Chapter 8. Creating a Podman site in a restricted environment
In a production environment which has no or limited internet access, you might need to mirror the required images to create a site.
This procedure outlines how to use Podman and tar files for managing container images. If a registry is available in the restricted environment, the same process can be followed. Ensure that the environment variables are set to reference the images in the registry after they have been populated.
If you want to use a Linux machine with a proxy to pull images, you can configure Podman to use a proxy:
$ systemctl --user edit podman
Add the following to the service definition:
[Service] Environment="HTTP_PROXY=<proxy-domain>:<proxy-port>" Environment="HTTPS_PROXY=<proxy-domain>:<proxy-port>"
To ensure that podman uses the new configuration:
$ systemctl --user daemon-reload $ systemctl --user restart podman
Prerequisites
- A Linux machine with internet access to download the images.
- A Linux machine in a restricted environment where you want to create the site.
This can be one machine, where the machine is moved to the restricted environment.
Procedure
Log in to
registry.redhat.ioon the machine with internet access:$ podman login -u USERNAME -p PASSWORD registry.redhat.io
Download the images required for a Podman site by creating a site:
$ skupper init
If you require a console, use the following command to ensure the extra images are downloaded
$ skupper init --enable-console --enable-flow-collector
After creating the site, the following images are listed using
podman image ls -a:- registry.redhat.io/service-interconnect/skupper-router-rhel9
- registry.redhat.io/service-interconnect/skupper-controller-podman-rhel9
- registry.redhat.io/service-interconnect/skupper-flow-collector-rhel9 (console only)
- registry.redhat.io/openshift4/ose-prometheus (console only)
The tags are determined by the version of the
skupperCLI.Create tar files for each image, for example:
$ podman save -o skupper-controller.tar registry.redhat.io/service-interconnect/skupper-controller-podman-rhel9:<tag>
where
<tag>is the tag shown from using thepodman image ls -acommand.- Copy the tar files to the machine in the restricted environment.
On the machine in the restricted environment, load the image from the tar files, for example:
podman load -i skupper-controller.tar
Change the image tags to remove reference to
registry.redhat.io:podman tag registry.redhat.io/service-interconnect/skupper-router-rhel9:<tag> service-interconnect/skupper-router-rhel9:<tag>
This step is required to avoid the machine attempting to pull images from
registry.redhat.io.Configure the
skupperCLI to use the mirrored images by setting the following environment variables:$ export SKUPPER_CONTROLLER_PODMAN_IMAGE=service-interconnect/skupper-controller-podman-rhel9:<tag> $ export QDROUTERD_IMAGE=service-interconnect/skupper-router-rhel9:<tag>
If you require a console, you also require the following environment variables:
$ export SKUPPER_FLOW_COLLECTOR_IMAGE=service-interconnect/skupper-flow-collector-rhel9:<tag> $ export PROMETHEUS_SERVER_IMAGE=openshift4/ose-prometheus:<tag>
Create a site, for example:
$ skupper init
