extract the release image on a machine with internet

[kalexand-rh]

Per @umohnani8 in Slack.

(@wking, FYI)

@jianlinliu, will you PTAL?

[openshift-docs-preview-bot]

The preview will be available shortly at:

• https://fix_mirror--ocpdocs.netlify.com/

[jianlinliu]

Refer to https://jira.coreos.com/browse/CORS-1107?focusedCommentId=114277&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-114277,

all clusters that are created by using OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE are unsupported.

I am not sure @umohnani8's issue, but pls make sure really follow the steps in our official doc. https://docs.openshift.com/container-platform/4.2/installing/installing_restricted_networks/installing-restricted-networks-preparations.html#cli-installing-cli_installing-restricted-networks-preparations

To create the installation program that is based on the content that you mirrored, extract it and pin it to the release:

[kalexand-rh]

Thank you for reminding me @jianlinliu, @umohnani8, do you have another suggestion for getting your customer back on track?

[umohnani8]

@kalexand-rh yeah we are just working on confirming the detail about the ENV variable. I will comment back here in a bit. But the oc adm release extract command is definitely wrong and not needed in the disconnected case.

[wking]

Using the official installer without alteration is what we want to have work. Testing in openshift/release#5567. But until we get that green, extracting from the mirrored release like the master docs have is certainly more official than using the environment variable override.

[kalexand-rh]

@wking, let me know when that merges so that we can account for it in doc. @umohnani8, I'm not going to merge this change as-is, but if there's additional information to present instead, please let me know so I can amend this PR.

[kalexand-rh]

I'm going to close this PR. @umohnani8, please let me know if you have more information that you'd like me to incorporate.

[umohnani8]

@kalexand-rh can we reopen this. We confirmed that this works as expected. We need to remove the oc adm release extract command from the steps.

[kalexand-rh]

@umohnani8, is it supported now? I hesitate to bring a change in that both Abhinav and Jianlin have declined.

[umohnani8]

Yeah, we don't want to add the OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE into the docs, so that should be removed.
But the oc adm release extract command should either be removed or moved up so that users know they have to run that on a machine that has access to the internet and then they can copy the artifacts over to the machine that is disconnected.
@wking @abhinavdahiya @christianh814 please correct me if I am mistaken.

[umohnani8]

LGTM
@wking PTAL

[kalexand-rh]

Trevor says that this looks ok to him. @jianlinliu, are you ok with this change?

[jianlinliu]

But the oc adm release extract command should either be removed or moved up so that users know they have to run that on a machine that has access to the internet and then they can copy the artifacts over to the machine that is disconnected.

Actually I still can not figure out why user have to extract installer on a machine that has access to the internet. I agree Mirror the repository should be run on a machine that has access to the internet (In original doc, Complete the following steps on the bastion host already indicates that machine has access to the internet), but I can not agree extract installer have to be run on a machine that has access to the internet. Once release repository is mirrored onto mirror registry, any other disconnected machine can extract installer from the mirrored release repository, the connectivity between mirror registry and disconnected machine should be available, right? That is why we call the mirror registry machine as a bastion host. Do I miss something? Based on the PR is harmless for original process, I do not object to this PR too much.

[kalexand-rh]

@jianlinliu, that's about where I am with this PR - I think that the existing direction to perform the steps on the bastion host was enough, but adding a reminder in a different location is harmless.

[bobfuru]

Consider combining this with the previous sentence into a single admonition: "...you must extract the installation program from the mirrored content using a machine with an active internet connection."

[kalexand-rh]

If the major point of the PR wasn't "people are missing that you need to do this on a machine with internet," I'd take that improvement.

[bobfuru]

One small comment; otherwise, LGTM!

[kalexand-rh]

/cherrypick enterprise-4.2

[openshift-cherrypick-robot]

@kalexand-rh: new pull request created: #18340

In response to this:

/cherrypick enterprise-4.2

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[kalexand-rh]

/cherrypick enterprise-4.3

[openshift-cherrypick-robot]

@kalexand-rh: new pull request created: #18341

In response to this:

/cherrypick enterprise-4.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[jianlinliu]

Today someone reported similar issue - https://bugzilla.redhat.com/show_bug.cgi?id=1777890. I reproduced it, refer to that bug for more details. So now this PR sound reasonable for me now.