<commit_before>[id="olm-restricted-networks"]
= Using Operator Lifecycle Manager on restricted networks
include::modules/common-attributes.adoc[]
:context: olm-restricted-networks

toc::[]

For {product-title} clusters installed on restricted networks, also known as
disconnected clusters, Operator Lifecycle Manager (OLM) by default cannot access
the Red Hat-provided OperatorHub sources hosted on Quay.io because they require
full Internet connectivity. However, cluster administrators can disable those
remote sources, create local mirrors of that same content, and configure OLM to
install and manage Operators from the local sources instead.

[IMPORTANT]
====
While OLM can manage Operators from local sources, the ability for a given
Operator to run successfully in a restricted network still depends on the
Operator itself. The Operator must:

* List any related images, or other container images that the Operator might
require to perform their functions, in the `relatedImages` parameter of its
ClusterServiceVersion (CSV) object.
* Reference all specified images by a digest (SHA) and not by a tag.

See the following Red Hat Knowledgebase Article for a list of Red Hat Operators
that support running in disconnected mode:

link:https://access.redhat.com/articles/4740011[]
====

.Additional resources

* xref:../../operators/operator_sdk/osdk-generating-csvs.adoc#olm-enabling-operator-for-restricted-network_osdk-generating-csvs[Enabling your Operator for restricted network environments]

include::modules/olm-understanding-operator-catalog-images.adoc[leveloffset=+1]

[id="olm-restricted-network-prereqs"]
== Prerequisites

* If you want to prune the default catalog and selectively mirror only a subset of Operators, install the xref:../../cli_reference/opm-cli.adoc#opm-cli[`opm` CLI].

include::modules/olm-restricted-networks-configuring-operatorhub.adoc[leveloffset=+1]
include::modules/olm-pruning-index-image.adoc[leveloffset=+1]
include::modules/olm-mirroring-catalog.adoc[leveloffset=+1]
.Additional resources

* xref:../../installing/install_config/installing-restricted-networks-preparations.adoc#installing-restricted-networks-preparations[Creating a mirror registry for installation in a restricted network]<commit_msg>Improve disconnected OLM intro<commit_after>[id="olm-restricted-networks"]
= Using Operator Lifecycle Manager on restricted networks
include::modules/common-attributes.adoc[]
:context: olm-restricted-networks

toc::[]

For {product-title} clusters that are installed on restricted networks, also known as disconnected clusters, Operator Lifecycle Manager (OLM) by default cannot access the Red Hat-provided OperatorHub sources hosted remotely on Quay.io because those remote sources require full Internet connectivity.

However, as a cluster administrator you can still enable your cluster to use OLM in a restricted network if you have a workstation that has full Internet access. The workstation is used to prepare local mirrors of the remote OperatorHub sources, and requires full Internet access to pull the remote content.

This guide describes the following process that is required to enable OLM in restricted networks:

* Disable the default remote OperatorHub sources for OLM.
* Use a workstation with full Internet access to create local mirrors of the OperatorHub content.
* Configure OLM to install and manage Operators from the local sources instead of the default remote sources.

After enabling OLM in a restricted network, you can continue to use your unrestricted workstation to keep your local OperatorHub sources updated as newer versions of Operators are released.

[IMPORTANT]
====
While OLM can manage Operators from local sources, the ability for a given Operator to run successfully in a restricted network still depends on the Operator itself. The Operator must:

* List any related images, or other container images that the Operator might require to perform their functions, in the `relatedImages` parameter of its ClusterServiceVersion (CSV) object.
* Reference all specified images by a digest (SHA) and not by a tag.

See the following Red Hat Knowledgebase Article for a list of Red Hat Operators that support running in disconnected mode:

link:https://access.redhat.com/articles/4740011[]
====

.Additional resources

* xref:../../operators/operator_sdk/osdk-generating-csvs.adoc#olm-enabling-operator-for-restricted-network_osdk-generating-csvs[Enabling your Operator for restricted network environments]

include::modules/olm-understanding-operator-catalog-images.adoc[leveloffset=+1]

[id="olm-restricted-network-prereqs"]
== Prerequisites

* If you want to prune the default catalog and selectively mirror only a subset of Operators, install the xref:../../cli_reference/opm-cli.adoc#opm-cli[`opm` CLI].

include::modules/olm-restricted-networks-configuring-operatorhub.adoc[leveloffset=+1]
include::modules/olm-pruning-index-image.adoc[leveloffset=+1]
include::modules/olm-mirroring-catalog.adoc[leveloffset=+1]
.Additional resources

* xref:../../installing/install_config/installing-restricted-networks-preparations.adoc#installing-restricted-networks-preparations[Creating a mirror registry for installation in a restricted network]
{'fraction_non_alphanumeric': 0.0764367816091954, 'fraction_numerical': 0.00421455938697318, 'mean_word_length': 5.728092783505154, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3738677', 'n_tokens_mistral': 1428, 'n_tokens_neox': 1317, 'n_words': 540}