Using External Images in CI

The ci-operator config only allows to reference ImageStreamTags, it does not allow to specify arbitrary Docker pull specs. In order to use external images, they need to be mirrored to the central CI registry.

Mirror Public Images

If the source image is open to the public, we can mirror the image by adding it into a mapping file in the core-services/image-mirroring/supplemental-ci-images folder of openshift/release repository. The following line in the mapping_supplemental_ci_images_ci file mirrors gcr.io/k8s-staging-boskos/boskos:latest to registry.ci.openshift.org/ci/boskos:latest. The naming convention of the mapping file is mapping_supplemental_ci_images_<namespace>, e.g., the images in mapping_supplemental_ci_images_ci are mirrored to the namespace ci.

1

gcr.io/k8s-staging-boskos/boskos:latest registry.ci.openshift.org/ci/boskos:latest

The hourly periodic job periodic-image-mirroring-supplemental-ci-images mirrors all the images defined in the mapping files. Note that it operates on the contents of the master branch, so the changes to the files have to be merged before the images can be used in jobs and/or pull request rehearsals. Once it is mirrored, you can use the image like this:

1
2
3
4
5

base_images:
  my-external-image:
    namespace: ci
    name:  boskos
    tag: latest

Mirror Private Images

If the image is in a private registry that requires authentication to pull it, you will need to add your credentials and define a new periodic mirroring job with it.

We cannot reuse the existing job as the keys in the credentials config are registries and we might have to set up multiple credentials for the same registry.