9.4. Adding OLM-based Operators to a disconnected cluster

Procedure

1. Run the oc mirror command with the --dry-run flag to perform a dry run:

   $ oc-mirror --config <ImageSetConfig.yaml> docker://localhost:5000 --workspace file://<outm2m> --dry-run --v2

   where:

   ImageSetConfig.yaml

   Specifies the name of the image set configuration file that you created.

   docker://localhost:5000

   Specifies the mirror registry. Nothing is mirrored to this registry when you use the --dry-run flag.

   --workspace file://<outm2m>

   Insert the address of the workspace path.

   --dry-run

   The dry run flag generates the dry run artifacts and not an actual image set file.

   --v2

   Specifies oc mirror v2.

   Example output

   2025/08/25 15:50:44  [INFO]   : 👋 Hello, welcome to oc-mirror
   2025/08/25 15:50:44  [INFO]   : ⚙  setting up the environment for you...
   2025/08/25 15:50:44  [INFO]   : 🔀 workflow mode: mirrorToMirror
   2025/08/25 15:50:44  [INFO]   : 🕵  going to discover the necessary images...
   2025/08/25 15:50:44  [INFO]   : 🔍 collecting release images...
   2025/08/25 15:50:44  [INFO]   : 🔍 collecting operator images...
    ✓   (1m30s) Collecting catalog registry.redhat.io/redhat/redhat-operator-index:v4.20
   2025/08/25 15:52:14  [INFO]   : 🔍 collecting additional images...
   2025/08/25 15:52:14  [INFO]   : 📄 list of all images for mirroring in : wspace/working-dir/dry-run/mapping.txt
   2025/08/25 15:52:14  [INFO]   : mirror time     : 1m30.399585837s
   2025/08/25 15:52:14  [INFO]   : 👋 Goodbye, thank you for using oc-mirror

2. Review the mapping.txt file that was generated by running the following command:

   $ cat wspace/working-dir/dry-run/mapping.txt

   Example output

   docker://registry.redhat.io/amq8/amq-broker-rhel9@sha256:47fd4ce2533496828aba37bd1f9715e2164d5c90bd0fc6b25e7e0786d723bf01=docker://mirror.com/amq8/amq-broker-rhel9:sha256-47fd4ce2533496828aba37bd1f9715e2164d5c90bd0fc6b25e7e0786d723bf01
   docker://registry.redhat.io/amq8/amq-broker-init-rhel9@sha256:9cc48eecf1442ae04b8543fa5d4381a13bc2831390850828834d387006d1342b=docker://mirror.com/amq7/amq-broker-init-rhel9:sha256-9cc48eecf1442ae04b8543fa5d4381a13bc2831390850828834d387006d1342b
   docker://registry.redhat.io/amq8/amq-broker-rhel9@sha256:bb6fbd68475a7852b4d99eea6c4ab313f9267da7963162f0d75375d7063409e7=docker://mirror.com/amq8/amq-broker-rhel9:sha256-bb6fbd68475a7852b4d99eea6c4ab313f9267da7963162f0d75375d7063409e7
   docker://registry.redhat.io/amq8/amq-broker-rhel9@sha256:d42d713da0ce6806fdc6492b6342586783e6865a82a8647d3c4288439b1751ee=docker://mirror.com/amq8/amq-broker-rhel9:sha256-d42d713da0ce6806fdc6492b6342586783e6865a82a8647d3c4288439b1751ee
   docker://registry.redhat.io/amq8/amq-broker-init-rhel9@sha256:ffffa9875f0379e9373f89f05eb06e5a193273bb04bc3aa5f85b044357b79098=docker://mirror.com/amq8/amq-broker-init-rhel9:sha256-ffffa9875f0379e9373f89f05eb06e5a193273bb04bc3aa5f85b044357b79098

Procedure

1. Parse the catalog index.json file to get the image references that you need to include in the image builder blueprint. You can use either the unfiltered catalog or you can filter out images that cannot be mirrored:

   1. Parse the unfiltered catalog index.json file to get the image references by running the following command:

      jq -r --slurp '.[] | select(.relatedImages != null) | "[[containers]]\nsource = \"" + .relatedImages[].image + "\"\n"'   ./oc-mirror-workspace/src/catalogs/registry.redhat.io/redhat/redhat-operator-index/v4.18/index/index.json

   2. If you want to filter out images that cannot be mirrored, filter and parse the catalog index.json file by running the following command:

      $ jq -r --slurp '.[] | select(.relatedImages != null) | .relatedImages[] | select(.name |  contains("ppc") or contains("s390x") | not) | "[[containers]]\\nsource = \\"" + .image + "\\"\\n"' ./oc-mirror-workspace/src/catalogs/registry.redhat.io/redhat/redhat-operator-index/v4.18/index/index.json

      注意

      This step uses the AMQ Broker Operator as an example. You can add other criteria to the jq command for further filtering as required by your use case.

      Example image-reference output

      [[containers]]
      source = "registry.redhat.io/amq8/amq-broker-init-rhel9@sha256:0b2126cfb6054fdf428c1f43b69e36e93a09a49ce15350e9273c98cc08c6598b"
      
      [[containers]]
      source = "registry.redhat.io/amq8/amq-broker-init-rhel9@sha256:0dde839c2dce7cb684094bf26523c8e16677de03149a0fff468b8c3f106e1f4f"
      ...
      ...
      
      [[containers]]
      source = "registry.redhat.io/amq8/amq-broker-rhel9@sha256:e8fa2a00e576ecb95561ffbdbf87b1c82d479c8791ab2c6ce741dd0d0b496d15"
      
      [[containers]]
      source = "registry.redhat.io/amq8/amq-broker-rhel9@sha256:ff6fefad518a6c997d4c5a6e475ba89640260167f0bc27715daf3cc30116fad1"
      …
      EOF

      重要

      For mirrored and disconnected use cases, ensure that all of the sources filtered from your catalog index.json file are digests. If any of the sources use tags instead of digests, the Operator installation fails. Tags require an internet connection.

2. View the imageset-config.yaml to get the catalog image reference for the CatalogSource custom resource (CR) by running the following command:

   $ cat imageset-config.yaml

   Example output

   kind: ImageSetConfiguration
   apiVersion: mirror.openshift.io/v2alpha1
   mirror:
     operators:
     - catalog: registry.redhat.io/redhat/redhat-operator-index:v4.18 

   1

   
       packages:
       - name: amq-broker-rhel9
         channels:
         - name: 7.13.x

   1

   Use the value in the mirror.catalog catalog image reference for the following jq command to get the image digest. In this example, <registry.redhat.io/redhat/redhat-operator-index:v4.18>.

3. Get the SHA of the catalog index image by running the following command:

   $ skopeo inspect docker://<registry.redhat.io/redhat/redhat-operator-index:v{product-version}> | jq .Digest 

   1

   1

   Use the value in the mirror.catalog catalog image reference for the jq command to get the image digest. In this example, <registry.redhat.io/redhat/redhat-operator-index:v4.18>.

   Example output

   "sha256:7a76c0880a839035eb6e896d54ebd63668bb37b82040692141ba39ab4c539bc6"

4. To get ready to add the image references to your image builder blueprint file, format the catalog image reference by using the following example:

   [[containers]]
   source = "registry.redhat.io/redhat/redhat-operator-index@sha256:7a76c0880a839035eb6e896d54ebd63668bb37b82040692141ba39ab4c539bc6"

5. Add the image references from all of the previous steps to the image builder blueprint.

   Generated image builder blueprint example snippet

   name = "microshift_blueprint"
   description = "MicroShift 4.18.1 on x86_64 platform"
   version = "0.0.1"
   modules = []
   groups = []
   
   [[packages]] 

   1

   
   name = "microshift"
   version = "4.18.1"
   ...
   ...
   
   [customizations.services] 

   2

   
   enabled = ["microshift"]
   
   [customizations.firewall]
   ports = ["22:tcp", "80:tcp", "443:tcp", "5353:udp", "6443:tcp", "30000-32767:tcp", "30000-32767:udp"]
   ...
   ...
   
   [[containers]] 

   3

   
   source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f41e79c17e8b41f1b0a5a32c3e2dd7cd15b8274554d3f1ba12b2598a347475f4"
   
   [[containers]]
   source = "quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:dbc65f1fba7d92b36cf7514cd130fe83a9bd211005ddb23a8dc479e0eea645fd"
   ...
   ...
   
   [[containers]] 

   4

   
   source = "registry.redhat.io/redhat/redhat-operator-index@sha256:7a76c0880a839035eb6e896d54ebd63668bb37b82040692141ba39ab4c539bc6"
   ...
   ...
   
   [[containers]]
   source = "registry.redhat.io/amq8/amq-broker-init-rhel9@sha256:0dde839c2dce7cb684094bf26523c8e16677de03149a0fff468b8c3f106e1f4f"
   ...
   ...
   
   [[containers]]
   source = "registry.redhat.io/amq8/amq-broker-rhel9@sha256:e8fa2a00e576ecb95561ffbdbf87b1c82d479c8791ab2c6ce741dd0d0b496d15"
   
   [[containers]]
   source = "registry.redhat.io/amq8/amq-broker-rhel9@sha256:ff6fefad518a6c997d4c5a6e475ba89640260167f0bc27715daf3cc30116fad1"
   …
   EOF

   1

   References for all non-optional MicroShift RPM packages using the same version compatible with the microshift-release-info RPM.

   2

   References for automatically enabling MicroShift on system startup and applying default networking settings.

   3

   References for all non-optional MicroShift container images necessary for a disconnected deployment.

   4

   References for the catalog index.

Procedure

1. Create a CatalogSource custom resource (CR), similar to the following example:

   Example my-catalog-source-cr.yaml file

   apiVersion: operators.coreos.com/v1alpha1
   kind: CatalogSource
   metadata:
     name: cs-redhat-operator-index
     namespace: openshift-marketplace 

   1

   
   spec:
     image: registry.example.com/redhat/redhat-operator-index:v4.17
     sourceType: grpc
     displayName:
     publisher:
     updateStrategy:
       registryPoll:
         interval: 60m

   1

   The global namespace. Setting the metadata.namespace to openshift-marketplace enables the catalog to run in all namespaces. Subscriptions in any namespace can reference catalogs created in the openshift-marketplace namespace.

   注意

   The default pod security admission definition for openshift-marketplace is baseline, therefore a catalog source custom resource (CR) created in that namespace does not require a spec.grpcPodConfig.securityContextConfig value to be set. You can set a legacy or restricted value if required for the namespace and Operators you want to use.

2. Add the SHA of the catalog index commit to the Catalog Source (CR), similar to the following example:

   Example namespace spec.image configuration

   apiVersion: operators.coreos.com/v1alpha1
   kind: CatalogSource
   metadata:
     name: cs-redhat-operator-index
     namespace: openshift-marketplace
   spec:
     image: registry.example.com/redhat/redhat-operator-index@sha256:7a76c0880a839035eb6e896d54ebd63668bb37b82040692141ba39ab4c539bc6 

   1

   
     sourceType: grpc
     displayName:
     publisher:
     updateStrategy:
       registryPoll:
         interval: 60m

   1

   The SHA of the image commit. Use the same SHA you added to the image builder blueprint.

   重要

   You must use the SHA instead of a tag in your catalog CR or the pod fails to start.

3. Apply the YAML file from the oc-mirror plugin dry run results directory to the cluster by running the following command:

   $ oc apply -f ./oc-mirror-workspace/results-1708508014/catalogSource-cs-redhat-operator-index.yaml

   Example output

   catalogsource.operators.coreos.com/cs-redhat-operator-index created

4. Verify that the CatalogSource resources were successfully installed by running the following command:

   $ oc get catalogsource --all-namespaces

5. Verify that the catalog source is running by using the following command:

   $ oc get pods -n openshift-marketplace

   Example output

   NAME                             READY   STATUS    RESTARTS   AGE
   cs-redhat-operator-index-4227b   2/2     Running   0          2m5s

6. Create a Subscription CR, similar to the following example:

   Example my-subscription-cr.yaml file

   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: amq-broker
     namespace: openshift-operators
   spec:
     channel: 7.11.x
     name: amq-broker-rhel8
     source: cs-redhat-operator-index
     sourceNamespace: openshift-marketplace

7. Apply the Subscription CR by running the following command:

   $ oc apply -f ./<my-subscription-cr.yaml> 

   1

   1

   Specify the name of your Subscription CR, such as my-subscription-cr.yaml.

   Example output

   subscription.operators.coreos.com/amq-broker created