Document URL: https://docs.openshift.com/container-platform/4.5/installing/install_config/installing-restricted-networks-preparations.html#installation-adding-registry-pull-secret_installing-restricted-networks-preparations Section Number and Name: Configuring credentials that allow images to be mirrored Describe the issue: [oc registry login] command failed when the kubeconfig file does not exist. But it is unnormal in some cases. For example, the kubeconfig should be not created yet when use [oc registry login --auth-basic=<username>:<password>] command to add repository info into a pull secret JSON file. Suggestions for improvement: Podman can add registry auth info into pull secret JSON too. But some customers don't want to add other tools into product env else oc client. Additional information:
*** Bug 1874290 has been marked as a duplicate of this bug. ***
Adding a me too here. The current instructions for mirroring a registry are broken: ~~~ oc registry login --to ./pull-secret.json --registry "...:5000" --auth-basic=root:password error: Missing or incomplete configuration info. Please point to an existing, complete config file: 1. Via the command-line flag --kubeconfig 2. Via the KUBECONFIG environment variable 3. In your home directory as ~/.kube/config To view or setup config directly use the 'config' command. ~~~ It's a chicken/egg problem. A mirrored registry is required to create an OpenShift cluster and a valid kubeconfig, but a cluster cannot be created without first mirroring the registry. As a workaround, the instructions up to https://docs.openshift.com/container-platform/4.2/installing/install_config/installing-restricted-networks-preparations.html list steps that actually do work: https://docs.openshift.com/container-platform/4.2/installing/install_config/installing-restricted-networks-preparations.html#installation-adding-registry-pull-secret_installing-restricted-networks-preparations
Also, this can be achieved with podman, as stated earlier. Here are the instructions for that: ---- Create a pull secret that can be used to push content into the container registry you installed on the registry VM. $ podman login -u openshift -p redhat --authfile $HOME/pullsecret_config.json registry.lab.msp.redhat.com:5000 That is one of the credentials you need. The other is the OpenShift pull secret that you got from Red Hat. Add that to a file called ocp_pullsecret.json. $ echo '<your-openshift-pull-secret-in-json>' > $HOME/ocp_pullsecret.json You can only use one pull secret when mirroring the images to your local container registry as well as when you install OpenShift, so you need to merge the pull secrets you created in the previous two steps into a single json file named merged_pullsecret.json. Remember that you created your pullsecret_config.json in step 4. $ jq -c --argjson var "$(jq .auths $HOME/pullsecret_config.json)" '.auths += $var' $HOME/ocp_pullsecret.json > merged_pullsecret.json $ jq . merged_pullsecret.json All of your pre-requisites are finally complete and you are ready to mirror the OpenShift 4 content to your local container registry!
There is the same issue with this section here: https://docs.openshift.com/container-platform/4.5/installing/install_config/installing-restricted-networks-preparations.html#installation-preparing-restricted-cluster-to-gather-support-data_installing-restricted-networks-preparations --- Preparing your cluster to gather support data Clusters using a restricted network must import the default must-gather image in order to gather debugging data for Red Hat support. The must-gather image is not imported by default, and clusters on a restricted network do not have access to the internet to pull the latest image from a remote repository. Procedure Import the default must-gather image from your installation payload: $ oc import-image is/must-gather -n openshift --- The instructions do not work for a new installation.
The PR to manually add the registry login information is here: https://github.com/openshift/openshift-docs/pull/25833 Jianlin, will you PTAL?
LGTM.
I've merged this change and am waiting for it to go live.
*** Bug 1857296 has been marked as a duplicate of this bug. ***
1857296 has been marked as duplicate of this.
This change is live: https://docs.openshift.com/container-platform/4.5/installing/install_config/installing-restricted-networks-preparations.html#installation-adding-registry-pull-secret_installing-restricted-networks-preparations
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days