5.5. Creating the image signature config map

Procedure

1. Obtain the image signature for the version that you are upgrading to from either mirror.openshift.com or Google Cloud Storage (GCS).
2. Use oc command-line interface (CLI) to log into the cluster that you are upgrading.

3. Apply the mirrored release image signature config map to the connected cluster:

   $ oc apply -f <image_signature_file> 

   1

   Copy to Clipboard Toggle word wrap

   1

   For <image_signature_file>, specify the path and name of the file, for example, mirror/config/signature-sha256-81154f5c03294534.yaml.

Procedure

1. Review the OpenShift Container Platform upgrade paths knowledge base article to determine a valid upgrade path for your cluster.

2. Add the version to the OCP_RELEASE_NUMBER environment variable:

   $ OCP_RELEASE_NUMBER=<release_version> 

   1

   Copy to Clipboard Toggle word wrap

   1

   For <release_version>, specify the tag that corresponds to the version of OpenShift Container Platform you want to update the cluster, such as 4.4.0.

3. Add the system architecture for your cluster to ARCHITECTURE environment variable:

   $ ARCHITECTURE=<server_architecture> 

   1

   Copy to Clipboard Toggle word wrap

   1

   For server_architecture, specify the architecture of the server, such as x86_64.

4. Get the release image digest from Quay:

   $ DIGEST="$(oc adm release info quay.io/openshift-release-dev/ocp-release:${OCP_RELEASE_NUMBER}-${ARCHITECTURE} | sed -n 's/Pull From: .*@//p')"

   Copy to Clipboard Toggle word wrap

5. Set the digest algorithm:

   $ DIGEST_ALGO="${DIGEST%%:*}"

   Copy to Clipboard Toggle word wrap

6. Set the digest signature:

   $ DIGEST_ENCODED="${DIGEST#*:}"

   Copy to Clipboard Toggle word wrap

7. Get the image signature from mirror.openshift.com website.

   $ SIGNATURE_BASE64=$(curl -s "https://mirror.openshift.com/pub/openshift-v4/signatures/openshift/release/${DIGEST_ALGO}=${DIGEST_ENCODED}/signature-1" | base64 -w0 && echo)

   Copy to Clipboard Toggle word wrap

8. Create the config map:

   $ cat >checksum-${OCP_RELEASE_NUMBER}.yaml <<EOF
   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: release-image-${OCP_RELEASE_NUMBER}
     namespace: openshift-config-managed
     labels:
       release.openshift.io/verification-signatures: ""
   binaryData:
     ${DIGEST_ALGO}-${DIGEST_ENCODED}: ${SIGNATURE_BASE64}
   EOF

   Copy to Clipboard Toggle word wrap

9. Apply the config map to the cluster to update:

   $ oc apply -f checksum-${OCP_RELEASE_NUMBER}.yaml

   Copy to Clipboard Toggle word wrap