Red Hat OpenShift 3.11 disconnected installation using Satellite Docker registry

Red Hat OpenShift 3.11 disconnected installation using Satellite Docker registry

In this article, I will discuss the prerequisites and requirements for the successful implementation of Red Hat OpenShift 3.11 disconnected installation using Red Hat Satellite as the local Docker registry, which I have been able to do with the support of my colleagues. I also discuss adjustments that may be required post install.

This work is based on the following references:

Prerequisites

Required Images

Before starting the installation, you must have all the required Docker images synchronized and accessible from all your nodes.

You will not need to synchronize all the images (total 100+), and depending on your requirements you will need:

  • Red Hat OpenShift Container Platform infrastructure component images, which are required for your base install, a total of 55 images
  • Red Hat OpenShift Container Platform component images for the optional components, which are required for logging and monitoring, a total of 26 images
  • Red Hat-certified Source-to-Image (S2I) builder images, which are required for your OpenShift applications, a total of 29 images

Additionally, if you know exactly which images your installation requires (by checking all the Docker images you have on an existing environment), you can pre-synchronize only those images.

Determine Red Hat OpenShift 3.11 version

At the time of this installation, version 3.11.69 was used; however, you should install the latest version available for the bugfixes and features.

This should be reflected in your inventory as follows:

openshift_release: v3.11
openshift_image_tag: v3.11.69
openshift_pkg_version: -3.11.69

Red Hat Satellite settings

On the Red Hat Satellite server, create a product within the organization that your Red Hat OpenShift nodes will be registered to

hammer product create --name "ocp311" --organization "MyOrg"

Then, you will need to create a repository for each image. This is what makes Red Hat Satellite behave slightly differently from other registries, as Red Hat Satellite will synchronize this image with the upstream server (registry.redhat.io), including all its versions. For example, to create a product for openshift3/ose-node, use the following command:

hammer repository create --name "openshift3/ose-node" --content-type "docker" --url "http://registry.redhat.io/" --docker-upstream-name "openshift3/ose-node" --product "ocp311" --organization "MyOrg"

Once you have created all the repositories, you can either synchronize using the GUI or via the command line:

hammer product synchronize --name "ocp311" --organization "MyOrg"

Ensure you add the product to the content view that your OpenShift will be registered to access.

The Red Hat Satellite server implements a Docker registry slightly differently from traditional Docker registries. This means the URL of a Docker image will change from:

registry.redhat.io/openshift3/ose-pod:v3.11.69

to

satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-pod:v3.11.69

If you do not tell the Red Hat OpenShift installer about this change, the installation will fail. I will provide further instructions in the next section.

Test an image pull:

docker pull satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-pod:v3.11.69

Red Hat OpenShift Ansible inventory modifications

For the installer to be able to use the Docker registry on Red Hat Satellite, restructure oreg_url as following:

oreg_url: satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-${component}:${version}
openshift_disable_check: "docker_image_availability"
openshift_docker_insecure_registries: "satellite.mydomain:5000"
openshift_docker_additional_registries: "satellite.mydomain:5000"
openshift_examples_modify_imagestreams: True

Set oreg_test_url to false:

oreg_test_login: false

Ensure oreg_auth values are commented out. Because no authentication is required, not commenting them out will cause issues:

# oreg_auth_user: '' # our registry doesn't require authentication. 
# oreg_auth_password: '' # our registry doesn't require authentication.

Additional inventory variables:

openshift_examples_registryurl: "{{ oreg_url | default(openshift_hosted_images_dict[openshift_deployment_type]) }}"
registry_host: "{{ openshift_examples_registryurl.split('/')[0] if '.' in openshift_examples_registryurl.split('/')[0] else '' }}"

Also, the pattern "MyOrg-ocp311-openshift3_ose-${component}:${version} will not work for etcd; therefore, you must specify the exact etcd docker image URL:

osm_etcd_image: satellite.mydomain:5000/MyOrg-ocp311-rhel7_etcd:3.2.22

Post-installation configuration

Depending on which applications you want to use in your OpenShift cluster, you may want to modify your image streams accordingly. I will not delve into these details here. However, certain tasks may still attempt to pull images from the online registry to perform their functions, such as diagnostics.

Therefore, to run diagnostics, the following images can be retagged to “trick” diagnostics so it doesn’t attempt to pull the image from the online registry:

ansible nodes --timeout=120 -m shell -b -a 'docker pull satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-deployer:v3.11.69'
ansible nodes --timeout=120 -m shell -b -a 'docker tag satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-control-plane:v3.11.69 registry.redhat.io/openshift3/ose-control-plane:v3.11.69'
ansible nodes --timeout=120 -m shell -b -a 'docker tag satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-control-plane:v3.11.69 registry.redhat.io/openshift3/ose-control-plane:v3.11'

ansible nodes --timeout=120 -m shell -b -a 'docker pull satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-node:v3.11.69'
ansible nodes --timeout=120 -m shell -b -a 'docker tag satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-node:v3.11.69 registry.redhat.io/openshift3/ose-node:v3.11.69'
ansible nodes --timeout=120 -m shell -b -a 'docker tag satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-node:v3.11.69 registry.redhat.io/openshift3/ose-node:v3.11'

ansible nodes --timeout=120 -m shell -b -a 'docker pull satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-deployer:v3.11.69'
ansible nodes --timeout=120 -m shell -b -a 'docker tag satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-deployer:v3.11.69 registry.redhat.io/openshift3/ose-deployer:v3.11.69'
ansible nodes --timeout=120 -m shell -b -a 'docker tag satellite.mydomain:5000/MyOrg-ocp311-openshift3_ose-deployer:v3.11.69 registry.redhat.io/openshift3/ose-deployer:v3.11'

Then, you should be able to run:

oc adm diagnostics

Conclusion

To get your cluster installed in a disconnected mode, the instructions in this article should get you started. However, it may be possible to encounter a missing image or a reference to an online image depending on which applications you might be using. In that case, keep an eye out for such possibilities and consider updating the references in the deployment or build configuration of the application, or re-tagging Docker images as a temporary measure only (just to rule out the error being the image is not reachable).

Everything you need to grow your career.

With your free Red Hat Developer program membership, unlock our library of cheat sheets and ebooks on next-generation application development.

SIGN UP

To learn more, visit our Linux containers or microservices pages.

Join Red Hat Developer and get access to handy cheat sheets, free books, and product downloads that can help you with your microservices and container application development.

For more information about Red Hat OpenShift and other related topics, visit: OpenShift, OpenShift Online.

Share