8.4. Adding OLM-based Operators to a disconnected cluster

Procedure

1. Run the oc mirror command with the --dry-run flag to perform a dry run:

   $ oc mirror --config=./imageset-config.yaml \

   1

   
     docker://registry.example:5000            \

   2

   
     --dry-run                                  

   3

   1

   Pass in the image set configuration file that was created. This procedure assumes that it is named imageset-config.yaml.

   2

   Specify the mirror registry. Nothing is mirrored to this registry as long as you use the --dry-run flag.

   3

   Use the --dry-run flag to generate the dry run artifacts and not an actual image set file.

   Example output

   Checking push permissions for registry.example:5000
   Creating directory: oc-mirror-workspace/src/publish
   Creating directory: oc-mirror-workspace/src/v2
   Creating directory: oc-mirror-workspace/src/charts
   Creating directory: oc-mirror-workspace/src/release-signatures
   No metadata detected, creating new workspace
   wrote mirroring manifests to oc-mirror-workspace/operators.1658342351/manifests-redhat-operator-index
   
   ...
   
   info: Planning completed in 31.48s
   info: Dry run complete
   Writing image mapping to oc-mirror-workspace/mapping.txt

2. Navigate into the workspace directory that was generated:

   $ cd oc-mirror-workspace/

3. Review the mapping.txt file that was generated.

   This file contains a list of all images that would be mirrored.

4. Review the pruning-plan.json file that was generated.

   This file contains a list of all images that would be pruned from the mirror registry when the image set is published.

   注記

   The pruning-plan.json file is only generated if your oc-mirror command points to your mirror registry and there are images to be pruned.

Procedure

1. Parse the catalog index.json file to get the image references that you need to include in the Image Builder blueprint. You can use either the unfiltered catalog or you can filter out images that cannot be mirrored:

   1. Parse the unfiltered catalog index.json file to get the image references by running the following command:

      jq -r --slurp '.[] | select(.relatedImages != null) | "[[containers]]\nsource = \"" + .relatedImages[].image + "\"\n"'   ./oc-mirror-workspace/src/catalogs/registry.redhat.io/redhat/redhat-operator-index/v4.17/index/index.json

   2. If you want to filter out images that cannot be mirrored, filter and parse the catalog index.json file by running the following command:

      $ jq -r --slurp '.[] | select(.relatedImages != null) | .relatedImages[] | select(.name |  contains("ppc") or contains("s390x") | not) | "[[containers]]\\nsource = \\"" + .image + "\\"\\n"' ./oc-mirror-workspace/src/catalogs/registry.redhat.io/redhat/redhat-operator-index/v4.17/index/index.json

      注記

      This step uses the AMQ Broker Operator as an example. You can add other criteria to the jq command for further filtering as required by your use case.

      Example image-reference output

      [[containers]]
      source = "registry.redhat.io/amq7/amq-broker-init-rhel8@sha256:0b2126cfb6054fdf428c1f43b69e36e93a09a49ce15350e9273c98cc08c6598b"
      
      [[containers]]
      source = "registry.redhat.io/amq7/amq-broker-init-rhel8@sha256:0dde839c2dce7cb684094bf26523c8e16677de03149a0fff468b8c3f106e1f4f"
      ...
      ...
      
      [[containers]]
      source = "registry.redhat.io/amq7/amq-broker-rhel8@sha256:e8fa2a00e576ecb95561ffbdbf87b1c82d479c8791ab2c6ce741dd0d0b496d15"
      
      [[containers]]
      source = "registry.redhat.io/amq7/amq-broker-rhel8@sha256:ff6fefad518a6c997d4c5a6e475ba89640260167f0bc27715daf3cc30116fad1"
      …
      EOF

      重要

      For mirrored and disconnected use cases, ensure that all of the sources filtered from your catalog index.json file are digests. If any of the sources use tags instead of digests, the Operator installation fails. Tags require an internet connection.

2. View the imageset-config.yaml to get the catalog image reference for the CatalogSource custom resource (CR) by running the following command:

   $ cat imageset-config.yaml

   Example output

   kind: ImageSetConfiguration
   apiVersion: mirror.openshift.io/v1alpha2
   storageConfig:
     registry:
       imageURL: registry.example.com/microshift-mirror
   mirror:
     operators:
     - catalog: registry.redhat.io/redhat/redhat-operator-index:v4.17 

   1

   
       packages:
       - name: amq-broker-rhel8
         channels:
         - name: 7.11.x

   1

   Use the value in the mirror.catalog catalog image reference for the follwing jq command to get the image digest. In this example, <registry.redhat.io/redhat/redhat-operator-index:v4.17>.

3. Get the SHA of the catalog index image by running the following command:

   $ skopeo inspect docker://<registry.redhat.io/redhat/redhat-operator-index:v4.17> | jq `.Digest` 

   1

   1

   Use the value in the mirror.catalog catalog image reference for the jq command to get the image digest. In this example, <registry.redhat.io/redhat/redhat-operator-index:v4.17>.

   Example output

   "sha256:7a76c0880a839035eb6e896d54ebd63668bb37b82040692141ba39ab4c539bc6"

4. To get ready to add the image references to your Image Builder blueprint file, format the catalog image reference by using the following example:

   [[containers]]
   source = "registry.redhat.io/redhat/redhat-operator-index@sha256:7a76c0880a839035eb6e896d54ebd63668bb37b82040692141ba39ab4c539bc6"

5. Add the image references from all the previous steps to the Image Builder blueprint.

   Generated Image Builder blueprint example snippet

   name = "microshift_blueprint"
   description = "MicroShift 4.17.1 on x86_64 platform"
   version = "0.0.1"
   modules = []
   groups = []
   
   [[packages]] 

   1

   
   name = "microshift"
   version = "4.17.1"
   ...
   ...
   
   [customizations.services] 

   2

   
   enabled = ["microshift"]
   
   [customizations.firewall]
   ports = ["22:tcp", "80:tcp", "443:tcp", "5353:udp", "6443:tcp", "30000-32767:tcp", "30000-32767:udp"]
   ...
   ...
   
   [[containers]] 

   3

   
   source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f41e79c17e8b41f1b0a5a32c3e2dd7cd15b8274554d3f1ba12b2598a347475f4"
   
   [[containers]]
   source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:dbc65f1fba7d92b36cf7514cd130fe83a9bd211005ddb23a8dc479e0eea645fd"
   ...
   ...
   
   [[containers]] 

   4

   
   source = "registry.redhat.io/redhat/redhat-operator-index@sha256:7a76c0880a839035eb6e896d54ebd63668bb37b82040692141ba39ab4c539bc6"
   ...
   ...
   
   [[containers]]
   source = "registry.redhat.io/amq7/amq-broker-init-rhel8@sha256:0dde839c2dce7cb684094bf26523c8e16677de03149a0fff468b8c3f106e1f4f"
   ...
   ...
   
   [[containers]]
   source = "registry.redhat.io/amq7/amq-broker-rhel8@sha256:e8fa2a00e576ecb95561ffbdbf87b1c82d479c8791ab2c6ce741dd0d0b496d15"
   
   [[containers]]
   source = "registry.redhat.io/amq7/amq-broker-rhel8@sha256:ff6fefad518a6c997d4c5a6e475ba89640260167f0bc27715daf3cc30116fad1"
   …
   EOF

   1

   References for all non-optional MicroShift RPM packages using the same version compatible with the microshift-release-info RPM.

   2

   References for automatically enabling MicroShift on system startup and applying default networking settings.

   3

   References for all non-optional MicroShift container images necessary for a disconnected deployment.

   4

   References for the catalog index.

Procedure

1. Create a CatalogSource custom resource (CR), similar to the following example:

   Example my-catalog-source-cr.yaml file

   apiVersion: operators.coreos.com/v1alpha1
   kind: CatalogSource
   metadata:
     name: cs-redhat-operator-index
     namespace: openshift-marketplace 

   1

   
   spec:
     image: registry.example.com/redhat/redhat-operator-index:v4.17
     sourceType: grpc
     displayName:
     publisher:
     updateStrategy:
       registryPoll:
         interval: 60m

   1

   The global namespace. Setting the metadata.namespace to openshift-marketplace enables the catalog to run in all namespaces. Subscriptions in any namespace can reference catalogs created in the openshift-marketplace namespace.

   注記

   The default pod security admission definition for openshift-marketplace is baseline, therefore a catalog source custom resource (CR) created in that namespace does not require a spec.grpcPodConfig.securityContextConfig value to be set. You can set a legacy or restricted value if required for the namespace and Operators you want to use.

2. Add the SHA of the catalog index commit to the Catalog Source (CR), similar to the following example:

   Example namespace spec.image configuration

   apiVersion: operators.coreos.com/v1alpha1
   kind: CatalogSource
   metadata:
     name: cs-redhat-operator-index
     namespace: openshift-marketplace
   spec:
     image: registry.example.com/redhat/redhat-operator-index@sha256:7a76c0880a839035eb6e896d54ebd63668bb37b82040692141ba39ab4c539bc6 

   1

   
     sourceType: grpc
     displayName:
     publisher:
     updateStrategy:
       registryPoll:
         interval: 60m

   1

   The SHA of the image commit. Use the same SHA you added to the image builder blueprint.

   重要

   You must use the SHA instead of a tag in your catalog CR or the pod fails to start.

3. Apply the YAML file from the oc-mirror plugin dry run results directory to the cluster by running the following command:

   $ oc apply -f ./oc-mirror-workspace/results-1708508014/catalogSource-cs-redhat-operator-index.yaml

   Example output

   catalogsource.operators.coreos.com/cs-redhat-operator-index created

4. Verify that the CatalogSource resources were successfully installed by running the following command:

   $ oc get catalogsource --all-namespaces

5. Verify that the catalog source is running by using the following command:

   $ oc get pods -n openshift-marketplace

   Example output

   NAME                             READY   STATUS    RESTARTS   AGE
   cs-redhat-operator-index-4227b   2/2     Running   0          2m5s

6. Create a Subscription CR, similar to the following example:

   Example my-subscription-cr.yaml file

   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: amq-broker
     namespace: openshift-operators
   spec:
     channel: 7.11.x
     name: amq-broker-rhel8
     source: cs-redhat-operator-index
     sourceNamespace: openshift-marketplace

7. Apply the Subscription CR by running the following command:

   $ oc apply -f ./<my-subscription-cr.yaml> 

   1

   1

   Specify the name of your Subscription CR, such as my-subscription-cr.yaml.

   Example output

   subscription.operators.coreos.com/amq-broker created