Configure the image builder worker in disconnected environments

Configure the image builder worker on Red Hat OpenShift Container Platform to pull builder images from a local registry and install the agent RPM from an offline repository. Complete this procedure when you build operating system images in a disconnected cluster.

Before you begin

  • Red Hat Edge Manager is installed on the cluster from Installing with Helm in a disconnected environment or an equivalent Helm release in the disconnected site.
  • Base images (rhel-bootc, bootc-image-builder, podman, syft, and related images) are mirrored to <local-registry> that worker pods can reach.
  • An offline RPM tree that includes flightctl-agent is staged and served over HTTP from inside the site. See Prepare offline RPMs with subscription repositories.
  • A .repo file whose baseurl points at that HTTP mirror, not cdn.redhat.com.
  • Cluster administrator access and the OpenShift CLI (oc) configured for the release namespace.

About this task

Before you enable Image Builder, review Image Builder security requirements for privileged workload and Security Context Constraint (SCC) requirements on Red Hat OpenShift Container Platform.

Procedure

  1. Mirror Red Hat Edge Manager service images, including the image builder API and worker, during Preparing offline container images and the Helm chart. Plan approximately 3 GB additional capacity when you include image builder images.

    Mirror builder dependency images that are not part of the standard mirror-images run. Copy podman, bootc-image-builder, syft, and your base rhel-bootc image to <local-registry> with skopeo or your site mirroring process. Use the same registry path prefix you configure in the Helm values in a later step.

  2. Publish the offline RPM tree on an HTTP server that worker pods can reach. The worker cannot use a file://baseurl from the host filesystem.

    Create a repository definition file for the mirror, for example rhem-offline.repo:

    [rhem-offline]
name=RHEM offline packages
baseurl=http://<rpm-mirror-host>:<port>/<path-to-repodata-parent>
enabled=1
gpgcheck=0

    Serve the .repo file from the same host (for example http://<rpm-mirror-host>:<port>/rhem-offline.repo). Replace <path-to-repodata-parent> with the directory that contains repodata/.

  3. Update your Helm values for the Red Hat Edge Manager release. Merge the following imageBuilderWorker fields with your existing values (for example disconnected install settings from Installing with Helm in a disconnected environment): 
    imageBuilderWorker:
  enabled: true
  rpmRepoUrl: "http://<rpm-mirror-host>:<port>/rhem-offline.repo"
  rpmRepoEnable: "edge-manager-1.3-for-rhel-9-x86_64-rpms"
  serviceImages:
    podman:
      image: "<local-registry>/<path>/podman/stable:<version>"
    bootcImageBuilder:
      image: "<local-registry>/<path>/bootc-image-builder:<tag>"
    syft:
      image: "<local-registry>/<path>/anchore/syft:<version>"

    Replace <local-registry>/<path> with the registry hostname and repository path from your mirror. Replace rpmRepoEnable with the repository identifier in your offline tree when it differs (for example edge-manager-1.3-for-rhel-10-x86_64-rpms on Red Hat Enterprise Linux 10). Image paths must match the locations where you mirrored the containers in step 1.

    Note

    When you already mount offline repository definitions with a Kubernetes secret instead of rpmRepoUrl, set rpmRepoAdd to false, set yumReposSecretName to your secret name, and omit rpmRepoUrl. See Configuring on Red Hat OpenShift Container Platform in Image builder worker configuration for subscription-managed RPM content for the secret pattern. Use an offline .repo file in that secret; do not reference cdn.redhat.com.
  4. When <local-registry> requires authentication for builder service images, mount registry credentials into the image builder worker. See Configuring registry authentication for builder service images.
  5. Upgrade the Helm release so the worker picks up the new configuration: 
    helm upgrade <release_name> <chart_archive> \
  --namespace <namespace> \
  -f <existing_values_file> \
  --reuse-values

    In the Red Hat OpenShift Container Platform web console, you can navigate to Helm Releases, select your release, and choose Upgrade to edit the YAML values instead.

  6. Verify that the worker pod is running and can reach the mirror without outbound internet access: 
    oc get deployment flightctl-imagebuilder-worker -n <namespace>
oc logs deployment/flightctl-imagebuilder-worker -n <namespace> --tail=50

    Confirm the deployment reports AVAILABLE. In the logs, look for errors pulling builder images or resolving the RPM repository URL.

Results

  • The flightctl-imagebuilder-worker deployment is available in the release namespace.
  • Worker logs do not report image pull failures from <local-registry>.
  • A test image build in the Red Hat Edge Manager web console completes, or flightctl image build commands succeed, without access to public registries or cdn.redhat.com.
  • When your mirror registry requires authentication, worker logs do not report unauthorized or authentication required errors for podman, bootc-image-builder, or syft image pulls.