# Noobaa MCG vs Ceph RGW for OpenShift Image Registry

Considerations:
1. Noobaa's MCG (Multi Cloud Gateway) -vs- Ceph's RGW (RADOS Gateway)
2. Service (Internal) -vs- Route (External)
* https://rook-ceph-rgw-ocs-storagecluster-cephobjectstore.openshift-storage.svc
* http://ocs-storagecluster-cephobjectstore-openshift-storage.apps.example.com

I'm going to document RGW via Service because it is a more direct network path and simpler architecture than Noobaa via Route. Noobaa may be valuable if you intend to mirro, replicate, encrypt the object bucket in the future.

Documentation available at https://docs.openshift.com/container-platform/4.15/registry/configuring_registry_storage/configuring-registry-storage-rhodf.html#registry-configuring-registry-storage-rhodf-cephrgw_configuring-registry-storage-rhodf

:::warning
It is NOT recommended to use CephFS
:::

## Ceph RGW via Service

Please note, the name of the `secret` that holds the bucket access/secret keys is hard coded as: `image-registry-private-configuration-user`
https://github.com/openshift/cluster-image-registry-operator?tab=readme-ov-file#image-registry-private-configuration-user-secret

cat <<EOF | oc apply -f -

---
apiVersion: objectbucket.io/v1alpha1
kind: ObjectBucketClaim
metadata:
  name: imageregistry
  namespace: openshift-image-registry
spec:
  generateBucketName: imageregistry
  storageClassName: ocs-storagecluster-ceph-rgw

EOF


CLAIM_NAME=$(oc get objectbucketclaim imageregistry -n openshift-image-registry -o jsonpath='{.spec.objectBucketName}')
BUCKET_NAME=$(oc get objectbucket $CLAIM_NAME -n openshift-image-registry -o=jsonpath='{.spec.endpoint.bucketName}')
ACCESS_KEY=$(oc extract secret/imageregistry -n openshift-image-registry --keys=AWS_ACCESS_KEY_ID --to=-)
SECRET_KEY=$(oc extract secret/imageregistry -n openshift-image-registry --keys=AWS_SECRET_ACCESS_KEY --to=-)
ENDPOINT=$(oc get objectbucket $CLAIM_NAME -n openshift-image-registry -o=jsonpath='{.spec.endpoint.bucketHost}')

echo "CLAIM_NAME: ${CLAIM_NAME}
BUCKET_NAME: ${BUCKET_NAME}
ACCESS_KEY:  ${ACCESS_KEY}
SECRET_KEY:  ${SECRET_KEY}
ENDPOINT:    ${ENDPOINT}"

# The secret name must be "image-registry-private-configuration-user"
oc create secret generic image-registry-private-configuration-user \
  --namespace openshift-image-registry \
  --from-literal=REGISTRY_STORAGE_S3_ACCESSKEY=${ACCESS_KEY} \
  --from-literal=REGISTRY_STORAGE_S3_SECRETKEY=${SECRET_KEY}

oc extract configmap/openshift-service-ca.crt --keys=service-ca.crt -n openshift-ingress --confirm

oc create configmap/imageregistry-trusted-ca --from-file=ca-bundle.crt=./service-ca.crt  -n openshift-config

oc patch config.image/cluster -p '{"spec":{"managementState":"Managed","replicas":2,"storage":{"managementState":"Unmanaged","s3":{"bucket":'\"${BUCKET_NAME}\"',"region":"us-east-1","regionEndpoint":'\"https://${ENDPOINT}\"',"virtualHostedStyle":false,"encrypt":false,"trustedCA":{"name":"imageregistry-trusted-ca"}}}}}' --type=merge

## Noobaa via default Route / Ingress

# route, trust default ingress CA
oc extract secret/router-certs-default --keys=tls.crt -n openshift-ingress --confirm

oc create configmap imageregistry-trusted-ca --from-file=ca-bundle.crt=./tls.crt  -n openshift-config

oc patch config.image/cluster -p '{"spec":{"managementState":"Managed","replicas":2,"storage":{"managementState":"Unmanaged","s3":{"bucket":'\"${BUCKET_NAME}\"',"region":"us-east-1","regionEndpoint":'\"https://${ENDPOINT}\"',"virtualHostedStyle":false,"encrypt":false,"trustedCA":{"name":"imageregistry-trusted-ca"}}}}}' --type=merge

## Noobaa via custom Route / Ingress

For situations where a proper certificate (not self-signed) was installed

# route, trust external CA