|
1 | | -# Deploy Global Hub Operator on a Disconnected Environment |
| 1 | +# Deploying Global Hub Operator in a disconnected environment |
| 2 | + |
| 3 | +In situations where a network connection is not available, you can deploy the Global Hub Operator in a disconnected environment. |
2 | 4 |
|
3 | 5 | ## Prerequisites |
4 | 6 |
|
5 | | -- Make sure you have an image registry, and a bastion host that has access to both the Internet and your mirror registry |
6 | | -- Have OLM([Operator Lifecycle Manager](https://docs.openshift.com/container-platform/4.11/operators/understanding/olm/olm-understanding-olm.html)) installed on your cluster |
7 | | -- The Advanced Cluster Management for Kubernetes has been installed on your cluster |
8 | | -- Make sure your user is authorized with cluster-admin permissions |
| 7 | +- An image registry and a bastion host that have access to both the Internet and to your mirror registry |
| 8 | +- Operator Lifecycle Manager ([OLM](https://docs.openshift.com/container-platform/4.11/operators/understanding/olm/olm-understanding-olm.html)) installed on your cluster |
| 9 | +- Red Hat Advanced Cluster Management for Kubernetes version 2.7, or later, installed on your cluster |
| 10 | +- A user account with `cluster-admin` permissions |
9 | 11 |
|
10 | 12 | ## Mirror Registry |
11 | 13 |
|
12 | | -Installing global hub in a disconnected environment involves the use of a mirror image registry. Which ensures your clusters only use container images that satisfy your organizational controls on external content. You can following the following two step to provision the mirror registry for global hub. |
13 | | -- [Creating a mirror registry](https://docs.openshift.com/container-platform/4.11/installing/disconnected_install/installing-mirroring-creating-registry.html#installing-mirroring-creating-registry) |
14 | | -- [Mirroring images for a disconnected installation](https://docs.openshift.com/container-platform/4.11/installing/disconnected_install/installing-mirroring-installation-images.html) |
| 14 | +You must use a mirror image registry when installing Multicluster Global Hub in a disconnected environment. The image registry ensures that your clusters only use container images that satisfy your organizational controls on external content. You can complete the following two-step procedure to provision the mirror registry for global hub. |
| 15 | +- [Creating a mirror registry](https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html/installing/disconnected-installation-mirroring#creating-mirror-registry) |
| 16 | +- [Mirroring images for a disconnected installation](https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html/installing/disconnected-installation-mirroring#installing-mirroring-installation-images) |
15 | 17 |
|
16 | | -## Create ImageContentSourcePolicy |
| 18 | +## Create an ImageContentSourcePolicy |
17 | 19 |
|
18 | | -In order to have your cluster obtain container images for the global hub operator from your mirror registry, rather than from the internet-hosted registries, you can configure an `ImageContentSourcePolicy` on your disconnected cluster to redirect image references to your mirror registry. |
| 20 | +You can configure an `ImageContentSourcePolicy` on your disconnected cluster to redirect image references to your mirror registry. This enables you to have your cluster obtain container images for the global hub operator on your mirror registry, rather than from the Internet-hosted registries. |
19 | 21 |
|
20 | 22 | **Note**: The ImageContentSourcePolicy can only support the image mirror with image digest. |
21 | 23 |
|
22 | | -```bash |
23 | | -$ cat ./doc/disconnected_environment/imagecontentsourcepolicy.yaml |
24 | | -apiVersion: operator.openshift.io/v1alpha1 |
25 | | -kind: ImageContentSourcePolicy |
26 | | -metadata: |
27 | | - name: global-hub-operator-icsp |
28 | | -spec: |
29 | | - repositoryDigestMirrors: |
30 | | - - mirrors: |
31 | | - - ${REGISTRY}//multicluster-globalhub |
32 | | - source: registry.redhat.io/multicluster-globalhub |
| 24 | +1. Create a file called `imagecontentsourcepolicy.yaml`: |
33 | 25 |
|
34 | | -$ envsubst < ./doc/disconnected-operator/imagecontentsourcepolicy.yaml | kubectl apply -f - |
35 | | -``` |
| 26 | + ``` |
| 27 | + $ cat ./doc/disconnected_environment/imagecontentsourcepolicy.yaml |
| 28 | + ``` |
| 29 | +
|
| 30 | +2. Add content that resembles the following content to the new file: |
| 31 | +
|
| 32 | + ``` |
| 33 | + apiVersion: operator.openshift.io/v1alpha1 |
| 34 | + kind: ImageContentSourcePolicy |
| 35 | + metadata: |
| 36 | + name: global-hub-operator-icsp |
| 37 | + spec: |
| 38 | + repositoryDigestMirrors: |
| 39 | + - mirrors: |
| 40 | + - ${REGISTRY}//multicluster-globalhub |
| 41 | + source: registry.redhat.io/multicluster-globalhub |
| 42 | + ``` |
| 43 | + |
| 44 | +3. Apply `imagecontentsourcepolicy.yaml` by running the following command: |
| 45 | +
|
| 46 | + ``` |
| 47 | + envsubst < ./doc/disconnected-operator/imagecontentsourcepolicy.yaml | kubectl apply -f - |
| 48 | + ``` |
36 | 49 |
|
37 | 50 | ## Configure the image pull secret |
38 | 51 |
|
39 | | -If the Operator or Operand images that are referenced by a subscribed Operator require access to a private registry, you can either [provide access to all namespaces in the cluster, or individual target tenant namespaces](https://access.redhat.com/documentation/en-us/openshift_container_platform/4.11/html-single/operators/index#olm-creating-catalog-from-index_olm-managing-custom-catalogs). |
| 52 | +If the Operator or Operand images that are referenced by a subscribed Operator require access to a private registry, you can either [provide access to all namespaces in the cluster, or to individual target tenant namespaces](https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html-single/operators/index#olm-creating-catalog-from-index_olm-managing-custom-catalogs). |
40 | 53 |
|
41 | | -### Option 1. Configure the globalhub imagepullsecret in an Openshift Cluster |
| 54 | +### Option 1. Configure the global hub image pull secret in an OpenShift cluster |
42 | 55 |
|
43 | | -**Note**: if you apply this on a pre-existing cluster, it will cause a rolling restart of all nodes. |
| 56 | +**Note**: Applying the image pull secret on a pre-existing cluster causes a rolling restart of all of the nodes. |
44 | 57 |
|
45 | | -```bash |
46 | | -$ export USER=<the-registry-user> |
47 | | -$ export PASSWORD=<the-registry-password> |
48 | | -$ oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' > pull_secret.yaml |
49 | | -$ oc registry login --registry=${REGISTRY} --auth-basic="$USER:$PASSWORD" --to=pull_secret.yaml |
50 | | -$ oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson=pull_secret.yaml |
51 | | -$ rm pull_secret.yaml |
52 | | -``` |
| 58 | +1. Export the user name from the pull secret: |
| 59 | + ``` |
| 60 | + export USER=<the-registry-user> |
| 61 | + ``` |
| 62 | +
|
| 63 | +2. Export the password from the pull secret: |
| 64 | + ``` |
| 65 | + export PASSWORD=<the-registry-password> |
| 66 | + ``` |
| 67 | +
|
| 68 | +3. Copy the pull secret: |
| 69 | + ``` |
| 70 | + oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' > pull_secret.yaml |
| 71 | + ``` |
| 72 | +
|
| 73 | +4. Log in using the pull secret: |
| 74 | + ``` |
| 75 | + oc registry login --registry=${REGISTRY} --auth-basic="$USER:$PASSWORD" --to=pull_secret.yaml |
| 76 | + ``` |
| 77 | +
|
| 78 | +5. Specify the global hub image pull secret: |
| 79 | + ``` |
| 80 | + oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson=pull_secret.yaml |
| 81 | + ``` |
| 82 | +
|
| 83 | +6. Remove the old pull secret: |
| 84 | + ``` |
| 85 | + rm pull_secret.yaml |
| 86 | + ``` |
53 | 87 |
|
54 | 88 | ### Option 2. Configure image pull secret to an individual namespace |
55 | 89 |
|
56 | | -```bash |
57 | | -# create the secret in the tenant namespace |
58 | | -$ oc create secret generic <secret_name> \ |
59 | | - -n <tenant_namespace> \ |
| 90 | +1. Create the secret in the tenant namespace by running the following command: |
| 91 | + ``` |
| 92 | + oc create secret generic <secret_name> -n <tenant_namespace> \ |
60 | 93 | --from-file=.dockerconfigjson=<path/to/registry/credentials> \ |
61 | 94 | --type=kubernetes.io/dockerconfigjson |
| 95 | + ``` |
62 | 96 |
|
63 | | -# link the secret to the service account for your operator/operand |
64 | | -$ oc secrets link <operator_sa> -n <tenant_namespace> <secret_name> --for=pull |
65 | | -``` |
| 97 | +2. Link the secret to the service account for your operator/operand: |
| 98 | + ``` |
| 99 | + oc secrets link <operator_sa> -n <tenant_namespace> <secret_name> --for=pull |
| 100 | + ``` |
66 | 101 |
|
67 | | -## Add GlobalHub operator catalog |
| 102 | +## Add the GlobalHub operator catalog |
68 | 103 |
|
69 | 104 | ### Build the GlobalHub catalog from upstream [Optional] |
70 | 105 |
|
@@ -150,7 +185,7 @@ multicluster-global-hub-operator Community Operators 28m |
150 | 185 | name: multicluster-global-hub-operator |
151 | 186 | namespace: open-cluster-management |
152 | 187 | spec: |
153 | | - channel: release-0.7 |
| 188 | + channel: alpha |
154 | 189 | installPlanApproval: Automatic |
155 | 190 | name: multicluster-global-hub-operator |
156 | 191 | source: global-hub-operator-catalog |
|
0 commit comments