Mirroring your images to the enterprise registry

• There must not be a huge latency between cluster nodes and your enterprise registry. Slow image pull can cause OpenShift® Container Platform installation to fail.
• You must have a container image registry that supports Docker v2-2 in the location that hosts the Red Hat® OpenShift Container Platform cluster. For more information about image manifest, see opm CLI reference .
  Important: Artifactory is the recommended registry because it supports the following must have capabilities:

  • Import and export
  • Untagged images

  JFrog Artifactory version 7.55.8 is tested on IBM Storage Fusion HCI System. From 2.5.x version onwards, the port that is specified in the URL is used to login and pull the images from enterprise repository. For a secured enterprise registry, specify 443. If you do not provide the port value, then no default port is considered in its absence. The API key is the only supported authentication method.

• For disconnected installation, you need a firewall type proxy server and for an air break installation, the registry must have import and export capabilities.

For example:

https://<enterprise registry host>:<enterprise registry port>/<mandatory root path>

• The mirror host must have access to the internet and enterprise registry.
• Ensure that you install the following tools on your system from where you can connect to Red Hat registry and enterprise registry:
  • Install Docker or Podman.
  • Install oc-mirror utility. For more information about installing oc mirror plugin, see Installing the oc-mirror OpenShift CLI plugin
  • Install skopeo for image copy operation. For more information to install skopeo, see https://github.com/containers/skopeo.
  • Install OC command tool from any of the Red Hat OpenShift Container Platform cluster:
    1. Log in to the system from where you want to run commands.
    2. Log in to OpenShift Container Platform.
    3. Click bell icon and select Command line tools.
    4. Click the appropriate oc download option based on your operating system.

    Alternatively, you can also download the platform based oc client from the following OpenShift Container Platform link: https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/4.12.42.

    For example, use the following link to download oc client for Linux platform: https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/4.12.42/openshift-client-linux-4.12.42.tar.gz.

• Download pull-secret.txt.

  To download the pull-secret, see https://console.redhat.com/openshift/install/pull-secret and follow the instructions.

  Edit the downloaded pull-secret with registry credentials:

  Add a new section of key-value pair under auths. For example,

  "<Your enterprise registry>:<port>": {
  "auth": "<base64 encoded 'user_name:password'>",
  email: "<your email>" }

  As a prerequisite to run base64, you must install base64 or jq.
  See the following sample values:

  
  { 
  "auths": { 
     "cloud.openshift.com": { 
        .... 
     "registryhost.com:443": { 
         "auth": "dXNlcl9uYW1lOnBhc3N3b3Jk",   
          "email": "user_name@ibm.com" 
      }
    }
  }
  

  Here, user_name and password are credentials to connect to enterprise registry.

  Note: If you want to use multiple repositories, add an auth section for both repositories.
• Ensure that you have entitlement key to access IBM Storage Fusion HCI System appliance images. For more information about entitlement key, see Activating IBM Storage Fusion HCI System Software to be downloaded.

time podman pull cp.icr.io/cp/isf/isf-compute-operator@sha256:42aaf756685d9e2f236a117d41982b9bf28f311bdd9b46f4246e378d98286374