Loading Images to the Container Registry

Download the images from Passport Advantage and save them locally.

Consider the following example for loading the images.
In order to preserve the images digests in the container registry, we recommend copying the downloaded images into the container registry using a recent version (1.13.3+) of the skopeo utility (available as a package for most distributions: Installing Skopeo).
Note: The example uses basic authentication. If the authentication is by a token, replace --dest-creds with --dest-registry-token along with the authentication token in the commands below.

1. Set variables with the source, destination, versions, credentials, etc. according to your environment:

   Code Block
   CONTAINER_REGISTRY_PATH="my-container-registry.example.com/dpod-cloud-agent" DPOD_CLOUD_AGENT_VERSION="1.0.21.0" DPOD_CLOUD_AGENT_OPERATOR_VERSION="1.1.0" IMAGES_DIR="/tmp" USER_ID="user" USER_PASSWORD="password"

2. Load the images to the container registry:

   Code Block

   skopeo copy --all --preserve-digests --dest-creds=${USER_ID}:${USER_PASSWORD} docker-archive:${IMAGES_DIR}/dpod-ca-operator-catalog-${DPOD_CLOUD_AGENT_VERSION}.tgz \ docker://${CONTAINER_REGISTRY_PATH}/dpod-cloud-agent-operator-catalog:${DPOD_CLOUD_AGENT_OPERATOR_VERSION}-amd64 skopeo copy --all --preserve-digests --dest-creds=${USER_ID}:${USER_PASSWORD} docker-archive:${IMAGES_DIR}/dpod-ca-operator-bundle-${DPOD_CLOUD_AGENT_VERSION}.tgz \ docker://${CONTAINER_REGISTRY_PATH}/dpod-cloud-agent-operator-bundle:${DPOD_CLOUD_AGENT_OPERATOR_VERSION}-amd64 skopeo copy --all --preserve-digests --dest-creds=${USER_ID}:${USER_PASSWORD} docker-archive:${IMAGES_DIR}/dpod-ca-operator-${DPOD_CLOUD_AGENT_VERSION}.tgz \ docker://${CONTAINER_REGISTRY_PATH}/dpod-cloud-agent-operator:${DPOD_CLOUD_AGENT_OPERATOR_VERSION}-amd64 skopeo copy --all --preserve-digests --dest-creds=${USER_ID}:${USER_PASSWORD} docker-archive:${IMAGES_DIR}/dpod-ca-api-proxy-${DPOD_CLOUD_AGENT_VERSION}.tgz \ docker://${CONTAINER_REGISTRY_PATH}/dpod-cloud-agent-api-proxy:${DPOD_CLOUD_AGENT_VERSION}-amd64 skopeo copy --all --preserve-digests --dest-creds=${USER_ID}:${USER_PASSWORD} docker-archive:${IMAGES_DIR}/dpod-ca-http-ingester-${DPOD_CLOUD_AGENT_VERSION}.tgz \ docker://${CONTAINER_REGISTRY_PATH}/dpod-cloud-agent-http-ingester:${DPOD_CLOUD_AGENT_VERSION}-amd64 skopeo copy --all --preserve-digests --dest-creds=${USER_ID}:${USER_PASSWORD} docker-archive:${IMAGES_DIR}/dpod-ca-manager-${DPOD_CLOUD_AGENT_VERSION}.tgz \ docker://${CONTAINER_REGISTRY_PATH}/dpod-cloud-agent-manager:${DPOD_CLOUD_AGENT_VERSION}-amd64 skopeo copy --all --preserve-digests --dest-creds=${USER_ID}:${USER_PASSWORD} docker-archive:${IMAGES_DIR}/dpod-ca-messaging-broker-${DPOD_CLOUD_AGENT_VERSION}.tgz \ docker://${CONTAINER_REGISTRY_PATH}/dpod-cloud-agent-messaging-broker:${DPOD_CLOUD_AGENT_VERSION}-amd64 skopeo copy --all --preserve-digests --dest-creds=${USER_ID}:${USER_PASSWORD} docker-archive:${IMAGES_DIR}/dpod-ca-syslog-ingester-${DPOD_CLOUD_AGENT_VERSION}.tgz \ docker://${CONTAINER_REGISTRY_PATH}/dpod-cloud-agent-syslog-ingester:${DPOD_CLOUD_AGENT_VERSION}-amd64

Configuring Mirroring

Consider the following example for configuring the mirroring.Note: Change the mirrors entries according to the container registry path that the images were loaded into (the value of CONTAINER_REGISTRY_PATH used above).

apiVersion: operator.openshift.io/v1alpha1
kind: ImageContentSourcePolicy
metadata:
  name: dpod-cloud-agent-registry-mirror
spec:
  repositoryDigestMirrors:
    - mirrors:
        - my-container-registry.example.com/dpod-cloud-agent
      source: cp.icr.io/cp/dpod
    - mirrors:         - my-container-registry.example.com/dpod-cloud-agent
      source: icr.io/cpopen

If the Mirroring doesn’t Work

Some OCP environments are not running the Machine Config Operator that allows modifying the nodes configuration files using K8S resources such as the ImageContentSourcePolicy.

...

[[registry]]
  prefix = ""
  location = "cp.icr.io/cp/dpodcpopen"
  mirror-by-digest-only = true
  [[registry.mirror]]
    location = "my-container-registry.example.com/dpod-cloud-agent"

[[registry]]
  prefix = ""
  location = "icr.io/cpopen"
  mirror-by-digest-only = true
  [[registry.mirror]]
    location = "my-container-registry.example.com/dpod-cloud-agent"

Authenticating to the Container Registry

Consider the following example for configuring authentication by updating the global pull secret.
Note: The example uses basic authentication. If the authentication is by a token, replace --dest-creds with --dest-registry-token along with the authentication token in the commands below.

oc get secret pull-secret -n openshift-config -o json | jq '.data.".dockerconfigjson"' -r | base64 -d > /tmp/pull-secret
oc registry login --registry=${CONTAINER_REGISTRY_PATH} --auth-basic=${USER_ID}:${USER_PASSWORD} --to=/tmp/pull-secret
oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson=/tmp/pull-secret

If the Global Pull Secret doesn’t Work

Some OCP environments are not running the Machine Config Operator that allows modifying the nodes configuration files using K8S resources such as the global pull secret.

For such environments, you must manually add the authentication configuration for each one of the worker nodes in config.json.
Note: Change the URL and the auth value according to your environment. You can inspect the content of /tmp/pull-secret created above which includes the relevant configuration snippet.

{
    "auths": {
        ...
        "https://my-container-registry.example.com/dpod-cloud-agent": {
            "auth": "..."
        },
        ...
    }
}