Mirroring images directly to the private container registry

If your client workstation can connect to the internet and to the private container registry, you can mirror the images directly to your private container registry.

If your client workstation cannot connect to the internet and to the private container registry, see Mirroring images using an intermediary container registry.

Installation phase

Setting up a client workstation

Collecting required information

Preparing your cluster

Installing the Cloud Pak for Data platform and services

Who needs to complete this task?

A user with permissions to push images to the private container registry must complete this task.

When do you need to complete this task?

If you want to mirror images to a private container registry, you must complete this task in the following situations:

Before you install Cloud Pak for Data for the first time.
Before you upgrade to a newer release of Cloud Pak for Data

Before you begin

Best practice: You can run the commands in this task exactly as written if you set up environment variables. For instructions, see Setting up installation environment variables.

Ensure that you source the environment variables before you run the commands in this task.

About this task

Use the cpd-cli manage commands to mirror the images from the IBM® Entitled Registry to the private container registry.

The following steps assume that you will mirror all of the components in a single step. The components that are mirrored are determined by the ${COMPONENTS} variable, from the installation environment variables script. If you want to mirror a specific component instead of multiple components, you can export COMPONENTS with the appropriate component ID.

Procedure

cpd-cli manage login-entitled-registry \
${IBM_ENTITLEMENT_KEY}

Log in to the private container registry.
The following command assumes that you are using private container registry that is secured with credentials:
```
cpd-cli manage login-private-registry \
${PRIVATE_REGISTRY_LOCATION} \
${PRIVATE_REGISTRY_PUSH_USER} \
${PRIVATE_REGISTRY_PUSH_PASSWORD}
```
If your private registry is not secured, see cpd-cli manage login-private-registry for additional options.
Confirm that you have access to the images that you want to mirror from the IBM Entitled Registry:

Note: This step is required if you purchased EDB Postgres Standard.
For all other users, this step is optional but strongly recommended.
1. Inspect the IBM Entitled Registry:
  Tip: If you want to validate that you have access to the images for a specific component, you can run the following command before you run the list-images command:
```
export COMPONENTS=<component-ID>
```
```
cpd-cli manage list-images \
--components=${COMPONENTS} \
--release=${VERSION} \
--inspect_source_registry=true
```
  The output is saved to the list_images.csv file in the cpd-cli-workspace/olm-utils-workspace/work/offline/${VERSION} directory.
2. Check the output for errors:
```
grep "level=fatal" list_images.csv
```
  The command returns images that failed because of authorization errors or network errors.
If you are mirroring the images for Watson™ Studio, you can choose which Watson Studio Runtimes images are mirrored.
The default runtimes must be mirrored; however, you can optionally remove the following images if you don't plan to use them:
GPU images

If you don't need GPU images, run the following command to remove them:
Workstations that use the default cpd-cli-workspace/olm-utils-workspace/work directory
sed -i -e '/gpu/d' ./cpd-cli-workspace/olm-utils-workspace/work/offline/${VERSION}/ws_runtimes/ibm-wsl-runtimes-*-images.csv
Workstations that use the CPD_CLI_MANAGE_WORKSPACE environment variable
sed -i -e '/gpu/d' ${CPD_CLI_MANAGE_WORKSPACE}/work/offline/${VERSION}/ws_runtimes/ibm-wsl-runtimes-*-images.csv
Pre-trained NLP models

If you don't need pre-trained natural language processing (NLP) models, run the following command to remove them:
Workstations that use the default cpd-cli-workspace/olm-utils-workspace/work directory
sed -i -e '/nlp/d' ./cpd-cli-workspace/olm-utils-workspace/work/offline/${VERSION}/ws_runtimes/ibm-wsl-runtimes-*-images.csv
Workstations that use the CPD_CLI_MANAGE_WORKSPACE environment variable
sed -i -e '/nlp/d' ${CPD_CLI_MANAGE_WORKSPACE}/work/offline/${VERSION}/ws_runtimes/ibm-wsl-runtimes-*-images.csv
If you purchased EDB Postgres Standard, run the following command to remove the EDB Postgres Enterprise images from the list of images that will be mirrored to the private container registry:
Workstations that use the default cpd-cli-workspace/olm-utils-workspace/work directory
```
sed -i -e '/edb-postgres-advanced/d' ./cpd-cli-workspace/olm-utils-workspace/work/offline/${VERSION}/edb_cp4d/ibm-cpd-edb-*-images.csv
```
Workstations that use the CPD_CLI_MANAGE_WORKSPACE environment variable
```
sed -i -e '/edb-postgres-advanced/d' ${CPD_CLI_MANAGE_WORKSPACE}/work/offline/${VERSION}/edb_cp4d/ibm-cpd-edb-*-images.csv
```
Mirror the images to the private container registry.
Tip: Determine whether you need to modify the behavior of this command:
- By default, this command mirrors only the images that are needed for your cluster architecture. If you want to mirror the images for all supported architectures, remove the --arch=${IMAGE_ARCH} option.
- This command mirrors the images for all of the components that are specified in the ${COMPONENTS} environment variable. If you want to mirror images for a specific component, you can run export COMPONENTS=<component-ID> before you run the command.
```
cpd-cli manage mirror-images \
--components=${COMPONENTS} \
--release=${VERSION} \
--target_registry=${PRIVATE_REGISTRY_LOCATION} \
--arch=${IMAGE_ARCH} \
--case_download=false
```
For each component, the command generates a log file in the cpd-cli-workspace/olm-utils-workspace/work directory.
Confirm that the images were mirrored to the private container registry:
1. Inspect the contents of the private container registry:
```
cpd-cli manage list-images \
--components=${COMPONENTS} \
--release=${VERSION} \
--target_registry=${PRIVATE_REGISTRY_LOCATION} \
--case_download=false
```
  The output is saved to the list_images.csv file in the cpd-cli-workspace/olm-utils-workspace/work/offline/${VERSION} directory.
2. Check the output for errors:
```
grep "level=fatal" list_images.csv
```
  The command returns images that are missing or that cannot be inspected.

What to do next

Now that you've mirrored the images to the private container registry, you are ready to Configuring an image content source policy.