Chapter 8. Operators

Procedure

1. Confirm that OLM is running by using the following command:

   $ oc -n openshift-operator-lifecycle-manager get pod -l app=olm-operator

   Example output

   NAME                            READY   STATUS    RESTARTS   AGE
   olm-operator-85b5c6786-n6kbc    1/1     Running   0          2m24s

2. Confirm that the OLM catalog Operator is running by using the following command:

   $ oc -n openshift-operator-lifecycle-manager get pod -l app=catalog-operator

   Example output

   NAME                                READY   STATUS    RESTARTS   AGE
   catalog-operator-5fc7f857b6-tj8cf   1/1     Running   0          2m33s

1. Create the CatalogSource object by using the following example YAML:

   Example catalog source YAML

   apiVersion: operators.coreos.com/v1alpha1
   kind: CatalogSource
   metadata:
     name: operatorhubio-catalog
     namespace: openshift-marketplace 1
   spec:
     sourceType: grpc
     image: quay.io/operatorhubio/catalog:latest
     displayName: Community Operators 2
     publisher: OperatorHub.io
     grpcPodConfig:
       securityContextConfig: restricted 3
     updateStrategy:
       registryPoll:
         interval: 60m

   1

   The global namespace. Setting the metadata.namespace to openshift-marketplace enables the catalog to run in all namespaces. Subscriptions in any namespace can reference catalogs created in the openshift-marketplace namespace.

   2

   Community Operators are not installed by default with OLM for MicroShift. Listed here for example only.

   3

   The value of securityContextConfig must be set to restricted for MicroShift.

2. Apply the CatalogSource configuration by running the following command:

   $ oc apply -f <catalog_source.yaml> 1

   1

   Replace <catalog-source.yaml> with your catalog source configuration file name. In this example, catalogsource.yaml is used.

   Example output

   catalogsource.operators.coreos.com/operatorhubio-catalog created

3. To verify that the catalog source is applied, check for the READY state by using the following command:

   $ oc describe catalogsources.operators.coreos.com -n openshift-marketplace operatorhubio-catalog

   Example output

   Name:         operatorhubio-catalog
   Namespace:    openshift-marketplace
   Labels:       <none>
   Annotations:  <none>
   API Version:  operators.coreos.com/v1alpha1
   Kind:         CatalogSource
   Metadata:
     Creation Timestamp:  2024-01-31T09:55:31Z
     Generation:          1
     Resource Version:    1212
     UID:                 4edc1a96-83cd-4de9-ac8c-c269ca895f3e
   Spec:
     Display Name:  Community Operators
     Grpc Pod Config:
       Security Context Config:  restricted
     Image:                      quay.io/operatorhubio/catalog:latest
     Publisher:                  OperatorHub.io
     Source Type:                grpc
     Update Strategy:
       Registry Poll:
         Interval:  60m
   Status:
     Connection State:
       Address:              operatorhubio-catalog.openshift-marketplace.svc:50051
       Last Connect:         2024-01-31T09:55:57Z
       Last Observed State:  READY 1
     Registry Service:
       Created At:         2024-01-31T09:55:31Z
       Port:               50051
       Protocol:           grpc
       Service Name:       operatorhubio-catalog
       Service Namespace:  openshift-marketplace
   Events:                 <none>

   1

   The status is reported as READY.

4. Confirm that the catalog source is running by using the following command:

   $ oc get pods -n openshift-marketplace -l olm.catalogSource=operatorhubio-catalog

   Example output

   NAME                          READY   STATUS    RESTARTS   AGE
   operatorhubio-catalog-x24nh   1/1     Running   0          59s

5. Create a Subscription CR configuration file by using the following example YAML:

   Example Subscription custom resource YAML

   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: my-cert-manager
     namespace: openshift-operators
   spec:
     channel: stable
     name: cert-manager
     source: operatorhubio-catalog
     sourceNamespace: openshift-marketplace 1

   1

   The global namespace. Setting the sourceNamespace value to openshift-marketplace enables Operators to run in multiple namespaces if the catalog also runs in the openshift-marketplace namespace.

6. Apply the Subscription CR configuration by running the following command:

   $ oc apply -f <subscription_cr.yaml> 1

   1

   Replace <subscription_cr.yaml> with your Subscription CR filename.

   Example output

   subscription.operators.coreos.com/my-cert-manager created

7. You can create a configuration file for the specific Operand you want to use and apply it now.

Verification

1. Verify that your Operator is running by using the following command:

   $ oc get pods -n openshift-operators 1

   1

   The namespace from the Subscription CR is used.

   Note

   Allow a minute or two for the Operator start.

   Example output

   NAME                                       READY   STATUS    RESTARTS   AGE
   cert-manager-7df8994ddb-4vrkr              1/1     Running   0          19s
   cert-manager-cainjector-5746db8fd7-69442   1/1     Running   0          18s
   cert-manager-webhook-f858bf58b-748nt       1/1     Running   0          18s

Procedure

1. Confirm that OLM is running by using the following command:

   $ oc -n openshift-operator-lifecycle-manager get pod -l app=olm-operator

   Example output

   NAME                           READY   STATUS    RESTARTS   AGE
   olm-operator-85b5c6786-n6kbc   1/1     Running   0          16m

2. Confirm that the OLM catalog Operator is running by using the following command:

   $ oc -n openshift-operator-lifecycle-manager get pod -l app=catalog-operator

   Example output

   NAME                                READY   STATUS    RESTARTS   AGE
   catalog-operator-5fc7f857b6-tj8cf   1/1     Running   0          16m

3. Create a namespace by using the following example YAML:

   Example namespace YAML

   apiVersion: v1
   kind: Namespace
   metadata:
     name: olm-microshift

4. Apply the namespace configuration using the following command:

   $ oc apply -f <ns.yaml> 1

   1

   Replace <ns.yaml> with the name of your namespace configuration file. In this example, olm-microshift is used.

   Example output

   namespace/olm-microshift created

5. Create the Operator group YAML by using the following example YAML:

   Example Operator group YAML

   kind: OperatorGroup
   apiVersion: operators.coreos.com/v1
   metadata:
     name: og
     namespace: olm-microshift
   spec: 1
     targetNamespaces:
     - olm-microshift

   1

   For Operators using the global namespace, omit the spec.targetNamespaces field and values.

6. Apply the Operator group configuration by running the following command:

   $ oc apply -f <og.yaml> 1

   1

   Replace <og.yaml> with the name of your operator group configuration file.

   Example output

   operatorgroup.operators.coreos.com/og created

7. Create the CatalogSource object by using the following example YAML:

   Example catalog source YAML

   apiVersion: operators.coreos.com/v1alpha1
   kind: CatalogSource
   metadata:
     name: operatorhubio-catalog
     namespace: openshift-marketplace 1
   spec:
     sourceType: grpc
     image: quay.io/operatorhubio/catalog:latest
     displayName: Community Operators 2
     publisher: OperatorHub.io
     grpcPodConfig:
       securityContextConfig: restricted 3
     updateStrategy:
       registryPoll:
         interval: 60m

   1

   The global namespace. Setting the metadata.namespace to openshift-marketplace enables the catalog to run in all namespaces. Subscriptions CRs in any namespace can reference catalogs created in the openshift-marketplace namespace.

   2

   Community Operators are not installed by default with OLM for MicroShift. Listed here for example only.

   3

   The value of securityContextConfig must be set to restricted for MicroShift.

8. Apply the CatalogSource configuration by running the following command:

   $ oc apply -f <catalog_source.yaml> 1

   1

   Replace <catalog_source.yaml> with your catalog source configuration file name.

9. To verify that the catalog source is applied, check for the READY state by using the following command:

   $ oc describe catalogsources.operators.coreos.com -n openshift-marketplace operatorhubio-catalog

   Example output

   Name:         operatorhubio-catalog
   Namespace:    openshift-marketplace
   Labels:       <none>
   Annotations:  <none>
   API Version:  operators.coreos.com/v1alpha1
   Kind:         CatalogSource
   Metadata:
     Creation Timestamp:  2024-01-31T10:09:46Z
     Generation:          1
     Resource Version:    2811
     UID:                 60ce4a36-86d3-4921-b9fc-84d67c28df48
   Spec:
     Display Name:  Community Operators
     Grpc Pod Config:
       Security Context Config:  restricted
     Image:                      quay.io/operatorhubio/catalog:latest
     Publisher:                  OperatorHub.io
     Source Type:                grpc
     Update Strategy:
       Registry Poll:
         Interval:  60m
   Status:
     Connection State:
       Address:              operatorhubio-catalog.openshift-marketplace.svc:50051
       Last Connect:         2024-01-31T10:10:04Z
       Last Observed State:  READY 1
     Registry Service:
       Created At:         2024-01-31T10:09:46Z
       Port:               50051
       Protocol:           grpc
       Service Name:       operatorhubio-catalog
       Service Namespace:  openshift-marketplace
   Events:                 <none>

   1

   The status is reported as READY.

10. Confirm that the catalog source is running by using the following command:

    $ oc get pods -n openshift-marketplace -l olm.catalogSource=operatorhubio-catalog

    Example output

    NAME                          READY   STATUS    RESTARTS   AGE
    operatorhubio-catalog-j7sc8   1/1     Running   0          43s

11. Create a Subscription CR configuration file by using the following example YAML:

    Example Subscription custom resource YAML

    apiVersion: operators.coreos.com/v1alpha1
    kind: Subscription
    metadata:
      name: my-gitlab-operator-kubernetes
      namespace: olm-microshift 1
    spec:
      channel: stable
      name: gitlab-operator-kubernetes
      source: operatorhubio-catalog
      sourceNamespace: openshift-marketplace 2

    1

    The specific namespace. Operators reference the global namespace for content, but run in the olm-microshift namespace.

    2

    The global namespace. Subscriptions CRs in any namespace can reference catalogs created in the openshift-marketplace namespace.

12. Apply the Subscription CR configuration by running the following command:

    $ oc apply -f <subscription_cr.yaml> 1

    1

    Replace <subscription_cr.yaml> with the name of the Subscription CR configuration file.

    Example output

    subscription.operators.coreos.com/my-gitlab-operator-kubernetes

13. You can create a configuration file for the specific Operand you want to use and apply it now.

Verification

1. Verify that your Operator is running by using the following command:

   $ oc get pods -n olm-microshift 1

   1

   The namespace from the Subscription CR is used.

   Note

   Allow a minute or two for the Operator start.

   Example output

   NAME                                         READY   STATUS    RESTARTS   AGE
   gitlab-controller-manager-69bb6df7d6-g7ntx   2/2     Running   0          3m24s

Procedure

1. Get a list of available Red Hat-provided Operator catalogs to filter by running the following command:

   $ oc mirror list operators --version 4.17 --catalogs

2. Get a list of Operators in the Red Hat Operators catalog by running the following command:

   $ oc mirror list operators <--catalog=<catalog_source>> 1

   1

   Specifies your catalog source, such as registry.redhat.io/redhat/redhat-operator-index:v4.17 or quay.io/operatorhubio/catalog:latest.

3. Select an Operator. For this example, amq-broker-rhel8 is selected.

4. Optional: To inspect the channels and versions of the Operator you want to filter, enter the following commands:

   1. Get a list of channels by running the following command:

      $ oc mirror list operators --catalog=registry.redhat.io/redhat/redhat-operator-index:v4.17 --package=amq-broker-rhel8

   2. Get a list of versions within a channel by running the following command:

      $ oc mirror list operators --catalog=registry.redhat.io/redhat/redhat-operator-index:v4.17 --package=amq-broker-rhel8 --channel=7.11.x

Procedure

1. Use the oc mirror init command to create a template for the image set configuration and save it to a file called imageset-config.yaml:

   $ oc mirror init <--registry <storage_backend> > imageset-config.yaml 1

   1

   Specifies the location of your storage backend, such as example.com/mirror/oc-mirror-metadata.

   Example default image set configuration file

   kind: ImageSetConfiguration
   apiVersion: mirror.openshift.io/v1alpha2
   storageConfig:
     registry:
       imageURL: registry.example.com/oc-mirror
       skipTLS: false
   mirror:
     platform: 1
       channels:
       - name: stable-4.17
         type: ocp
     operators:
     - catalog: registry.redhat.io/redhat/redhat-operator-index:v4.17
       packages:
       - name: serverless-operator
         channels:
         - name: stable
     additionalImages: 2
     - name: registry.redhat.io/ubi8/ubi:latest
     helm: {} 3

   1

   The platform field and related fields are not supported by MicroShift and must be deleted.

   2

   Specify any additional images to include in the image set. If you do not need to specify additional images, delete this field.

   3

   Helm is not supported by MicroShift and must be deleted.

2. Edit the values of your image set configuration file to meet the requirements of both MicroShift and the Operator you want to mirror, like the following example:

   Example edited MicroShift image set configuration file

   kind: ImageSetConfiguration
   apiVersion: mirror.openshift.io/v1alpha2
   storageConfig: 1
     registry:
       imageURL: <storage_backend> 2
       skipTLS: false
   mirror:
     operators:
     - catalog: registry.redhat.io/redhat/redhat-operator-index:v4.17 3
       packages:
       - name: amq-broker-rhel8 4
         channels:
         - name: 7.11.x 5

   1

   Set the backend location where the image set metadata is saved. This location can be a registry or local directory. It is required to specify storageConfig values.

   2

   Set the registry URL for the storage backend, such as <example.com/mirror/oc-mirror-metadata.

   3

   Set the Operator catalog to retrieve images from.

   4

   Specify the Operator packages to include in the image set. Remove this field to retrieve all packages in the catalog.

   5

   Specify only certain channels of the Operator packages to include in the image set. You must always include the default channel for the Operator package even if you do not use the bundles in that channel. You can find the default channel by running the following command: oc mirror list operators --catalog=<catalog_name> --package=<package_name>.

3. Save the updated file.

Verification

1. Navigate into the oc-mirror-workspace/ directory that was generated.
2. Navigate into the results directory, for example, results-1639608409/.
3. Verify that YAML files are present for the ImageContentSourcePolicy and CatalogSource resources.

Procedure

1. Confirm the contents of the imageContentSourcePolicy.yaml file by running the following command:

   $ cat oc-mirror-workspace/<results-directory>/imageContentSourcePolicy.yaml 1

   1

   Specify the results directory name, such as <results-1707148826>.

   Example output

   apiVersion: operator.openshift.io/v1alpha1
   kind: ImageContentSourcePolicy
   metadata:
     labels:
       operators.openshift.org/catalog: "true"
     name: operator-0
   spec:
     repositoryDigestMirrors:
     - mirrors:
       - registry.<example.com>/amq7
       source: registry.redhat.io/amq7

2. Transform the imageContentSourcePolicy.yaml into a format ready for CRI-O configuration by running the following command:

   yq '.spec.repositoryDigestMirrors[] as $item ireduce([]; . + [{"mirror": $item.mirrors[], "source": ($item | .source)}]) | .[] |
     "[[registry]]
         prefix = \"" + .source + "\"
         location = \"" + .mirror + "\"
         mirror-by-digest-only = true
         insecure = true
         "' ./icsp.yaml

   Example output

   [[registry]]
         prefix = "registry.redhat.io/amq7"
         location = "registry.example.com/amq7"
         mirror-by-digest-only = true
         insecure = true

3. Add the output to the CRI-O configuration file in the /etc/containers/registries.conf.d/ directory:

   Example crio-config.yaml mirror configuration file

   [[registry]]
         prefix = "registry.redhat.io/amq7"
         location = "registry.example.com/amq7"
         mirror-by-digest-only = true
         insecure = true
   
   [[registry]]
       prefix = ""
       location = "quay.io"
       mirror-by-digest-only = true
   [[registry.mirror]]
       location = "<registry_host>:<port>" 1
       insecure = false

   1

   Specify the host name and port of your mirror registry server, for example microshift-quay:8443.

4. Apply the CRI-O configuration changes by restarting MicroShift with the following command:

   $ sudo systemctl restart crio

Procedure

1. Apply the catalog source configuration file from the results directory to create the catalog source object by running the following command:

   $ oc apply -f ./oc-mirror-workspace/results-1708508014/catalogSource-cs-redhat-operator-index.yaml

   Example catalog source configuration file

   apiVersion: operators.coreos.com/v1alpha1
   kind: CatalogSource
   metadata:
     name: redhat-catalog
     namespace: openshift-marketplace 1
   spec:
     sourceType: grpc
     image: registry.example.com/redhat/redhat-operator-index:v4.17
     updateStrategy:
       registryPoll:
         interval: 60m

   1

   Specifies the global namespace. Setting the metadata.namespace to openshift-marketplace enables the catalog to reference catalogs in all namespaces. Subscriptions in any namespace can reference catalogs created in the openshift-marketplace namespace.

   Example output

   catalogsource.operators.coreos.com/cs-redhat-operator-index created

2. Verify that the CatalogSource resources were successfully installed by running the following command:

   $ oc get catalogsource --all-namespaces

3. Verify that the catalog source is running by using the following command:

   $ oc get pods -n openshift-marketplace

   Example output

   NAME                             READY   STATUS    RESTARTS   AGE
   cs-redhat-operator-index-4227b   2/2     Running   0          2m5s

4. Create a Subscription CR, similar to the following example:

   Example Subscription CR

   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: amq-broker
     namespace: openshift-operators
   spec:
     channel: 7.11.x
     name: amq-broker-rhel8
     source: cs-redhat-operator-index
     sourceNamespace: openshift-marketplace

5. Apply the Subscription CR configuration by running the following command:

   $ oc apply -f ./<my-subscription-cr.yaml> 1

   1

   Specify the name of your subscription, such as my-subscription-cr.yaml.

   Example output

   subscription.operators.coreos.com/amq-broker created

Procedure

1. Run the oc mirror command with the --dry-run flag to perform a dry run:

   $ oc mirror --config=./imageset-config.yaml \1
     docker://registry.example:5000            \2
     --dry-run                                  3

   1

   Pass in the image set configuration file that was created. This procedure assumes that it is named imageset-config.yaml.

   2

   Specify the mirror registry. Nothing is mirrored to this registry as long as you use the --dry-run flag.

   3

   Use the --dry-run flag to generate the dry run artifacts and not an actual image set file.

   Example output

   Checking push permissions for registry.example:5000
   Creating directory: oc-mirror-workspace/src/publish
   Creating directory: oc-mirror-workspace/src/v2
   Creating directory: oc-mirror-workspace/src/charts
   Creating directory: oc-mirror-workspace/src/release-signatures
   No metadata detected, creating new workspace
   wrote mirroring manifests to oc-mirror-workspace/operators.1658342351/manifests-redhat-operator-index
   
   ...
   
   info: Planning completed in 31.48s
   info: Dry run complete
   Writing image mapping to oc-mirror-workspace/mapping.txt

2. Navigate into the workspace directory that was generated:

   $ cd oc-mirror-workspace/

3. Review the mapping.txt file that was generated.

   This file contains a list of all images that would be mirrored.

4. Review the pruning-plan.json file that was generated.

   This file contains a list of all images that would be pruned from the mirror registry when the image set is published.

   Note

   The pruning-plan.json file is only generated if your oc-mirror command points to your mirror registry and there are images to be pruned.

Procedure

1. Parse the catalog index.json file to get the image references that you need to include in the Image Builder blueprint. You can use either the unfiltered catalog or you can filter out images that cannot be mirrored:

   1. Parse the unfiltered catalog index.json file to get the image references by running the following command:

      jq -r --slurp '.[] | select(.relatedImages != null) | "[[containers]]\nsource = \"" + .relatedImages[].image + "\"\n"'   ./oc-mirror-workspace/src/catalogs/registry.redhat.io/redhat/redhat-operator-index/v4.17/index/index.json

   2. If you want to filter out images that cannot be mirrored, filter and parse the catalog index.json file by running the following command:

      $ jq -r --slurp '.[] | select(.relatedImages != null) | .relatedImages[] | select(.name |  contains("ppc") or contains("s390x") | not) | "[[containers]]\\nsource = \\"" + .image + "\\"\\n"' ./oc-mirror-workspace/src/catalogs/registry.redhat.io/redhat/redhat-operator-index/v4.17/index/index.json

      Note

      This step uses the AMQ Broker Operator as an example. You can add other criteria to the jq command for further filtering as required by your use case.

      Example image-reference output

      [[containers]]
      source = "registry.redhat.io/amq7/amq-broker-init-rhel8@sha256:0b2126cfb6054fdf428c1f43b69e36e93a09a49ce15350e9273c98cc08c6598b"
      
      [[containers]]
      source = "registry.redhat.io/amq7/amq-broker-init-rhel8@sha256:0dde839c2dce7cb684094bf26523c8e16677de03149a0fff468b8c3f106e1f4f"
      ...
      ...
      
      [[containers]]
      source = "registry.redhat.io/amq7/amq-broker-rhel8@sha256:e8fa2a00e576ecb95561ffbdbf87b1c82d479c8791ab2c6ce741dd0d0b496d15"
      
      [[containers]]
      source = "registry.redhat.io/amq7/amq-broker-rhel8@sha256:ff6fefad518a6c997d4c5a6e475ba89640260167f0bc27715daf3cc30116fad1"
      …
      EOF

      Important

      For mirrored and disconnected use cases, ensure that all of the sources filtered from your catalog index.json file are digests. If any of the sources use tags instead of digests, the Operator installation fails. Tags require an internet connection.

2. View the imageset-config.yaml to get the catalog image reference for the CatalogSource custom resource (CR) by running the following command:

   $ cat imageset-config.yaml

   Example output

   kind: ImageSetConfiguration
   apiVersion: mirror.openshift.io/v1alpha2
   storageConfig:
     registry:
       imageURL: registry.example.com/microshift-mirror
   mirror:
     operators:
     - catalog: registry.redhat.io/redhat/redhat-operator-index:v4.17 1
       packages:
       - name: amq-broker-rhel8
         channels:
         - name: 7.11.x

   1

   Use the value in the mirror.catalog catalog image reference for the follwing jq command to get the image digest. In this example, <registry.redhat.io/redhat/redhat-operator-index:v4.17>.

3. Get the SHA of the catalog index image by running the following command:

   $ skopeo inspect docker://<registry.redhat.io/redhat/redhat-operator-index:v4.17> | jq `.Digest` 1

   1

   Use the value in the mirror.catalog catalog image reference for the jq command to get the image digest. In this example, <registry.redhat.io/redhat/redhat-operator-index:v4.17>.

   Example output

   "sha256:7a76c0880a839035eb6e896d54ebd63668bb37b82040692141ba39ab4c539bc6"

4. To get ready to add the image references to your Image Builder blueprint file, format the catalog image reference by using the following example:

   [[containers]]
   source = "registry.redhat.io/redhat/redhat-operator-index@sha256:7a76c0880a839035eb6e896d54ebd63668bb37b82040692141ba39ab4c539bc6"

5. Add the image references from all the previous steps to the Image Builder blueprint.

   Generated Image Builder blueprint example snippet

   name = "microshift_blueprint"
   description = "MicroShift 4.17.1 on x86_64 platform"
   version = "0.0.1"
   modules = []
   groups = []
   
   [[packages]] 1
   name = "microshift"
   version = "4.17.1"
   ...
   ...
   
   [customizations.services] 2
   enabled = ["microshift"]
   
   [customizations.firewall]
   ports = ["22:tcp", "80:tcp", "443:tcp", "5353:udp", "6443:tcp", "30000-32767:tcp", "30000-32767:udp"]
   ...
   ...
   
   [[containers]] 3
   source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f41e79c17e8b41f1b0a5a32c3e2dd7cd15b8274554d3f1ba12b2598a347475f4"
   
   [[containers]]
   source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:dbc65f1fba7d92b36cf7514cd130fe83a9bd211005ddb23a8dc479e0eea645fd"
   ...
   ...
   
   [[containers]] 4
   source = "registry.redhat.io/redhat/redhat-operator-index@sha256:7a76c0880a839035eb6e896d54ebd63668bb37b82040692141ba39ab4c539bc6"
   ...
   ...
   
   [[containers]]
   source = "registry.redhat.io/amq7/amq-broker-init-rhel8@sha256:0dde839c2dce7cb684094bf26523c8e16677de03149a0fff468b8c3f106e1f4f"
   ...
   ...
   
   [[containers]]
   source = "registry.redhat.io/amq7/amq-broker-rhel8@sha256:e8fa2a00e576ecb95561ffbdbf87b1c82d479c8791ab2c6ce741dd0d0b496d15"
   
   [[containers]]
   source = "registry.redhat.io/amq7/amq-broker-rhel8@sha256:ff6fefad518a6c997d4c5a6e475ba89640260167f0bc27715daf3cc30116fad1"
   …
   EOF

   1

   References for all non-optional MicroShift RPM packages using the same version compatible with the microshift-release-info RPM.

   2

   References for automatically enabling MicroShift on system startup and applying default networking settings.

   3

   References for all non-optional MicroShift container images necessary for a disconnected deployment.

   4

   References for the catalog index.

Procedure

1. Create a CatalogSource custom resource (CR), similar to the following example:

   Example my-catalog-source-cr.yaml file

   apiVersion: operators.coreos.com/v1alpha1
   kind: CatalogSource
   metadata:
     name: cs-redhat-operator-index
     namespace: openshift-marketplace 1
   spec:
     image: registry.example.com/redhat/redhat-operator-index:v4.17
     sourceType: grpc
     displayName:
     publisher:
     updateStrategy:
       registryPoll:
         interval: 60m

   1

   The global namespace. Setting the metadata.namespace to openshift-marketplace enables the catalog to run in all namespaces. Subscriptions in any namespace can reference catalogs created in the openshift-marketplace namespace.

   Note

   The default pod security admission definition for openshift-marketplace is baseline, therefore a catalog source custom resource (CR) created in that namespace does not require a spec.grpcPodConfig.securityContextConfig value to be set. You can set a legacy or restricted value if required for the namespace and Operators you want to use.

2. Add the SHA of the catalog index commit to the Catalog Source (CR), similar to the following example:

   Example namespace spec.image configuration

   apiVersion: operators.coreos.com/v1alpha1
   kind: CatalogSource
   metadata:
     name: cs-redhat-operator-index
     namespace: openshift-marketplace
   spec:
     image: registry.example.com/redhat/redhat-operator-index@sha256:7a76c0880a839035eb6e896d54ebd63668bb37b82040692141ba39ab4c539bc6 1
     sourceType: grpc
     displayName:
     publisher:
     updateStrategy:
       registryPoll:
         interval: 60m

   1

   The SHA of the image commit. Use the same SHA you added to the image builder blueprint.

   Important

   You must use the SHA instead of a tag in your catalog CR or the pod fails to start.

3. Apply the YAML file from the oc-mirror plugin dry run results directory to the cluster by running the following command:

   $ oc apply -f ./oc-mirror-workspace/results-1708508014/catalogSource-cs-redhat-operator-index.yaml

   Example output

   catalogsource.operators.coreos.com/cs-redhat-operator-index created

4. Verify that the CatalogSource resources were successfully installed by running the following command:

   $ oc get catalogsource --all-namespaces

5. Verify that the catalog source is running by using the following command:

   $ oc get pods -n openshift-marketplace

   Example output

   NAME                             READY   STATUS    RESTARTS   AGE
   cs-redhat-operator-index-4227b   2/2     Running   0          2m5s

6. Create a Subscription CR, similar to the following example:

   Example my-subscription-cr.yaml file

   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: amq-broker
     namespace: openshift-operators
   spec:
     channel: 7.11.x
     name: amq-broker-rhel8
     source: cs-redhat-operator-index
     sourceNamespace: openshift-marketplace

7. Apply the Subscription CR by running the following command:

   $ oc apply -f ./<my-subscription-cr.yaml> 1

   1

   Specify the name of your Subscription CR, such as my-subscription-cr.yaml.

   Example output

   subscription.operators.coreos.com/amq-broker created