anchor.diff:  /registry/docker/registry/v2/repositories/p1/pause/_layers/sha256/f72a00a23f01987b42cb26f259582bb33502bdb0fcf5011e03c60577c4284845
   /registry/docker/registry/v2/repositories/p1/pause/_layers/sha256/f72a00a23f01987b42cb26f259582bb33502bdb0fcf5011e03c60577c4284845/link
   ----
  -<1> This directory stores all layers and signatures as blobs
  -<2> This file contains the blob's contents
  -<3> This directory stores all the image repositories
  -<4> This directory is for a single image repository `p1/pause`
  -<5> This directory contains signatures for a particular image manifest revision
  -<6> This file contains a reference back to a blob (which contains the signature data)
  -<7> This directory contains any layers that are currently being uploaded and staged for the given repository
  -<8> This directory contains links to all the layers this repository references
  -<9> This file contains a reference to a specific layer that has been linked into this repository via an image
  +<1> This directory stores all layers and signatures as blobs.
  +<2> This file contains the blob's contents.
  +<3> This directory stores all the image repositories.
  +<4> This directory is for a single image repository *p1/pause*.
  +<5> This directory contains signatures for a particular image manifest revision.
  +<6> This file contains a reference back to a blob (which contains the signature
  +data).
  +<7> This directory contains any layers that are currently being uploaded and
  +staged for the given repository.
  +<8> This directory contains links to all the layers this repository references.
  +<9> This file contains a reference to a specific layer that has been linked into
  +this repository via an image.
   
   == Securing the Registry
   
  -=== Overview
  -
  -You can optionally secure the registry to serve traffic via TLS.
  -
  -=== Procedure
  -
  -. Deploy the registry. See <<deploy-registry>> for more information.
  -+
  -. Fetch service IP and port of the registry.
  -+
  +Optionally, you can secure the registry so that it serves traffic via TLS:
  +
  +. link:#deploy-registry[Deploy the registry].
  ++
  +. Fetch the service IP and port of the registry:
  ++
  +====
   [options="nowrap"]
   ----
   $ oc get se docker-registry
   NAME              LABELS                                    SELECTOR                  IP(S)            PORT(S)
   docker-registry   docker-registry=default                   docker-registry=default   172.30.124.220   5000/TCP
   ----
  -+
  -. Create server certificates for the registry service IP and docker-registry.default.svc.cluster.local
  -+
  -[options="nowrap"]
  -----
  -$ oadm create-server-cert --signer-cert=ca.crt --signer-key=ca.key --signer-serial=ca.serial.txt --hostnames='docker-registry.default.svc.cluster.local,172.30.124.220' --cert=registry.crt --key=registry.key
  -----
  -+
  -. Bundle and create secret for registry certificates
  -+
  +====
  ++
  +. You can use your own existing server certificate or create a key and server
  +certificate valid for specified IPs and host names, signed by a specified CA. To
  +create a server certificate for the registry service IP and the
  +*docker-registry.default.svc.cluster.local* host name:
  ++
  +====
  +[options="nowrap"]
  +----
  +$ oadm create-server-cert --signer-cert=ca.crt \
  +    --signer-key=ca.key --signer-serial=ca.serial.txt \
  +    --hostnames='docker-registry.default.svc.cluster.local,172.30.124.220' \
  +    --cert=registry.crt --key=registry.key
  +----
  +====
  ++
  +. Create the secret for the registry certificates:
  ++
  +====
   [options="nowrap"]
   ----
   $ oc secrets new registry-secret registry.crt registry.key
   ----
  -+
  -. Add secret volume to the registry deployment configuration.
  -+
  -[options="nowrap"]
  -----
  -$ oc edit dc docker-registry
  -...
  -volumes:
  -  ...
  -  - name: secret-volume
  -    secret:
  -      secretName: registry-secret
  -...
  -volumeMounts:
  -  ...
  -  - name: secret-volume
  -    mountPath: /etc/secrets/
  -    readOnly: true
  -----
  -+
  -. Enable TLS by adding these environment variables to the registry deployment configuration:
  -  More details: https://github.com/docker/distribution/blob/master/docs/configuration.md#override-configuration-options[Overriding registry options]
  -+
  -[options="nowrap"]
  -----
  -$ oc env dc/docker-registry REGISTRY_HTTP_TLS_CERTIFICATE=/etc/secrets/registry.crt REGISTRY_HTTP_TLS_KEY=/etc/secrets/registry.key
  -----
  -+
  -. Validate registry is running in TLS mode.
  -  Wait until docker-registry pod status changes to `Running` and verify the docker logs for the registry container. You should find this entry `listening on :5000, tls`.
  -+
  +====
  ++
  +. Add the secret to the registry pod's service account (i.e., the *default*
  +service account):
  ++
  +====
  +[options="nowrap"]
  +----
  +$ oc secrets add serviceaccounts/default secrets/registry-secret
  +----
  +====
  ++
  +. Add the secret volume to the registry deployment configuration:
  ++
  +====
  +[options="nowrap"]
  +----
  +$ oc volume dc/docker-registry --add --type=secret \
  +    --secret-name=registry-secret -m /etc/secrets
  +----
  +====
  ++
  +. Enable TLS by adding the following environment variables to the registry
  +deployment configuration.
  ++
  +====
  +[options="nowrap"]
  +----
  +$ oc env dc/docker-registry \
  +    REGISTRY_HTTP_TLS_CERTIFICATE=/etc/secrets/registry.crt \
  +    REGISTRY_HTTP_TLS_KEY=/etc/secrets/registry.key
  +----
  +====
  ++
  +See more details on
  +https://github.com/docker/distribution/blob/master/docs/configuration.md#override-configuration-options[overriding
  +registry options].
  ++
  +. Validate the registry is running in TLS mode. Wait until the *docker-registry*
  +pod status changes to `Running` and verify the docker logs for the registry
  +container. You should find an entry for `listening on :5000, tls`.
  ++
  +====
   [options="nowrap"]
   ----
   $ oc get pods
  
positive.code: $ oc log docker-registry-1-da73t | grep tls
  time="2015-05-27T05:05:53Z" level=info msg="listening on :5000, tls" instance.id=deeba528-c478-41f5-b751-dc48e4935fc2
  ----
  +
  . Copy CA certificate to the docker certs dir. This must be done on all nodes in the cluster.
  +
  ----
  $ sudo mkdir -p /etc/docker/certs.d/172.30.124.220:5000
  $ sudo cp ca.crt /etc/docker/certs.d/172.30.124.220:5000
  
negative.code: 
  To deploy the integrated OpenShift
  link:../architecture/infrastructure_components/image_registry.html[Docker
  registry], run the following command as a user with cluster administrator
  privileges:
  
  ====
  ----
  $ oadm registry --config=admin.kubeconfig \
      --credentials=openshift-registry.kubeconfig
  ----
  <1> `--config` is the path to the *_kubeconfig_* file for the cluster
  administrator.
  <2> `--credentials` is the path to the *_kubeconfig_* file for the
  *openshift-registry*.
  ====
  
  This creates a service and a deployment configuration, both called
  *docker-registry*. Once deployed successfully, a pod is created with a name
  similar to *docker-registry-1-cpty9*.
  
  To see a full list of options that you can specify when creating the registry:
  
  ----
  $ oadm registry --help
  ----
  
  == Viewing Logs
  
  To view the logs for the Docker registry, run the `oc logs` command for the
  pod(s) for the registry. For example:
  
  ====
  [options="nowrap"]
  ----
  $ oc logs docker-registry-1-da73t
  2015-05-01T19:48:36.300593110Z time="2015-05-01T19:48:36Z" level=info msg="version=v2.0.0+unknown"
  2015-05-01T19:48:36.303294724Z time="2015-05-01T19:48:36Z" level=info msg="redis not configured" instance.id=9ed6c43d-23ee-453f-9a4b-031fea646002
  2015-05-01T19:48:36.303422845Z time="2015-05-01T19:48:36Z" level=info msg="using inmemory layerinfo cache" instance.id=9ed6c43d-23ee-453f-9a4b-031fea646002
  2015-05-01T19:48:36.303433991Z time="2015-05-01T19:48:36Z" level=info msg="Using OpenShift Auth handler"
  2015-05-01T19:48:36.303439084Z time="2015-05-01T19:48:36Z" level=info msg="listening on :5000" instance.id=9ed6c43d-23ee-453f-9a4b-031fea646002
  ----
  ====
  
  == File Storage
  
  Tag and image metadata is stored in OpenShift, but the registry owns layer and
  signature data. The registry stores data in a volume that is mounted into the
  registry container at *_/registry_*. You can
  link:../dev_guide/executing_remote_commands.html[execute a remote command] in
  the registry container to see the contents:
  
  [options="nowrap"]
  ----
  