You can do many tasks on isolated clusters when you use Connectivity Link as a disconnected gateway. For example, securely route traffic, limit request rates, and handle automatic failover. You can also manage internal network policies, security rules, and automate TLS certificates.

Install Connectivity Link Operators in disconnected OpenShift Container Platform environments by mirroring the Operator catalog and images to your internal registry. Use the oc-mirror tool to perform the following actions, in order:

  1. Mirror the Red Hat Operator catalog containing the Connectivity Link Operator package to your local registry.

  2. Configure your OpenShift Container Platform cluster to use the mirrored catalog.

  3. Install the Connectivity Link Operator using Operator Lifecycle Manager (OLM).

To begin your disconnected Connectivity Link installation, you must mirror the Red Hat Operator catalog to your disconnected environment. By mirroring, you are making a complete local copy of Connectivity Link on a private container registry that your isolated cluster can reach.

Note

Applying ImageDigestMirrorSet or ImageTagMirrorSet objects triggers MachineConfig object updates and restarts cluster nodes.

If you want to use the Connectivity Link Red Hat Developer Hub plugin in your disconnected environment, you must also mirror the OCI images.

Important

With Connectivity Link on OpenShift Container Platform 4.19 and newer, you can configure the OpenShift istio controller as the Gateway API provider to manage gateway traffic. You do not need to install OpenShift Service Mesh. However, the underlying Istio container images remain a hard dependency. In a disconnected environment, ensure that you mirror these images alongside your cluster image set configuration. Istio images are not included in the Connectivity Link Operator catalog.
Prerequisites

  • You have a supported-version, disconnected OpenShift Container Platform cluster.

  • You configured a mirror registry.

  • You have access to registry.redhat.io on an internet-connected workstation.

  • You have credentials for your mirror registry configured in ${HOME}/.docker/config.json.

  • You have either an ImageDigestMirrorSet or ImageTagMirrorSet object configured for platform images.

  • You installed the oc-mirror CLI tool for mirroring operator catalogs.

Procedure

  1. On your internet-connected workstation, create an ImageSetConfiguration file named rhcl-imageset-config.yaml by using the following example:

    Example ImageSetConfiguration YAML
    apiVersion: mirror.openshift.io/v2alpha1
kind: ImageSetConfiguration
mirror:
  operators:
  - catalog: registry.redhat.io/redhat/redhat-operator-index:v4.22
    packages:
    - name: rhcl-operator
    - name: authorino-operator
    - name: limitador-operator
    - name: dns-operator
  additionalImages:
  - name: registry.redhat.io/rhcl-1/coredns-rhel9:<vX.Y.Z>

    • In the mirror.operators.catalog parameter, specify the Red Hat Operator catalog version matching your OpenShift Container Platform cluster version.

    • Optional. The value of the mirror.additionalImages.name parameter is the dns-operator Operator version. Set this value if you want to use the Core DNS Operator. Replace vX.Y.Z with the version matching the Connectivity Link Operator release.

  2. Mirror the catalog to a local directory by running the following command:

    $ oc mirror --v2 --config rhcl-imageset-config.yaml file://./rhcl-mirror

    This command downloads the catalog and Operator images to the rhcl-mirror directory.

  3. Transfer the rhcl-mirror directory to your disconnected environment using removable media.

  4. On a host in the disconnected environment that has access to your mirror registry, push the images to the registry by running the following command:

    $ oc mirror --v2 --config rhcl-imageset-config.yaml \
  --from file://./rhcl-mirror \
  docker://<mirror_registry:port>

    Replace <mirror_registry:port> with the path and port to your mirror registry.

  5. Apply either or both the ImageDigestMirrorSet and ImageTagMirrorSet files to configure the cluster to use the mirrored images by running the following commands:

    1. Apply the ImageDigestMirrorSet by running the following command:

      $ oc apply -f results-*/cluster-resources/idms-oc-mirror.yaml

    2. Apply the ImageTagMirrorSet by running the following command:

      $ oc apply -f results-*/cluster-resources/itms-oc-mirror.yaml
      Note

      The oc-mirror tool generates these manifests based on how you reference your images in the mirrored Operators.

  6. Wait for the MachineConfigPool object to update by running the following command:

    $ oc wait mcp --all --for=condition=Updated --timeout=30m
    Example output
    machineconfigpool.machineconfiguration.openshift.io/master condition met
machineconfigpool.machineconfiguration.openshift.io/worker condition met

  7. From your disconnected cluster, apply the generated CatalogSource manifest by running the following command:

    $ oc apply -f cluster-resources/<cs-redhat-operator-index-v4-21.yaml>

    Replace <cs-redhat-operator-index-v4-21.yaml> with the manifest filename.

  8. Wait for the Operator catalog to be ready by running the following command:

    $ oc wait catalogsource -n openshift-marketplace --all --for=condition=Ready --timeout=5m
    Example output
    catalogsource.operators.coreos.com/cs-redhat-operator-index-v4-21 condition met

You can install Connectivity Link with OpenShift CLI (oc) using the OpenShift Container Platform Cluster Ingress Operator as the default Gateway object controller. You must complete these steps on each OpenShift Container Platform cluster that you want to use Connectivity Link on.

Warning

Connectivity Link uses labels formatted as kuadrant.io/* to search and filter resources on the cluster. Removing of any labels with the prefix might cause unexpected behavior and degradation of Connectivity Link.
Prerequisites

  • You are logged into OpenShift Container Platform as a cluster administrator.

  • You are using a supported configuration of OpenShift Container Platform and required components.

  • You installed the OpenShift CLI (oc).

Procedure

  1. Create the namespace where you want to install Connectivity Link by running the following command:

    $ oc create ns <kuadrant_system>

    You can replace the default <kuadrant_system> with the namespace you want to use.

  2. Create the Subscription custom resource (CR) by using the following example:

    apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: rhcl-operator
  namespace: <kuadrant_system>
spec:
  channel: stable
  installPlanApproval: Automatic
  name: rhcl-operator
  source: redhat-operators
  sourceNamespace: openshift-marketplace

    Replace <kuadrant_system> with the namespace you created to install Connectivity Link.

    Important

    For disconnected installations, you must replace the spec.source parameter value of the Subscription object with the name of the CatalogSource object created by oc-mirror. You can find the catalog source name by running the following command:

    $ oc get catalogsource -n openshift-marketplace

  3. Apply the Subscription CR by running the following command:

    $ oc apply -f subscription.yaml

  4. Create the OperatorGroup CR by using the following example:

    apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: kuadrant
  namespace: <kuadrant_system>
spec:
  upgradeStrategy: Default

    Replace <kuadrant_system> with the namespace where you are installing Connectivity Link.

  5. Apply the OperatorGroup CR by running the following command:

    $ oc apply -f operatorgroup.yaml

  6. Confirm that the Connectivity Link installation has finished by running one of the following commands:

    $ oc wait --for=jsonpath={.status.installPlanRef.name} subscription rhcl-operator --timeout=10s
ip=$(oc get subscription rhcl-operator -o=jsonpath={.status.installPlanRef.name})
    $ oc wait --for=condition=Installed installplan ${ip} --timeout=60s

    Expect the status of installplan.operators.coreos.com/install-<suffix> when Connectivity Link is ready. The name of the install plan has a random suffix, for example, 4rql7.

  7. Create your Connectivity Link CR by using the following example:

    apiVersion: kuadrant.io/v1beta1
kind: Kuadrant
metadata:
  name: kuadrant
  namespace: <kuadrant_system>
spec: {}

    Replace <kuadrant_system> with the namespace where you installed Connectivity Link.

  8. Optional. If you have a Red Hat Developer Hub subscription, enable the Red Hat Developer Hub plugin by using the following example:

    apiVersion: kuadrant.io/v1beta1
kind: Kuadrant
metadata:
#...
spec:
  components:
    developerPortal:
      enabled: true
#...

  9. Apply the Connectivity Link CR by running the following command:

    $ oc apply -f kuadrant.yaml
Verification

  1. Check the status of the Connectivity Link CR generation by running the following command:

    $ oc wait kuadrant/kuadrant --for="condition=Ready=true" -n <kuadrant_system> --timeout=300s

    Replace <kuadrant_system> with the namespace where you installed Connectivity Link.

    Example output
    kuadrant.kuadrant.io/kuadrant Ready

  2. Verify that all component Operator pods are running by entering the following command:

    $ oc get pods -n <kuadrant_system>

    Replace <kuadrant_system> with the namespace where you installed Connectivity Link.

    Example output
    NAME                                                READY   STATUS    RESTARTS   AGE
authorino-operator-controller-manager-<hash>        2/2     Running   0          5m
dns-operator-controller-manager-<hash>              2/2     Running   0          5m
kuadrant-operator-controller-manager-<hash>         2/2     Running   0          7m
limitador-operator-controller-manager-<hash>        2/2     Running   0          5m

  3. For a disconnected installation, verify that there are no image pull errors by running the following command:

    $ oc get events -n <kuadrant_system> --field-selector reason=Failed

    Replace <kuadrant_system> with the namespace where you installed Connectivity Link.

    The output should not show image pull failures.

    Note

    Pod specifications still show original the image references, for example, registry.redhat.io/redhat/…​, even when images are pulled from your mirror registry. The redirection happens transparently at the CRI-O level through ImageDigestMirrorSet or ImageTagMirrorSet configuration objects.

If your CatalogSource object shows a READY=False status, the catalog image is not accessible from your mirror registry. You can check pod logs and check that the catalog image exists to troubleshoot this situation.

Prerequisites

  • You completed a disconnected installation of Connectivity Link.

Procedure

  1. Check the catalog pod logs by running the following command:

    $ oc logs -n openshift-marketplace -l olm.catalogSource=cs-redhat-operator-index-v{ocp-latest-version}

    Make sure you use the information that was created by the oc mirror tool to run this command.

  2. Verify that the catalog image exists in the mirror registry by running the following command:

    $ oc image info <mirror_registry>/redhat/redhat-operator-index:v{ocp-latest-version}

    Replace <mirror_registry> with the path to your mirror registry.

If you only see the Connectivity Link Operator ClusterServiceVersion, but the Authorino, Limitador, or DNS Operators are missing, the catalog might be missing digest references or the dependencies are not declared. You can track the source of the problem by checking a couple of resources.

Prerequisites

  • You completed a disconnected installation of Connectivity Link.

Procedure

  1. Verify that all of the required Operators are available as PackageManifest resources by running the following command:

    $ oc get packagemanifest -n openshift-marketplace | grep -E '(rhcl|authorino|limitador|dns)-operator'

  2. If any packages are missing, the catalog was not mirrored or applied correctly. Check that the catalog is ready and running with no errors and that the ImageSetConfiguration is created correctly.

  3. Check that the InstallPlan shows all dependencies by running the following command:

    $ oc get installplan -n <kuadrant_system> -o yaml

    • Replace <kuadrant_system> with the namespace in which you installed Connectivity Link.

    • Look for all required Operators in the InstallPlan specification output.

  4. If an Operator is missing, check the InstallPlan for errors or re-mirror the catalog.

If your pods are stuck with an ImagePullBackOff status, this might mean that the image is either not in the mirror registry or that the ImageDigestMirrorSet object not applied correctly.

Prerequisites

  • You completed a disconnected installation of Connectivity Link.

Procedure

  1. Verify that ImageDigestMirrorSet exists by running the following command:

    $ oc get imagedigestmirrorset

  2. Check whether the specific image was mirrored by running the following command:

    $ oc image info <mirror_registry>/rhcl-1/rhcl-operator@sha256:_<digest>_

    • Replace <mirror_registry> with the path to your mirror registry.

    • Replace <digest> with the complete digest value.

  3. Check pod events by running the following command:

    $ oc describe pod <pod_name> -n <kuadrant_system>

    • Replace <pod_name> with the name of the stuck pod.

    • Replace <kuadrant_system> with the namespace in which you installed Connectivity Link.

← Previous: Use the OpenShift web console | ↑ Up: Install | ⌂ Home: Red Hat Connectivity Link | Next: Install the MCP gateway →