Mirroring OpenShift Release Images to a Supported Container Registry

When preparing an OpenShift environment for restricted connectivity or future disconnected operations, one of the prerequisites is the availability of a container image registry that supports the Docker Registry HTTP API V2 specification.

According to Red Hat documentation, supported registry solutions include:

• Red Hat Quay
• JFrog Artifactory
• Sonatype Nexus Repository
• Harbor

Creating the Target Repository

A dedicated repository was created in the container registry to host OpenShift release images.

Example:

Project: ocp4
Repository: openshift4

The repository must be accessible from the OpenShift cluster nodes and have sufficient storage capacity to host the mirrored release content.

Creating a Service Account for Mirroring

A dedicated service account (or robot account, depending on the registry platform) should be created to perform the mirroring operation.

The account requires permissions to:

• Authenticate against the registry
• Push images
• Read repository content
• List repository artifacts

Preparing the Pull Secret

Download the pull secret associated with an OpenShift account that has access to Red Hat registries.

Create a new JSON file and append credentials for the target registry.

Example:

{
  "auths": {
    "cloud.openshift.com": {},
    "quay.io": {},
    "registry.connect.redhat.com": {},
    "registry.redhat.io": {},
    "registry.xxx.xxx.dev.corp": {
      "auth": "<base64-encoded-credentials>"
    }
  }
}

The registry authentication value must contain a Base64-encoded representation of:

username:password

Example:

echo -n 'robot$ocp-account:password' | base64

Mirroring OpenShift Release Images

Execute the release mirror command:

oc adm release mirror \
  -a mirroring.json \
  --from=quay.io/openshift-release-dev/ocp-release:4.16.33-x86_64 \
  --to=registry.xxx.xxx.dev.corp/ocp4/openshift4 \
  --apply-release-image-signature \
  --skip-verification=true \
  --insecure=true

Select the release tag that matches the OpenShift version required for your environment.

At the end of the process, OpenShift provides:

• The list of mirrored images
• Storage requirements
• An example ImageDigestMirrorSet

Configuring the Cluster to Use the Mirror

Apply the generated ImageDigestMirrorSet:

oc apply -f ImageDigestMirrorSet.yaml

Example:

apiVersion: config.openshift.io/v1
kind: ImageDigestMirrorSet
metadata:
  name: offline-mode
spec:
  imageDigestMirrors:
  - mirrors:
    - registry.xxx.xxx.dev.corp/ocp4/openshift4
    source: quay.io/openshift-release-dev/ocp-release
  - mirrors:
    - registry.xxx.xxx.dev.corp/ocp4/openshift4
    source: quay.io/openshift-release-dev/ocp-v4.0-art-dev

Validation

Verify that the mirror configuration has been applied:

oc get idms

Expected output:

NAME           AGE
offline-mode   20d

Conclusion

By using a supported container registry as an OpenShift release mirror, organizations can reduce external dependencies, improve upgrade reliability, and establish the foundation required for restricted or disconnected environments.