How to setup okd to use external nexus docker registry? - openshift

Question

I like to replace my default docker registry in OKD with an existing Nexus Docker registry in OKD. How do I replace the exist docker registry in OKD with the Nexus Docker Registry?
The idea is to host all my images in that Nexus repo. For example when I use S2I.

Answer 1

This topic (as #GhostCat indicates) leaves your options pretty open until you make some additional decisions. There are a couple of resources/topics that you may want to investigate to help hone on in your desired outcome:
1) Pushing/Pulling from an external registry
In this topic, I'd suggest that you don't "replace" the internal registry, but rather run a nexus registry alongside the internal registry. The internal registry can still be used to store system components, s2i image builders, etc etc., while Nexus can be the primary registry for your applications.
For image pulling: Each docker host can be configured with additional external registries to search through, and by simply editing your image streams or including the full image path in your deployment / statefulset / etc.
You can modify your build configs to store the built images in an external registry https://blog.openshift.com/pushing-application-images-to-an-external-registry/
2) Moving all registry features/components to Nexus
In this topic, you will need to read up on the disconnected installation notes around OpenShift and adapt them to your own Nexus config. Essentially, you need to load up all of the images in Nexus and modify all of the templates/imagestreams in openshift to point at the new repository.
Follow the guidance here and modify accordingly https://blog.openshift.com/pushing-application-images-to-an-external-registry/
This is a less common pattern and really only followed by teams in fully disconnected environments. Most teams we meet follow the guidance in #1 above.

Answer 2

Thanks for that article, its helpful but is there not a way to make this automatic select as default? So that always all my build images goes to my external Nexus Docker repo? Because if it goes to the internal registry then we lost the images by a reboot of a crash of the internal registry container.
Especially the S2I images.

Answer 3

I see a couple of ideas to discuss;
1) If you just want your build outputs to target another external repo instead of the default internal, this can be codified in any of your external ci/cd systems as part of the build config. The most common way in openshift would be to have Jenkins create the build configs through a Jenkinsfile in your code repo.
I'm not aware of a simple documented way to override a default configuration or setting for all build outputs across the system.
2) If you are losing your images on the internal registry, then you are not leveraging persistent storage, which should be considered. See [here] (https://docs.okd.io/3.10/install_config/registry/extended_registry_configuration.html#docker-registry-configuration-reference-storage)