Configure MSR for a cloud storage provider (S3)
You can configure MSR to store Docker images on Amazon S3 or on any other file servers with an S3-compatible API.
All S3-compatible services store files in “buckets”, to which you can authorize users to read, write, and delete files. Whenever you integrate MSR with such a service, MSR sends all read and write operations to the S3 bucket where the images then persist.
Note
The instructions offered below pertain specifically to the configuration of MSR to Amazon S3. They can, however, also serve as a guide for how to configure MSR to other available cloud storage providers.
Create a bucket on Amazon S3
Before you configure MSR you must first create a bucket on Amazon S3. To optimize pulls and pushes, Mirantis suggests that you create the S3 bucket in the AWS region that is physically closest to the servers on which MSR is set to run.
Create an S3 bucket.
Create a new IAM user for the MSR integration.
Apply an IAM policy that has the following limited user permissions:
Access to the newly-created bucket
Ability to read, write, and delete files
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:ListAllMyBuckets", "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:ListBucketMultipartUploads" ], "Resource": "arn:aws:s3:::<bucket-name>" }, { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:ListBucketMultipartUploads" ], "Resource": "arn:aws:s3:::<bucket-name>/*" } ] }
Configure MSR on Amazon S3
Kubernetes deployments
Add the following values to the custom resource manifest. If you are using IAM role authentication, do not include the lines for
accesskeyandsecretkey. Running Kubernetes on AWS requires that you includev4auth: true.spec: registry: storage: backend: "s3" s3: region: <region> bucket: <bucket-name> accesskey: <access-key> secretkey: <secret-key> v4auth: true persistentVolume: size: <size>
Apply the changes to the custom resource:
kubectl apply -f cr-sample-manifest.yaml
Verify completion of the reconciliation process for the custom resource:
kubectl get msrs.msr.mirantis.com kubectl get rethinkdbs.rethinkdb.com
Set
registry.storage.backendtos3.Specify
registry.storage.s3.regionandregistry.storage.s3.bucket.If you are not using IAM role authentication, you must also set
registry.storage.s3.accesskeyandregistry.storage.s3.secretkey.To activate the new storage configuration settings, issue the helm upgrade command.
Example configuration command at install time:
helm install msr msrofficial/msr \
--version 1.0.0 \
--set registry.storage.backend=s3 \
--set registry.storage.s3.accesskey=<> \
--set registry.storage.s3.secretkey=<> \
--set registry.storage.s3.region=us-east-2 \
--set registry.storage.s3.bucket=testing-msr-kube
Example configuration command at time of upgrade:
helm upgrade msr msrofficial/msr \
--version 1.0.0 \
--set registry.storage.backend=s3 \
--set registry.storage.s3.accesskey=<> \
--set registry.storage.s3.secretkey=<> \
--set registry.storage.s3.region=us-east-2 \
--set registry.storage.s3.bucket=testing-msr-kube
Swarm deployments
Update your
values.yamlfile to include the following values.Note
If you are using IAM role authentication, do not include the lines that set the
accesskeyandsecretkeyvalues.registry: storage: backend: 's3' s3: region: <region> bucket: <bucket-name> accesskey: <access-key> secretkey: <secret-key>
The following parameters are available for configuration in the
registry.storage.s3 section of the custom resource manifest, Helm chart, or
Swarm cluster values.yaml file:
MSR supports the following S3 regions:
us-east-1 |
us-east-2 |
us-west-1 |
us-west-2 |
eu-west-1 |
eu-west-2 |
eu-central-1 |
ap-south-1 |
ap-southeast-1 |
ap-southeast-2 |
ap-northeast-1 |
ap-northeast-2 |
sa-east-1 |
cn-north-1 |
us-gov-west-1 |
ca-central-1 |
Restore MSR with your previous settings
Restore MSR with S3 settings
To restore MSR using your previously configured S3 settings, use restore.
Restore MSR with non-S3 cloud storage provider settings
For S3-compatible cloud storage providers other than Amazon S3, configure the
following parameters in the registry.storage section of the custom resource
manifest, Helm chart, or Swarm cluster values.yaml file: