<commit_before>// Module included in the following assemblies:
//
// * installing/install_config/installing-restricted-networks-preparations.adoc
// * openshift_images/samples-operator-alt-registry.adoc

[id="installation-mirror-repository_{context}"]
= Mirroring the {product-title} image repository

Mirror the {product-title} image repository to your registry to use during cluster installation or upgrade.

.Prerequisites

* Your mirror host has access to the Internet.
* You configured a mirror registry to use in your restricted network and
can access the certificate and credentials that you configured.
ifndef::openshift-origin[]
* You downloaded the pull secret from the
link:https://cloud.redhat.com/openshift/install/pull-secret[Pull Secret] page on the {cloud-redhat-com} site and modified it to include authentication to your mirror repository.
endif::[]
ifdef::openshift-origin[]
* You have created a pull secret for your mirror repository.
endif::[]

.Procedure

Complete the following steps on the mirror host:

. Review the
link:https://access.redhat.com/downloads/content/290/[{product-title} downloads page]
to determine the version of {product-title} that you want to install and determine the corresponding tag on the link:https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags[Repository Tags] page.

. Set the required environment variables:
.. Export the release version:
+
[source,terminal]
----
$ OCP_RELEASE=<release_version>
----
+
For `<release_version>`, specify the tag that corresponds to the version of {product-title} to
install, such as `4.5.4`.

.. Export the local registry name and host port:
+
[source,terminal]
----
$ LOCAL_REGISTRY='<local_registry_host_name>:<local_registry_host_port>'
----
+
For `<local_registry_host_name>`, specify the registry domain name for your mirror
repository, and for `<local_registry_host_port>`, specify the port that it
serves content on.

.. Export the local repository name:
+
[source,terminal]
----
$ LOCAL_REPOSITORY='<local_repository_name>'
----
+
For `<local_repository_name>`, specify the name of the repository to create in your
registry, such as `ocp4/openshift4`.

.. Export the name of the repository to mirror:
+
[source,terminal]
----
$ PRODUCT_REPO='openshift-release-dev'
----
+
For a production release, you must specify `openshift-release-dev`.

.. Export the path to your registry pull secret:
+
[source,terminal]
----
$ LOCAL_SECRET_JSON='<path_to_pull_secret>'
----
+
For `<path_to_pull_secret>`, specify the absolute path to and file name of the pull secret for your mirror registry that you created.

.. Export the release mirror:
+
[source,terminal]
----
$ RELEASE_NAME="ocp-release"
----
+
For a production release, you must specify `ocp-release`.

.. Export the type of architecture for your server, such as `x86_64`.:
+
[source,terminal]
----
$ ARCHITECTURE=<server_architecture>
----

.. Export the path to the directory to host the mirrored images:
+
[source,terminal]
----
$ REMOVABLE_MEDIA_PATH=<path> <1>
----
<1> Specify the full path, including the initial forward slash (/) character.

. Mirror the version images to the internal container registry:
** If your mirror host does not have Internet access, take the following actions:
... Connect the removable media to a system that is connected to the Internet.
... Review the images and configuration manifests to mirror:
+
[source,terminal]
----
$ oc adm -a ${LOCAL_SECRET_JSON} release mirror \
     --from=quay.io/${PRODUCT_REPO}/${RELEASE_NAME}:${OCP_RELEASE}-${ARCHITECTURE} \
     --to=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY} \
     --to-release-image=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY}:${OCP_RELEASE}-${ARCHITECTURE} --dry-run
----
... Record the entire `imageContentSources` section from the output of the previous
command. The information about your mirrors is unique to your mirrored repository, and you must add the `imageContentSources` section to the `install-config.yaml` file during installation.
... Mirror the images to a directory on the removable media:
+
[source,terminal]
----
$ oc adm release mirror -a ${LOCAL_SECRET_JSON} --to-dir=${REMOVABLE_MEDIA_PATH}/mirror quay.io/${PRODUCT_REPO}/${RELEASE_NAME}:${OCP_RELEASE}-${ARCHITECTURE}
----
... Take the media to the restricted network environment and upload the images to the local container registry.
+
[source,terminal]
----
$ oc image mirror -a ${LOCAL_SECRET_JSON} --from-dir=${REMOVABLE_MEDIA_PATH}/mirror "file://openshift/release:${OCP_RELEASE}*" ${LOCAL_REGISTRY}/${LOCAL_REPOSITORY} <1>
----
+
<1> For `REMOVABLE_MEDIA_PATH`, you must use the same path that you specified when you mirrored the images.

** If the local container registry is connected to the mirror host, take the following actions:
... Directly push the release images to the local registry by using following command:
+
[source,terminal]
----
$ oc adm -a ${LOCAL_SECRET_JSON} release mirror \
     --from=quay.io/${PRODUCT_REPO}/${RELEASE_NAME}:${OCP_RELEASE}-${ARCHITECTURE} \
     --to=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY} \
     --to-release-image=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY}:${OCP_RELEASE}-${ARCHITECTURE}
----
+
This command pulls the release information as a digest, and its output includes
the `imageContentSources` data that you require when you install your cluster.

... Record the entire `imageContentSources` section from the output of the previous
command. The information about your mirrors is unique to your mirrored repository, and you must add the `imageContentSources` section to the `install-config.yaml` file during installation.
+
[NOTE]
====
The image name gets patched to Quay.io during the mirroring process, and the podman images will show Quay.io in the registry on the bootstrap virtual machine.
====

. To create the installation program that is based on the content that you
mirrored, extract it and pin it to the release:
** If your mirror host does not have Internet access, run the following command:
+
[source,terminal]
----
$ oc adm -a ${LOCAL_SECRET_JSON} release extract --command=openshift-install "${LOCAL_REGISTRY}/${LOCAL_REPOSITORY}:${OCP_RELEASE}"
----
** If the local container registry is connected to the mirror host, run the following command:
+
[source,terminal]
----
$ oc adm -a ${LOCAL_SECRET_JSON} release extract --command=openshift-install "${LOCAL_REGISTRY}/${LOCAL_REPOSITORY}:${OCP_RELEASE}-${ARCHITECTURE}"
----

[IMPORTANT]
====
To ensure that you use the correct images for the version of {product-title}
that you selected, you must extract the installation program from the mirrored
content.

You must perform this step on a machine with an active Internet connection.
====
<commit_msg>BZ-1886892: Adding note to set 'GODEBUG=x509ignoreCN=0'<commit_after>// Module included in the following assemblies:
//
// * installing/install_config/installing-restricted-networks-preparations.adoc
// * openshift_images/samples-operator-alt-registry.adoc

[id="installation-mirror-repository_{context}"]
= Mirroring the {product-title} image repository

Mirror the {product-title} image repository to your registry to use during cluster installation or upgrade.

.Prerequisites

* Your mirror host has access to the Internet.
* You configured a mirror registry to use in your restricted network and
can access the certificate and credentials that you configured.
ifndef::openshift-origin[]
* You downloaded the pull secret from the
link:https://cloud.redhat.com/openshift/install/pull-secret[Pull Secret] page on the {cloud-redhat-com} site and modified it to include authentication to your mirror repository.
endif::[]
ifdef::openshift-origin[]
* You have created a pull secret for your mirror repository.
endif::[]

* If you use self-signed certificates that do not set a Subject Alternative Name, you must precede the `oc` commands in this procedure with `GODEBUG=x509ignoreCN=0`. If you do not set this variable, the `oc` commands will fail with the following error:
+
[source,terminal]
----
x509: certificate relies on legacy Common Name field, use SANs or temporarily enable Common Name matching with GODEBUG=x509ignoreCN=0
----

.Procedure

Complete the following steps on the mirror host:

. Review the
link:https://access.redhat.com/downloads/content/290/[{product-title} downloads page]
to determine the version of {product-title} that you want to install and determine the corresponding tag on the link:https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags[Repository Tags] page.

. Set the required environment variables:
.. Export the release version:
+
[source,terminal]
----
$ OCP_RELEASE=<release_version>
----
+
For `<release_version>`, specify the tag that corresponds to the version of {product-title} to
install, such as `4.5.4`.

.. Export the local registry name and host port:
+
[source,terminal]
----
$ LOCAL_REGISTRY='<local_registry_host_name>:<local_registry_host_port>'
----
+
For `<local_registry_host_name>`, specify the registry domain name for your mirror
repository, and for `<local_registry_host_port>`, specify the port that it
serves content on.

.. Export the local repository name:
+
[source,terminal]
----
$ LOCAL_REPOSITORY='<local_repository_name>'
----
+
For `<local_repository_name>`, specify the name of the repository to create in your
registry, such as `ocp4/openshift4`.

.. Export the name of the repository to mirror:
+
[source,terminal]
----
$ PRODUCT_REPO='openshift-release-dev'
----
+
For a production release, you must specify `openshift-release-dev`.

.. Export the path to your registry pull secret:
+
[source,terminal]
----
$ LOCAL_SECRET_JSON='<path_to_pull_secret>'
----
+
For `<path_to_pull_secret>`, specify the absolute path to and file name of the pull secret for your mirror registry that you created.

.. Export the release mirror:
+
[source,terminal]
----
$ RELEASE_NAME="ocp-release"
----
+
For a production release, you must specify `ocp-release`.

.. Export the type of architecture for your server, such as `x86_64`.:
+
[source,terminal]
----
$ ARCHITECTURE=<server_architecture>
----

.. Export the path to the directory to host the mirrored images:
+
[source,terminal]
----
$ REMOVABLE_MEDIA_PATH=<path> <1>
----
<1> Specify the full path, including the initial forward slash (/) character.

. Mirror the version images to the internal container registry:
** If your mirror host does not have Internet access, take the following actions:
... Connect the removable media to a system that is connected to the Internet.
... Review the images and configuration manifests to mirror:
+
[source,terminal]
----
$ oc adm -a ${LOCAL_SECRET_JSON} release mirror \
     --from=quay.io/${PRODUCT_REPO}/${RELEASE_NAME}:${OCP_RELEASE}-${ARCHITECTURE} \
     --to=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY} \
     --to-release-image=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY}:${OCP_RELEASE}-${ARCHITECTURE} --dry-run
----
... Record the entire `imageContentSources` section from the output of the previous
command. The information about your mirrors is unique to your mirrored repository, and you must add the `imageContentSources` section to the `install-config.yaml` file during installation.
... Mirror the images to a directory on the removable media:
+
[source,terminal]
----
$ oc adm release mirror -a ${LOCAL_SECRET_JSON} --to-dir=${REMOVABLE_MEDIA_PATH}/mirror quay.io/${PRODUCT_REPO}/${RELEASE_NAME}:${OCP_RELEASE}-${ARCHITECTURE}
----
... Take the media to the restricted network environment and upload the images to the local container registry.
+
[source,terminal]
----
$ oc image mirror -a ${LOCAL_SECRET_JSON} --from-dir=${REMOVABLE_MEDIA_PATH}/mirror "file://openshift/release:${OCP_RELEASE}*" ${LOCAL_REGISTRY}/${LOCAL_REPOSITORY} <1>
----
+
<1> For `REMOVABLE_MEDIA_PATH`, you must use the same path that you specified when you mirrored the images.

** If the local container registry is connected to the mirror host, take the following actions:
... Directly push the release images to the local registry by using following command:
+
[source,terminal]
----
$ oc adm -a ${LOCAL_SECRET_JSON} release mirror \
     --from=quay.io/${PRODUCT_REPO}/${RELEASE_NAME}:${OCP_RELEASE}-${ARCHITECTURE} \
     --to=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY} \
     --to-release-image=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY}:${OCP_RELEASE}-${ARCHITECTURE}
----
+
This command pulls the release information as a digest, and its output includes
the `imageContentSources` data that you require when you install your cluster.

... Record the entire `imageContentSources` section from the output of the previous
command. The information about your mirrors is unique to your mirrored repository, and you must add the `imageContentSources` section to the `install-config.yaml` file during installation.
+
[NOTE]
====
The image name gets patched to Quay.io during the mirroring process, and the podman images will show Quay.io in the registry on the bootstrap virtual machine.
====

. To create the installation program that is based on the content that you
mirrored, extract it and pin it to the release:
** If your mirror host does not have Internet access, run the following command:
+
[source,terminal]
----
$ oc adm -a ${LOCAL_SECRET_JSON} release extract --command=openshift-install "${LOCAL_REGISTRY}/${LOCAL_REPOSITORY}:${OCP_RELEASE}"
----
** If the local container registry is connected to the mirror host, run the following command:
+
[source,terminal]
----
$ oc adm -a ${LOCAL_SECRET_JSON} release extract --command=openshift-install "${LOCAL_REGISTRY}/${LOCAL_REPOSITORY}:${OCP_RELEASE}-${ARCHITECTURE}"
----

[IMPORTANT]
====
To ensure that you use the correct images for the version of {product-title}
that you selected, you must extract the installation program from the mirrored
content.

You must perform this step on a machine with an active Internet connection.
====

{'fraction_non_alphanumeric': 0.114616497829233, 'fraction_numerical': 0.003907380607814761, 'mean_word_length': 4.638922888616891, 'pattern_counts': {'":': 0, '<': 35, '<?xml version=': 0, '>': 35, 'https://': 6, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 6, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2001186', 'n_tokens_mistral': 4128, 'n_tokens_neox': 3929, 'n_words': 1470}