OpenShift

OpenShift 4 Hands-on Lab- 用ImageStream操作Image

Posted Cola🌀

什么是ImageStream

ImageStream是OpenShift中的一种对象，它并不是用来存储Image的，而是用来记录并管理Image信息的。它就像是所有Image的虚拟视图，可以通过它统一访问存放在不同Image Registry（OpenShift外部独立运行的Registry、或是OpenShift内置的Registry）上的Image。通过这个视图可以简化对那些来自不同Registry的Image的访问。

ImageStream使用访问标签（ImageStreamTag）和指向信息（ImageStreamImage）记录这种对应关系。

  • ImageStreamTag：是由用户指定的、有意义的字符串，可用它来表示一个特定Image，我们可以把它想象成DNS的域名地址。
  • ImageStreamImage：一串基于sha256的无意义的字符创，可用它来表示一个特定Image，我们可以把它想象成DNS的IP地址。

当我们使用ImageStreamTag访问一个Image的时候，其实OpenShift最终会识别出ImageStreamTag对应的ImageStreamImage（就像我们使用DNS域名访问一个地址时，系统需要将其翻译成IP地址访问目标）。ImageStreamTag和ImageStreamImage的这种对应关系可以通过2种方式被解析：

  • 在ImageStream记录了ImageStreamTag和ImageStreamImage这种对应关系。当使用ImageStreamTag访问Image的时候，OpenShift实际是使用ImageStreamImage访问该Image。（这种情况类似DNS解析使用的本地hosts文件实现的）
  • 在ImageStream不记录ImageStreamTag和ImageStreamImage这种对应关系，而只记录ImageStreamTag信息。因此每次通过ImageStreamTag访问Image的时候，OpenShift需要直接向Registry询问这个ImageStreamTag对应是哪个ImageStreamImage，然后才能访问该Image。（这种情况类似每次DNS解析使用的都是远程DNS服务实现的）


根据ImageStream所在项目，可将其分为集群级和项目级的ImageStream。无论当前在哪个项目中，任何用户都可访问到集群级的ImageStream；而项目级ImageStream只能该项目用户或被授权用户才可访问。

从Image生成ImageStream

如果我们跟随《OpenShift 4 Hands-on Lab (1) – 部署应用》成功创建应用后可以通过以下命令发现OpenShift会自动生成ImageStream对象，这就说明在运行应用前，OpenShift要创建ImageStream并建立App Image的指向关系。

$ oc get is

OpenShift除了可以自动创建ImageStream外，我们还可以从定义ImageStream的YAML文件创建它，但是我们通常用以下两种方法手工从Image生成ImageStream：

1.首选创建名为imagestream-lab1的OpenShift项目，以下所有操作都缺省在该项目中进行。

$ export USER_ID=YOUR-USER-ID
$ oc new-project ${USER_ID}-imagestream-lab1

2.通过import-image导入镜像的信息并生成ImageStream。以下将docker.io/openshift/deployment-example:v1的镜像信息导入到名为is-example的ImageStream中，并用v1指向该远程镜像。

$ oc import-image --from=docker.io/openshift/deployment-example:v1 is-example:v1 --confirm -n ${USER_ID}-imagestream-lab1
Name:                   is-example
Namespace:              user1-imagestream-lab1
Created:                Less than a second ago
Labels:                 <none>
Annotations:            openshift.io/image.dockerRepositoryCheck=2020-02-02T04:27:15Z
Image Repository:       image-registry.openshift-image-registry.svc:5000/user1-imagestream-lab1/is-example
Image Lookup:           local=false
Unique Images:          1
Tags:                   1
 
v1
  tagged from docker.io/openshift/deployment-example:v1
 
  * docker.io/openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b
      Less than a second ago
 
Image Name:     is-example:v1
Docker Image:   docker.io/openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b
Name:           sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b
Created:        Less than a second ago
Annotations:    image.openshift.io/dockerLayersOrder=ascending
Image Size:     5.77MB in 6 layers
Layers:         0B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
                5.77MB  sha256:50438f3701c47319ff1c8189ff19f5a8c779f2479aa2066979b930c7dbb3bde8
                0B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
                0B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
                0B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
                0B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Image Created:  4 years ago
Author:         Clayton Coleman <ccoleman@redhat.com>
Arch:           amd64
Entrypoint:     /deployment v1
Working Dir:    <none>
User:           <none>
Exposes Ports:  8080/tcp
Docker Labels:  <none>
Environment:    COLOR=#006e9c

3.使用tag对镜像打标签。下面是将docker.io上的openshift/deployment-example:v2打标签为v2，并保存到名为is-example的ImageStream中。

$ oc tag --source=docker openshift/deployment-example:v2 is-example:v2 -n ${USER_ID}-imagestream-lab1
Tag is-example:v2 set to openshift/deployment-example:v2.

4.为了在后面证明tag命令的“–source=docker”选项会使用“docker.io”上的镜像，我们执行以下命令，其中“openshift/deployment-example-test:v2”的镜像实际在“docker.io”上并不存在。

$ oc tag --source=docker docker.io/openshift/deployment-example:v2 is-example:v3 -n ${USER_ID}-imagestream-lab1
$ oc tag --source=docker openshift/deployment-example-test:v2 is-example:v4 -n ${USER_ID}-imagestream-lab1

ImageStream的操作

1.查看ImageStream列表，注意TAGS部分的“v3,v2,v1,v4”。

$ oc get is -n ${USER_ID}-imagestream-lab1
NAME         IMAGE REPOSITORY                                                                     TAGS          UPDATED
is-example   image-registry.openshift-image-registry.svc:5000/user1-imagestream-lab1/is-example   v3,v2,v1,v4   42 minutes ago

2.查看名为is-example的ImageStream配置。注意：名为v2和v3的ImageStreamTag都指向ImageStreamImage为“sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b”的镜像；另外，在v4部分提示无法访问“docker.io/openshift/deployment-example-test:v2”，这说明“oc tag”命令的“–source=docker”选项是从“docker.io”获取镜像。

$ oc describe is is-example -n ${USER_ID}-imagestream-lab1
Name:                   is-example
Namespace:              user1-imagestream-lab1
Created:                2 hours ago
Labels:                 <none>
Annotations:            openshift.io/image.dockerRepositoryCheck=2020-12-08T14:58:12Z
Image Repository:       image-registry.openshift-image-registry.svc:5000/user1-imagestream-lab1/is-example
Image Lookup:           local=false
Unique Images:          2
Tags:                   4
 
v1
  tagged from docker.io/openshift/deployment-example:v1
 
  * docker.io/openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b
      2 hours ago
 
v2
  tagged from openshift/deployment-example:v2
  
  * openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b
      2 hours ago
 
v3
  tagged from docker.io/openshift/deployment-example:v2
 
  * docker.io/openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b
      37 minutes ago
 
v4
  tagged from openshift/deployment-example-test:v2
  
  ! error: Import failed (Unauthorized): you may not have access to the container image "docker.io/openshift/deployment-example-test:v2"
      5 seconds ago

$ oc get is is-example -o yaml -n ${USER_ID}-imagestream-lab1
apiVersion: image.openshift.io/v1
kind: ImageStream
metadata:
  annotations:
    openshift.io/image.dockerRepositoryCheck: "2020-12-08T13:03:59Z"
  creationTimestamp: "2020-12-08T12:59:18Z"
  generation: 3
  name: is-example
  namespace: user1-imagestream-lab1
  resourceVersion: "232297"
  selfLink: /apis/image.openshift.io/v1/namespaces/user1-imagestream-lab1/imagestreams/is-example
  uid: dd1f8458-3043-4791-b5da-2930ff3524c5
spec:
  lookupPolicy:
    local: false
  tags:
  - annotations: null
    from:
      kind: DockerImage
      name: docker.io/openshift/deployment-example:v1
    generation: 1
    importPolicy: {}
    name: v1
    referencePolicy:
      type: Source
  - annotations: null
    from:
      kind: DockerImage
      name: openshift/deployment-example:v2
    generation: 3
    importPolicy: {}
    name: v2
    referencePolicy:
      type: Source
  - annotations: null
    from:
      kind: DockerImage
      name: docker.io/openshift/deployment-example:v2
    generation: 5
    importPolicy: {}
    name: v3
    referencePolicy:
      type: Source
  - annotations: null
    from:
      kind: DockerImage
      name: openshift/deployment-example-test:v2
    generation: 9
    importPolicy: {}
    name: v4
    referencePolicy:
      type: Source
status:
  dockerImageRepository: image-registry.openshift-image-registry.svc:5000/user1-imagestream-lab1/is-example
  tags:
  - items:
    - created: "2020-12-08T12:59:18Z"
      dockerImageReference: docker.io/openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b
      generation: 1
      image: sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b
    tag: v1
  - items:
    - created: "2020-12-08T13:03:59Z"
      dockerImageReference: openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b
      generation: 3
      image: sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b
    tag: v2
  - items:
    - created: "2020-12-08T14:20:41Z"
      dockerImageReference: docker.io/openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b
      generation: 5
      image: sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b
    tag: v3
  - conditions:
    - generation: 9
      lastTransitionTime: "2020-12-08T14:58:12Z"
      message: you may not have access to the container image "docker.io/openshift/deployment-example-test:v2"
      reason: Unauthorized
      status: "False"
      type: ImportSuccess
    items: null
    tag: v4

3.查看ImageStreamTag列表，确认没有“is-example:v4”的ImageStreamTag。这说明名为v4的ImageStreamTag没有创建成功。

$ oc get istag -n ${USER_ID}-imagestream-lab1
NAME            IMAGE REFERENCE                                                                                                  UPDATED
is-example:v1   docker.io/openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b   2 hours ago
is-example:v2   openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b             2 hours ago
is-example:v3   docker.io/openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b   About an hour ago

4.查看ImageStreamTag配置

$ oc describe istag is-example:v1 -n ${USER_ID}-imagestream-lab1
Image Name:     sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b
Docker Image:   docker.io/openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b
Name:           sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b
Created:        2 hours ago
Annotations:    image.openshift.io/dockerLayersOrder=ascending
Image Size:     5.77MB in 6 layers
Layers:         0B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
                5.77MB  sha256:50438f3701c47319ff1c8189ff19f5a8c779f2479aa2066979b930c7dbb3bde8
                0B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
                0B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
                0B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
                0B      sha256:a3ed95caeb02ffe68cdd9fd84406680ae93d633cb16422d00e8a7c22955b46d4
Image Created:  4 years ago
Author:         Clayton Coleman <ccoleman@redhat.com>
Arch:           amd64
Entrypoint:     /deployment v1
Working Dir:    <none>
User:           <none>
Exposes Ports:  8080/tcp
Docker Labels:  <none>
Environment:    COLOR=#006e9c

5.按大小排序查看USER-ID-imagestream-lab1项目中的imagestreams。注意，下面命令必须有“ -n USER-ID-imagestream-lab1”部分来指定查看的项目，否则看到的是“openshift”项目中的imagestreams。

$ oc adm top imagestreams -n ${USER_ID}-imagestream-lab1
NAME                       			STORAGE  IMAGES LAYERS
USER-ID-imagestream-lab1/is-example 5.503MiB 2      12

6.执行命令，将“is-example:v1”指向docker.io网站的“openshift/deployment-example:v2”

$ oc tag --source=docker openshift/deployment-example:v2 is-example:v1 -n ${USER_ID}-imagestream-lab1

7.查看名为is-example的ImageStream，其中v1的指向的ImageStreamImage记录为2条，当前v1和v2指向的是同一个Image。而v1以前指向的是另一个Image。

$ oc describe is is-example -n ${USER_ID}-imagestream-lab1
Name:                   is-example
Namespace:              USER-ID-imagestream-lab1
Created:                4 minutes ago
Labels:                 <none>
Annotations:            openshift.io/image.dockerRepositoryCheck=2020-02-02T14:07:48Z
Image Repository:       default-route-openshift-image-registry.apps.cluster-beijing-c70a.beijing-c70a.example.opentlc.com/USER-ID-imagestream-lab1/is-example
Image Lookup:           local=false
Unique Images:          2
Tags:                   2
 
v1
  tagged from openshift/deployment-example:v2
 
  * openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b
      26 seconds ago
    docker.io/openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b
      3 hours ago
 
v2
  tagged from openshift/deployment-example:v2
  
  * openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b
      3 hours ago
 
v3
  tagged from docker.io/openshift/deployment-example:v2
 
  * docker.io/openshift/deployment-example@sha256:1318f08b141aa6a4cdca8c09fe8754b6c9f7802f8fc24e4e39ebf93e9d58472b
      About an hour ago
 
v4
  tagged from openshift/deployment-example-test:v2
 
  ! error: Import failed (Unauthorized): you may not have access to the container image "docker.io/openshift/deployment-example-test:v2"
      37 minutes ago

8.删除名为“is-example:v2”的ImageStreamTag

$ oc delete istag/is-example:v2 -n ${USER_ID}-imagestream-lab1

生成ImageStream过程的选项

在使用“oc tag”和“oc import-image”命令生成ImageStream的时候，可以使用参数“–reference-policy=local”让OpenShift只在本地（其内部的Image Registry）找镜像；另外还可以用“–reference”参数让OpenShift只创建一个非导入的ImageStreamTag，即不导入目标Image的元数据。下面我们看看这两个选项对ImageStream有什么影响？

1.新建imagestream-lab2项目

$ oc new-project ${USER_ID}-imagestream-lab2


2.执行以下命令，使用不同选项生从“openshift/deployment-example:v1”成相关ImageStream资源。

$ oc tag --source=docker openshift/deployment-example:v1 is-example:v1 -n ${USER_ID}-imagestream-lab2
$ oc tag --source=docker openshift/deployment-example:v1 is-example:v2 --reference-policy=local -n ${USER_ID}-imagestream-lab2
$ oc tag --source=docker openshift/deployment-example:v1 is-example:v3 --reference=true -n ${USER_ID}-imagestream-lab2

3.查看ImageStream的信息，注意3个Tags它们之间的差异，其中v3没有相应的镜像ID（说明当使用–reference=true，OpenShift不会主动获取镜像元数据）。

$ oc describe is is-example -n ${USER_ID}-imagestream-lab2
Name:                   is-example
Namespace:              imagestream-lab2
Created:                2 minutes ago
Labels:                 <none>
Annotations:            openshift.io/image.dockerRepositoryCheck=2020-02-02T11:14:02Z
Image Repository:       default-route-openshift-image-registry.apps.cluster-beijing-c70a.beijing-c70a.example.opentlc.com/USER-ID-imagestream-lab2/is-example
Image Lookup:           local=false
Unique Images:          2
Tags:                   3
 
v1
  tagged from openshift/deployment-example:v1
  * openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b
      2 minutes ago
  
v2
  tagged from openshift/deployment-example:v1
    prefer registry pullthrough when referencing this tag
  * openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b
      2 minutes ago
 
v3
  reference to registry openshift/deployment-example:v1
  * openshift/deployment-example:v1
      2 minutes ago

4.查看ImageStreamTag列表。确认“is-example:v2”和“is-example:v2”指向的是同一个sha256的ImageStreamImage，但是镜像所在位置不同，前者指向是远程“docker.io”上的镜像，后者则是指向是已经在OpenShift内部Registry的镜像。另外还确认istag列表中没有“is-example:v3”，说明它是无效的。

$ oc get istag -n ${USER_ID}-imagestream-lab2
NAME            IMAGE REF                                                                                                                                             UPDATED
is-example:v1   openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b                                                  2 minutes ago
is-example:v2   image-registry.openshift-image-registry.svc:5000/USER-ID-imagestream-lab2/is-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b   2 minutes ago

5.在OpenShift控制台也可看到名为is-example的ImageStream的“is-example:v3”的Tag提示以下错误。

6.执行以下命令，根据已有的ImageSteamTag生成新的ImageSteamTag，这次使用了“–reference=true”参数。

$ oc tag --source=istag is-example:v1 is-example:v4 --reference=true -n ${USER_ID}-imagestream-lab2

7.再次查看ImageStreamTag，确认“is-example:v4”是正常的。虽然这次使用了“–reference=true”参数，即OpenShift不会主动获取镜像元数据，但是由于使用的是“–source=istag”，因此ImageStreamImage信息已经在本地有了（是在创建“is-example:v1”的步骤获取到的）。

$ oc get istag -n ${USER_ID}-imagestream-lab2
NAME            IMAGE REF                                                                                                                                             UPDATED
is-example:v1   openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b                                                  22 minutes ago
is-example:v2   image-registry.openshift-image-registry.svc:5000/USER-ID-imagestream-lab2/is-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b   22 minutes ago
is-example:v4   openshift/deployment-example@sha256:c505b916f7e5143a356ff961f2c21aee40fbd2cd906c1e3feeb8d5e978da284b                                                  About a minute ago

常见问题

1.根据远程的Image创建ImageStream的时候，Image是否会下载到本地？
说明：不会。只有第一次基于这个Image运行应用的时候才去下载这个Image。

2.当使用“–reference-policy=local”参数和不使用它的时候，对使用Image有什么影响？
说明：当使用“–reference-policy=local”后，OpenShift就不会访问其外部的Registry获得Image了，只会使用其内置的Registry获取Image了。因此需要手动将Image提前push到其内置的Registry才可使用这些Image。

3.删除了ImageStreamTag后，对应的本地Image有影响么？
说明：没有。两者是若关联关系，删除任何一个不会自动删除相关的另一方。