Mirroring images to your private container registry

IBM® Cloud Pak for Data images are accessible from the IBM Entitled Registry. In most situations, it is strongly recommended that you mirror the necessary software images from the IBM Entitled Registry to a private container registry.

Important:
You must mirror the necessary images to your private container registry in the following situations:
  • Your cluster is air-gapped (also called an offline or disconnected cluster)
  • Your cluster uses an allowlist to permit direct access by specific sites and the allowlist does not include the IBM Entitled Registry
  • Your cluster uses a blocklist to prevent direct access by specific sites and the blocklist includes the IBM Entitled Registry
Even if these situations do not apply to your environment, you should consider using a private container registry if you want to:
  • Run security scans against the software images before you install them on your cluster
  • Ensure that you have the same images available for multiple deployments, such as development or test environments and production environments

The only situation in which you might consider pulling images directly from the IBM Entitled Registry is when your cluster is not air-gapped, your network is extremely reliable, and latency is not a concern. However, for predictable and reliable performance, you should mirror the images to a private container registry.

Setting up a private container registry

For details about which container registries you can use with Red Hat® OpenShift® Container Platform, see the Red Hat OpenShift Container Platform documentation:
Your private container registry must meet the following requirements:

In addition, the private container registry must be accessible from all of the nodes in the cluster and all of the nodes must have permission to push to and pull from the private container registry.

Restriction: You cannot use the integrated OpenShift Container Platform registry. It does not support multi-architecture images and is not compliant with the Docker Image Manifest Version 2, Schema 2.
As part of your private container registry set up, ensure that you follow the guidelines for configuring the registry in the Red Hat OpenShift Container Platform documentation:

Image prefixes

IBM Cloud Pak software uses the following prefixes to identify images:

Tag Used for
cp.icr.io/cp Images that are pulled from the IBM Entitled Registry that require an entitlement key to download.

Most of the IBM Cloud Pak for Data software uses this tag.
icr.io/cpopen Publicly available images that are provided by IBM and that don't require an entitlement key to download.

The IBM Cloud Pak for Data operators use this tag.
quay.io/opencloudio IBM open source images that are available on quay.io.

The IBM Cloud Pak® foundational services software uses this tag.
Ensure that:
  • Your private container registry is configured to allow these prefixes
  • The credentials that you will use to push images to the private container registry can push images with these prefixes

Methods for mirroring images

There are several ways that you can mirror images from the IBM Entitled Registry to your private container registry. Choose the most appropriate method for your environment:

Method Description Connected clusters Air-gapped clusters
Portable compute device
Example: A laptop that you can move behind your firewall is a portable compute device.

High-level process using a portable compute device:

  1. Create an intermediary container registry on a portable compute device that is connected to the internet.
  2. From the portable compute device, mirror images from the IBM Entitled Registry to the intermediary container registry.
  3. Bring the device behind your firewall and mirror the images from the intermediary container registry to the private container registry that is accessible from the Red Hat OpenShift Container Platform cluster.

For the full process, see Mirroring images with an intermediary container registry.

   ✓
File transfer
Example: You can either use a portable storage device, such as a USB drive, or use scp or sftp to move images behind your firewall.

High-level process using a file transfer:

  1. Create an intermediary container registry. If you are using a portable storage device, create the intermediary container registry on the storage device.
  2. From a workstation that can connect to the internet and the intermediary container registry, mirror the images from the IBM Entitled Registry to the intermediary container registry.
  3. Move the files and or the storage device behind your firewall.
  4. Set up a workstation behind the firewall to mirror the images to the private container registry that is accessible from the Red Hat OpenShift Container Platform cluster.

For the full process, see Mirroring images with an intermediary container registry.

   ✓
Bastion node
Example: A server with access to both the public internet and the private container registry that is accessible from the Red Hat OpenShift Container Platform cluster.

High-level process using a bastion node:

  1. From the bastion node, replicate the images from the IBM Entitled Registry to the private container registry that is accessible from the Red Hat OpenShift Container Platform cluster.

For the full process, see Mirroring images with a bastion node.

 ✓ ✓

Mirroring images to a private container registry

Complete the appropriate task for your environment: