antony@notes:~/openshift$ cat "Disconnected-Installation-Mirroring.md"

Disconnected Installation Mirroring

2024-08-14· openshift ·OpenShift Container Platform

Disconnected Installation Mirroring

1. 關於離線安裝 Mirroring

可以使用 mirror registry 來確保您的叢集僅使用滿足組織對外部內容控制的 container images 。在限制網路中佈建的基礎結構上安裝叢集之前，您必須將所需的 container images mirror 到該環境中。若要 mirror container images ，必須有一個 mirror registry 。

2. 建立 Container image registry

如果已有 container image registry ，例如 Red Hat Quay，您可以將它用作 mirror registry。

2.1. Prerequisites

一個 OpenShift Container Platform 訂閱.
Red Hat Enterprise Linux (RHEL) 8 and 9 with Podman 3.4.2 or later and OpenSSL installed.
Fully qualified domain name for the Red Hat Quay service, 必須透過 DNS 伺服器解析。
Key-based SSH connectivity on the target host. SSH keys are automatically generated for local installs. For remote hosts, you must generate your own SSH keys.
2 or more vCPUs.
8 GB of RAM.
About 12 GB for OpenShift Container Platform 4.14 release images, or about 358 GB for OpenShift Container Platform 4.14 release images and OpenShift Container Platform 4.14 Red Hat Operator images. Up to 1 TB per stream or more is suggested.

2.2. Procedure

Download the mirror-registry.tar.gz package for the latest version of the mirror registry for Red Hat OpenShift found on the OpenShift console Downloads page.

$ tar -zxvf mirror-registry.tar.gz
image-archive.tar
execution-environment.tar
mirror-registry

Install the mirror registry for Red Hat OpenShift on your local host with your current user account by using the mirror-registry tool. For a full list of available flags, see “mirror registry for Red Hat OpenShift flags”.

$ hostname -f
bastion.ocp4.example.com
    
$ sudo mkdir /root/ocpmirror

# Check Disk Space
$ lsblk /dev/rhel/root
NAME      MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
rhel-root 253:0    0  349G  0 lvm  /

$ sudo lvs /dev/rhel/root
  LV   VG   Attr       LSize    Pool Origin Data%  Meta%  Move Log Cpy%Sync Convert
  root rhel -wi-ao---- 349.00g

## 密碼必須至少有 8 個字元，且不得包含空白字元
$ sudo ./mirror-registry install \
--quayHostname $(hostname -f) \
--quayRoot /root/ocpmirror \
--initUser bigred \
--initPassword srebigred
...
INFO[2024-08-07 10:11:06] Quay installed successfully, config data is stored in /root/ocpmirror
INFO[2024-08-07 10:11:06] Quay is available at https://bastion.ocp4.example.com:8443 with credentials (bigred, srebigred)

$ sudo cp -v /root/ocpmirror/quay-rootCA/rootCA.pem /etc/pki/ca-trust/source/anchors/ && \
sudo update-ca-trust

$ podman login -u bigred -p srebigred $(hostname -f):8443
Login Succeeded!

# 安裝完成後，可以查看已建立的服務:
$ systemctl -a | grep quay
  quay-app.service                                                                                                                     loaded    active   running   Quay Container
  quay-pod.service                                                                                                                     loaded    active   exited    Infra Container for Quay
  quay-postgres.service                                                                                                                loaded    active   running   PostgreSQL Podman Container for Quay
  quay-redis.service                                                                                                                   loaded    active   running   Redis Podman Container for Quay
  
# 這些服務會在系統重新啟動時自動啟動。quay-redis, quay-db, 和 quay-app 服務依賴於 quay-pod 服務。可以使用一個命令重新啟動所有服務：
$ sudo systemctl restart quay-pod

3. Mirroring images for a disconnected installation

3.1. 透過下載二進位檔安裝 OpenShift CLI

導覽到 Red Hat Customer Portal 上的 OpenShift Container Platform downloads page。
從 Product Variant 下拉清單中選擇架構。
從 Version 下拉清單中選擇 4.14.33 for RHEL 9 的版本。
按一下 OpenShift v4.14.33 Linux Client 項目旁的立即下載，並儲存檔案。
解壓縮檔案並將 oc 和 kubectl 命令移到 PATH 路徑底下

$ tar -zxvf oc-4.14.33-linux.tar.gz && \
sudo mv oc kubectl /usr/local/bin

3.2. 設定允許 Mirror Images 的憑證

建立 container image registry 憑證檔案，允許從 Red Hat mirror 影像到自建的 container image registry。

在安裝主機上完成下列步驟 :

從 Red Hat OpenShift Cluster Manager 下載您的 registry.redhat.io pull secret。
以 JSON 格式產生您的 pull secret：

$ mkdir -p $HOME/.docker
$ cat pull-secret.txt | jq . > $HOME/.docker/config.json

把私有 Registry 的身分驗證訊息也加到同一個檔案中：

$ podman login -u bigred -p srebigred \
  --authfile $HOME/.docker/config.json $(hostname -f):8443

# 檢查
$ cat $HOME/.docker/config.json
{
        "auths": {
                "bastion.ocp4.example.com:8443": {
                        "auth": "YmlncmVkOnNyZWJpZ3JlZA=="
                },
...以下省略

3.3. Mirroring the OpenShift Container Platform image repository

設定所需的環境變數：

$ OCP_RELEASE=4.14.33 \
LOCAL_REGISTRY='bastion.ocp4.example.com:8443' \
LOCAL_REPOSITORY='ocp4/openshift4' \
PRODUCT_REPO='openshift-release-dev' \
LOCAL_SECRET_JSON="$HOME/.podman/config.json" \
RELEASE_NAME="ocp-release" \
ARCHITECTURE='x86_64'

Mirror the version images to the mirror registry:

oc adm release mirror -a ${LOCAL_SECRET_JSON} \
--from=quay.io/${PRODUCT_REPO}/${RELEASE_NAME}:${OCP_RELEASE}-${ARCHITECTURE} \
--to=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY} \
--to-release-image=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY}:${OCP_RELEASE}-${ARCHITECTURE}

執行結果 :

...
Success
Update image:  bastion.ocp4.example.com:8443/ocp4/openshift4:4.14.33-x86_64
Mirror prefix: bastion.ocp4.example.com:8443/ocp4/openshift4
Mirror prefix: bastion.ocp4.example.com:8443/ocp4/openshift4:4.14.33-x86_64

To use the new mirrored repository to install, add the following section to the install-config.yaml:

imageContentSources:
- mirrors:
  - bastion.ocp4.example.com:8443/ocp4/openshift4
  source: quay.io/openshift-release-dev/ocp-release
- mirrors:
  - bastion.ocp4.example.com:8443/ocp4/openshift4
  source: quay.io/openshift-release-dev/ocp-v4.0-art-dev


To use the new mirrored repository for upgrades, use the following to create an ImageContentSourcePolicy:

apiVersion: operator.openshift.io/v1alpha1
kind: ImageContentSourcePolicy
metadata:
  name: example
spec:
  repositoryDigestMirrors:
  - mirrors:
    - bastion.ocp4.example.com:8443/ocp4/openshift4
    source: quay.io/openshift-release-dev/ocp-release
  - mirrors:
    - bastion.ocp4.example.com:8443/ocp4/openshift4
    source: quay.io/openshift-release-dev/ocp-v4.0-art-dev

3.4. Mirroring Operator catalogs for use with disconnected clusters

extract and mirror the content to the mirror registry

# Install oc-mirror
$ sudo tar -zxvf oc-mirror.rhel9.tar.gz -C /usr/local/bin/ && \
sudo chmod +x /usr/local/bin/oc-mirror

Setting up and configuring the Image Registry on OpenShift OpenShift 如何在 Deployment 不改設定的情況下，設 Deployment pods 跑在特定的某些節點上