Merge pull request #58953 from skopacz1/OSDOCS-5737

OSDOCS-5737: oc-mirror applying release signatures

Author: bscott-rh

installing/disconnected_install/installing-mirroring-disconnected.adoc

@@ -16,7 +16,7 @@ The following steps outline the high-level workflow on how to use the oc-mirror
 . Mirror the image set to the mirror registry by using one of the following methods:
 ** Mirror an image set directly to the mirror registry.
 ** Mirror an image set to disk, transfer the image set to the target environment, then upload the image set to the target mirror registry.
-. Install the `ImageContentSourcePolicy` and `CatalogSource` resources that were generated by oc-mirror into the cluster.
+. Configure your cluster to use the resources generated by the oc-mirror plugin.
 . Repeat these steps to update your mirror registry as necessary.
 
 // About the oc-mirror plugin
@@ -97,7 +97,7 @@ include::modules/oc-mirror-mirror-to-disk.adoc[leveloffset=+3]
 // Mirroring from disk to mirror in a disconnected environment
 include::modules/oc-mirror-disk-to-mirror.adoc[leveloffset=+3]
 
-// Installing the ImageContentSourcePolicy and CatalogSource resources into the cluster
+// Configuring your cluster to use the resources generated by oc-mirror
 include::modules/oc-mirror-updating-cluster-manifests.adoc[leveloffset=+1]
 
 [id="updating-mirror-registry-content"]
@@ -119,7 +119,7 @@ include::modules/oc-mirror-differential-updates.adoc[leveloffset=+2]
 * xref:../../installing/disconnected_install/installing-mirroring-disconnected.adoc#oc-mirror-image-set-examples_installing-mirroring-disconnected[Image set configuration examples]
 * xref:../../installing/disconnected_install/installing-mirroring-disconnected.adoc#mirroring-image-set-partial[Mirroring an image set in a partially disconnected environment]
 * xref:../../installing/disconnected_install/installing-mirroring-disconnected.adoc#mirroring-image-set-full[Mirroring an image set in a fully disconnected environment]
-* xref:../../installing/disconnected_install/installing-mirroring-disconnected.adoc#oc-mirror-updating-cluster-manifests_installing-mirroring-disconnected[Installing the ImageContentSourcePolicy and CatalogSource resources into the cluster]
+* xref:../../installing/disconnected_install/installing-mirroring-disconnected.adoc#oc-mirror-updating-cluster-manifests_installing-mirroring-disconnected[Configuring your cluster to use the resources generated by oc-mirror]
 
 // Performing a dry run
 include::modules/oc-mirror-dry-run.adoc[leveloffset=+1]

modules/oc-mirror-differential-updates.adoc

@@ -33,4 +33,4 @@ You must use the same storage backend as the initial execution of oc-mirror for
 * If you specified a top-level namespace for the mirror registry during the initial image set creation, then you must use this same namespace every time you run the oc-mirror plugin for the same mirror registry.
 ====
 
-. Install the `ImageContentSourcePolicy` and `CatalogSource` resources into the cluster.
+. Configure your cluster to use the resources generated by oc-mirror.

modules/oc-mirror-disk-to-mirror.adoc

@@ -41,4 +41,4 @@ This command updates the mirror registry with the image set and generates the `I
 
 .Next steps
 
-* Install the `ImageContentSourcePolicy` and `CatalogSource` resources into the cluster.
+* Configure your cluster to use the resources generated by oc-mirror.

modules/oc-mirror-mirror-to-mirror.adoc

@@ -45,4 +45,4 @@ $ oc mirror --config=./imageset-config.yaml \// <1>
 
 .Next steps
 
-* Install the `ImageContentSourcePolicy` and `CatalogSource` resources into the cluster.
+* Configure your cluster to use the resources generated by oc-mirror.

modules/oc-mirror-oci-format.adoc

@@ -132,4 +132,4 @@ You can optionally use the `--oci-insecure-signature-policy` flag to not push si
 
 .Next steps
 
-* Install the `ImageContentSourcePolicy` and `CatalogSource` resources into the cluster.
+* Configure your cluster to use the resources generated by oc-mirror.

modules/oc-mirror-updating-cluster-manifests.adoc

@@ -5,13 +5,11 @@
 
 :_content-type: PROCEDURE
 [id="oc-mirror-updating-cluster-manifests_{context}"]
-= Installing the ImageContentSourcePolicy and CatalogSource resources into the cluster
+= Configuring your cluster to use the resources generated by oc-mirror
 
-// TODO: Can we find a better title / more generic than calling out the two resources?
+After you have mirrored your image set to the mirror registry, you must apply the generated `ImageContentSourcePolicy`, `CatalogSource`, and release image signature resources into the cluster.
 
-After you have mirrored your image set to the mirror registry, you must install the generated `ImageContentSourcePolicy` and `CatalogSource` resources into the cluster.
-
-The `ImageContentSourcePolicy` resource associates the mirror registry with the source registry and redirects image pull requests from the online registries to the mirror registry. The `CatalogSource` resource is used by Operator Lifecycle Manager (OLM) to retrieve information about the available Operators in the mirror registry.
+The `ImageContentSourcePolicy` resource associates the mirror registry with the source registry and redirects image pull requests from the online registries to the mirror registry. The `CatalogSource` resource is used by Operator Lifecycle Manager (OLM) to retrieve information about the available Operators in the mirror registry. The release image signatures are used to verify the mirrored release images.
 
 .Prerequisites
 
@@ -22,25 +20,32 @@ The `ImageContentSourcePolicy` resource associates the mirror registry with the
 
 . Log in to the OpenShift CLI as a user with the `cluster-admin` role.
 
-. Apply the YAML files from the results directory to the cluster:
+. Apply the YAML files from the results directory to the cluster by running the following command:
 +
 [source,terminal]
 ----
 $ oc apply -f ./oc-mirror-workspace/results-1639608409/
 ----
 
+. Apply the release image signatures to the cluster by running the following command:
++
+[source,terminal]
+----
+$ oc apply -f ./oc-mirror-workspace/results-1639608409/release-signatures/
+----
+
 // TODO: Any example output to show?
 
 .Verification
 
-. Verify that the `ImageContentSourcePolicy` resources were successfully installed:
+. Verify that the `ImageContentSourcePolicy` resources were successfully installed by running the following command:
 +
 [source,terminal]
 ----
 $ oc get imagecontentsourcepolicy --all-namespaces
 ----
 
-. Verify that the `CatalogSource` resources were successfully installed:
+. Verify that the `CatalogSource` resources were successfully installed by running the following command:
 +
 [source,terminal]
 ----

updating/updating-restricted-network-cluster/mirroring-image-repository.adoc

@@ -27,7 +27,7 @@ The following steps outline the high-level workflow on how to mirror images to a
 
 .. Mirror your targeted release images directly to a mirror registry, or to removable media and then to a mirror registry.
 
-.. Install the `ImageContentSourcePolicy` and `CatalogSource` resources that oc-mirror generated into the cluster.
+.. Configure your cluster to use the resources generated by the oc-mirror plugin.
 
 .. Repeat these steps as needed to update your mirror registry.
 
@@ -131,7 +131,7 @@ include::modules/oc-mirror-mirror-to-disk.adoc[leveloffset=+4]
 // Mirroring from disk to mirror in a disconnected environment
 include::modules/oc-mirror-disk-to-mirror.adoc[leveloffset=+4]
 
-// Installing the ImageContentSourcePolicy and CatalogSource resources into the cluster
+// Configuring your cluster to use the resources generated by oc-mirror
 include::modules/oc-mirror-updating-cluster-manifests.adoc[leveloffset=+2]
 
 [id="updating-mirror-registry-content"]
@@ -153,7 +153,7 @@ include::modules/oc-mirror-differential-updates.adoc[leveloffset=+3]
 * xref:../../updating/updating-restricted-network-cluster/mirroring-image-repository.adoc#oc-mirror-image-set-examples_mirroring-ocp-image-repository[Image set configuration examples]
 * xref:../../updating/updating-restricted-network-cluster/mirroring-image-repository.adoc#mirroring-image-set-partial[Mirroring an image set in a partially disconnected environment]
 * xref:../../updating/updating-restricted-network-cluster/mirroring-image-repository.adoc#mirroring-image-set-full[Mirroring an image set in a fully disconnected environment]
-* xref:../../updating/updating-restricted-network-cluster/mirroring-image-repository.adoc#oc-mirror-updating-cluster-manifests_mirroring-ocp-image-repository[Installing the ImageContentSourcePolicy and CatalogSource resources into the cluster]
+* xref:../../updating/updating-restricted-network-cluster/mirroring-image-repository.adoc#oc-mirror-updating-cluster-manifests_mirroring-ocp-image-repository[Configuring your cluster to use the resources generated by oc-mirror]
 
 // Performing a dry run
 include::modules/oc-mirror-dry-run.adoc[leveloffset=+2]