BZ1907755: Use image digest instead of image tag name #38381
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -9,17 +9,29 @@ Before you upgrade a cluster on infrastructure that you provision in a restricte | |
|
|
||
| .Procedure | ||
|
|
||
|
|
||
|
|
||
| . Use the link:https://access.redhat.com/labs/ocpupgradegraph/update_channel[Red Hat {product-title} Upgrade Graph visualizer and update planner] to plan an upgrade from one version to another. The OpenShift Upgrade Graph provides channel graphs and a way to confirm that there is an update path between your current and intended cluster versions. | ||
|
|
||
| . Set the required environment variables: | ||
| .. Export the image repository from the image release advisory: | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ OCP_RELEASE_REPOSITORY=quay.io/openshift-release-dev/ocp-release | ||
| ---- | ||
|
|
||
| .. Export the release digest from the image release advisory: | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ OCP_RELEASE_DIGEST=<release_digest> | ||
| ---- | ||
| + | ||
| For `<release_digest>`, specify the digest from the release image advisory, such as | ||
| `sha256:4d048ae1274d11c49f9b7e70713a072315431598b2ddbb512aee4027c422fe3e`. | ||
| + | ||
| If you want to inspect a particular release image, use `oc adm release info "${OCP_RELEASE_REPOSITORY}@${OCP_RELEASE_DIGEST}`. | ||
|
|
||
| .. Export the local registry name and host port: | ||
| + | ||
|
|
@@ -42,15 +54,6 @@ $ LOCAL_REPOSITORY='<local_repository_name>' | |
| For `<local_repository_name>`, specify the name of the repository to create in your | ||
| registry, such as `ocp4/openshift4`. | ||
|
|
||
| .. Export the path to your registry pull secret: | ||
| + | ||
| [source,terminal] | ||
|
|
@@ -65,22 +68,6 @@ For `<path_to_pull_secret>`, specify the absolute path to and file name of the p | |
| If your cluster uses an `ImageContentSourcePolicy` object to configure repository mirroring, you can use only global pull secrets for mirrored registries. You cannot add a pull secret to a project. | ||
| ==== | ||
|
|
||
| .. Export the path to the directory to host the mirrored images: | ||
| + | ||
| [source,terminal] | ||
|
|
@@ -89,26 +76,33 @@ $ REMOVABLE_MEDIA_PATH=<path> <1> | |
| ---- | ||
| <1> Specify the full path, including the initial forward slash (/) character. | ||
|
|
||
| . Mirror the version images to the internal container registry: | ||
| ** If your mirror host does not have internet access, take the following actions: | ||
| ... Connect the removable media to a system that is connected to the internet. | ||
| ... Review the images and configuration manifests to mirror: | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc adm -a ${LOCAL_SECRET_JSON} release mirror \ | ||
| --from=${OCP_RELEASE_REPOSITORY}@${OCP_RELEASE_DIGEST} \ | ||
| --to=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY} \ | ||
| --to-release-image=${OCP_RELEASE_REPOSITORY}@${OCP_RELEASE_DIGEST} --dry-run | ||
| $ oc adm release mirror -a ${LOCAL_SECRET_JSON} --to-dir=${REMOVABLE_MEDIA_PATH}/mirror quay.io/${PRODUCT_REPO}/${RELEASE_NAME}:${OCP_RELEASE}-${ARCHITECTURE} --dry-run | ||
|
There was a problem hiding this comment. Mirroring to removable media is useful if you can't mirror directly to the local registry and need to sneakernet the data in. So when you add the direct-to-local-registry command above while keeping the to-disk command here, it seems like it's conflicted about the network environment. Maybe these need to get split into restricted-network and connected-network cases, with one command in each case? |
||
| ---- | ||
|
|
||
| ... Record the entire `ImageContentSourcePolicy` section from the output of the previous | ||
| command. The information about your mirrors is unique to your mirrored repository, and you must ensure your in-cluster `ImageContentSourcePolicy` includes the entries needed for the mirrored release. | ||
| ... Mirror the images to a directory on the removable media: | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc adm release mirror -a ${LOCAL_SECRET_JSON} --to-dir=${REMOVABLE_MEDIA_PATH}/mirror ${OCP_RELEASE_REPOSITORY}@${OCP_RELEASE_DIGEST} | ||
| ---- | ||
| ... Take the media to the restricted network environment and upload the images to the local container registry. | ||
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc image mirror -a ${LOCAL_SECRET_JSON} --from-dir=${REMOVABLE_MEDIA_PATH}/mirror "file://openshift/release:4.*" ${LOCAL_REGISTRY}/${LOCAL_REPOSITORY} | ||
|
||
| ---- | ||
| + | ||
| <1> For `REMOVABLE_MEDIA_PATH`, you must use the same path that you specified when you mirrored the images. | ||
|
|
@@ -117,11 +111,21 @@ $ oc image mirror -a ${LOCAL_SECRET_JSON} --from-dir=${REMOVABLE_MEDIA_PATH}/mi | |
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc adm -a ${LOCAL_SECRET_JSON} release mirror \ | ||
| --from=${OCP_RELEASE_REPOSITORY}@${OCP_RELEASE_DIGEST} \ | ||
| --to=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY} \ | ||
| --apply-release-image-signature | ||
| ---- | ||
| + | ||
| ... Record the entire `ImageContentSourcePolicy` section from the output of the previous | ||
| command. The information about your mirrors is unique to your mirrored repository, and you must ensure your in-cluster `ImageContentSourcePolicy` includes the entries needed for the mirrored release. | ||
| + | ||
| [NOTE] | ||
| ==== | ||
| If you include the `--apply-release-image-signature` option, do not create the config map for image signature verification. | ||
| ==== | ||
|
|
||
| [NOTE] | ||
| ==== | ||
| Optionally, you can use image tag name instead of image digest in the previous commands. | ||
| ==== | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nit: Preexisting wording, so feel free to ignore, but
OCP_RELEASE_REPOSITORY=...is setting a variable, not exporting it (which would beexport OCP_RELEASE_REPOSITORY=...). I'd use "Declare the image repository..." or something else to avoid saying "export" and risking confusion withexport. Also in this space here and discussion in #22008.