You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Confirm that no new content was added since I did the reorg of the disconnected install assemblies (up to date as of 2/13)
12
-
* Add info about mirroring to a namespace
13
-
* Test and get some actual example output
14
-
* Use cases for changing image set config between runs
15
-
////
9
+
Running your cluster in a restricted network without direct internet connectivity is possible by installing the cluster from a mirrored set of {product-title} container images in a private registry. This registry must be running at all times as long as the cluster is running. See the xref:../../installing/disconnected_install/installing-mirroring-disconnected.adoc#prerequisites_installing-mirroring-disconnected[Prerequisites] section for more information.
16
10
17
-
You can ensure your clusters only use container images that satisfy your organizational controls on external content. Before you install a cluster on infrastructure that you provision in a restricted network, you must mirror the required container images into that environment. To mirror container images, you must have a registry for mirroring.
18
-
19
-
You can use the oc-mirror OpenShift CLI (`oc`) plug-in to mirror images to a mirror registry in your fully or partially disconnected environments.
20
-
21
-
:FeatureName: Mirroring images for disconnected environments using the oc-mirror plug-in
You can use the oc-mirror OpenShift CLI (`oc`) plug-in to mirror images to a mirror registry in your fully or partially disconnected environments. You must run oc-mirror from a system with internet connectivity in order to download the required images from the official Red Hat registries.
23
12
24
13
The following steps outline the high-level workflow on how to use the oc-mirror plug-in to mirror images to a mirror registry:
25
14
26
15
. Create an image set configuration file.
27
-
. Mirror the image set to the mirror registry.
16
+
. Mirror the image set to the mirror registry by using one of the following methods:
17
+
** Mirror an image set directly to the mirror registry.
18
+
** Mirror an image set to disk, transfer the image set to the target environment, then upload the image set to the target mirror registry.
28
19
. Install the `ImageContentSourcePolicy` and `CatalogSource` resources that were generated by oc-mirror into the cluster.
29
20
. Repeat these steps to update your mirror registry as necessary.
* xref:../../installing/disconnected_install/installing-mirroring-disconnected.adoc#oc-mirror-imageset-config-params_installing-mirroring-disconnected[Image set configuration parameters]
78
69
* xref:../../installing/disconnected_install/installing-mirroring-disconnected.adoc#oc-mirror-image-set-examples_installing-mirroring-disconnected[Image set configuration examples]
70
+
* xref:../../updating/updating-restricted-network-cluster.adoc#update-service-overview_updating-restricted-network-cluster[About the OpenShift Update Service]
After your target mirror registry is populated with the initial image set, be sure to update it regularly so that it has the latest content. You can optionally set up a cron job, if possible, so that the mirror registry is updated on a regular basis.
108
+
109
+
Ensure that you update your image set configuration to add or remove {product-title} and Operator releases as necessary. Any images that are removed are pruned from the mirror registry.
* xref:../../installing/disconnected_install/installing-mirroring-disconnected.adoc#oc-mirror-image-set-examples_installing-mirroring-disconnected[Image set configuration examples]
118
121
* xref:../../installing/disconnected_install/installing-mirroring-disconnected.adoc#mirroring-image-set-partial[Mirroring an image set in a partially disconnected environment]
119
122
* xref:../../installing/disconnected_install/installing-mirroring-disconnected.adoc#mirroring-image-set-full[Mirroring an image set in a fully disconnected environment]
120
123
* xref:../../installing/disconnected_install/installing-mirroring-disconnected.adoc#oc-mirror-updating-cluster-manifests_installing-mirroring-disconnected[Installing the ImageContentSourcePolicy and CatalogSource resources into the cluster]
Copy file name to clipboardExpand all lines: modules/oc-mirror-about.adoc
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,6 +12,8 @@ You can use the oc-mirror OpenShift CLI (`oc`) plug-in to mirror all required {p
12
12
* Maintains update paths for {product-title} and Operators.
13
13
* Uses a declarative image set configuration file to include only the {product-title} releases, Operators, and images that your cluster needs.
14
14
* Performs incremental mirroring, which reduces the size of future image sets.
15
+
* Prunes images from the target mirror registry that were excluded from the image set configuration since the previous execution.
16
+
* Optionally generates supporting artifacts for OpenShift Update Service (OSUS) usage.
15
17
16
18
When using the oc-mirror plug-in, you specify which content to mirror in an image set configuration file. In this YAML file, you can fine-tune the configuration to only include the {product-title} releases and Operators that your cluster needs. This reduces the amount of data that you need to download and transfer. The oc-mirror plug-in can also mirror arbitrary helm charts and additional container images to assist users in seamlessly synchronizing their workloads onto mirror registries.
The following tables describe the `oc mirror` subcommands and flags:
10
+
11
+
.oc mirror subcommands
12
+
[cols="1,2",options="header"]
13
+
|===
14
+
|Subcommand
15
+
|Description
16
+
17
+
|`completion`
18
+
|Generate the autocompletion script for the specified shell.
19
+
20
+
|`describe`
21
+
|Output the contents of an image set.
22
+
23
+
|`help`
24
+
|Show help about any subcommand.
25
+
26
+
|`init`
27
+
|Output an initial image set configuration template.
28
+
29
+
|`list`
30
+
|List available platform and Operator content and their version.
31
+
32
+
|`version`
33
+
|Output the oc-mirror version.
34
+
35
+
|===
36
+
37
+
.oc mirror flags
38
+
[cols="1,2",options="header"]
39
+
|===
40
+
|Flag
41
+
|Description
42
+
43
+
|`-c`, `--config``<string>`
44
+
|Specify the path to an image set configuration file.
45
+
46
+
|`--continue-on-error`
47
+
|If any non image-pull related error occurs, continue and attempt to mirror as much as possible.
48
+
49
+
|`--dest-skip-tls`
50
+
|Disable TLS validation for the target registry.
51
+
52
+
|`--dest-use-http`
53
+
|Use plain HTTP for the target registry.
54
+
55
+
|`--dry-run`
56
+
|Print actions without mirroring images. Generates `mapping.txt` and `pruning-plan.json` files.
57
+
58
+
|`--from <string>`
59
+
|Specify the path to an image set archive that was generated by an execution of oc-mirror to load into a target registry.
60
+
61
+
|`-h`, `--help`
62
+
|Show the help.
63
+
64
+
|`--ignore-history`
65
+
|Ignore past mirrors when downloading images and packing layers. Disables incremental mirroring and might download more data.
66
+
67
+
|`--manifests-only`
68
+
|Generate manifests for `ImageContentSourcePolicy` and `CatalogSource` objects to configure a cluster to use the mirror registry, but do not actually mirror any images.
69
+
70
+
|`--max-per-registry <int>`
71
+
|Specify the number of concurrent requests allowed per registry. The default is `6`.
72
+
73
+
|`--skip-cleanup`
74
+
|Skip removal of artifact directories.
75
+
76
+
|`--skip-image-pin`
77
+
|Do not replace image tags with digest pins in Operator catalogs.
78
+
79
+
|`--skip-metadata-check`
80
+
|Skip metadata when publishing an image set. This is only recommended when the image set was created with `--ignore-history`.
81
+
82
+
|`--skip-missing`
83
+
|If an image is not found, skip it instead of reporting an error and aborting execution. Does not apply to custom images explicitly specified in the image set configuration.
84
+
85
+
|`--skip-verification`
86
+
|Skip digest verification.
87
+
88
+
|`--source-skip-tls`
89
+
|Disable TLS validation for the source registry.
90
+
91
+
|`--source-use-http`
92
+
|Use plain HTTP for the source registry.
93
+
94
+
|`-v`, `--verbose``<int>`
95
+
|Specify the number for the log level verbosity. Valid values are `0` - `9`. The default is `0`.
Copy file name to clipboardExpand all lines: modules/oc-mirror-creating-image-set-config.adoc
+45-19Lines changed: 45 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,32 +15,58 @@ You must specify a storage backend in the image set configuration file. This sto
15
15
Do not delete or modify the metadata that is generated by the oc-mirror plug-in. You must use the same storage backend every time you run the oc-mirror plug-in for the same mirror registry.
16
16
====
17
17
18
+
.Prerequisites
19
+
20
+
* You have created a container image registry credentials file. For instructions, see _Configuring credentials that allow images to be mirrored_.
21
+
18
22
.Procedure
19
23
20
-
. Create an `ImageSetConfiguration` resource that specifies the necessary configuration details:
24
+
. Use the `oc mirror init` command to create a template for the image set configuration and save it to a file called `imageset-config.yaml`:
<1> The maximum size, in GiB, of each file within the image set.
39
-
<2> The channel to retrieve the {product-title} images from.
40
-
<3> The Operator catalog to retrieve the {product-title} images from.
41
-
<4> The back-end location to save the image set metadata to. This location can be a registry or local directory. It is required to specify `storageConfig` values.
42
-
<5> The registry URL for the storage backend.
59
+
<1> Add `archiveSize` to set the maximum size, in GiB, of each file within the image set.
60
+
<2> Set the back-end location to save the image set metadata to. This location can be a registry or local directory. It is required to specify `storageConfig` values.
61
+
<3> Set the registry URL for the storage backend.
62
+
<4> Set the channel to retrieve the {product-title} images from.
63
+
<5> Add `graph: true` to generate the OpenShift Update Service (OSUS) graph image to allow for an improved cluster update experience when using the web console. For more information, see _About the OpenShift Update Service_.
64
+
<6> Set the Operator catalog to retrieve the {product-title} images from.
65
+
<7> Specify only certain Operator packages and channels to include in the image set. Remove this field to retrieve all packages in the catalog.
66
+
<8> Specify any additional images to include in image set.
43
67
+
44
-
This example pulls images from the `stable-4.9` channel for the `registry.redhat.io/redhat/redhat-operator-index:v4.9` operator catalog and saves the image set metadata to the `example.com/example/oc-mirror` registry.
68
+
See _Image set configuration parameters_for the full list of parameters and _Image set configuration examples_ for various mirroring use cases.
45
69
46
-
. Save the file as `imageset-config.yaml`. This file is required by the `oc mirror` command when mirroring content.
70
+
. Save the updated file.
71
+
+
72
+
This image set configuration file is required by the `oc mirror` command when mirroring content.
Copy file name to clipboardExpand all lines: modules/oc-mirror-differential-updates.adoc
+11-16Lines changed: 11 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,32 +4,27 @@
4
4
5
5
:_content-type: PROCEDURE
6
6
[id="oc-mirror-differential-updates_{context}"]
7
-
= Updating your mirror registry
7
+
= Updating your mirror registry content
8
8
9
-
After you publish a full image set to the mirror registry, you can use the oc-mirror plug-in to update the mirror registry with updated images.
9
+
After you publish the initial image set to the mirror registry, you can use the oc-mirror plug-in to keep your disconnected clusters updated.
10
10
11
-
When you run the oc-mirror plug-in again, it generates an image set that only contains new and updated images since the previous execution.
12
-
13
-
[NOTE]
14
-
====
15
-
You must use the same storage backend as the initial execution of oc-mirror for the same mirror registry. Do not delete or modify the metadata that is generated by the oc-mirror plug-in.
16
-
====
17
-
18
-
Because it only pulls in the differences since the previous image set was created, the generated image set is often smaller and faster to process than the initial image set.
19
-
20
-
[IMPORTANT]
21
-
====
22
-
Generated image sets are sequential and must be synchronized to the target mirror registry in order.
23
-
====
11
+
Depending on your image set configuration, oc-mirror automatically detects newer releases of {product-title} and your selected Operators that have been released after you completed the inital mirror. It is recommended to run oc-mirror at regular intervals, for example in a nightly cron job, to receive product and security updates on a timely basis.
24
12
25
13
.Prerequisites
26
14
27
15
* You have used the oc-mirror plug-in to mirror the initial image set to your mirror registry.
28
16
* You have access to the storage backend that was used for the initial execution of the oc-mirror plug-in.
17
+
+
18
+
[NOTE]
19
+
====
20
+
You must use the same storage backend as the initial execution of oc-mirror for the same mirror registry. Do not delete or modify the metadata image that is generated by the oc-mirror plug-in.
21
+
====
29
22
30
23
.Procedure
31
24
32
-
. Follow the same steps that you used to create the initial image set and mirror it to the mirror registry. For instructions, see _Mirroring an image set in a partially disconnected environment_ or _Mirroring an image set in a fully disconnected environment_.
25
+
. If necessary, update your image set configuration file to pick up new {product-title} and Operator versions. See _Image set configuration examples_ for example mirroring use cases.
26
+
27
+
. Follow the same steps that you used to mirror your initial image set to the mirror registry. For instructions, see _Mirroring an image set in a partially disconnected environment_ or _Mirroring an image set in a fully disconnected environment_.
<1> Pass in the image set .tar file to mirror, named `mirror_seq1_000000.tar` in this example. If an `archiveSize` value was specified in the image set configuration file, the image set might be broken up into multiple .tar files. In this situation, you can pass in a directory that contains the image set .tar files.
29
29
<2> Specify the registry to mirror the image set file to. The registry must start with `docker://`. If you specify a top-level namespace for the mirror registry, you must also use this same namespace on subsequent executions.
You can use oc-mirror to perform a dry run, without actually mirroring any images. This allows you to review the list of images that would be mirrored, as well as any images that would be pruned from the mirror registry. It also allows you to catch any errors with your image set configuration early or use the generated list of images with other tools to carry out the mirroring operation.
10
+
11
+
.Prerequisites
12
+
13
+
* You have access to the internet to obtain the necessary container images.
14
+
* You have installed the OpenShift CLI (`oc`).
15
+
* You have installed the `oc-mirror` CLI plug-in.
16
+
* You have created the image set configuration file.
17
+
18
+
.Procedure
19
+
20
+
. Run the `oc mirror` command with the `--dry-run` flag to perform a dry run:
0 commit comments