--insecure-registry in /etc/sysconfig/docker removed by undercloud upgrade

[Ian Pilcher]

When pulling container images from an internal registry (such as docker-registry.engineering.redhat.com), one is often required to edit /etc/sysconfig/docker and add the internal registry to the INSECURE_REGISTRY line.

This additional entry is removed when "openstack undercloud upgrade" runs.

To reproduce:

1. Edit /etc/sysconfig/docker and add an additional insecure registry.
2. Run 'openstack undercloud upgrade'
3. Check /etc/sysconfig/docker; note that additional insecure registry is no longer there.

This will cause future image pulls, tag checks, etc. to fail until the registry is re-added to INSECURE_REGISTRY in /etc/sysconfig/docker.

[Dan Prince (dan-prince)]

As part of the new containers based undercloud I've just proposed added an option called 'docker_insecure_registries'. This would be appended to the list of default Undercloud insecure settings for the local registry and would allow you to pull containers from any set of registries you'd like and would survive an upgrade.

https://review.openstack.org/#/c/526147/3/tripleoclient/v1/undercloud_config.py

Again, this is not yet backported to instack-undercloud although we could look at doing something there as well.

[Alex Schultz (alex-schultz)]

This was fixed as part of Bug 1767373

[Alex Schultz (alex-schultz)]

Was only partially done with Bug 1767373. In Pike the docker registry code also lived in the docker_registry profile, where as in Queens we deprecated docker_registry so the docker code managed it

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/587190
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=80c5a07aa5a0a9042789a067aa175a1ddfe0a193
Submitter: Zuul
Branch: stable/pike

commit 80c5a07aa5a0a9042789a067aa175a1ddfe0a193
Author: Dan Prince <email address hidden>
Date: Tue Dec 5 16:15:32 2017 -0500

    Remove INSECURE_REGISTRY from docker_registry.pp

    This patch removes the INSECURE_REGISTRY options from the
    docker_registry manifest. These configuration options can
    conflict with the configuration done in the docker
    profile. Furthermore they are not directly related to
    the docker registry service itself and are better managed
    as part of the other profile.

    Change-Id: I6d0cfc9aafd2184161666bb9edcce16a0ec5a06f
    Closes-bug: #1736587
    Closes-bug: #1736803
    (cherry picked from commit b2521749561bc7b1d6da9e5b776c2945c65977a0)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-tripleo 7.4.15 release.