt_Bfknc1 cp.icr.io

    Login Succeeded!

    Once you successfully login to registry cp.icr.io using your your entitlement key,

    you can then issue the skopeo copy cmd to copy the container images from the IBM Container Registry your local destination registry.

    Here is an example copy cmd for odm-decisioncenter image:

    $ sudo skopeo copy docker://cp.icr.io/cp/cp4a/odm/odm-decisioncenter:8.10.5.0-amd64 docker://default-route-openshift-image-registry.apps-crc.testing/odm8105/odm-decisioncenter:8.10.5.0-amd64 --dest-creds kubeadmin:sha256~A2Sxa6ijcjpJEEQ --src-creds cp:eyJhbGcmiUHt_Bfknc1

    Getting image source signatures

    Checking if image destination supports signatures

    Copying blob c1d1224007be done

    --- lines removed ---

    Copying config 43560f8efe done

    Writing manifest to image destination

    Storing signatures

    The odm-decisioncenter image is now in the local container registry-

    $ sudo podman images

    REPOSITORY TAG IMAGE ID CREATED SIZE

    default-route-openshift-image-registry.apps-crc.testing/odm8105/odm-decisioncenter 8.10.5.0-amd64 43560f8efe00 6 months ago 1.64 GB

    ---

    In addition to the skopeo copy command, you can issue a skopeo inspect cmd

    to get detailed information about the container image.

    Note: skopeo inspect cmd also validates your entitlement key to the cp.icr.io registry and can be used in place of the podman login cmd shown earlier.

    $ sudo skopeo inspect docker://cp.icr.io/cp/cp4a/odm/odm-decisioncenter:8.10.5.0-amd64 --creds cp:eyJhbGcmiUHt_Bfknc1

    {

    "Name": "cp.icr.io/cp/cp4a/odm/odm-decisioncenter",

    "Digest": "sha256:dd1f70a5ac64929e6da0048e8d854eedd2e76c9c4c96f54b3d8f1149fd8a8abc",

    "RepoTags": [

    "20.0.3-amd64",

    "21.0.1-amd64",

    "8.10.2.1-amd64",

    "8.10.3-amd64",

    "8.10.3.0_ICP2001-amd64",

    "8.10.4.0-IF002-amd64",

    "8.10.4.0-amd64",

    "8.10.5.0-IF003-amd64",

    "8.10.5.0-amd64",

    "8.10.5.0_CP4BA2101-amd64"

    ],

    "Created": "2020-12-03T14:48:02.841648562Z",

    "DockerVersion": "19.03.12",

    "Labels": {

    "BuildLabel": "cl200920200820-0913",

    "ProductID": "fbf6a96d49214c0abc6a3bc5da6e48cd",

    "ProductName": "WebSphere Application Server Liberty",

    "ProductVersion": "20.0.0.9",

    "architecture": "x86_64",

    "build-date": "2020-09-01T19:43:46.041620",

    "com.redhat.build-host": "cpt-1008.osbs.prod.upshift.rdu2.redhat.com",

    "com.redhat.component": "ubi8-container",

    "com.redhat.license_terms": "https://www.redhat.com/en/about/red-hat-end-user-license-agreements#UBI",

    "description": "Decision Center is a web application where business users author, model, and manage decisions with limited or no dependence on the IT department.",

    "distribution-scope": "public",

    "io.k8s.description": "Decision Center is a web application to manage and author decisions.",

    "io.k8s.display-name": "Decision Center",

    "io.openshift.expose-services": "",

    "io.openshift.tags": "odm,dba,dbamc",

    "maintainer": "ODMDev odmdev_open_source_user, Laurent GRATEAU \u003claurent.grateau\u003e",

    "name": "Decision Center",

    "org.opencontainers.image.authors": "Arthur De Magalhaes, Chris Potter",

    "org.opencontainers.image.documentation": "https://www.ibm.com/support/knowledgecenter/SSAW57_liberty/com.ibm.websphere.wlp.nd.multiplatform.doc/ae/cwlp_about.html",

    "org.opencontainers.image.revision": "cl200920200820-0913",

    "org.opencontainers.image.url": "http://wasdev.net",

    "org.opencontainers.image.vendor": "IBM",

    "org.opencontainers.image.version": "20.0.0.9",

    "release": "8",

    "run": "docker run --rm -ti \u003cimage_name:tag\u003e /bin/bash",

    "summary": "Decision Center is a web application to manage and author decisions.",

    "url": "https://access.redhat.com/containers/#/registry.access.redhat.com/ubi8/images/8.2-347",

    "vcs-ref": "663db861f0ff7a9c526c1c169a62c14c01a32dcc",

    "vcs-type": "git",

    "vendor": "IBM",

    "version": "8.10.5.0-amd64"

    },

    "Architecture": "amd64",

    "Os": "linux",

    "Layers": [

    "sha256:ec1681b6a383e4ecedbeddd5abc596f3de835aed6db39a735f62395c8edbff30",

    "sha256:c4d668e229cd131e0a8e4f8218dca628d9cf9697572875e355fe4b247b6aa9f0",

    --- lines removed ---

    ],

    "Env": [

    "PATH=/opt/ibm/wlp/bin:/opt/ibm/helpers/build:/opt/ibm/java/jre/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",

    "container=oci",

    "JAVA_VERSION=1.8.0_sr6fp16",

    "JAVA_HOME=/opt/ibm/java/jre",

    "IBM_JAVA_OPTIONS=-Xshareclasses:name=liberty,nonfatal,cacheDir=/output/.classCache/ -XX:+UseContainerSupport",

    "LIBERTY_VERSION=20.0.0_09",

    "LOG_DIR=/logs",

    "WLP_OUTPUT_DIR=/opt/ibm/wlp/output",

    "OPENJ9_SCC=true",

    "RANDFILE=/tmp/.rnd",

    "APP_NAME=DecisionCenter",

    "ODMDOCKERDIR=odm-ondocker",

    "SCRIPT=/script",

    "APPS=/config/apps"

    ]

    }

    As you can see from the skopeo inspect output, a lot of detailed information is displayed about the image and also validates your entitlement key for the container image you need to copy .



    #OperationalDecisionManager(ODM)
    #Support
    #SupportMigration