Chapter 17. Airgapped environment
An air-gapped environment ensures security by physically isolating it from other networks and systems. You can install director Operator in an air-gapped environment to ensure security and provides certain regulatory requirements.
17.1. Prerequisites
An operational Red Hat Openshift Container Platform (RHOCP) cluster, version 4.12, 4.14, or 4.16. The cluster must contain a
provisioning
network, and the following Operators:-
A
baremetal
cluster Operator. Thebaremetal
cluster Operator must be enabled. For more information onbaremetal
cluster Operators, see Bare-metal cluster Operators. - OpenShift Virtualization Operator. For more information on installing the OpenShift Virtualization Operator, see Installing OpenShift Virtualization using the web console.
- SR-IOV Network Operator.
-
A
- You have a disconnected registry adhering to docker v2 schema. For more information, see Mirroring images for a disconnected installation.
- You have access to a Satellite server or any other repository used to register the overcloud nodes and install packages.
- You have access to a local git repository to store deployment artifacts.
The following command line tools are installed on your workstation:
-
podman
-
skopeo
-
oc
-
jq
-
17.2. Configuring an airgapped environment
To configure an airgapped environment, you must have access to both registry.redhat.io
and the registry for airgapped environment. For more information on how to access both registries, see Mirroring catalog contents to airgapped registries.
Procedure
Create the
openstack
namespace:$ oc new-project openstack
Create the index image and push it to your registry:
$ podman login registry.redhat.io $ podman login your.registry.local $ BUNDLE_IMG="registry.redhat.io/rhosp-rhel9/osp-director-operator-bundle@sha256:<bundle digest>" $ INDEX_IMG="quay.io/<account>/osp-director-operator-index:x.y.z-a" $ opm index add --bundles ${BUNDLE_IMG} --tag ${INDEX_IMG} -u podman --pull-tool podman
NoteYou can get the latest bundle image from: Certified container images. Search for
osp-director-operator-bundle
.Retrieve the digest of the index image you created in the previous step:
$ INDEX_DIGEST="$(skopeo inspect docker://quay.io/<account>/osp-director-operator-index:x.y.z-a | jq '.Digest' -r)"
Mirror the relevant images based on the operator index image:
$ oc adm catalog mirror quay.io/<account>/osp-director-operator-index@${INDEX_DIGEST} your.registry.local --insecure --index-filter-by-os='Linux/x86_64'
After mirroring is complete, a
manifests
directory is generated in your current directory calledmanifests-osp-director-operator-index-<random_number>
. Apply the created ImageContentSourcePolicy to your cluster:$ os apply -f manifests-osp-director-operator-index-<random_number>/imageContentSourcePolicy.yaml
-
Replace
<random_number>
with the randomly generated number.
-
Replace
Create a file named
osp-director-operator.yaml
and include the following YAML content to configure the three resources required to install director Operator:apiVersion: operators.coreos.com/v1alpha1 kind: CatalogSource metadata: name: osp-director-operator-index namespace: openstack spec: sourceType: grpc image: your.registry.local/osp-director-operator-index:1.3.x-y --- apiVersion: operators.coreos.com/v1 kind: OperatorGroup metadata: name: "osp-director-operator-group" namespace: openstack spec: targetNamespaces: - openstack --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: name: osp-director-operator-subscription namespace: openstack spec: config: env: - name: WATCH_NAMESPACE value: openstack,openshift-machine-api,openshift-sriov-network-operator source: osp-director-operator-index sourceNamespace: openstack name: osp-director-operator
Create the new resources in the
openstack
namespace:$ oc apply -f osp-director-operator.yaml
Copy the required overcloud images to the repository:
$ for i in $(podman search --limit 1000 "registry.redhat.io/rhosp-rhel9/openstack" --format="{{ .Name }}" | awk '{print $1 ":" "17.1.0"}' | awk -F "/" '{print $2 "/" $3}'); do skopeo copy --all docker://registry.redhat.io/$i docker://your.registry.local/$i;done
NoteYou can refer to Preparing a Satellite server for container images if Red Hat Satellite is used as the local registry.
- You can now proceed with Installing and preparing director Operator.
Verification
Confirm that you have successfully installed director Operator:
$ oc get operators NAME AGE osp-director-operator.openstack 5m