OC-ADM-RELEASE-NEW(1)

💖 OC ADM RELEASE(1) 💖

okay so bestie, you found the OpenShift CLI User Manuals page for oc adm release new, dated June 2016. This is the release-building main character moment. Let’s go. 💅✨

---

🌸 NAME 🌸

oc adm release new — create a new OpenShift release. Literally what it says on the tin, no cap. 👑

🦋 SYNOPSIS 🦋

oc adm release new [OPTIONS]

✨ DESCRIPTION ✨

So this command builds a brand-new OpenShift release image that will update a cluster. Iconic behavior. 💖

OpenShift uses long-running active management processes called “operators” to keep the cluster running and manage component lifecycle. This command composes a set of images with operator definitions into a single update payload that can be used to install or update a cluster.

Operators are expected to host the config they need to be installed to a cluster in the /manifests directory in their image. This command iterates over a set of operator images and extracts those manifests into a single, ordered list of Kubernetes objects that can then be iteratively updated on a cluster by the cluster version operator when it is time to perform an update. Manifest files are renamed to 0000 70<image_name><filename> by default, and an operator author that needs to provide a global-ordered file (before or after other operators) should prepend 0000 NN<component> to their file name, which instructs the release builder to not assign a component prefix. Only images in the input that have the image label io.openshift.release.operator=true will have manifests loaded.

If an image is in the input but is not referenced by an operator’s image-references file, the image will not be included in the final release image unless --include=NAME is provided.

Mappings specified via SRC=DST positional arguments allows overriding particular operators with a specific image. For example:

cluster-version-operator=registry.example.com/openshift/cluster-version-operator:test-123

will override the default cluster-version-operator image with one pulled from registry.example.com.

💅 OPTIONS 💅

• --allow-missing-images=false — ignore errors when an operator references a release image that is not included.
• --certificate-authority="" — the path to a certificate authority bundle to use when communicating with the managed container image registries. If --insecure is used, this flag will be ignored.
• --component-versions="" — supply additional version strings to the release in key=value[,key=value] form.
• --component-versions-display-names="" — supply additional version display names to the release in key=value[,key=value] form.
• --dir="" — directory to write release contents to; will default to a temporary directory.
• --dry-run=false — skips changes to external registries via mirroring or pushing images.
• --exclude=[] — a list of image names or tags to exclude. It is applied after all inputs. Comma separated or individual arguments.
• --from-dir="" — use this directory as the source for the release payload.
• --from-image-stream="" — look at all tags in the provided image stream and build a release payload from them.
• -f, --from-image-stream-file="" — take the provided image stream on disk and build a release payload from it.
• --from-release="" — use an existing release image as input.
• --include=[] — a list of image tags that should not be pruned. Excluding a tag takes precedence. Comma separated or individual arguments.
• --insecure=false — allow push and pull operations to registries to be made over HTTP.
• --keep-manifest-list=false — if an image is part of a manifest list, always mirror the list even if only one image is found.
• --mapping-file=[] — a file defining a mapping of input images to use to build the release.
• --max-per-registry=4 — number of concurrent requests allowed per registry.
• --metadata="" — a JSON object to attach as the metadata for the release manifest.
• --mirror="" — mirror the contents of the release to this repository.
• --name="" — the name of the release. Will default to the current time.
• --next=[] — a list of semantic versions that should succeed this version in the release manifest. Using --next can potentially cause regressions given the release does not exist. Use with caution.

⚠️ bestie, that --next caveat is real: using --next can potentially cause regressions given the release does not exist. Use with caution. 😭

• -o, --output="" — output the mapping definition in this format.
• --previous=[] — a list of semantic versions that should precede this version in the release manifest.
• --reference-mode="" — by default, the image reference from an image stream points to the public registry for the stream and the image digest. Pass source to build references to the originating image.
• -a, --registry-config="" — path to your registry credentials. Alternatively REGISTRY_AUTH_FILE env variable can be also specified. Defaults to ${XDG_RUNTIME_DIR}/containers/auth.json, /run/containers/${UID}/auth.json, ${XDG_CONFIG_HOME}/containers/auth.json, ${DOCKER_CONFIG}, /.docker/config.json, /.dockercfg. The order can be changed via the REGISTRY_AUTH_PREFERENCE env variable (deprecated) to a "docker" value; that prioritizes Docker credentials over Podman’s.
• --release-manifest=false — if true, a release manifest will be created using --name as the semantic version.
• --skip-manifest-check=false — ignore errors when an operator includes a yaml/yml/json file that is not parseable.
• --skip-verification=false — skip verifying the integrity of the retrieved content. This is not recommended, but may be necessary when importing images from older image registries. Only bypass verification if the registry is known to be trustworthy.

🚨 no cap: only bypass verification if the registry is known to be trustworthy. That is not a casual vibe-check situation. 💀

• --to-dir="" — output the release manifests to a directory instead of creating an image.
• --to-file="" — output the release to a tar file instead of creating an image.
• --to-image="" — the location to upload the release image to.
• --to-image-base="" — if specified, the image to add the release layer on top of.
• --to-image-base-tag="cluster-version-operator" — if specified, the image tag in the input to add the release layer on top of. Defaults to cluster-version-operator.
• --to-signature="" — if specified, output a message that can be signed that describes this release. Requires --to-image.

🫶 OPTIONS INHERITED FROM PARENT COMMANDS 🫶

• --as="" — username to impersonate for the operation. User could be a regular user or a service account in a namespace.
• --as-group=[] — group to impersonate for the operation; this flag can be repeated to specify multiple groups.
• --as-uid="" — UID to impersonate for the operation.
• --as-user-extra=[] — user extras to impersonate for the operation; this flag can be repeated to specify multiple values for the same key.
• --cache-dir="/homeless-shelter/.kube/cache" — default cache directory.
• --client-certificate="" — path to a client certificate file for TLS.
• --client-key="" — path to a client key file for TLS.
• --cluster="" — the name of the kubeconfig cluster to use.
• --context="" — the name of the kubeconfig context to use.
• --disable-compression=false — if true, opt-out of response compression for all requests to the server.
• --insecure-skip-tls-verify=false — if true, the server’s certificate will not be checked for validity. This will make your HTTPS connections insecure.

🙈 this one is giving “security is optional” and that is exactly what it says: the server’s certificate will not be checked for validity. Your HTTPS connections will be insecure. Do with that what you will, bestie.

• --kubeconfig="" — path to the kubeconfig file to use for CLI requests.
• --kuberc="" — path to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.
• --match-server-version=false — require server version to match client version.
• -n, --namespace="" — if present, the namespace scope for this CLI request.
• --profile="none" — name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex).
• --profile-output="profile.pprof" — name of the file to write the profile to.
• --request-timeout="0" — the length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don’t timeout requests.
• -s, --server="" — the address and port of the Kubernetes API server.
• --tls-server-name="" — server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used.
• --token="" — bearer token for authentication to the API server.
• --user="" — the name of the kubeconfig user to use.
• --warnings-as-errors=false — treat warnings received from the server as errors and exit with a non-zero exit code.

🔥 EXAMPLE 🔥

okay these are the exact examples, keep them safe in your notes app bestie:

# Create a release from the latest origin images and push to a DockerHub repository
oc adm release new --from-image-stream=4.11 -n origin --to-image docker.io/mycompany/myrepo:latest

# Create a new release with updated metadata from a previous release
oc adm release new --from-release registry.ci.openshift.org/origin/release:v4.11 --name 4.11.1 \
--previous 4.11.0 --metadata ... --to-image docker.io/mycompany/myrepo:latest

# Create a new release and override a single image
oc adm release new --from-release registry.ci.openshift.org/origin/release:v4.11 \
cli=docker.io/mycompany/cli:latest --to-image docker.io/mycompany/myrepo:latest

# Run a verification pass to ensure the release can be reproduced
oc adm release new --from-release registry.ci.openshift.org/origin/release:v4.11

🌈 SEE ALSO 🌈

peep this sibling page too: oc-adm-release(1),

🎀 HISTORY 🎀

June 2016, Ported from the Kubernetes man-doc generator

---

💖 cute little sign-off before you go: source/version is Openshift, the manual is Openshift CLI User Manuals, the date is June 2016, and this page is OC ADM RELEASE(1). slay, you’re all caught up. 🫶✨