12.2. Mise en miroir du référentiel d'images d'OpenShift Container Platform

Procédure

1. Naviguez jusqu'à la page de téléchargements OpenShift Container Platform sur le portail client Red Hat.
2. Sélectionnez l'architecture dans la liste déroulante Product Variant.
3. Sélectionnez la version appropriée dans la liste déroulante Version.
4. Cliquez sur Download Now à côté de l'entrée OpenShift v4.12 Linux Client et enregistrez le fichier.

5. Décompressez l'archive :

   tar xvf <file>

6. Placez le fichier binaire oc dans un répertoire situé sur votre site PATH.

   Pour vérifier votre PATH, exécutez la commande suivante :

   $ echo $PATH

Procédure

1. Naviguez jusqu'à la page de téléchargements OpenShift Container Platform sur le portail client Red Hat.
2. Sélectionnez la version appropriée dans la liste déroulante Version.
3. Cliquez sur Download Now à côté de l'entrée OpenShift v4.12 Windows Client et enregistrez le fichier.
4. Décompressez l'archive à l'aide d'un programme ZIP.

5. Déplacez le fichier binaire oc dans un répertoire situé sur votre site PATH.

   Pour vérifier votre PATH, ouvrez l'invite de commande et exécutez la commande suivante :

   C:\N> path

Procédure

1. Naviguez jusqu'à la page de téléchargements OpenShift Container Platform sur le portail client Red Hat.
2. Sélectionnez la version appropriée dans la liste déroulante Version.

3. Cliquez sur Download Now à côté de l'entrée OpenShift v4.12 macOS Client et enregistrez le fichier.

   Note

   Pour macOS arm64, choisissez l'entrée OpenShift v4.12 macOS arm64 Client.

4. Décompressez l'archive.

5. Déplacez le binaire oc dans un répertoire de votre PATH.

   Pour vérifier votre PATH, ouvrez un terminal et exécutez la commande suivante :

   $ echo $PATH

1. Téléchargez votre registry.redhat.io pull secret depuis le gestionnaire de cluster Red Hat OpenShift.

2. Faites une copie de votre secret d'extraction au format JSON :

   $ cat ./pull-secret | jq . > <path>/<pull_secret_file_in_json> 1

   1

   Indiquez le chemin d'accès au dossier dans lequel stocker le secret d'extraction et un nom pour le fichier JSON que vous créez.

   Le contenu du fichier ressemble à l'exemple suivant :

   {
     "auths": {
       "cloud.openshift.com": {
         "auth": "b3BlbnNo...",
         "email": "you@example.com"
       },
       "quay.io": {
         "auth": "b3BlbnNo...",
         "email": "you@example.com"
       },
       "registry.connect.redhat.com": {
         "auth": "NTE3Njg5Nj...",
         "email": "you@example.com"
       },
       "registry.redhat.io": {
         "auth": "NTE3Njg5Nj...",
         "email": "you@example.com"
       }
     }
   }

3. Facultatif : si vous utilisez le plugin oc-mirror, enregistrez le fichier sous ~/.docker/config.json ou $XDG_RUNTIME_DIR/containers/auth.json.

4. Générer le nom d'utilisateur et le mot de passe ou le jeton encodés en base64 pour votre registre miroir :

   $ echo -n '<user_name>:<password>' | base64 -w0 1
   BGVtbYk3ZHAtqXs=

   1

   Pour <user_name> et <password>, indiquez le nom d'utilisateur et le mot de passe que vous avez configurés pour votre registre.

5. Modifiez le fichier JSON et ajoutez-y une section décrivant votre registre :

     "auths": {
       "<mirror_registry>": { 1
         "auth": "<credentials>", 2
         "email": "you@example.com"
       }
     },

   1

   Pour <mirror_registry>, indiquez le nom de domaine du registre, et éventuellement le port, que votre registre miroir utilise pour servir le contenu. Par exemple, registry.example.com ou registry.example.com:8443

   2

   Pour <credentials>, indiquez le nom d'utilisateur et le mot de passe encodés en base64 pour le registre miroir.

   Le fichier ressemble à l'exemple suivant :

   {
     "auths": {
       "registry.example.com": {
         "auth": "BGVtbYk3ZHAtqXs=",
         "email": "you@example.com"
       },
       "cloud.openshift.com": {
         "auth": "b3BlbnNo...",
         "email": "you@example.com"
       },
       "quay.io": {
         "auth": "b3BlbnNo...",
         "email": "you@example.com"
       },
       "registry.connect.redhat.com": {
         "auth": "NTE3Njg5Nj...",
         "email": "you@example.com"
       },
       "registry.redhat.io": {
         "auth": "NTE3Njg5Nj...",
         "email": "you@example.com"
       }
     }
   }

Procédure

1. Download the oc-mirror CLI plugin.

   1. Navigate to the Downloads page of the OpenShift Cluster Manager Hybrid Cloud Console.
   2. Under the OpenShift disconnected installation tools section, click Download for OpenShift Client (oc) mirror plugin and save the file.

2. Extract the archive:

   $ tar xvzf oc-mirror.tar.gz

3. If necessary, update the plugin file to be executable:

   $ chmod +x oc-mirror

   Note

   Do not rename the oc-mirror file.

4. Install the oc-mirror CLI plugin by placing the file in your PATH, for example, /usr/local/bin:

   $ sudo mv oc-mirror /usr/local/bin/.

Procédure

1. Use the oc mirror init command to create a template for the image set configuration and save it to a file called imageset-config.yaml:

   oc mirror init --registry example.com/mirror/oc-mirror-metadata > imageset-config.yaml 1

   1

   Replace example.com/mirror/oc-mirror-metadata with the location of your registry for the storage backend.

2. Edit the file and adjust the settings as necessary:

   kind: ImageSetConfiguration
   apiVersion: mirror.openshift.io/v1alpha2
   archiveSize: 4                                                      1
   storageConfig:                                                      2
     registry:
       imageURL: example.com/mirror/oc-mirror-metadata                 3
       skipTLS: false
   mirror:
     platform:
       channels:
       - name: stable-4.12                                             4
         type: ocp
       graph: true                                                     5
     operators:
     - catalog: registry.redhat.io/redhat/redhat-operator-index:v4.12  6
       packages:
       - name: serverless-operator                                     7
         channels:
         - name: stable                                                8
     additionalImages:
     - name: registry.redhat.io/ubi8/ubi:latest                        9
     helm: {}

   1

   Add archiveSize to set the maximum size, in GiB, of each file within the image set.

   2

   Set the back-end location to save the image set metadata to. This location can be a registry or local directory. It is required to specify storageConfig values, unless you are using the Technology Preview OCI feature.

   3

   Set the registry URL for the storage backend.

   4

   Set the channel to retrieve the OpenShift Container Platform images from.

   5

   Add graph: true to build and push the graph-data image to the mirror registry. The graph-data image is required to create OpenShift Update Service (OSUS) applications. The graph: true field also generates the UpdateService CR manifest. The oc command-line interface (CLI) can use the UpdateService CR manifest to create OSUS applications. For more information, see About the OpenShift Update Service.

   6

   Set the Operator catalog to retrieve the OpenShift Container Platform images from.

   7

   Specify only certain Operator packages to include in the image set. Remove this field to retrieve all packages in the catalog.

   8

   Specify only certain channels of the Operator packages to include in the image set. You must always include the default channel for the Operator package even if you do not use the bundles in that channel. You can find the default channel by running the following command: oc mirror list operators --catalog=<catalog_name> --package=<package_name>.

   9

   Specify any additional images to include in image set.

   See Image set configuration parameters for the full list of parameters and Image set configuration examples for various mirroring use cases.

3. Save the updated file.

   This image set configuration file is required by the oc mirror command when mirroring content.

Procédure

1. Log in to the OpenShift CLI as a user with the cluster-admin role.

2. Apply the YAML files from the results directory to the cluster by running the following command:

   $ oc apply -f ./oc-mirror-workspace/results-1639608409/

3. Apply the release image signatures to the cluster by running the following command:

   $ oc apply -f ./oc-mirror-workspace/results-1639608409/release-signatures/

Vérification

1. Verify that the ImageContentSourcePolicy resources were successfully installed by running the following command:

   $ oc get imagecontentsourcepolicy --all-namespaces

2. Verify that the CatalogSource resources were successfully installed by running the following command:

   $ oc get catalogsource --all-namespaces

Procédure

1. Run the oc mirror command with the --dry-run flag to perform a dry run:

   $ oc mirror --config=./imageset-config.yaml \1
     docker://registry.example:5000            \2
     --dry-run                                  3

   1

   Pass in the image set configuration file that was created. This procedure assumes that it is named imageset-config.yaml.

   2

   Specify the mirror registry. Nothing is mirrored to this registry as long as you use the --dry-run flag.

   3

   Use the --dry-run flag to generate the dry run artifacts and not an actual image set file.

   Exemple de sortie

   Checking push permissions for registry.example:5000
   Creating directory: oc-mirror-workspace/src/publish
   Creating directory: oc-mirror-workspace/src/v2
   Creating directory: oc-mirror-workspace/src/charts
   Creating directory: oc-mirror-workspace/src/release-signatures
   No metadata detected, creating new workspace
   wrote mirroring manifests to oc-mirror-workspace/operators.1658342351/manifests-redhat-operator-index
   
   ...
   
   info: Planning completed in 31.48s
   info: Dry run complete
   Writing image mapping to oc-mirror-workspace/mapping.txt

2. Navigate into the workspace directory that was generated:

   $ cd oc-mirror-workspace/

3. Review the mapping.txt file that was generated.

   This file contains a list of all images that would be mirrored.

4. Review the pruning-plan.json file that was generated.

   This file contains a list of all images that would be pruned from the mirror registry when the image set is published.

   Note

   The pruning-plan.json file is only generated if your oc-mirror command points to your mirror registry and there are images to be pruned.

Procédure

1. Optional: Retrieve the catalogs and images that you require and save them to disk. If you already have the catalog image in OCI format on disk, you can skip this step.

   1. Create the image set configuration file:

      Example image set configuration file for copying to disk

      kind: ImageSetConfiguration
      apiVersion: mirror.openshift.io/v1alpha2
      mirror:
       operators:
       - catalog: registry.redhat.io/redhat/redhat-operator-index:v4.12
         packages:
         - name: aws-load-balancer-operator

      Note

      When using the OCI feature, only the mirror.operators.catalog setting is available for use.

      The storageConfig setting is ignored in favor of the location passed in to the oc mirror command.

   2. Run the oc mirror command to mirror the images from the specified image set configuration to disk:

      $ oc mirror --config=./imageset-config.yaml \ 1
        --use-oci-feature \                         2
        --oci-feature-action=copy \                 3
        oci://my-oci-catalog                        4

      1

      Pass in the image set configuration file. This procedure assumes that it is named imageset-config.yaml.

      2

      Use the --use-oci-feature flag to enable the OCI feature.

      3

      To copy the catalog to disk, set the --oci-feature-action flag to copy.

      4

      Specify a directory on disk where you want to output the catalog. This procedure assumes that it is named my-oci-catalog. The path must start with oci://. If the specified directory is not a full path, the directory is created in the current working directory where the oc mirror command is run.

      Note

      You can optionally use the --oci-registries-config flag to specify the path to a TOML-formatted registries.conf file. You can use this to mirror from a different registry, such as a pre-production location for testing, without having to change the image set configuration file.

      Example registries.conf file

      [[registry]]
       location = "registry.redhat.io:5000"
       insecure = false
       blocked = false
       mirror-by-digest-only = true
       prefix = ""
       [[registry.mirror]]
          location = "preprod-registry.example.com"
          insecure = false

      Set the location field in the registry.mirror section to an alternative registry location that you want to pull images from. The location field in the registry section must be the same registry location as the one you specify in the image set configuration file.

   3. List your directory contents and verify that the following directories were created:

      $ ls -l

      Exemple de sortie

      my-oci-catalog      1
      oc-mirror-workspace 2
      olm_artifacts       3

      1

      Directory that contains the OCI catalog. This procedure assumes that it is named my-oci-catalog.

      2

      Directory that contains each image in the catalog in its original format.

      3

      Directory that contains the files that describe the Operator bundles that this catalog references.

2. Update the image set configuration file to specify the location of the catalog on disk to mirror to the target mirror registry:

   Example image set configuration file for mirroring to mirror registry

   kind: ImageSetConfiguration
   apiVersion: mirror.openshift.io/v1alpha2
   mirror:
    operators:
    - catalog: oci:///home/user/oc-mirror/my-oci-catalog/redhat-operator-index 1
      packages:
      - name: aws-load-balancer-operator

   1

   Specify the absolute path to the location of the OCI catalog on disk. This procedure assumes that you used my-oci-catalog as the directory and mirrored the redhat-operator-index catalog. The path must start with oci://.

3. Run the oc mirror command to process the image set file on disk and mirror the contents to a target mirror registry:

   $ oc mirror --config=./imageset-config.yaml \ 1
     --use-oci-feature \                         2
     --oci-feature-action=mirror \               3
     docker://registry.example:5000              4

   1

   Pass in the updated image set configuration file. This procedure assumes that it is named imageset-config.yaml.

   2

   Use the --use-oci-feature flag to enable the OCI feature.

   3

   To mirror the catalog to the target mirror registry, set the --oci-feature-action flag to mirror.

   4

   Specify the registry to mirror the image set file to. The registry must start with docker://. If you specify a top-level namespace for the mirror registry, you must also use this same namespace on subsequent executions.

   Note

   You can optionally use the --oci-insecure-signature-policy flag to not push signatures to the target mirror registry.