Skip to content

Latest commit

 

History

History
131 lines (92 loc) · 6.59 KB

restricted-network-update-osus.adoc

File metadata and controls

131 lines (92 loc) · 6.59 KB

Updating a cluster in a disconnected environment using the OpenShift Update Service

To get an update experience similar to connected clusters, you can use the following procedures to install and configure the OpenShift Update Service (OSUS) in a disconnected environment.

The following steps outline the high-level workflow on how to update a cluster in a disconnected environment using OSUS:

  1. Configure access to a secured registry.

  2. Update the global cluster pull secret to access your mirror registry.

  3. Install the OSUS Operator.

  4. Create a graph data container image for the OpenShift Update Service.

  5. Install the OSUS application and configure your clusters to use the local OpenShift Update Service.

  6. Perform a supported update procedure from the documentation as you would with a connected cluster.

Prerequisites

Configuring access to a secured registry for the OpenShift Update Service

If the release images are contained in a registry whose HTTPS X.509 certificate is signed by a custom certificate authority, complete the steps in Configuring additional trust stores for image registry access along with following changes for the update service.

The OpenShift Update Service Operator needs the config map key name updateservice-registry in the registry CA cert.

Image registry CA config map example for the update service
apiVersion: v1
kind: ConfigMap
metadata:
  name: my-registry-ca
data:
  updateservice-registry: | (1)
    -----BEGIN CERTIFICATE-----
    ...
    -----END CERTIFICATE-----
  registry-with-port.example.com..5000: | (2)
    -----BEGIN CERTIFICATE-----
    ...
    -----END CERTIFICATE-----

  1. The OpenShift Update Service Operator requires the config map key name updateservice-registry in the registry CA cert.

  2. If the registry has the port, such as registry-with-port.example.com:5000, : should be replaced with ...

Installing the OpenShift Update Service Operator

To install the OpenShift Update Service, you must first install the OpenShift Update Service Operator by using the {product-title} web console or CLI.

Note

For clusters that are installed in disconnected environments, also known as disconnected clusters, Operator Lifecycle Manager by default cannot access the Red Hat-provided OperatorHub sources hosted on remote registries because those remote sources require full internet connectivity. For more information, see Using Operator Lifecycle Manager on restricted networks.

Creating an OpenShift Update Service application

You can create an OpenShift Update Service application by using the {product-title} web console or CLI.

Note

The policy engine route name must not be more than 63 characters based on RFC-1123. If you see ReconcileCompleted status as false with the reason CreateRouteFailed caused by host must conform to DNS 1123 naming convention and must be no more than 63 characters, try creating the Update Service with a shorter name.
Note

See Enabling the cluster-wide proxy to configure the CA to trust the update server.

Next steps

Before updating your cluster, confirm that the following conditions are met:

  • The Cluster Version Operator (CVO) is configured to use your locally-installed OpenShift Update Service application.

  • The release image signature config map for the new release is applied to your cluster.

    Note

    The release image signature config map allows the Cluster Version Operator (CVO) to ensure the integrity of release images by verifying that the actual image signatures match the expected signatures.

  • The current release and update target release images are mirrored to a locally accessible registry.

  • A recent graph data container image has been mirrored to your local registry.

After you configure your cluster to use the locally-installed OpenShift Update Service and local mirror registry, you can use any of the following update methods: