OpenWhisk support custom registry

Question

I need to run a Docker action in OpenWhisk. Inside the Docker Container, I execute a Java program.

Now I pulled the docker skeleton from Openwhisk and installed Java on it. I also put my Java program inside the container and replaced the exec.

I can create the action with:

wsk create action NAME --docker myDockerHub/repo:1 -i

This is not optimal since my code should not be on DockerHub. Does OpenWhisk provide usage for my local Registy?

wsk action create ImportRegionJob --docker server.domain.domain:5443/import-region-job:v0.0.2 -i
error: Unable to create action 'ImportRegionJob': The request content was malformed:
image prefix not is not valid (code qXB0Tu65zOfayHCqVgrYJ33RMewTtph9)
Run 'wsk --help' for usage.

I know you can provide a .zip file to a docker action when creating it, but that does not work because the default image used does not have Java installed.

If you're deploying openwhisk on your own, then you can use a private registry for all your images. You can also use a zip file with your docker action: `wsk action create ImportRegionJob secretsauce.zip --docker import-region-job:v0.0.2` if the zip file fits within the limits of the deployment. — user6062970, Jul 10 '18 at 16:20
Thank you for your answer. How do I use a private registry? When I create an action and use a private registry, I get an error (see above code snippet). — rootdoot, Jul 11 '18 at 07:20
It is 9 month later, but I added an answer to your question "How do I use a private registry?" — Schuh, Feb 15 '19 at 10:49

Schuh · Answer 1 · 2019-02-15T10:54:02.820

I achieved this for a distributed OpenWhisk environment. The docker actions are hosted in GitLab, built by GitLab CI and deployed to a custom container registry in their respective GitLab repositories. Pulls from the local registry are significantly faster than pulls from docker hub.

In OpenWhisk, create an action using the full path including registry url.

wsk create action NAME --docker YourRegistry:port/namespace/image[:tag]

On invocation, the pull command for the action will be carried out inside the invoker containers on the compute nodes. The following table shows in the first column an example setup of invoker hosts (configured in openwhisk/ansible/environments/distributed/hosts, section [invokers]), and in the second column the respective invoker container name running on that host. The invoker container in the second column should show up, when doing a docker ps on the hostname from the first column:

invoker-host-0 invoker0
invoker-host-1 invoker1
...
invoker-host-2 invokerN

for $I in $(seq 0 N); do ssh invoker-host-$I docker ps | grep invoker$I; done

Now, you can do a docker login for all invokers in one command.

for $I in $(seq 0 N); do ssh invoker-host-$I docker exec invoker$I docker login YourRegistry:port -u username -p TokenOrPassword; done

As a prerequisite, inside all invoker containers, I had to add the root certificates for the registry, update-ca-certificates and restart the docker deamon.

An improvement might be to do this already in the invoker container image, that is built when deploying openwhisk (before running) invoker.yml, which is imported in openwhisk.yml.

score 0 · Answer 2 · answered Jul 17 '18 at 10:52

Docker images can be specified when deploying applications from zip files. This allows you use the existing Java runtime with the zip file, which has Java installed, removing the need for a custom image.

wsk action update --docker openwhisk/java8action action_name action_files.zip

OpenWhisk support custom registry

2 Answers2