Skip to content

Commit 8650b27

Browse files
mburke5678mburke5678
authored
Merge pull request #36351 from mburke5678/connected-to-disconnected
GH#36350: Create conneted to disconnected cluster document
2 parents f1f782f + ac9f6b9 commit 8650b27

10 files changed

+627
-0
lines changed

‎_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -461,6 +461,8 @@ Topics:
461461
File: preparing-for-users
462462
- Name: Configuring alert notifications
463463
File: configuring-alert-notifications
464+
- Name: Converting a connected cluster to a disconnected cluster
465+
File: connected-to-disconnected
464466
---
465467
Name: Updating clusters
466468
Dir: updating

‎images/create-nodes-okd.png‎

68.4 KB
Loading

‎modules/connected-to-disconnected-config-registry.adoc‎

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * post_installation_configuration/connected-to-disconnected.adoc
4+
5+
[id="connected-to-disconnected-config-registry_{context}"]
6+
= Configuring the cluster for the mirror registry
7+
8+
After creating and mirroring the images to the mirror registry, you must modify your cluster so that pods can pull images from the mirror registry.
9+
10+
You must:
11+
12+
* Add the mirror registry credentials to the global pull secret.
13+
* Add the mirror registry server certificate to the cluster.
14+
* Create an `ImageContentSourcePolicy` custom resource (ICSP), which associates the mirror registry with the source registry.
15+
16+
17+
18+
. Add mirror registry credential to the cluster global pull-secret:
19+
+
20+
[source,terminal]
21+
----
22+
$ oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson=<pull_secret_location> <1>
23+
----
24+
<1> Provide the path to the new pull secret file.
25+
+
26+
For example:
27+
+
28+
[source,terminal]
29+
----
30+
$ oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson=.mirrorsecretconfigjson
31+
----
32+
33+
. Add the CA-signed mirror registry server certificate to the nodes in the cluster:
34+
35+
.. Create a config map that includes the server certificate for the mirror registry
36+
+
37+
[source,terminal]
38+
----
39+
$ oc create configmap <config_map_name> --from-file=<mirror_address_host>..<port>=$path/ca.crt -n openshift-config
40+
----
41+
+
42+
For example:
43+
+
44+
[source,terminal]
45+
----
46+
S oc create configmap registry-config --from-file=mirror.registry.com..443=/root/certs/ca-chain.cert.pem -n openshift-config
47+
----
48+
49+
.. Use the config map to update the `image.config.openshift.io/cluster` custom resource (CR). {product-title} applies the changes to this CR to all nodes in the cluster:
50+
+
51+
[source,terminal]
52+
----
53+
$ oc patch image.config.openshift.io/cluster --patch '{"spec":{"additionalTrustedCA":{"name":"<config_map_name>"}}}' --type=merge
54+
----
55+
+
56+
For example:
57+
+
58+
[source,terminal]
59+
----
60+
$ oc patch image.config.openshift.io/cluster --patch '{"spec":{"additionalTrustedCA":{"name":"registry-config"}}}' --type=merge
61+
----
62+
63+
. Create an ICSP to redirect container pull requests from the online registries to the mirror registry:
64+
65+
.. Create the `ImageContentSourcePolicy` custom resource:
66+
+
67+
[source,yaml]
68+
----
69+
apiVersion: operator.openshift.io/v1alpha1
70+
kind: ImageContentSourcePolicy
71+
metadata:
72+
name: mirror-ocp
73+
spec:
74+
repositoryDigestMirrors:
75+
- mirrors:
76+
- mirror.registry.com:443/ocp/release <1>
77+
source: quay.io/openshift-release-dev/ocp-release <2>
78+
- mirrors:
79+
- mirror.registry.com:443/ocp/release
80+
source: quay.io/openshift-release-dev/ocp-v4.0-art-dev
81+
----
82+
<1> Specifies the name of the mirror image registry and repository.
83+
<2> Specifies the online registry and repository containing the content that is mirrored.
84+
85+
.. Create the ICSP object:
86+
+
87+
[source,terminal]
88+
----
89+
$ oc create -f registryrepomirror.yaml
90+
----
91+
+
92+
.Example output
93+
[source,terminal]
94+
----
95+
imagecontentsourcepolicy.operator.openshift.io/mirror-ocp created
96+
----
97+
+
98+
{product-title} applies the changes to this CR to all nodes in the cluster.
99+
100+
. Verify that the credentials, CA, and ICSP for mirror registry were added:
101+
102+
.. Log into a node:
103+
+
104+
[source,terminal]
105+
----
106+
$ oc debug node/<node_name>
107+
----
108+
109+
.. Set `/host` as the root directory within the debug shell:
110+
+
111+
[source,terminal]
112+
----
113+
sh-4.4# chroot /host
114+
----
115+
116+
.. Check the `config.json` file for the credentials:
117+
+
118+
[source,terminal]
119+
----
120+
sh-4.4# cat /var/lib/kubelet/config.json
121+
----
122+
+
123+
.Example output
124+
[source,terminal]
125+
----
126+
{"auths":{"brew.registry.redhat.io":{"xx=="},"brewregistry.stage.redhat.io":{"auth":"xxx=="},"mirror.registry.com:443":{"auth":"xx="}}} <1>
127+
----
128+
<1> Ensure that the mirror registry and credentials are present.
129+
130+
.. Change to the `certs.d` directory
131+
+
132+
[source,terminal]
133+
----
134+
sh-4.4# cd /etc/docker/certs.d/
135+
----
136+
137+
.. List the certificates in the `certs.d` directory:
138+
+
139+
[source,terminal]
140+
----
141+
sh-4.4# ls
142+
----
143+
+
144+
.Example output
145+
----
146+
image-registry.openshift-image-registry.svc.cluster.local:5000
147+
image-registry.openshift-image-registry.svc:5000
148+
mirror.registry.com:443 <1>
149+
----
150+
<1> Ensure that the mirror registry is in the list.
151+
152+
.. Check that the ICSP added the mirror registry to the `registries.conf` file:
153+
+
154+
[source,terminal]
155+
----
156+
sh-4.4# cat /etc/containers/registries.conf
157+
----
158+
+
159+
.Example output
160+
+
161+
[source,terminal]
162+
----
163+
unqualified-search-registries = ["registry.access.redhat.com", "docker.io"]
164+
165+
[[registry]]
166+
prefix = ""
167+
location = "quay.io/openshift-release-dev/ocp-release"
168+
mirror-by-digest-only = true
169+
170+
[[registry.mirror]]
171+
location = "mirror.registry.com:443/ocp/release"
172+
173+
[[registry]]
174+
prefix = ""
175+
location = "quay.io/openshift-release-dev/ocp-v4.0-art-dev"
176+
mirror-by-digest-only = true
177+
178+
[[registry.mirror]]
179+
location = "mirror.registry.com:443/ocp/release"
180+
----
181+
+
182+
The `registry.mirror` parameters indicate that the mirror registry is searched before the original registry.
183+
184+
.. Exit the node.
185+
+
186+
[source,terminal]
187+
----
188+
sh-4.4# exit
189+
----
190+

‎modules/connected-to-disconnected-disconnect.adoc‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * post_installation_configuration/connected-to-disconnected.adoc
4+
5+
[id="connected-to-disconnected-disconnect_{context}"]
6+
= Disconnect the cluster from the network
7+
8+
After mirroring all the required repositories and configuring your cluster to work as a disconnected cluster, you can disconnect the cluster from the network.
9+
10+
11+

‎modules/connected-to-disconnected-mirror-images.adoc‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * post_installation_configuration/connected-to-disconnected.adoc
4+
5+
[id="connected-to-disconnected-mirror-images_{context}"]
6+
= Mirroring the images
7+
8+
After the cluster is properly configured, you can mirror the images from your external repositories to the mirror repository.
9+
10+
.Procedure
11+
12+
. Mirror the Operator Lifecycle Manager (OLM) images:
13+
// copied from olm-mirroring-catalog.adoc
14+
+
15+
[source,terminal]
16+
----
17+
$ oc adm catalog mirror registry.redhat.io/redhat/redhat-operator-index:v{product-version} <mirror_registry>:<port>/olm -a <reg_creds>
18+
----
19+
+
20+
--
21+
where:
22+
23+
`product-version`:: Specifies the tag that corresponds to the version of {product-title} to install, such as `4.8`.
24+
`mirror_registry`:: Specifies the target registry and namespace to mirror the Operator content to, where `<namespace>` is any existing namespace on the registry.
25+
`reg_creds`:: Specifies the location of your modified `.dockerconfigjson` file.
26+
--
27+
+
28+
For example:
29+
+
30+
[source,terminal]
31+
----
32+
$ oc adm catalog mirror registry.redhat.io/redhat/redhat-operator-index:v4.8 mirror.registry.com:443/olm -a ./.dockerconfigjson --index-filter-by-os='.*'
33+
----
34+
35+
. Mirror the content for any other Red Hat-provided Operator:
36+
+
37+
[source,terminal]
38+
----
39+
$ oc adm catalog mirror <index_image> <mirror_registry>:<port>/<namespace> -a <reg_creds>
40+
----
41+
+
42+
--
43+
where:
44+
45+
`index_image`:: Specifies the index image for the catalog you want to mirror. For example, this might be a pruned index image that you created previously, or one of the source index images for the default catalogs, such as `{index-image-pullspec}`.
46+
`mirror_registry`:: Specifies the target registry and namespace to mirror the Operator content to, where `<namespace>` is any existing namespace on the registry.
47+
`reg_creds`:: Optional: Specifies the location of your registry credentials file, if required.
48+
--
49+
+
50+
For example:
51+
+
52+
[source,terminal]
53+
----
54+
$ oc adm catalog mirror registry.redhat.io/redhat/community-operator-index:v4.8 mirror.registry.com:443/olm -a ./.dockerconfigjson --index-filter-by-os='.*'
55+
----
56+
57+
. Mirror the {product-title} image repository:
58+
+
59+
[source,terminal]
60+
----
61+
$ oc adm release mirror -a .dockerconfigjson --from=quay.io/openshift-release-dev/ocp-release:v<product-version>-<architecture> --to=<local_registry>/<local_repository> --to-release-image=<local_registry>/<local_repository>:v<product-version>-<architecture>
62+
----
63+
+
64+
--
65+
where:
66+
67+
`product-version`:: Specifies the tag that corresponds to the version of {product-title} to install, such as `4.8.15-x86_64`.
68+
`architecture`:: Specifies the type of architecture for your server, such as `x86_64`.
69+
`local_registry`:: Specifies the registry domain name for your mirror repository.
70+
`local_repository`:: Specifies the name of the repository to create in your registry, such as `ocp4/openshift4`.
71+
--
72+
+
73+
For example:
74+
+
75+
[source,terminal]
76+
----
77+
$ oc adm release mirror -a .dockerconfigjson --from=quay.io/openshift-release-dev/ocp-release:4.8.15-x86_64 --to=mirror.registry.com:443/ocp/release --to-release-image=mirror.registry.com:443/ocp/release:4.8.15-x86_64
78+
----
79+
+
80+
.Example output
81+
+
82+
[source,terminal]
83+
+
84+
----
85+
info: Mirroring 109 images to mirror.registry.com/ocp/release ...
86+
mirror.registry.com:443/
87+
ocp/release
88+
manifests:
89+
sha256:086224cadce475029065a0efc5244923f43fb9bb3bb47637e0aaf1f32b9cad47 -> 4.8.15-x86_64-thanos
90+
sha256:0a214f12737cb1cfbec473cc301aa2c289d4837224c9603e99d1e90fc00328db -> 4.8.15-x86_64-kuryr-controller
91+
sha256:0cf5fd36ac4b95f9de506623b902118a90ff17a07b663aad5d57c425ca44038c -> 4.8.15-x86_64-pod
92+
sha256:0d1c356c26d6e5945a488ab2b050b75a8b838fc948a75c0fa13a9084974680cb -> 4.8.15-x86_64-kube-client-agent
93+
94+
…..
95+
sha256:66e37d2532607e6c91eedf23b9600b4db904ce68e92b43c43d5b417ca6c8e63c mirror.registry.com:443/ocp/release:4.5.41-multus-admission-controller
96+
sha256:d36efdbf8d5b2cbc4dcdbd64297107d88a31ef6b0ec4a39695915c10db4973f1 mirror.registry.com:443/ocp/release:4.5.41-cluster-kube-scheduler-operator
97+
sha256:bd1baa5c8239b23ecdf76819ddb63cd1cd6091119fecdbf1a0db1fb3760321a2 mirror.registry.com:443/ocp/release:4.5.41-aws-machine-controllers
98+
info: Mirroring completed in 2.02s (0B/s)
99+
100+
Success
101+
Update image: mirror.registry.com:443/ocp/release:4.5.41-x86_64
102+
Mirror prefix: mirror.registry.com:443/ocp/release
103+
----
104+
105+
. Mirror any other registries, as needed:
106+
+
107+
[source,terminal]
108+
----
109+
$ oc image mirror <online_registry>/my/image:latest <mirror_registry>
110+
----

‎modules/connected-to-disconnected-prepare-mirror.adoc‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * post_installation_configuration/connected-to-disconnected.adoc
4+
5+
[id="connected-to-disconnected-prepare-mirror_{context}"]
6+
= Preparing the cluster for mirroring
7+
8+
Before disconnecting your cluster, you must mirror, or copy, the images to a mirror registry that is reachable by every node in your disconnected cluster. In order to mirror the images, you must prepare your cluster by:
9+
10+
* Adding the mirror registry certificates to the list of trusted CAs on your host.
11+
* Creating a `.dockerconfigjson` file that contains your image pull secret, which is from the `cloud.openshift.com` token.
12+
13+
.Procedure
14+
15+
. Configuring credentials that allow image mirroring:
16+
17+
.. Add the CA certificate for the mirror registry, in the simple PEM or DER file formats, to the list of trusted CAs. For example:
18+
+
19+
[source,terminal]
20+
----
21+
$ cp </path/to/cert.crt> /usr/share/pki/ca-trust-source/anchors/
22+
----
23+
+
24+
--
25+
where::
26+
+
27+
`</path/to/cert.crt>`:: Specifies the path to the certificate on your local file system.
28+
--
29+
30+
.. Update the CA trust. For example, in Linux:
31+
+
32+
[source,terminal]
33+
----
34+
$ update-ca-trust
35+
----
36+
37+
.. Extract the `.dockerconfigjson` file from the global pull secret:
38+
+
39+
[source,terminal]
40+
----
41+
$ oc extract secret/pull-secret -n openshift-config --confirm --to=.
42+
----
43+
+
44+
.Example output
45+
[source,terminal]
46+
----
47+
.dockerconfigjson
48+
----
49+
50+
.. Edit the `.dockerconfigjson` file to add your mirror registry and authentication credentials and save it as a new file:
51+
// copied from olm-accessing-images-private-registries
52+
+
53+
[source,terminal]
54+
----
55+
{"auths":{"<local_registry>": {"auth": "<credentials>","email": "[email protected]"}}},"<registry>:<port>/<namespace>/":{"auth":"<token>"}}}
56+
----
57+
+
58+
where:
59+
+
60+
`<local_registry>`:: Specifies the registry domain name, and optionally the port, that your mirror registry uses to serve content.
61+
`auth`:: Specifies the base64-encoded user name and password for your mirror registry.
62+
`<registry>:<port>/<namespace>`:: Specifies the mirror registry details.
63+
`<token>`:: Specifies the base64-encoded `username:password` for your mirror registry.
64+
+
65+
For example:
66+
+
67+
[source,terminal]
68+
----
69+
$ {"auths":{"cloud.openshift.com":{"auth":"b3BlbnNoaWZ0Y3UjhGOVZPT0lOMEFaUjdPUzRGTA==","email":"[email protected]"},
70+
"quay.io":{"auth":"b3BlbnNoaWZ0LXJlbGVhc2UtZGOVZPT0lOMEFaUGSTd4VGVGVUjdPUzRGTA==","email":"[email protected]"},
71+
"registry.connect.redhat.com"{"auth":"NTE3MTMwNDB8dWhjLTFEZlN3VHkxOSTd4VGVGVU1MdTpleUpoYkdjaUailA==","email":"[email protected]"},
72+
"registry.redhat.io":{"auth":"NTE3MTMwNDB8dWhjLTFEZlN3VH3BGSTd4VGVGVU1MdTpleUpoYkdjaU9fZw==","email":"[email protected]"},
73+
"registry.svc.ci.openshift.org":{"auth":"dXNlcjpyWjAwWVFjSEJiT2RKVW1pSmg4dW92dGp1SXRxQ3RGN1pwajJhN1ZXeTRV"},"my-registry:5000/my-namespace/":{"auth":"dXNlcm5hbWU6cGFzc3dvcmQ="}}}
74+
----

0 commit comments

Comments
 (0)