Skip to content

Commit

Permalink
Cherry-pick 09396a manually (#545)
Browse files Browse the repository at this point in the history 
* Cherry-pick 09396a manually

Signed-off-by: clyang82 <chuyang@redhat.com>

* Correct README.md

Signed-off-by: clyang82 <chuyang@redhat.com>

---------

Signed-off-by: clyang82 <chuyang@redhat.com>
  • Loading branch information
@clyang82
clyang82 authored Jul 19, 2023
1 parent 398e548 commit 9e80b11
Show file tree
Hide file tree
Showing 6 changed files with 358 additions and 271 deletions.
156 changes: 84 additions & 72 deletions doc/README.md
View file

Large diffs are not rendered by default.

75 changes: 44 additions & 31 deletions doc/dev-preview.md
View file
Original file line number Diff line number Diff line change
@@ -1,32 +1,45 @@
### Create a regional hub cluster (dev preview)
Refer to the original [Create cluster](https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.6/html/multicluster_engine/multicluster_engine_overview#creating-a-cluster) document to create the managed cluster in the global hub cluster. add labels of `global-hub.open-cluster-management.io/hub-cluster-install: ''` in managedcluster CR and then the new created managed cluster can be switched to be a regional hub cluster automatically. In other words, the latest released RHACM is installed in this managed cluster. You can get the ACM hub information in the cluster overview page.
### Create a regional hub cluster (Developer Preview)
Refer to the original [Create cluster](https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.8/html/clusters/cluster_mce_overview#creating-a-cluster) document to create the managed cluster in the global hub cluster. Add the label of `global-hub.open-cluster-management.io/hub-cluster-install: ''` to the `managedcluster` custom resource and then the new created managed cluster can automatically be switched to be a regional hub cluster. In other words, the latest version of Red Hat Advanced Cluster Management for Kubernetes is installed in this managed cluster. You can get the Red Hat Advanced Cluster Management hub information in the cluster overview page.

![cluster overview](cluster_overview.png)
### Import a regional hub cluster in hosted mode (dev preview)
It does not require any changes before importing it. The ACM agent is running in a hosting cluster.
1. Import the cluster from the ACM console, add these annotations to the managedCluster, use the kubeconfig import mode, and disable all add-ons.
```
import.open-cluster-management.io/klusterlet-deploy-mode: Hosted
import.open-cluster-management.io/hosting-cluster-name: local-cluster
addon.open-cluster-management.io/disable-automatic-installation: "true"
```
![import hosted cluster](import_hosted_cluster.png)
Click `Next` Button to complete the import process.

2. Enable work-manager addon after the imported cluster is available.
```
oc apply -f - <<EOF
apiVersion: addon.open-cluster-management.io/v1alpha1
kind: ManagedClusterAddOn
metadata:
name: work-manager
namespace: hub1
annotations:
addon.open-cluster-management.io/hosting-cluster-name: local-cluster
spec:
installNamespace: open-cluster-management-hub1-addon-workmanager
EOF
```
You have to create a kubeconfig secret for the work-manager add-on via the following command:
```
oc create secret generic work-manager-managed-kubeconfig --from-file=kubeconfig=<your regional hub kubeconfig> -n open-cluster-management-hub1-addon-workmanager
```

### Import a regional hub cluster in hosted mode (Developer Preview)
A regional hub cluster does not require any changes before importing it. The Red Hat Advanced Cluster Management agent is running in a hosting cluster.

1. Import the cluster from the Red Hat Advanced Cluster Management console, add these annotations to the `managedCluster` custom resource. Use the kubeconfig import mode, and disable all add-ons.

```
import.open-cluster-management.io/klusterlet-deploy-mode: Hosted
import.open-cluster-management.io/hosting-cluster-name: local-cluster
addon.open-cluster-management.io/disable-automatic-installation: "true"
```

![import hosted cluster](import_hosted_cluster.png)

2. Click `Next` to complete the import process.

3. Enable the work-manager addon after the imported cluster is available by creating a file named `work-manager-file` that contains content that is similar to the following example:.

```
apiVersion: addon.open-cluster-management.io/v1alpha1
kind: ManagedClusterAddOn
metadata:
name: work-manager
namespace: hub1
annotations:
addon.open-cluster-management.io/hosting-cluster-name: local-cluster
spec:
installNamespace: open-cluster-management-hub1-addon-workmanager
```

4. Apply the file by running the following command:

```
oc apply -f <work-manager-file>
```

5. Create a kubeconfig secret for the work-manager add-on by running the following command:

```
oc create secret generic work-manager-managed-kubeconfig --from-file=kubeconfig=<your regional hub kubeconfig> -n open-cluster-management-hub1-addon-workmanager
```
121 changes: 78 additions & 43 deletions doc/disconnected_environment/README.md
View file
Original file line number Diff line number Diff line change
@@ -1,70 +1,105 @@
# Deploy Global Hub Operator on a Disconnected Environment
# Deploying Global Hub Operator in a disconnected environment

In situations where a network connection is not available, you can deploy the Global Hub Operator in a disconnected environment.

## Prerequisites

- Make sure you have an image registry, and a bastion host that has access to both the Internet and your mirror registry
- Have OLM([Operator Lifecycle Manager](https://docs.openshift.com/container-platform/4.11/operators/understanding/olm/olm-understanding-olm.html)) installed on your cluster
- The Advanced Cluster Management for Kubernetes has been installed on your cluster
- Make sure your user is authorized with cluster-admin permissions
- An image registry and a bastion host that have access to both the Internet and to your mirror registry
- Operator Lifecycle Manager ([OLM](https://docs.openshift.com/container-platform/4.11/operators/understanding/olm/olm-understanding-olm.html)) installed on your cluster
- Red Hat Advanced Cluster Management for Kubernetes version 2.7, or later, installed on your cluster
- A user account with `cluster-admin` permissions

## Mirror Registry

Installing global hub in a disconnected environment involves the use of a mirror image registry. Which ensures your clusters only use container images that satisfy your organizational controls on external content. You can following the following two step to provision the mirror registry for global hub.
- [Creating a mirror registry](https://docs.openshift.com/container-platform/4.11/installing/disconnected_install/installing-mirroring-creating-registry.html#installing-mirroring-creating-registry)
- [Mirroring images for a disconnected installation](https://docs.openshift.com/container-platform/4.11/installing/disconnected_install/installing-mirroring-installation-images.html)
You must use a mirror image registry when installing Multicluster Global Hub in a disconnected environment. The image registry ensures that your clusters only use container images that satisfy your organizational controls on external content. You can complete the following two-step procedure to provision the mirror registry for global hub.
- [Creating a mirror registry](https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html/installing/disconnected-installation-mirroring#creating-mirror-registry)
- [Mirroring images for a disconnected installation](https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html/installing/disconnected-installation-mirroring#installing-mirroring-installation-images)

## Create ImageContentSourcePolicy
## Create an ImageContentSourcePolicy

In order to have your cluster obtain container images for the global hub operator from your mirror registry, rather than from the internet-hosted registries, you can configure an `ImageContentSourcePolicy` on your disconnected cluster to redirect image references to your mirror registry.
You can configure an `ImageContentSourcePolicy` on your disconnected cluster to redirect image references to your mirror registry. This enables you to have your cluster obtain container images for the global hub operator on your mirror registry, rather than from the Internet-hosted registries.

**Note**: The ImageContentSourcePolicy can only support the image mirror with image digest.

```bash
$ cat ./doc/disconnected_environment/imagecontentsourcepolicy.yaml
apiVersion: operator.openshift.io/v1alpha1
kind: ImageContentSourcePolicy
metadata:
name: global-hub-operator-icsp
spec:
repositoryDigestMirrors:
- mirrors:
- ${REGISTRY}//multicluster-globalhub
source: registry.redhat.io/multicluster-globalhub
1. Create a file called `imagecontentsourcepolicy.yaml`:

$ envsubst < ./doc/disconnected-operator/imagecontentsourcepolicy.yaml | kubectl apply -f -
```
```
$ cat ./doc/disconnected_environment/imagecontentsourcepolicy.yaml
```

2. Add content that resembles the following content to the new file:

```
apiVersion: operator.openshift.io/v1alpha1
kind: ImageContentSourcePolicy
metadata:
name: global-hub-operator-icsp
spec:
repositoryDigestMirrors:
- mirrors:
- ${REGISTRY}//multicluster-globalhub
source: registry.redhat.io/multicluster-globalhub
```

3. Apply `imagecontentsourcepolicy.yaml` by running the following command:

```
envsubst < ./doc/disconnected-operator/imagecontentsourcepolicy.yaml | kubectl apply -f -
```

## Configure the image pull secret

If the Operator or Operand images that are referenced by a subscribed Operator require access to a private registry, you can either [provide access to all namespaces in the cluster, or individual target tenant namespaces](https://access.redhat.com/documentation/en-us/openshift_container_platform/4.11/html-single/operators/index#olm-creating-catalog-from-index_olm-managing-custom-catalogs).
If the Operator or Operand images that are referenced by a subscribed Operator require access to a private registry, you can either [provide access to all namespaces in the cluster, or to individual target tenant namespaces](https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html-single/operators/index#olm-creating-catalog-from-index_olm-managing-custom-catalogs).

### Option 1. Configure the globalhub imagepullsecret in an Openshift Cluster
### Option 1. Configure the global hub image pull secret in an OpenShift cluster

**Note**: if you apply this on a pre-existing cluster, it will cause a rolling restart of all nodes.
**Note**: Applying the image pull secret on a pre-existing cluster causes a rolling restart of all of the nodes.

```bash
$ export USER=<the-registry-user>
$ export PASSWORD=<the-registry-password>
$ oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' > pull_secret.yaml
$ oc registry login --registry=${REGISTRY} --auth-basic="$USER:$PASSWORD" --to=pull_secret.yaml
$ oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson=pull_secret.yaml
$ rm pull_secret.yaml
```
1. Export the user name from the pull secret:
```
export USER=<the-registry-user>
```

2. Export the password from the pull secret:
```
export PASSWORD=<the-registry-password>
```

3. Copy the pull secret:
```
oc get secret/pull-secret -n openshift-config --template='{{index .data ".dockerconfigjson" | base64decode}}' > pull_secret.yaml
```

4. Log in using the pull secret:
```
oc registry login --registry=${REGISTRY} --auth-basic="$USER:$PASSWORD" --to=pull_secret.yaml
```

5. Specify the global hub image pull secret:
```
oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson=pull_secret.yaml
```

6. Remove the old pull secret:
```
rm pull_secret.yaml
```

### Option 2. Configure image pull secret to an individual namespace

```bash
# create the secret in the tenant namespace
$ oc create secret generic <secret_name> \
-n <tenant_namespace> \
1. Create the secret in the tenant namespace by running the following command:
```
oc create secret generic <secret_name> -n <tenant_namespace> \
--from-file=.dockerconfigjson=<path/to/registry/credentials> \
--type=kubernetes.io/dockerconfigjson
```

# link the secret to the service account for your operator/operand
$ oc secrets link <operator_sa> -n <tenant_namespace> <secret_name> --for=pull
```
2. Link the secret to the service account for your operator/operand:
```
oc secrets link <operator_sa> -n <tenant_namespace> <secret_name> --for=pull
```

## Add GlobalHub operator catalog
## Add the GlobalHub operator catalog

### Build the GlobalHub catalog from upstream [Optional]

Expand Down Expand Up @@ -150,7 +185,7 @@ multicluster-global-hub-operator Community Operators 28m
name: multicluster-global-hub-operator
namespace: open-cluster-management
spec:
channel: release-0.7
channel: alpha
installPlanApproval: Automatic
name: multicluster-global-hub-operator
source: global-hub-operator-catalog
Expand Down
Loading

0 comments on commit 9e80b11

Please sign in to comment.