Chapter 17. Airgapped environment


An air-gapped environment ensures security by physically isolating it from other networks and systems. You can install director Operator in an air-gapped environment to ensure security and provides certain regulatory requirements.

17.1. Prerequisites

  • An operational Red Hat Openshift Container Platform (RHOCP) cluster, version 4.12, 4.14, or 4.16. The cluster must contain a provisioning network, and the following Operators:

  • You have a disconnected registry adhering to docker v2 schema. For more information, see Mirroring images for a disconnected installation.
  • You have access to a Satellite server or any other repository used to register the overcloud nodes and install packages.
  • You have access to a local git repository to store deployment artifacts.
  • The following command line tools are installed on your workstation:

    • podman
    • skopeo
    • oc
    • jq

17.2. Configuring an airgapped environment

To configure an airgapped environment, you must have access to both registry.redhat.io and the registry for airgapped environment. For more information on how to access both registries, see Mirroring catalog contents to airgapped registries.

Procedure

  1. Create the openstack namespace:

    $ oc new-project openstack
  2. Create the index image and push it to your registry:

    $ podman login registry.redhat.io
    $ podman login your.registry.local
    $ BUNDLE_IMG="registry.redhat.io/rhosp-rhel9/osp-director-operator-bundle@sha256:<bundle digest>"
    $ INDEX_IMG="quay.io/<account>/osp-director-operator-index:x.y.z-a"
    $ opm index add --bundles ${BUNDLE_IMG} --tag ${INDEX_IMG} -u podman --pull-tool podman
    Note

    You can get the latest bundle image from: Certified container images. Search for osp-director-operator-bundle.

  3. Retrieve the digest of the index image you created in the previous step:

    $ INDEX_DIGEST="$(skopeo inspect docker://quay.io/<account>/osp-director-operator-index:x.y.z-a | jq '.Digest' -r)"
  4. Mirror the relevant images based on the operator index image:

    $ oc adm catalog mirror quay.io/<account>/osp-director-operator-index@${INDEX_DIGEST} your.registry.local --insecure --index-filter-by-os='Linux/x86_64'
  5. After mirroring is complete, a manifests directory is generated in your current directory called manifests-osp-director-operator-index-<random_number>. Apply the created ImageContentSourcePolicy to your cluster:

    $ os apply -f manifests-osp-director-operator-index-<random_number>/imageContentSourcePolicy.yaml
    • Replace <random_number> with the randomly generated number.
  6. Create a file named osp-director-operator.yaml and include the following YAML content to configure the three resources required to install director Operator:

    apiVersion: operators.coreos.com/v1alpha1
    kind: CatalogSource
    metadata:
      name: osp-director-operator-index
      namespace: openstack
    spec:
      sourceType: grpc
      image: your.registry.local/osp-director-operator-index:1.3.x-y
    ---
    apiVersion: operators.coreos.com/v1
    kind: OperatorGroup
    metadata:
      name: "osp-director-operator-group"
      namespace: openstack
    spec:
      targetNamespaces:
      - openstack
    ---
    apiVersion: operators.coreos.com/v1alpha1
    kind: Subscription
    metadata:
      name: osp-director-operator-subscription
      namespace: openstack
    spec:
      config:
        env:
        - name: WATCH_NAMESPACE
          value: openstack,openshift-machine-api,openshift-sriov-network-operator
      source: osp-director-operator-index
      sourceNamespace: openstack
      name: osp-director-operator
  7. Create the new resources in the openstack namespace:

    $ oc apply -f osp-director-operator.yaml
  8. Copy the required overcloud images to the repository:

    $ for i in $(podman search --limit 1000 "registry.redhat.io/rhosp-rhel9/openstack" --format="{{ .Name }}" | awk '{print $1 ":" "17.1.0"}' | awk -F "/" '{print $2 "/" $3}'); do skopeo copy --all docker://registry.redhat.io/$i docker://your.registry.local/$i;done
    Note

    You can refer to Preparing a Satellite server for container images if Red Hat Satellite is used as the local registry.

  9. You can now proceed with Installing and preparing director Operator.

Verification

  1. Confirm that you have successfully installed director Operator:

    $ oc get operators
    NAME                                     AGE
    osp-director-operator.openstack          5m
Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

© 2024 Red Hat, Inc.