diff --git a/modules/registry-configuring-storage-baremetal.adoc b/modules/registry-configuring-storage-baremetal.adoc index b61fd0462f22..84a186260c0a 100644 --- a/modules/registry-configuring-storage-baremetal.adoc +++ b/modules/registry-configuring-storage-baremetal.adoc @@ -52,6 +52,11 @@ ReadWriteMany access mode. . To configure your registry to use storage, change the `spec.storage.pvc` in the `configs.imageregistry/cluster` resource. + +[NOTE] +==== +When using shared storage such as NFS, it is strongly recommended to use the `supplementalGroups` strategy, which dictates the allowable supplemental groups for the Security Context, rather than the `fsGroup` ID. Refer to the NFS *Group IDs* documentation for details. +==== + . Verify you do not have a registry Pod: + ---- @@ -60,13 +65,12 @@ $ oc get pod -n openshift-image-registry + [NOTE] ===== -If the storage type is `emptyDIR`, the replica number cannot be greater than `1`. -If the storage type is `NFS`, and you want to scale up the registry Pod by setting -`replica>1` you must enable the `no_wdelay` mount option. For example: - +* If the storage type is `emptyDIR`, the replica number cannot be greater than `1`. +* If the storage type is `NFS`, you must enable the `no_wdelay` and `root_squash` mount options. For example: ++ ---- # cat /etc/exports -/mnt/data *(rw,sync,no_wdelay,no_root_squash,insecure,fsid=0) +/mnt/data *(rw,sync,no_wdelay,root_squash,insecure,fsid=0) sh-4.3# exportfs -rv exporting *:/mnt/data ---- diff --git a/modules/registry-configuring-storage-vsphere.adoc b/modules/registry-configuring-storage-vsphere.adoc index 3f5ed992497a..ac489c2a73f2 100644 --- a/modules/registry-configuring-storage-vsphere.adoc +++ b/modules/registry-configuring-storage-vsphere.adoc @@ -31,6 +31,11 @@ a different storage backend, such as `NFS`, to configure the registry storage. . To configure your registry to use storage, change the `spec.storage.pvc` in the `configs.imageregistry/cluster` resource. + +[NOTE] +==== +When using shared storage such as NFS, it is strongly recommended to use the `supplementalGroups` strategy, which dictates the allowable supplemental groups for the Security Context, rather than the `fsGroup` ID. Refer to the NFS *Group IDs* documentation for details. +==== + . Verify you do not have a registry Pod: + ---- @@ -39,13 +44,12 @@ $ oc get pod -n openshift-image-registry + [NOTE] ===== -If the storage type is `emptyDIR`, the replica number cannot be greater than `1`. -If the storage type is `NFS`, and you want to scale up the registry Pod by setting -`replica>1` you must enable the `no_wdelay` mount option. For example: - +* If the storage type is `emptyDIR`, the replica number cannot be greater than `1`. +* If the storage type is `NFS`, you must enable the `no_wdelay` and `root_squash` mount options. For example: ++ ---- # cat /etc/exports -/mnt/data *(rw,sync,no_wdelay,no_root_squash,insecure,fsid=0) +/mnt/data *(rw,sync,no_wdelay,root_squash,insecure,fsid=0) sh-4.3# exportfs -rv exporting *:/mnt/data ---- diff --git a/modules/storage-persistent-storage-nfs-group-ids.adoc b/modules/storage-persistent-storage-nfs-group-ids.adoc index 8fcd20038e2c..6379502a45f2 100644 --- a/modules/storage-persistent-storage-nfs-group-ids.adoc +++ b/modules/storage-persistent-storage-nfs-group-ids.adoc @@ -1,7 +1,9 @@ // Module included in the following assemblies: // // * storage/persistent_storage/persistent-storage-nfs.adoc +// * storage/registry/configuring_registry_storage/configuring-registry-storage-baremetal.adoc +[id=storage-persistent-storage-nfs-group-ids_{context}] = Group IDs The recommended way to handle NFS access, assuming it is not an option to @@ -13,8 +15,7 @@ Pod's `securityContext`. [NOTE] ==== -It is generally preferable to use supplemental group IDs to gain access to -persistent storage versus using user IDs. +To gain access to persistent storage, it is generally preferable to use supplemental group IDs versus user IDs. ==== Because the group ID on the example target NFS directory diff --git a/registry/configuring_registry_storage/configuring-registry-storage-baremetal.adoc b/registry/configuring_registry_storage/configuring-registry-storage-baremetal.adoc index 6110e4ffc4b9..3aec85982c1a 100644 --- a/registry/configuring_registry_storage/configuring-registry-storage-baremetal.adoc +++ b/registry/configuring_registry_storage/configuring-registry-storage-baremetal.adoc @@ -12,10 +12,12 @@ include::modules/installation-registry-storage-config.adoc[leveloffset=+1] include::modules/registry-configuring-storage-baremetal.adoc[leveloffset=+1] +See xref:../../storage/persistent_storage/persistent-storage-nfs.adoc#storage-persistent-storage-nfs-group-ids_persistent-storage-nfs[Group IDs] for additional details about using supplemental groups to handle NFS access. + include::modules/installation-registry-storage-non-production.adoc[leveloffset=+1] [id="configuring-registry-storage-baremetal-addtl-resources"] == Additional resources -For more details on configuring registry storage for bare metal, see xref:../../scalability_and_performance/optimizing-storage.adoc#recommended-configurable-storage-technology_persistent-storage[Recommended configurable storage technology]. +For more details about configuring registry storage for bare metal, see xref:../../scalability_and_performance/optimizing-storage.adoc#recommended-configurable-storage-technology_persistent-storage[Recommended configurable storage technology]. diff --git a/registry/configuring_registry_storage/configuring-registry-storage-vsphere.adoc b/registry/configuring_registry_storage/configuring-registry-storage-vsphere.adoc index 340bf96d5765..ba02fe03d23e 100644 --- a/registry/configuring_registry_storage/configuring-registry-storage-vsphere.adoc +++ b/registry/configuring_registry_storage/configuring-registry-storage-vsphere.adoc @@ -12,9 +12,11 @@ include::modules/installation-registry-storage-config.adoc[leveloffset=+2] include::modules/registry-configuring-storage-vsphere.adoc[leveloffset=+1] +See xref:../../storage/persistent_storage/persistent-storage-nfs.adoc#storage-persistent-storage-nfs-group-ids_persistent-storage-nfs[Group IDs] for additional details about using supplemental groups to handle NFS access. + include::modules/installation-registry-storage-non-production.adoc[leveloffset=+1] [id="configuring-registry-storage-vsphere-addtl-resources"] == Additional resources -For more details on configuring registry storage for vSphere, see xref:../../scalability_and_performance/optimizing-storage.adoc#recommended-configurable-storage-technology_persistent-storage[Recommended configurable storage technology]. +For more details about configuring registry storage for vSphere, see xref:../../scalability_and_performance/optimizing-storage.adoc#recommended-configurable-storage-technology_persistent-storage[Recommended configurable storage technology].