OC-ADM-CATALOG-MIRROR(1)

📦
version 4.22.0 · 2 versions
, in nixpkgs unstable

💅 OC ADM CATALOG(1) — oc adm catalog mirror

hey bestie, welcome to the OpenShift CLI User Manuals ✨ this one's all about oc adm catalog mirror, and honestly it's kind of a big deal 🎀

🌸 NAME

oc adm catalog mirror — mirror an operator-registry catalog 🪞

✨ SYNOPSIS

oc adm catalog mirror [OPTIONS]

🦋 DESCRIPTION

So basically, this command mirrors the contents of a catalog into a registry. Slay. 💅

Here's the whole glow-up: it pulls down an image containing a catalog, extracts it to disk, queries it to find all of the images used in the manifests, and then mirrors them to a target registry. The way it does all four of those things in one go? Iconic, no cap.

By default, the catalog files are extracted to a temporary directory, but like, you can save them locally via flags if you're that kind of person 🫶

An image content source policy gets written to a file that can be added to a cluster with access to the target registry. That's the whole point, fr fr — it configures the cluster to pull from the mirrors instead of the locations referenced in the operator manifests.

A mapping.txt file is also created that is compatible with oc image mirror. You may use it to further customize the mirroring configuration, but lowkey you shouldn't need it in normal circumstances.

⚠️ !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ⚠️ !! DEPRECATION NOTICE: ⚠️ !! Sqlite-based catalogs are deprecated. Support for them will be removed in a ⚠️ !! future release. Please migrate your catalog workflows to the new file-based ⚠️ !! catalog format. ⚠️ !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! not me begging you to migrate 😭 sqlite catalogs are deprecated, bestie — support is getting removed in a future release. move your catalog workflows to the new file-based catalog format, please and thank you 💀

🎀 OPTIONS

  • --certificate-authority="" — the path to a certificate authority bundle to use when communicating with the managed container image registries. Heads up: if --insecure is used, this flag is ignored entirely 🙈
  • --continue-on-error=true — if an error occurs while mirroring, keep going and attempt to mirror as much as possible. resilient queen energy 👑
  • --dir="" — the directory on disk that file:// images will be copied under.
  • --dry-run=false — print the actions that would be taken and exit without writing to the destinations. peek, don't touch ✨
  • --from-dir="" — the directory on disk that file:// images will be read from. overrides --dir.
  • --idms-scope="repository" — scope of registry mirrors in the imagedigestmirrorset file. allowed values: repository, registry. defaults to: repository.
  • --index-filter-by-os="" — a regular expression to control which index image is picked when multiple variants are available. images will be passed as '<platform>/<architecture>[/<variant>]'. this does not apply to images referenced by the index 👀
  • --insecure=false — allow push and pull operations to registries to be made over HTTP.
  • --manifests-only=false — calculate the manifests required for mirroring, but don't actually mirror image content.
  • --max-components=2 — the maximum number of path components allowed in a destination mapping. example: quay.io/org/repo has two path components.
  • --max-idms-size=250000 — the maximum number of bytes for the generated IDMS yaml(s). defaults to 250000.
  • --max-per-registry=4 — number of concurrent requests allowed per registry.
  • --path="" — specify an in-container to local path mapping for the index file(s).
  • -a, --registry-config="" — path to your registry credentials. alternatively the REGISTRY_AUTH_FILE env variable can be also specified. defaults to ${XDG_RUNTIME_DIR}/containers/auth.json, /run/containers/${UID}/auth.json, ${XDG_CONFIG_HOME}/containers/auth.json, ${DOCKER_CONFIG}, /.docker/config.json, /.dockercfg. the order can be changed via the REGISTRY_AUTH_PREFERENCE env variable (deprecated) to a "docker" value to prioritize Docker credentials over Podman's.
  • --skip-verification=false — skip verifying the integrity of the retrieved content. this is not recommended, but may be necessary when importing images from older image registries. only bypass verification if the registry is known to be trustworthy 🔥
  • --to-manifests="" — local path to store manifests.

💖 OPTIONS INHERITED FROM PARENT COMMANDS

these ones came from the parent commands, and they're just as iconic 💜

  • --as="" — username to impersonate for the operation. user could be a regular user or a service account in a namespace.
  • --as-group=[] — group to impersonate for the operation. this flag can be repeated to specify multiple groups.
  • --as-uid="" — UID to impersonate for the operation.
  • --as-user-extra=[] — user extras to impersonate for the operation. this flag can be repeated to specify multiple values for the same key.
  • --cache-dir="/homeless-shelter/.kube/cache" — default cache directory.
  • --client-certificate="" — path to a client certificate file for TLS.
  • --client-key="" — path to a client key file for TLS.
  • --cluster="" — the name of the kubeconfig cluster to use.
  • --context="" — the name of the kubeconfig context to use.
  • --disable-compression=false — if true, opt-out of response compression for all requests to the server.
  • --insecure-skip-tls-verify=false — if true, the server's certificate will not be checked for validity. this will make your HTTPS connections insecure 😬
  • --kubeconfig="" — path to the kubeconfig file to use for CLI requests.
  • --kuberc="" — path to the kuberc file to use for preferences. this can be disabled by exporting the KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
  • --match-server-version=false — require server version to match client version.
  • -n, --namespace="" — if present, the namespace scope for this CLI request.
  • --profile="none" — name of profile to capture. one of (none|cpu|heap|goroutine|threadcreate|block|mutex).
  • --profile-output="profile.pprof" — name of the file to write the profile to.
  • --request-timeout="0" — the length of time to wait before giving up on a single server request. non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). a value of zero means don't timeout requests.
  • -s, --server="" — the address and port of the Kubernetes API server.
  • --tls-server-name="" — server name to use for server certificate validation. if it is not provided, the hostname used to contact the server is used.
  • --token="" — bearer token for authentication to the API server.
  • --user="" — the name of the kubeconfig user to use.
  • --warnings-as-errors=false — treat warnings received from the server as errors and exit with a non-zero exit code.

🌈 EXAMPLE

okay this is the part where it gets good — copy these exactly, bestie 🫶

# Mirror an operator-registry image and its contents to a registry
oc adm catalog mirror quay.io/my/image:latest myregistry.com

# Mirror an operator-registry image and its contents to a particular namespace in a registry
oc adm catalog mirror quay.io/my/image:latest myregistry.com/my-namespace

# Mirror to an airgapped registry by first mirroring to files
oc adm catalog mirror quay.io/my/image:latest file:///local/index
oc adm catalog mirror file:///local/index/my/image:latest my-airgapped-registry.com

# Configure a cluster to use a mirrored registry
oc apply -f manifests/imageDigestMirrorSet.yaml

# Edit the mirroring mappings and mirror with "oc image mirror" manually
oc adm catalog mirror --manifests-only quay.io/my/image:latest myregistry.com
oc image mirror -f manifests/mapping.txt

# Delete all ImageDigestMirrorSets generated by oc adm catalog mirror
oc delete imagedigestmirrorset -l operators.openshift.org/catalog=true

⭐ SEE ALSO

oc-adm-catalog(1)

🧚 HISTORY

June 2016, ported from the Kubernetes man-doc generator 🌸

and that's the whole page, bestie!! 🎀 this gem came to you from the Openshift CLI User Manuals, dated June 2016 — ngl it's giving vintage but it still ate 💅✨

📦 where this page comes from