Chapter 17. Airgapped environment
Chapter 17. Airgapped environment An air-gapped environment ensures security by physically isolating it from other networks and systems. You can install director Operator in an air-gapped environment to ensure security and provides certain regulatory requirements. 17.1. Configuring an airgapped environment To configure an airgapped environment, you must have access to both registry.redhat.io and the registry for airgapped environment. For more information on how to access both registries, see Mirroring catalog contents to airgapped registries . Prerequisites You have installed an Openshift Container Platform LTS release (OCP) 4.10 or later cluster, with an enabled baremetal cluster operator, and a provisioning network. You have installed the Kubevirt-Hyperconvered (OCP Virtualization Operator) and SR-IOV operator in the cluster. You have a disconnected registry adhering to docker v2 schema. For more information, see Mirroring images for a disconnected installation . You have access to a Satellite server or any other repository used to register the overcloud nodes and install packages. You have access to a local git repository to store deployment artifacts. You have installed the oc command line tool on your workstation. You have installed the podman and skopeo command line tools on your workstation. Procedure Create the openstack namespace: Create the index image and push it to your registry: Note You can get the latest bundle image from: Certified container images . Search for osp-director-operator-bundle . Mirror the relevant images based on the operator index image: After mirroring is complete, a manifests directory is generated in your current directory called manifests-osp-director-operator-index-<random_number> . Apply the created ImageContentSourcePolicy to your cluster: Replace <random_number> with the randomly generated number. Create a file named osp-director-operator.yaml and include the following YAML content to configure the three resources required to install director Operator: Create the new resources in the openstack namespace: Copy the required overcloud images to the respository: Note You can refer to Preparing a Satellite server for container images if Red Hat Satellite is used as the local registry. You can now proceed with Preparing the overcloud deployment with the director Operator . Verification Confirm that you have successfully installed the director Operator: Additional Resources Installing from OperatorHub using the CLI . Mirroring Operator catalogs for use with disconnected clusters . Mirroring catalog contents to airgapped registries . Preparing a Satellite server for container images . Obtaining container images from private registries .
oc new-project openstack podman login registry.redhat.io podman login your.registry.local BUNDLE_IMG="registry.redhat.io/rhosp-rhel8/osp-director-operator-bundle@sha256:c19099ac3340d364307a43e0ae2be949a588fefe8fcb17663049342e7587f055" oc adm catalog mirror USD{INDEX_IMG} your.registry.local --insecure --index-filter-by-os='Linux/x86_64' os apply -f manifests-osp-director-operator-index-<random_number>/imageContentSourcePolicy.yaml apiVersion: operators.coreos.com/v1alpha1 kind: CatalogSource metadata: name: osp-director-operator-index namespace: openstack spec: sourceType: grpc image: your.registry.local/osp-director-operator-index:1.3.x-y --- apiVersion: operators.coreos.com/v1 kind: OperatorGroup metadata: name: "osp-director-operator-group" namespace: openstack spec: targetNamespaces: - openstack --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: name: osp-director-operator-subscription namespace: openstack spec: config: env: - name: WATCH_NAMESPACE value: openstack,openshift-machine-api,openshift-sriov-network-operator source: osp-director-operator-index sourceNamespace: openstack name: osp-director-operator oc applycreate -f osp-director-operator.yaml for i in USD(podman search --limit 1000 "registry.redhat.io/rhosp-rhel8/openstack" --format="{{ .Name }}" | awk '{print USD1 ":" "16.2.4"}' | awk -F "/" '{print USD2 "/" USD3}'); do skopeo copy --all docker://registry.redhat.io/USDi docker://your.registry.local/USDi;done oc get operators NAME AGE osp-director-operator.openstack 5m