Fully qualify all openshift/origin and openshift3/ose images

README_CONTAINERIZED_INSTALLATION.md

@@ -44,14 +44,14 @@ beginning of the installation process ensuring that these settings are applied
 before attempting to pull any of the following images.
 
     Origin
-        openshift/origin
-        openshift/node (node + openshift-sdn + openvswitch rpm for client tools)
-        openshift/openvswitch (centos7 + openvswitch rpm, runs ovsdb ovsctl processes)
+        docker.io/openshift/origin
+        docker.io/openshift/node (node + openshift-sdn + openvswitch rpm for client tools)
+        docker.io/openshift/openvswitch (centos7 + openvswitch rpm, runs ovsdb ovsctl processes)
         registry.access.redhat.com/rhel7/etcd
     OpenShift Enterprise
-        openshift3/ose
-        openshift3/node
-        openshift3/openvswitch
+        registry.access.redhat.com/openshift3/ose
+        registry.access.redhat.com/openshift3/node
+        registry.access.redhat.com/openshift3/openvswitch
         registry.access.redhat.com/rhel7/etcd
 
   * note openshift3/* images come from registry.access.redhat.com and

README_CONTAINER_IMAGE.md

@@ -30,7 +30,7 @@ Here is an example of how to run a containerized `openshift-ansible` playbook th
            -e INVENTORY_FILE=/tmp/inventory \
            -e PLAYBOOK_FILE=playbooks/openshift-checks/certificate_expiry/default.yaml \
            -e OPTS="-v" -t \
-           openshift/origin-ansible
+           docker.io/openshift/origin-ansible
 
 You might want to adjust some of the options in the example to match your environment and/or preferences. For example: you might want to create a separate directory on the host where you'll copy the ssh key and inventory files prior to invocation to avoid unwanted SELinux re-labeling of the original files or paths (see below).
 
@@ -61,7 +61,7 @@ If the inventory file needs additional files then it can use the path `/var/lib/
 Run the ansible system container:
 
 ```sh
-atomic install --system --set INVENTORY_FILE=$(pwd)/inventory.origin openshift/origin-ansible
+atomic install --system --set INVENTORY_FILE=$(pwd)/inventory.origin docker.io/openshift/origin-ansible
 systemctl start origin-ansible
 ```
 

examples/certificate-check-upload.yaml

@@ -28,7 +28,7 @@ spec:
     spec:
       containers:
       - name: openshift-ansible
-        image: openshift/origin-ansible
+        image: docker.io/openshift/origin-ansible
         env:
         - name: PLAYBOOK_FILE
           value: playbooks/openshift-checks/certificate_expiry/easy-mode-upload.yaml

examples/certificate-check-volume.yaml

@@ -30,7 +30,7 @@ spec:
     spec:
       containers:
       - name: openshift-ansible
-        image: openshift/origin-ansible
+        image: docker.io/openshift/origin-ansible
         env:
         - name: PLAYBOOK_FILE
           value: playbooks/openshift-checks/certificate_expiry/html_and_json_timestamp.yaml

examples/scheduled-certcheck-upload.yaml

@@ -25,7 +25,7 @@ spec:
         spec:
           containers:
           - name: openshift-ansible
-            image: openshift/origin-ansible
+            image: docker.io/openshift/origin-ansible
             env:
             - name: PLAYBOOK_FILE
               value: playbooks/openshift-checks/certificate_expiry/easy-mode-upload.yaml

examples/scheduled-certcheck-volume.yaml

@@ -25,7 +25,7 @@ spec:
         spec:
           containers:
           - name: openshift-ansible
-            image: openshift/origin-ansible
+            image: docker.io/openshift/origin-ansible
             env:
             - name: PLAYBOOK_FILE
               value: playbooks/openshift-checks/certificate_expiry/html_and_json_timestamp.yaml

hack/build-images.sh

@@ -36,7 +36,7 @@ done
 
 # allow ENV to take precedent over switches
 prefix="${PREFIX:-$prefix}"
-version="${OS_TAG:-$version}" 
+version="${OS_TAG:-$version}"
 
 if [ "$help" = true ]; then
   echo "Builds the docker images for openshift-ansible"
@@ -44,12 +44,12 @@ if [ "$help" = true ]; then
   echo "Options: "
   echo "  --prefix=PREFIX"
   echo "  The prefix to use for the image names."
-  echo "  default: openshift/origin-ansible"
+  echo "  default: docker.io/openshift/origin-ansible"
   echo
   echo "  --version=VERSION"
   echo "  The version used to tag the image (can be a comma-separated list)"
   echo "  default: latest"
-  echo 
+  echo
   echo "  --no-cache"
   echo "  If set will perform the build without a cache."
   echo

hack/push-release.sh

@@ -16,7 +16,7 @@ set -o pipefail
 starttime=$(date +%s)
 
 # image name without repo or tag.
-image="${PREFIX:-openshift/origin-ansible}"
+image="${PREFIX:-docker.io/openshift/origin-ansible}"
 
 # existing local tag on the image we want to push
 source_tag="${OS_TAG:-latest}"

images/installer/README_INVENTORY_GENERATOR.md

@@ -49,7 +49,7 @@ docker run -u `id -u` \
        -e PLAYBOOK_FILE=playbooks/openshift-checks/health.yml \
        -e GENERATE_INVENTORY=true \
        -e USER=`whoami` \
-       openshift/origin-ansible
+       docker.io/openshift/origin-ansible
 
 ```
 
@@ -66,7 +66,7 @@ and manually execute `/usr/local/bin/generate`:
 docker run -u `id -u` \
        -v ...
        ...
-       -it openshift/origin-ansible /bin/bash
+       -it docker.io/openshift/origin-ansible /bin/bash
 
 ---
 

images/installer/root/usr/local/bin/usage

@@ -28,6 +28,6 @@ docker run -tu `id -u` \
        -e INVENTORY_FILE=/tmp/inventory \
        -e OPTS="-v" \
        -e PLAYBOOK_FILE=playbooks/byo/openshift_facts.yml \
-       openshift/origin-ansible
+       docker.io/openshift/origin-ansible
 
 EOF

roles/lib_openshift/library/oc_adm_registry.py

@@ -97,7 +97,7 @@ options:
   images:
     description:
     - The image to base this registry on - ${component} will be replaced with --type
-    required: 'openshift3/ose-${component}:${version}'
+    required: 'registry.access.redhat.com/openshift3/ose-${component}:${version}'
     default: None
     aliases: []
   latest_images:
@@ -203,7 +203,7 @@ EXAMPLES = '''
     replicas: 2
     namespace: default
     selector: type=infra
-    images: "registry.ops.openshift.com/openshift3/ose-${component}:${version}"
+    images: "registry.access.redhat.com/openshift3/ose-${component}:${version}"
     env_vars:
       REGISTRY_CONFIGURATION_PATH: /etc/registryconfig/config.yml
       REGISTRY_HTTP_TLS_CERTIFICATE: /etc/secrets/registry.crt

roles/lib_openshift/library/oc_adm_router.py

@@ -100,7 +100,7 @@ options:
   images:
     description:
     - The image to base this router on - ${component} will be replaced with --type
-    required: 'openshift3/ose-${component}:${version}'
+    required: 'registry.access.redhat.com/openshift3/ose-${component}:${version}'
     default: None
     aliases: []
   latest_images:
@@ -3183,7 +3183,7 @@ def main():
             default_cert=dict(default=None, type='str'),
             cert_file=dict(default=None, type='str'),
             key_file=dict(default=None, type='str'),
-            images=dict(default=None, type='str'), #'openshift3/ose-${component}:${version}'
+            images=dict(default=None, type='str'), #'registry.access.redhat.com/openshift3/ose-${component}:${version}'
             latest_images=dict(default=False, type='bool'),
             labels=dict(default=None, type='dict'),
             ports=dict(default=['80:80', '443:443'], type='list'),

roles/lib_openshift/src/ansible/oc_adm_router.py

@@ -19,7 +19,7 @@ def main():
             default_cert=dict(default=None, type='str'),
             cert_file=dict(default=None, type='str'),
             key_file=dict(default=None, type='str'),
-            images=dict(default=None, type='str'), #'openshift3/ose-${component}:${version}'
+            images=dict(default=None, type='str'), #'registry.access.redhat.com/openshift3/ose-${component}:${version}'
             latest_images=dict(default=False, type='bool'),
             labels=dict(default=None, type='dict'),
             ports=dict(default=['80:80', '443:443'], type='list'),

roles/lib_openshift/src/doc/registry

@@ -44,7 +44,7 @@ options:
   images:
     description:
     - The image to base this registry on - ${component} will be replaced with --type
-    required: 'openshift3/ose-${component}:${version}'
+    required: 'registry.access.redhat.com/openshift3/ose-${component}:${version}'
     default: None
     aliases: []
   latest_images:
@@ -150,7 +150,7 @@ EXAMPLES = '''
     replicas: 2
     namespace: default
     selector: type=infra
-    images: "registry.ops.openshift.com/openshift3/ose-${component}:${version}"
+    images: "registry.access.redhat.com/openshift3/ose-${component}:${version}"
     env_vars:
       REGISTRY_CONFIGURATION_PATH: /etc/registryconfig/config.yml
       REGISTRY_HTTP_TLS_CERTIFICATE: /etc/secrets/registry.crt

roles/lib_openshift/src/doc/router

@@ -47,7 +47,7 @@ options:
   images:
     description:
     - The image to base this router on - ${component} will be replaced with --type
-    required: 'openshift3/ose-${component}:${version}'
+    required: 'registry.access.redhat.com/openshift3/ose-${component}:${version}'
     default: None
     aliases: []
   latest_images:

roles/lib_openshift/src/test/unit/test_oc_adm_registry.py

@@ -102,7 +102,7 @@ class RegistryTest(unittest.TestCase):
                             "containers": [
                                 {
                                     "name": "registry",
-                                    "image": "openshift3/ose-docker-registry:v3.5.0.39",
+                                    "image": "registry.access.redhat.com/openshift3/ose-docker-registry:v3.5.0.39",
                                     "ports": [
                                         {
                                             "containerPort": 5000

roles/lib_openshift/src/test/unit/test_oc_adm_router.py

@@ -109,7 +109,7 @@ class RouterTest(unittest.TestCase):
                         "containers": [
                             {
                                 "name": "router",
-                                "image": "openshift3/ose-haproxy-router:v3.5.0.39",
+                                "image": "registry.access.redhat.com/openshift3/ose-haproxy-router:v3.5.0.39",
                                 "ports": [
                                     {
                                         "containerPort": 80

roles/lib_utils/filter_plugins/oo_filters.py

@@ -438,9 +438,9 @@ def lib_utils_oo_pods_match_component(pods, deployment_type, component):
     if not isinstance(component, string_types):
         raise errors.AnsibleFilterError("failed expects component to be a string")
 
-    image_prefix = 'openshift/origin-'
+    image_prefix = 'docker.io/openshift/origin-'
     if deployment_type == 'openshift-enterprise':
-        image_prefix = 'openshift3/ose-'
+        image_prefix = 'registry.access.redhat.com/openshift3/ose-'
 
     matching_pods = []
     image_regex = image_prefix + component + r'.*'

roles/openshift_control_plane/files/apiserver.yaml

@@ -13,7 +13,7 @@ spec:
   hostNetwork: true
   containers:
   - name: api
-    image: openshift/origin:v3.11.0
+    image: docker.io/openshift/origin:v3.11.0
     command: ["/bin/bash", "-c"]
     args:
     - |

roles/openshift_control_plane/files/controller.yaml

@@ -13,7 +13,7 @@ spec:
   hostNetwork: true
   containers:
   - name: controllers
-    image: openshift/origin:v3.11.0
+    image: docker.io/openshift/origin:v3.11.0
     command: ["/bin/bash", "-c"]
     args:
     - |

roles/openshift_health_checker/openshift_checks/docker_image_availability.py

@@ -12,14 +12,14 @@ DEPLOYMENT_IMAGE_INFO = {
     "origin": {
         "namespace": "openshift",
         "name": "origin",
-        "registry_console_prefix": "cockpit/",
+        "registry_console_prefix": "docker.io/cockpit/",
         "registry_console_basename": "kubernetes",
         "registry_console_default_version": "latest",
     },
     "openshift-enterprise": {
         "namespace": "openshift3",
         "name": "ose",
-        "registry_console_prefix": "openshift3/",
+        "registry_console_prefix": "registry.access.redhat.com/openshift3/",
         "registry_console_basename": "registry-console",
         "registry_console_default_version": "${short_version}",
     },
@@ -142,15 +142,17 @@ class DockerImageAvailability(DockerHostMixin, OpenShiftCheck):
     def required_images(self):
         """
         Determine which images we expect to need for this host.
-        Returns: a set of required images like 'openshift/origin:v3.6'
+        Returns: a set of required images like 'docker.io/openshift/origin:v3.6'
 
         The thorny issue of determining the image names from the variables is under consideration
         via https://github.com/openshift/openshift-ansible/issues/4415
 
         For now we operate as follows:
-        * For containerized components (master, node, ...) we look at the deployment type and
-          use openshift/origin or openshift3/ose as the base for those component images. The
-          version is openshift_image_tag as determined by the openshift_version role.
+        * For containerized components (master, node, ...) we look at the deployment
+          type and use docker.io/openshift/origin or
+          registry.access.redhat.com/openshift3/ose as the base for those component
+          images. The version is openshift_image_tag as determined by the
+          openshift_version role.
         * For OpenShift-managed infrastructure (router, registry...) we use oreg_url if
           it is defined; otherwise we again use the base that depends on the deployment type.
         Registry is not included in constructed images. It may be in oreg_url or etcd image.

roles/openshift_health_checker/test/docker_image_availability_test.py

@@ -167,13 +167,13 @@ def test_registry_availability(image, registries, connection_test_failed, skopeo
 
 @pytest.mark.parametrize("deployment_type, openshift_is_atomic, groups, oreg_url, expected", [
     (  # standard set of stuff required on nodes
-        "origin", False, ['oo_nodes_to_config'], "",
+        "origin", False, ['oo_nodes_to_config'], "docker.io/openshift/origin-${component}:${version}",
         set([
-            'openshift/origin-pod:vtest',
-            'openshift/origin-deployer:vtest',
-            'openshift/origin-docker-registry:vtest',
-            'openshift/origin-haproxy-router:vtest',
-            'cockpit/kubernetes:latest',  # origin version of registry-console
+            'docker.io/openshift/origin-pod:vtest',
+            'docker.io/openshift/origin-deployer:vtest',
+            'docker.io/openshift/origin-docker-registry:vtest',
+            'docker.io/openshift/origin-haproxy-router:vtest',
+            'docker.io/cockpit/kubernetes:latest',  # origin version of registry-console
         ])
     ),
     (  # set a different URL for images
@@ -183,20 +183,20 @@ def test_registry_availability(image, registries, connection_test_failed, skopeo
             'foo.io/openshift/origin-deployer:vtest',
             'foo.io/openshift/origin-docker-registry:vtest',
             'foo.io/openshift/origin-haproxy-router:vtest',
-            'cockpit/kubernetes:latest',  # AFAICS this is not built from the URL
+            'docker.io/cockpit/kubernetes:latest',  # AFAICS this is not built from the URL
         ])
     ),
     (
-        "origin", True, ['oo_nodes_to_config', 'oo_masters_to_config', 'oo_etcd_to_config'], "",
+        "origin", True, ['oo_nodes_to_config', 'oo_masters_to_config', 'oo_etcd_to_config'], "docker.io/openshift/origin-${component}:${version}",
         set([
             # images running on top of openshift
-            'openshift/origin-pod:vtest',
-            'openshift/origin-deployer:vtest',
-            'openshift/origin-docker-registry:vtest',
-            'openshift/origin-haproxy-router:vtest',
-            'cockpit/kubernetes:latest',
+            'docker.io/openshift/origin-pod:vtest',
+            'docker.io/openshift/origin-deployer:vtest',
+            'docker.io/openshift/origin-docker-registry:vtest',
+            'docker.io/openshift/origin-haproxy-router:vtest',
+            'docker.io/cockpit/kubernetes:latest',
             # containerized component images
-            'openshift3/ose-node:vtest',
+            'registry.access.redhat.com/openshift3/ose-node:vtest',
         ])
     ),
     (  # enterprise images
@@ -207,9 +207,9 @@ def test_registry_availability(image, registries, connection_test_failed, skopeo
             'foo.io/openshift3/ose-docker-registry:f13ac45',
             'foo.io/openshift3/ose-haproxy-router:f13ac45',
             # registry-console is not constructed/versioned the same as the others.
-            'openshift3/registry-console:vtest',
+            'registry.access.redhat.com/openshift3/registry-console:vtest',
             # containerized images aren't built from oreg_url
-            'openshift3/ose-node:vtest',
+            'registry.access.redhat.com/openshift3/ose-node:vtest',
         ])
     ),
 
@@ -221,7 +221,7 @@ def test_required_images(deployment_type, openshift_is_atomic, groups, oreg_url,
         group_names=groups,
         oreg_url=oreg_url,
         openshift_image_tag='vtest',
-        osn_image='openshift3/ose-node:vtest',
+        osn_image='registry.access.redhat.com/openshift3/ose-node:vtest',
     )
 
     assert expected == DockerImageAvailability(task_vars=task_vars).required_images()
@@ -233,13 +233,13 @@ def test_required_images(deployment_type, openshift_is_atomic, groups, oreg_url,
             openshift_deployment_type="origin",
             openshift_image_tag="vtest",
         ),
-        "cockpit/kubernetes:latest",
+        "docker.io/cockpit/kubernetes:latest",
     ), (
         dict(
             openshift_deployment_type="openshift-enterprise",
             openshift_image_tag="vtest",
         ),
-        "openshift3/registry-console:vtest",
+        "registry.access.redhat.com/openshift3/registry-console:vtest",
     ), (
         dict(
             openshift_deployment_type="openshift-enterprise",
@@ -268,12 +268,12 @@ def test_registry_console_image(task_vars, expected):
         dict(
             group_names=['oo_nodes_to_config'],
             openshift_image_tag="veggs",
-            osn_image="openshift3/ose-node:vtest",
+            osn_image="registry.access.redhat.com/openshift3/ose-node:vtest",
         ),
         set([
-            'openshift3/ose-node:vtest', 'cockpit/kubernetes:latest',
-            'openshift/origin-haproxy-router:veggs', 'openshift/origin-deployer:veggs',
-            'openshift/origin-docker-registry:veggs', 'openshift/origin-pod:veggs',
+            'registry.access.redhat.com/openshift3/ose-node:vtest', 'docker.io/cockpit/kubernetes:latest',
+            'docker.io/openshift/origin-haproxy-router:veggs', 'docker.io/openshift/origin-deployer:veggs',
+            'docker.io/openshift/origin-docker-registry:veggs', 'docker.io/openshift/origin-pod:veggs',
         ]),
     ), (
         dict(
@@ -285,6 +285,7 @@ def test_registry_console_image(task_vars, expected):
 def test_containerized(task_vars, expected):
     task_vars.update(dict(
         openshift_is_atomic=True,
+        oreg_url="docker.io/openshift/origin-${component}:${version}",
         openshift_deployment_type="origin",
     ))
 

roles/openshift_hosted/README.md

@@ -19,11 +19,11 @@ From this role:
 | Name                                  | Default value                            | Description                                                                                                              |
 |---------------------------------------|------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|
 | openshift_hosted_router_certificate   | None                                     | Dictionary containing "certfile", "keyfile" and "cafile" keys with values containing paths to local certificate files.   |
-| openshift_hosted_router_registryurl   | 'openshift3/ose-${component}:${version}' | The image to base the OpenShift router on.                                                                               |
+| openshift_hosted_router_registryurl   | 'registry.access.redhat.com/openshift3/ose-${component}:${version}' | The image to base the OpenShift router on.                                                                               |
 | openshift_hosted_router_replicas      | Number of nodes matching selector        | The number of replicas to configure.                                                                                     |
 | openshift_hosted_router_selector      | node-role.kubernetes.io/infra=true       | Node selector used when creating router. The OpenShift router will only be deployed to nodes matching this selector.     |
 | openshift_hosted_router_name          | router                                   | The name of the router to be created.                                                                                    |
-| openshift_hosted_registry_registryurl | 'openshift3/ose-${component}:${version}' | The image to base the OpenShift registry on.                                                                             |
+| openshift_hosted_registry_registryurl | 'registry.access.redhat.com/openshift3/ose-${component}:${version}' | The image to base the OpenShift registry on.                                                                             |
 | openshift_hosted_registry_replicas    | Number of nodes matching selector        | The number of replicas to configure.                                                                                     |
 | openshift_hosted_registry_selector    | node-role.kubernetes.io/infra=true                   | Node selector used when creating registry. The OpenShift registry will only be deployed to nodes matching this selector. |
 | openshift_hosted_registry_cert_expire_days | `730` (2 years)                     | Validity of the certificates in days. Works only with OpenShift version 1.5 (3.5) and later.                             |

roles/openshift_node/defaults/main.yml

@@ -17,8 +17,8 @@ l_osn_image: "{{ (system_images_registry == 'docker') | ternary(osn_image, (osn_
 system_osn_image: "{{ (system_images_registry == 'docker') | ternary('docker:' + l_osn_image, l_osn_image) }}"
 
 openshift_oreg_url_default_dict:
-  origin: "openshift/origin-${component}:${version}"
-  openshift-enterprise: "openshift3/ose-${component}:${version}"
+  origin: "docker.io/openshift/origin-${component}:${version}"
+  openshift-enterprise: "registry.access.redhat.com/openshift3/ose-${component}:${version}"
 openshift_oreg_url_default: "{{ openshift_oreg_url_default_dict[openshift_deployment_type] }}"
 oreg_url_node: "{{ oreg_url | default(openshift_oreg_url_default) | regex_replace('${version}' | regex_escape, openshift_image_tag | default('${version}')) }}"
 

roles/openshift_web_console/files/console-template.yaml

@@ -12,7 +12,7 @@ metadata:
     openshift.io/provider-display-name: Red Hat, Inc.
 parameters:
 - name: IMAGE
-  value: openshift/origin-web-console:latest
+  value: docker.io/openshift/origin-web-console:latest
 - name: NAMESPACE
   # This namespace cannot be changed. Only `openshift-web-console` is supported.
   value: openshift-web-console

roles/template_service_broker/files/apiserver-template.yaml

@@ -4,7 +4,7 @@ metadata:
   name: template-service-broker-apiserver
 parameters:
 - name: IMAGE
-  value: openshift/origin-template-service-broker:latest
+  value: docker.io/openshift/origin-template-service-broker:latest
 - name: NAMESPACE
   value: openshift-template-service-broker
 - name: LOGLEVEL

test/ci/inventory/group_vars/all.yml

@@ -11,7 +11,7 @@ openshift_node_port_range: '30000-32000'
 # to test specific versions of openshift.
 openshift_pkg_version: "{{ lookup('env', 'ORIGIN_TAG') }}"
 openshift_release: "{{ lookup('env', 'ORIGIN_RELEASE') }}"
-oreg_url: "openshift/origin-${component}:{{ lookup('env', 'ORIGIN_COMMIT') }}"
+oreg_url: "docker.io/openshift/origin-${component}:{{ lookup('env', 'ORIGIN_COMMIT') }}"
 
 osm_default_node_selector: "node-role.kubernetes.io/infra=true"
 osm_controller_args:

test/ci/inventory/group_vars/containerized_hosts.yml

@@ -1,4 +1,4 @@
 ---
 openshift_image_tag: "{{ lookup('env', 'OPENSHIFT_IMAGE_TAG') }}"
-oreg_url: "openshift/origin-${component}:{{ openshift_image_tag }}"
+oreg_url: "docker.io/openshift/origin-${component}:{{ openshift_image_tag }}"
 containerized: True