Moving images for the `manage` plug-in to the private container registry

If you need to run cpd-cli manage commands against a cluster in a restricted network, you must make the olm-utils image available inside the cluster network. Additionally, if you plan to use the resource specification injection (RSI) feature, you must make the zen-rsi-adm-controller image available inside the cluster network. You can mirror the images to the private container registry and pull the images to workstations that can connect to the cluster.

Important: Depending on the procedure that you followed to install Cloud Pak for Data, the olm-utils image might already be in the private container registry.

Installation phase: Setting up a client workstation; Collecting required information; Preparing your cluster; Installing the Cloud Pak for Data platform and services
Who needs to complete this task?: A user who has permissions to push images to the private container registry must complete this task.
When do you need to complete this task?: You must complete this task before users try to run the cpd-cli manage commands inside cluster network.

Before you begin

Complete the following tasks before you move the images to the private container registry:

About this task

This plug-in requires the olm-utils image:

x86-64 clusters: icr.io/cpopen/cpd/olm-utils:latest
s390x clusters: icr.io/cpopen/cpd/olm-utils:latest.s390x

If you plan to use the resource specification injection (RSI) feature, the plug-in requires the zen-rsi-adm-controller image.

Important: The RSI feature is recommended only for advanced Red Hat OpenShift Container Platform users.

x86-64 clusters: icr.io/cpopen/cpd/zen-rsi-adm-controller:4.6.5-x86_64
s390x clusters: This image is not available for s390x hardware.

Procedure

The steps that you must complete depend on whether the workstation can connect to both the internet and the private container registry at the same time:

The workstation can connect to the internet and to the private container registry

Ensure that Docker or Podman is running on the workstation.
Log in to the private container registry.
The following command assumes that you are using private container registry that is secured with credentials:
```
cpd-cli manage login-private-registry \
${PRIVATE_REGISTRY_LOCATION} \
${PRIVATE_REGISTRY_PUSH_USER} \
${PRIVATE_REGISTRY_PUSH_PASSWORD}
```
If your private registry is not secured, see cpd-cli manage login-private-registry for additional options.

Run the following command to copy the olm-utils image from the IBM® Entitled Registry to the private container registry:

x86-64 clusters

cpd-cli manage copy-image \
--from=icr.io/cpopen/cpd/olm-utils:latest \
--to=${PRIVATE_REGISTRY_LOCATION}/cpd/olm-utils:latest

s390x clusters

cpd-cli manage copy-image \
--from=icr.io/cpopen/cpd/olm-utils:latest.s390x \
--to=${PRIVATE_REGISTRY_LOCATION}/cpd/olm-utils:latest.s390x

If you plan to use the resource specification injection (RSI) feature, run the following command to copy the zen-rsi-adm-controller image from the IBM Entitled Registry to the private container registry:
```
cpd-cli manage copy-image \
--from=icr.io/cpopen/cpd/zen-rsi-adm-controller:4.6.5-x86_64 \
--to=${PRIVATE_REGISTRY_LOCATION}/cpd/zen-rsi-adm-controller:4.6.5-x86_64
```

The workstation cannot connect to the private container registry at the same time

From a workstation that can connect to the internet:
1. Ensure that Docker or Podman is running on the workstation.
2. Run the following command to save the olm-utils image to the client workstation:
  x86-64 clusters
```
cpd-cli manage save-image \
--from=icr.io/cpopen/cpd/olm-utils:latest
```
  This command saves the image as a compressed TAR file named icr.io_cpopen_cpd_olm-utils_latest.tar.gz in the cpd-cli-workspace/olm-utils-workspace/work/offline directory.
  s390x clusters
```
cpd-cli manage save-image \
--from=icr.io/cpopen/cpd/olm-utils:latest.s390x
```
  This command saves the image as a compressed TAR file named icr.io_cpopen_cpd_olm-utils_latest.s390x.tar.gz in the cpd-cli-workspace/olm-utils-workspace/work/offline directory.
3. Run the following command to save the zen-rsi-adm-controller image to the client workstation.
  Remember: This image is required only if you plan to use the resource specification injection (RSI) feature.
```
cpd-cli manage save-image \
--from=icr.io/cpopen/cpd/zen-rsi-adm-controller:4.6.5-x86_64
```
  This command saves the image as a compressed TAR file named icr.io_cpopen_zen-rsi-adm-controller_4.6.5_x86_64.tar.gz in the cpd-cli-workspace/olm-utils-workspace/work/offline directory.
Transfer the compressed files to a client workstation that can connect to the cluster.
Ensure that you place the TAR files in the cpd-cli-workspace/olm-utils-workspace/work/offline directory:
x86-64 clusters
- icr.io_cpopen_cpd_olm-utils_latest.tar.gz
- (If needed) icr.io_cpopen_zen-rsi-adm-controller_4.6.5_x86_64.tar.gz
s390x clusters

icr.io_cpopen_cpd_olm-utils_latest.s390x.tar.gz
From the workstation that can connect to the cluster:
1. Ensure that Docker or Podman is running on the workstation.
2. Run the following command to load the olm-utils image on the client workstation:
  x86-64 clusters
```
cpd-cli manage load-image \
--source-image=icr.io/cpopen/cpd/olm-utils:latest
```
  The command returns the following message when the image is loaded:
```
Loaded image: icr.io/cpopen/cpd/olm-utils:latest
```
  s390x clusters
```
cpd-cli manage load-image \
--source-image=icr.io/cpopen/cpd/olm-utils:latest.s390x
```
  The command returns the following message when the image is loaded:
```
Loaded image: icr.io/cpopen/cpd/olm-utils:latest.s390x
```
3. Log in to the private container registry.
  The following command assumes that you are using private container registry that is secured with credentials:
```
cpd-cli manage login-private-registry \
${PRIVATE_REGISTRY_LOCATION} \
${PRIVATE_REGISTRY_PUSH_USER} \
${PRIVATE_REGISTRY_PUSH_PASSWORD}
```
  If your private registry is not secured, see cpd-cli manage login-private-registry for additional options.
4. Run the following command to copy the olm-utils image to the private container registry:
  x86-64 clusters
```
cpd-cli manage copy-image \
--from=icr.io/cpopen/cpd/olm-utils:latest \
--to=${PRIVATE_REGISTRY_LOCATION}/cpd/olm-utils:latest
```
  s390x clusters
```
cpd-cli manage copy-image \
--from=icr.io/cpopen/cpd/olm-utils:latest.s390x \
--to=${PRIVATE_REGISTRY_LOCATION}/cpd/olm-utils:latest.s390x
```
5. Run the following command to copy the zen-rsi-adm-controller image to the private container registry
  Remember: This image is required only if you plan to use the resource specification injection (RSI) feature.
```
cpd-cli manage copy-image \
--from=icr.io/cpopen/cpd/zen-rsi-adm-controller:v1.1 \
--to=${PRIVATE_REGISTRY_LOCATION}/cpd/zen-rsi-adm-controller:4.6.5-x86_64
```

What to do next

olm-utils

After you push the olm-utils image to the private container registry, users who want to run the

cpd-cli
manage

command must add the OLM_UTILS_IMAGE environment variable to their environment variables script:

x86-64 clusters

export OLM_UTILS_IMAGE=${PRIVATE_REGISTRY_LOCATION}/cpd/olm-utils:latest

s390x clusters

export OLM_UTILS_IMAGE=${PRIVATE_REGISTRY_LOCATION}/cpd/olm-utils:latest.s390x

Remember: You must source the environment variables each time you open a new bash prompt. For example:

source ./cpd_vars.sh

For more information, see Setting up installation environment variables.

zen-rsi-adm-controller

When you install the RSI webhook, you must specify --rsi_image=${PRIVATE_REGISTRY_LOCATION}/cpd/zen-rsi-adm-controller:4.6.5-x86_64.

For more information, see Installing or updating the resource specification injection webhook on the cluster.