Steps used to test CRW staging catalog on a disconnected cluster for the CRW 2.2.0 release

testing-staging-crw-on-dosconnected-cluster.md

Prepare env variables

export QUAY_USERNAME=xxx ; export QUAY_PASSWORD=xxx
export AUTH_TOKEN=$(curl -sH "Content-Type: application/json" -XPOST https://quay.io/cnr/api/v1/users/login -d '
{
    "user": {  
        "username": "'"${QUAY_USERNAME}"'",
        "password": "'"${QUAY_PASSWORD}"'"
    }
}' | jq -r '.token')
export REGISTRY_HOST=<bastion host name>:5000

Grab the correspondign oc client

curl --insecure -L https://downloads-openshift-console.apps.rhopp-airgap.crw-qe.com/amd64/linux/oc > oc
chmod a+x ./oc

Login to you bastion host docker registry

docker login $REGISTRY_HOST

Build the catalog mirror, and prepare the mirroring

./oc adm catalog build  --filter-by-os="linux/amd64" --from=registry.redhat.io/openshift4/ose-operator-registry:v4.4 --appregistry-org redhat-operators-stage --to=${REGISTRY_HOST}/olm/redhat-operators-stage:1 --insecure --auth-token="${AUTH_TOKEN}"
./oc adm catalog mirror --insecure --manifests-only=true ${REGISTRY_HOST}/olm/redhat-operators-stage:1 ${REGISTRY_HOST} --filter-by-os=".*"

Manually filter / tweak the list of images to mirror

sed -i \
-e 's/^\(.*codeready.*\)$/TOKEEP\1/' \
-e 's/^\(.*rhscl.*\)$/TOKEEP\1/' \
-e 's/^\(.*ubi8-minimal.*\)$/TOKEEP\1/' \
-e 's/^\(.*redhat-sso-7.*\)$/TOKEEP\1/' \
-e 's/^\(.*rh-sso-7.*\)$/TOKEEP\1/' \
-e 's/^\(.*jboss-eap-7.*\)$/TOKEEP\1/' \
-e 's/^\(.*postgresql.*\)$/TOKEEP\1/' \
-e '/^TOKEEP.*/!d' \
-e '/.*@sha256:.*/!d' \
-e 's/TOKEEP//g' \
redhat-operators-stage-manifests/mapping.txt

Manually change the image content source policy for images from the production RedHat catalog

for image in $(echo 'codeready-workspaces/theia-rhel8
codeready-workspaces/theia-endpoint-rhel8
codeready-workspaces/plugin-java8-rhel8
codeready-workspaces/plugin-kubernetes-rhel8
codeready-workspaces/plugin-openshift-rhel8
codeready-workspaces/plugin-java11-rhel8
codeready-workspaces/stacks-golang-rhel8
codeready-workspaces/stacks-cpp-rhel8
codeready-workspaces/stacks-dotnet-rhel8
codeready-workspaces/stacks-python-rhel8
codeready-workspaces/stacks-node-rhel8
codeready-workspaces/stacks-php-rhel8
codeready-workspaces/stacks-java-rhel8
codeready-workspaces/machineexec-rhel8
rhscl/mysql-57-rhel7
rhscl/mongodb-34-rhel7
rhscl/mongodb-36-rhel7
jboss-eap-7/eap73-openjdk8-openshift-rhel7')
do  
echo "Reverting mirror to 'regisry.redhat.io' for image: $image"
sed -i -e "s#registry\.stage\.redhat\.io/$image#registry.redhat.io/$image#" redhat-operators-stage-manifests/imageContentSourcePolicy.yaml 
done

Mirror the selected images

Official way would be:

for line in $(cat redhat-operators-stage-manifests/mapping.txt)
do
  echo $(echo $line | sed -e 's/^\([^=][^=]*\)=.*$/Mirroring \1/')
  oc image mirror  --filter-by-os=".*" $line
  echo
done

But since some oc mirror versions have bugs, you might prefer to use:

for line in $(cat redhat-operators-stage-manifests/mapping.txt)
do
  echo $(echo $line | sed -e 's/^\([^=][^=]*\)=.*$/Mirroring \1/')
  echo $line | sed -e 's/^\([^=][^=]*\)=\(.*\)$/docker:\/\/\1 docker:\/\/\2/' | xargs skopeo copy --all
  echo
done

Apply the new catalog source to the disconnected cluster

cat <<EOF | oc apply -f -
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: redhat-operators-stage
  namespace: openshift-marketplace
spec:
  sourceType: grpc
  image: ${REGISTRY_HOST}/olm/redhat-operators-stage:1 
  displayName: My Restricted Eclipse Che Catalog
  publisher: grpc
EOF

Install the operator

export INSTALL_NAMESPACE=dfestal-tests 
oc create project $INSTALL_NAMESPACE || true
oc project $INSTALL_NAMESPACE

Add the creation of the subscription and operator group as you usually do

Missing script here ...

Create the custom resource to start the instalation

cat <<EOF | oc apply -f -
apiVersion: org.eclipse.che/v1
kind: CheCluster
metadata:
  name: codeready-workspaces
  namespace: $INSTALL_NAMESPACE
spec:
  server:
    cheFlavor: codeready
    tlsSupport: true
    proxyURL: "http://$(echo ${REGISTRY_HOST} | sed -e 's/:[^:][^:]*$//')"
    proxyPort: '3128'
    nonProxyHosts: $(oc get infrastructures.config.openshift.io/cluster -o jsonpath={.status.apiServerURL} | sed -e 's#^https://##' -e 's/:[^:][^:]*$//')
  auth:
    openShiftoAuth: true
  storage:
    pvcStrategy: per-workspace
    pvcClaimSize: 1Gi
    preCreateSubPaths: true
EOF