Chapter 5. Embedding in a RHEL for Edge image for offline use
Embedding MicroShift containers in an rpm-ostree
commit means that you can run a cluster in air-gapped, disconnected, or offline environments. You can embed MicroShift containers in a Red Hat Enterprise Linux for Edge (RHEL for Edge) image so that container engines do not need to pull images over a network from a container registry. Workloads can start up immediately without network connectivity.
5.1. System requirements for installing MicroShift
The following conditions must be met prior to installing MicroShift:
- A compatible version of Red Hat Enterprise Linux (RHEL). For more information, see the "Compatibility table" section.
- AArch64 or x86_64 system architecture.
- 2 CPU cores.
- 2 GB RAM. Installing from the network (UEFI HTTPs or PXE boot) requires 3 GB RAM for RHEL.
- 10 GB of storage.
- You have an active MicroShift subscription on your Red Hat account. If you do not have a subscription, contact your sales representative for more information.
- If your workload requires Persistent Volumes (PVs), you have a Logical Volume Manager (LVM) Volume Group (VG) with sufficient free capacity for the workloads.
These requirements are the minimum system requirements for MicroShift and Red Hat Enterprise Linux (RHEL). Add the system requirements for the workload you plan to run.
For example, if an IoT gateway solution requires 4 GB of RAM, your system needs to have at least 2 GB for Red Hat Enterprise Linux (RHEL) and MicroShift, plus 4 GB for the workloads. 6 GB of RAM is required in total.
It is recommended to allow for extra capacity for future needs if you are deploying physical devices in remote locations. If you are uncertain of the RAM required and if the budget permits, use the maximum RAM capacity that the device can support.
Ensure you configure secure access to the system to be able to manage it accordingly. For more information, see Using secure communications between two systems with OpenSSH.
5.2. Compatibility table
Plan to pair a supported version of RHEL for Edge with the MicroShift version you are using as described in the following compatibility table:
Red Hat Device Edge release compatibility matrix
Red Hat Enterprise Linux (RHEL) and MicroShift work together as a single solution for device-edge computing. You can update each component separately, but the product versions must be compatible. For example, an update of MicroShift from 4.14 to 4.16 requires a {op-system} update. Supported configurations of Red Hat Device Edge use verified releases for each together as listed in the following table:
RHEL for Edge Version(s) | MicroShift Version | MicroShift Release Status | Supported MicroShift Version→MicroShift Version Updates |
9.4 | 4.16 | Generally Available | 4.16.0→4.16.z, 4.14→4.16 and 4.15→4.16 |
9.2, 9.3 | 4.15 | Generally Available | 4.15.0→4.15.z, 4.14→4.15 and 4.15→4.16 |
9.2, 9.3 | 4.14 | Generally Available | 4.14.0→4.14.z, 4.14→4.15 and 4.14→4.16 |
9.2 | 4.13 | Technology Preview | None |
8.7 | 4.12 | Developer Preview | None |
5.3. Embedding MicroShift containers for offline deployments
You can use Image Builder to create rpm-ostree
system images with embedded MicroShift container images. To embed container images, you must add the image references to your Image Builder blueprint.
Prerequisites
- You have root-user access to your build host.
- Your build host meets the Image Builder system requirements.
-
You have installed and set up Image Builder and the
composer-cli
tool. - You have created a RHEL for Edge image blueprint.
- You have installed jq.
Procedure
-
Get the exact list of container image references used by the MicroShift version you are deploying. You can either install the
microshift-release-info
RPM package by following step 2 or download and unpack the RPM by following step 3. To install the
microshift-release-info
RPM package:Install the
microshift-release-info
RPM package by running the following command:$ sudo dnf install -y microshift-release-info-<release_version>
Replace
<release_version>
with the numerical value of the release you are deploying, using the entire version number, such as4.16.0
.List the contents of the
/usr/share/microshift/release
directory to verify the presence of the release information files by running the following command:$ ls /usr/share/microshift/release
Example output
release-x86_64.json release-aarch64.json
If you installed the
microshift-release-info
RPM, you can proceed to step 4.
If you did not complete step 2, download and unpack the
microshift-release-info
RPM without installing it:Download the RPM package by running the following command:
$ sudo dnf download microshift-release-info-<release_version>
Replace
<release_version>
with the numerical value of the release you are deploying, using the entire version number, such as4.16.0
.Example rpm
microshift-release-info-4.16.0.*.el9.noarch.rpm 1
- 1
- The
*
represents the date and commit ID. Your output should contain both, for example-202311101230.p0.g7dc6a00.assembly.4.16.0
.
Unpack the RPM package without installing it by running the following command:
$ rpm2cpio <my_microshift_release_info> | cpio -idmv 1 ./usr/share/microshift/release/release-aarch64.json ./usr/share/microshift/release/release-x86_64.json
- 1
- Replace
<my_microshift_release_info>
with the name of the RPM package from the previous step.
Define the location of your JSON file, which contains the container reference information, by running the following command:
$ RELEASE_FILE=</path/to/your/release-$(uname -m).json>
Replace
</path/to/your/release-$(uname -m).json>
with the full path to your JSON file. Be sure to use the file needed for your architecture.Define the location of your TOML file, which contains instructions for building the image, by running the following command:
$ BLUEPRINT_FILE=</path/to/your/blueprint.toml>
Replace
</path/to/your/blueprint.toml>
with the full path to your JSON file.Generate and then embed the container image references in your blueprint TOML file by running the following command:
$ jq -r '.images | .[] | ("[[containers]]\nsource = \"" + . + "\"\n")' "${RELEASE_FILE}" >> "${BLUEPRINT_FILE}"
Example resulting
<my_blueprint.toml>
fragment showing container references[[containers]] source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:82cfef91557f9a70cff5a90accba45841a37524e9b93f98a97b20f6b2b69e5db" [[containers]] source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:82cfef91557f9a70cff5a90accba45841a37524e9b93f98a97b20f6b2b69e5db"
You can manually embed any container image by adding it to the Image Builder blueprint using the following example:
Example section for manually embedding container image to Image Builder
[[containers]] source = "<my_image_pullspec_with_tag_or_digest>"
Replace
<my_image_pullspec_with_tag_or_digest>
with the exact reference to a container image used by the MicroShift version you are deploying.
5.4. Updating osbuilder worker configuration to prepare for image building
After you have updated the blueprint, you must update the osbuilder worker configuration to prepare for building the image with embedded MicroShift containers.
Prerequisites
- You have root-user access to your build host.
- Your build host meets the Image Builder system requirements.
-
You have installed and set up Image Builder and the
composer-cli
tool.
You can create an /etc/osbuild-worker/osbuild-worker.toml
directory and configuration file if they do not exist.
Procedure
Add a pull secret for authenticating to the registry by setting the
auth_file_path
in the[containers]
section of the/etc/osbuild-worker/osbuild-worker.toml
osbuilder worker configuration file:[containers] auth_file_path = "/etc/osbuild-worker/pull-secret.json"
-
Restart the
osbuild-worker
to apply configuration changes by restarting the host. Restarting the host ensures that allosbuild-worker
services currently running are restarted.
5.5. Build and use the rpm-ostree image for offline deployments
You can use Image Builder to create rpm-ostree
system images with embedded MicroShift container images. To embed container images, you must add the image references to your Image Builder blueprint. You can create the commit and ISO as needed for your use case.
Add the prerequisites listed here to the ones that are included in the procedures that follow.
5.5.1. Additional prerequisites for offline deployments
- You have created and updated a RHEL for Edge image blueprint for offline use. The following procedures use the example of a blueprint created with container images. You must use the updated blueprint you created in the "Embedding MicroShift containers for offline deployments" procedure.
-
You have updated the
/etc/osbuild-worker/osbuild-worker.toml
configuration file for offline use.
Replace minimal-microshift.toml
in the following procedures with the name of the TOML you updated for offline use, <my_blueprint_name>.
5.5.2. Adding the MicroShift service to a blueprint
Adding the MicroShift RPM package to an Image Builder blueprint enables the build of a RHEL for Edge image with MicroShift embedded.
- Start with step 1 to create your own minimal blueprint file which results in a faster MicroShift installation.
Start with step 2 to use the generated blueprint for installation which includes all the RPM packages and container images. This is a longer installation process, but a faster start up because container references are accessed locally.
Important- Replace <microshift_blueprint.toml> in the following procedures with the name of the TOML file you are using.
- Replace <microshift_blueprint> in the following procedures with the name you want to use for your blueprint.
Procedure
Use the following example to create your own blueprint file:
Custom Image Builder blueprint example
cat > <microshift_blueprint.toml> <<EOF 1 name = "<microshift_blueprint>" 2 description = "" version = "0.0.1" modules = [] groups = [] [[packages]] name = "microshift" version = "*" [customizations.services] enabled = ["microshift"] EOF
NoteThe wildcard
*
in the commands uses the latest MicroShift RPMs. If you need a specific version, substitute the wildcard for the version you want. For example, insert4.16.0
to download the MicroShift 4.16.0 RPMs.Optional. Use the blueprint installed in the
/usr/share/microshift/blueprint
directory that is specific to your platform architecture. See the following example snippet for an explanation of the blueprint sections:Generated Image Builder blueprint example snippet
name = "microshift_blueprint" description = "MicroShift 4.16.1 on x86_64 platform" version = "0.0.1" modules = [] groups = [] [[packages]] 1 name = "microshift" version = "4.16.1" ... ... [customizations.services] 2 enabled = ["microshift"] [customizations.firewall] ports = ["22:tcp", "80:tcp", "443:tcp", "5353:udp", "6443:tcp", "30000-32767:tcp", "30000-32767:udp"] ... ... [[containers]] 3 source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f41e79c17e8b41f1b0a5a32c3e2dd7cd15b8274554d3f1ba12b2598a347475f4" [[containers]] source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:dbc65f1fba7d92b36cf7514cd130fe83a9bd211005ddb23a8dc479e0eea645fd" ... … EOF
- 1
- References for all non-optional MicroShift RPM packages using the same version compatible with the
microshift-release-info
RPM. - 2
- References for automatically enabling MicroShift on system startup and applying default networking settings.
- 3
- References for all non-optional MicroShift container images necessary for an offline deployment.
Add the blueprint to the Image Builder by running the following command:
$ sudo composer-cli blueprints push <microshift_blueprint.toml> 1
- 1
- Replace <microshift_blueprint.toml> with the name of your TOML file.
Verification
Verify the Image Builder configuration listing only MicroShift packages by running the following command:
$ sudo composer-cli blueprints depsolve <microshift_blueprint> | grep microshift 1
- 1
- Replace <microshift_blueprint> with the name of your blueprint.
Example output
blueprint: microshift_blueprint v0.0.1 microshift-greenboot-4.16.1-202305250827.p0.g4105d3b.assembly.4.16.1.el9.noarch microshift-networking-4.16.1-202305250827.p0.g4105d3b.assembly.4.16.1.el9.x86_64 microshift-release-info-4.16.1-202305250827.p0.g4105d3b.assembly.4.16.1.el9.noarch microshift-4.16.1-202305250827.p0.g4105d3b.assembly.4.16.1.el9.x86_64 microshift-selinux-4.16.1-202305250827.p0.g4105d3b.assembly.4.16.1.el9.noarch
Optional: Verify the Image Builder configuration listing all components to be installed by running the following command:
$ sudo composer-cli blueprints depsolve <microshift_blueprint> 1
- 1
- Replace <microshift_blueprint> with the name of your blueprint.
5.5.3. Creating the RHEL for Edge image
Use the following procedure to create the ISO. The RHEL for Edge Installer image pulls the commit from the running container and creates an installable boot ISO with a Kickstart file configured to use the embedded rpm-ostree
commit.
Prerequisites
- Your build host meets the Image Builder system requirements.
-
You have installed and set up Image Builder and the
composer-cli
tool. - You have root-user access to your build host.
-
You have installed the
podman
tool.
Procedure
Start an
ostree
container image build by running the following command:$ BUILDID=$(sudo composer-cli compose start-ostree --ref "rhel/{op-system-version-major}/$(uname -m)/edge" <microshift_blueprint> edge-container | awk '/^Compose/ {print $2}') 1
- 1
- Replace <microshift_blueprint> with the name of your blueprint.
This command also returns the identification (ID) of the build for monitoring.
You can check the status of the build periodically by running the following command:
$ sudo composer-cli compose status
Example output of a running build
ID Status Time Blueprint Version Type Size cc3377ec-4643-4483-b0e7-6b0ad0ae6332 RUNNING Wed Jun 7 12:26:23 2023 microshift_blueprint 0.0.1 edge-container
Example output of a completed build
ID Status Time Blueprint Version Type Size cc3377ec-4643-4483-b0e7-6b0ad0ae6332 FINISHED Wed Jun 7 12:32:37 2023 microshift_blueprint 0.0.1 edge-container
NoteYou can use the
watch
command to monitor your build if you are familiar with how to start and stop it.Download the container image using the ID and get the image ready for use by running the following command:
$ sudo composer-cli compose image ${BUILDID}
Change the ownership of the downloaded container image to the current user by running the following command:
$ sudo chown $(whoami). ${BUILDID}-container.tar
Add read permissions for the current user to the image by running the following command:
$ sudo chmod a+r ${BUILDID}-container.tar
Bootstrap a server on port 8085 for the
ostree
container image to be consumed by the ISO build by completing the following steps:Get the
IMAGEID
variable result by running the following command:$ IMAGEID=$(cat < "./${BUILDID}-container.tar" | sudo podman load | grep -o -P '(?<=sha256[@:])[a-z0-9]*')
Use the
IMAGEID
variable result to execute the podman command step by running the following command:$ sudo podman run -d --name=minimal-microshift-server -p 8085:8080 ${IMAGEID}
This command also returns the ID of the container saved in the
IMAGEID
variable for monitoring.
Generate the installer blueprint file by running the following command:
cat > microshift-installer.toml <<EOF name = "microshift-installer" description = "" version = "0.0.0" modules = [] groups = [] packages = [] EOF