Mirroring certified container images in an air-gapped environment

You can install certified containers in an AIR-GAP environment where your OpenShift Container Platform or Kubernetes cluster does not have access to the internet. Therefore, it is important to properly configure and install the certified containers in such an environment.

Installing certified containers in an air gap environment

Required tools and resources:

casectl
cloud-pak-airgap-cli scripts (Ideally embedded as launch scripts in your CASE)
cloudctl

Note: Download the listed tools in the VM and save them.

Procedure

Run this command to create a digest.yaml file.

casectl digest --case <path of the helm charts>

Set up CASE resolvers as follows:
- Add URLs to the resolvers-auth.yaml file.
- Add the user IDs and password keys to the resolvers-auth.yaml file.

Run this command to download the CASES.

casectl check items --downloadDir /tmp/cases \
-c stable/ibm-itxa10-case-bundle/case/ibm-itxa10/ \
-i "*" \
--resourceAuthLocation ~/git/ibm-itxa10-case-bundle-resolversAuth.yaml \
--resourceLocation ~/git/ibm-itxa10-case-bundle-resolvers.yaml \
--force

Check the downloaded CASES under the download directory /tmp/cases.
Note: The following CASES is created under the download directory.
```
Charts
ibm-itxa10-1.0.1-images.csv
ibm-itxa10-1.0.1-charts.csv
ibm-itxa10-1.0.2.tgz
```
Update the following fields:
registry, image_name, tag, digest, mtype, os, arch, variant, insecure, digest_source, image_type and groups values in the images csv file.

Mirror the images as follows:

Setup temporary registries.

Run this command to setup a temporary registry.
```
./airgap.sh registry service init
```
Run this command to start the registry service.
```
./airgap.sh registry service start
```

Run this command to add any required credentials to mirror images into an internal registry.

cloudctl case launch  \
  --case $CASEPATH    \
  --namespace $NS     \
  --inventory $ITEM   \
  --action configure-creds-airgap  \
  --args "--registry $SOURCE_REGISTRY --user $SOURCE_REGISTRY_USER --pass $SOURCE_REGISTRY_PASS" \
  --tolerance 1

Run this command to mirror the images.

cloudctl case launch  \
  --case $CASEPATH    \
  --namespace $NS     \
  --inventory $ITEM   \
  --action mirror-images  \
  --args "--registry $TARGET_REGISTRY --inputDir $OFFLINEDIR" \
  --tolerance 1

Run this command to configure cluster.

cloudctl case launch  \
  --case $CASEPATH    \
  --namespace $NS     \
  --inventory $ITEM   \
  --action configure-cluster-airgap  \
  --args "--registry $TARGET_REGISTRY --inputDir $OFFLINEDIR --dryRun" \
  --tolerance 1

Run the following installation tests.

cloudctl case launch  \
--case $CASEPATH    \
--namespace $NS     \
--inventory $ITEM   \
--action $ACTION \
--args "--additional_prop1 $VALUE1 --additional_prop2 $VALUE2" \
--tolerance 1