In this article, I will discuss the prerequisites and requirements for the successful implementation of Red Hat OpenShift 3.11 disconnected installation using Red Hat Satellite as the local Docker registry, which I have been able to do with the support of my colleagues. I also discuss adjustments that may be required post install.
This work is based on the following references:
- OpenShift disconnected installation documentation
- Using Satellite 6 Server for a Disconnect OpenShift Container Platform Install
Prerequisites
Required Images
Before starting the installation, you must have all the required Docker images synchronized and accessible from all your nodes.
You will not need to synchronize all the images (total 100+), and depending on your requirements you will need:
- Red Hat OpenShift Container Platform infrastructure component images, which are required for your base install, a total of 55 images
- Red Hat OpenShift Container Platform component images for the optional components, which are required for logging and monitoring, a total of 26 images
- Red Hat-certified Source-to-Image (S2I) builder images, which are required for your OpenShift applications, a total of 29 images
Additionally, if you know exactly which images your installation requires (by checking all the Docker images you have on an existing environment), you can pre-synchronize only those images.
Determine Red Hat OpenShift 3.11 version
At the time of this installation, version 3.11.69 was used; however, you should install the latest version available for the bugfixes and features.
This should be reflected in your inventory as follows:
openshift_release: v3.11 openshift_image_tag: v3.11.69 openshift_pkg_version: -3.11.69
Red Hat Satellite settings
On the Red Hat Satellite server, create a product within the organization that your Red Hat OpenShift nodes will be registered to
hammer product create --name "ocp311" --organization "MyOrg"
Then, you will need to create a repository for each image. This is what makes Red Hat Satellite behave slightly differently from other registries, as Red Hat Satellite will synchronize this image with the upstream server (registry.redhat.io), including all its versions. For example, to create a product for openshift3/ose-node, use the following command:
hammer repository create --name "openshift3/ose-node" --content-type "docker" --url "http://registry.redhat.io/" --docker-upstream-name "openshift3/ose-node" --product "ocp311" --organization "MyOrg"
Once you have created all the repositories, you can either synchronize using the GUI or via the command line:
hammer product synchronize --name "ocp311" --organization "MyOrg"
Ensure you add the product to the content view that your OpenShift will be registered to access.
The Red Hat Satellite server implements a Docker registry slightly differently from traditional Docker registries. This means the URL of a Docker image will change from:
registry.redhat.io/openshift3/ose-pod:v3.11.69
to
satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-pod:v3.11.69
If you do not tell the Red Hat OpenShift installer about this change, the installation will fail. I will provide further instructions in the next section.
Test an image pull:
docker pull satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-pod:v3.11.69
Red Hat OpenShift Ansible inventory modifications
For the installer to be able to use the Docker registry on Red Hat Satellite, restructure oreg_url as following:
oreg_url: satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-${component}:${version}
openshift_disable_check: "docker_image_availability"
openshift_docker_insecure_registries: "satellite.mydomain:5000"
openshift_docker_additional_registries: "satellite.mydomain:5000"
openshift_examples_modify_imagestreams: True
Set oreg_test_url to false:
oreg_test_login: false
Ensure oreg_auth values are commented out. Because no authentication is required, not commenting them out will cause issues:
# oreg_auth_user: '' # our registry doesn't require authentication. # oreg_auth_password: '' # our registry doesn't require authentication.
Additional inventory variables:
openshift_examples_registryurl: "{{ oreg_url | default(openshift_hosted_images_dict[openshift_deployment_type]) }}"
registry_host: "{{ openshift_examples_registryurl.split('/')[0] if '.' in openshift_examples_registryurl.split('/')[0] else '' }}"
Also, the pattern "MyOrg-ocp311-openshift3_ose-${component}:${version} will not work for etcd; therefore, you must specify the exact etcd docker image URL:
osm_etcd_image: satellite.mydomain:5000/MyOrg-ocp311-rhel7_etcd:3.2.22
Post-installation configuration
Depending on which applications you want to use in your OpenShift cluster, you may want to modify your image streams accordingly. I will not delve into these details here. However, certain tasks may still attempt to pull images from the online registry to perform their functions, such as diagnostics.
Therefore, to run diagnostics, the following images can be retagged to "trick" diagnostics so it doesn't attempt to pull the image from the online registry:
ansible nodes --timeout=120 -m shell -b -a 'docker pull satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-deployer:v3.11.69' ansible nodes --timeout=120 -m shell -b -a 'docker tag satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-control-plane:v3.11.69 registry.redhat.io/openshift3/ose-control-plane:v3.11.69' ansible nodes --timeout=120 -m shell -b -a 'docker tag satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-control-plane:v3.11.69 registry.redhat.io/openshift3/ose-control-plane:v3.11' ansible nodes --timeout=120 -m shell -b -a 'docker pull satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-node:v3.11.69' ansible nodes --timeout=120 -m shell -b -a 'docker tag satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-node:v3.11.69 registry.redhat.io/openshift3/ose-node:v3.11.69' ansible nodes --timeout=120 -m shell -b -a 'docker tag satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-node:v3.11.69 registry.redhat.io/openshift3/ose-node:v3.11' ansible nodes --timeout=120 -m shell -b -a 'docker pull satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-deployer:v3.11.69' ansible nodes --timeout=120 -m shell -b -a 'docker tag satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-deployer:v3.11.69 registry.redhat.io/openshift3/ose-deployer:v3.11.69' ansible nodes --timeout=120 -m shell -b -a 'docker tag satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-deployer:v3.11.69 registry.redhat.io/openshift3/ose-deployer:v3.11'
Then, you should be able to run:
oc adm diagnostics
Conclusion
To get your cluster installed in a disconnected mode, the instructions in this article should get you started. However, it may be possible to encounter a missing image or a reference to an online image depending on which applications you might be using. In that case, keep an eye out for such possibilities and consider updating the references in the deployment or build configuration of the application, or re-tagging Docker images as a temporary measure only (just to rule out the error being the image is not reachable).
Last updated: January 12, 2024