Chapter 8. Creating a Podman site in a restricted environment
Chapter 8. Creating a Podman site in a restricted environment In a production environment which has no or limited internet access, you might need to mirror the required images to create a site. This procedure outlines how to use Podman and tar files for managing container images. If a registry is available in the restricted environment, the same process can be followed. Ensure that the environment variables are set to reference the images in the registry after they have been populated. Note If you want to use a Linux machine with a proxy to pull images, you can configure Podman to use a proxy: USD systemctl --user edit podman Add the following to the service definition: [Service] Environment="HTTP_PROXY=<proxy-domain>:<proxy-port>" Environment="HTTPS_PROXY=<proxy-domain>:<proxy-port>" To ensure that podman uses the new configuration: USD systemctl --user daemon-reload USD systemctl --user restart podman Prerequisites A Linux machine with internet access to download the images. A Linux machine in a restricted environment where you want to create the site. This can be one machine, where the machine is moved to the restricted environment. Procedure Log in to registry.redhat.io on the machine with internet access: USD podman login -u USERNAME -p PASSWORD registry.redhat.io Download the images required for a Podman site by creating a site: USD skupper init If you require a console, use the following command to ensure the extra images are downloaded USD skupper init --enable-console --enable-flow-collector After creating the site, the following images are listed using podman image ls -a : registry.redhat.io/service-interconnect/skupper-router-rhel9 registry.redhat.io/service-interconnect/skupper-controller-podman-rhel9 registry.redhat.io/service-interconnect/skupper-flow-collector-rhel9 (console only) registry.redhat.io/openshift4/ose-prometheus (console only) The tags are determined by the version of the skupper CLI. Create tar files for each image, for example: USD podman save -o skupper-controller.tar registry.redhat.io/service-interconnect/skupper-controller-podman-rhel9:<tag> where <tag> is the tag shown from using the podman image ls -a command. Copy the tar files to the machine in the restricted environment. On the machine in the restricted environment, load the image from the tar files, for example: podman load -i skupper-controller.tar Change the image tags to remove reference to registry.redhat.io : podman tag registry.redhat.io/service-interconnect/skupper-router-rhel9:<tag> service-interconnect/skupper-router-rhel9:<tag> This step is required to avoid the machine attempting to pull images from registry.redhat.io . Configure the skupper CLI to use the mirrored images by setting the following environment variables: USD export SKUPPER_CONTROLLER_PODMAN_IMAGE=service-interconnect/skupper-controller-podman-rhel9:<tag> USD export QDROUTERD_IMAGE=service-interconnect/skupper-router-rhel9:<tag> If you require a console, you also require the following environment variables: USD export SKUPPER_FLOW_COLLECTOR_IMAGE=service-interconnect/skupper-flow-collector-rhel9:<tag> USD export PROMETHEUS_SERVER_IMAGE=openshift4/ose-prometheus:<tag> Create a site, for example:
systemctl --user edit podman [Service] Environment="HTTP_PROXY=<proxy-domain>:<proxy-port>" Environment="HTTPS_PROXY=<proxy-domain>:<proxy-port>" systemctl --user daemon-reload systemctl --user restart podman podman login -u USERNAME -p PASSWORD registry.redhat.io skupper init skupper init --enable-console --enable-flow-collector podman save -o skupper-controller.tar registry.redhat.io/service-interconnect/skupper-controller-podman-rhel9:<tag> load -i skupper-controller.tar tag registry.redhat.io/service-interconnect/skupper-router-rhel9:<tag> service-interconnect/skupper-router-rhel9:<tag> export SKUPPER_CONTROLLER_PODMAN_IMAGE=service-interconnect/skupper-controller-podman-rhel9:<tag> export QDROUTERD_IMAGE=service-interconnect/skupper-router-rhel9:<tag> export SKUPPER_FLOW_COLLECTOR_IMAGE=service-interconnect/skupper-flow-collector-rhel9:<tag> export PROMETHEUS_SERVER_IMAGE=openshift4/ose-prometheus:<tag> skupper init