Prepare offline container images and the Helm chart

On a connected host, mirror Red Hat Edge Manager container images to a private registry reachable from the disconnected cluster, and download the Helm chart for transfer to the air-gapped site.

Before you begin

  • A connected Red Hat Enterprise Linux host with skopeo, podman, and helm installed
  • registry.redhat.io credentials
  • A destination registry reachable from the disconnected Red Hat OpenShift Container Platform cluster, or a transfer path to move a mirror archive into the site
  • Sufficient disk space for mirrored images and the chart archive (typically 10–15 GB for the standard image set, plus optional image builder images)

Procedure

  1. Install the Flight Control CLI on the prep machine. The mirror-images command is included with the package: 
    sudo dnf install -y flightctl-cli

    Your Red Hat Edge Manager release artifacts might include a prebuilt mirror-images binary in scripts/air-gap/; use that copy when your organization provides one instead of the CLI package. For the complete list of command-line flags, see mirror-images flag reference.

  2. Select a variant that matches your cluster base image:
    • rhem-el9 — Red Hat Enterprise Linux 9 base images from registry.redhat.io
    • rhem-el10 — Red Hat Enterprise Linux 10 base images from registry.redhat.io
  3. Log in to registry.redhat.io on the prep machine: 
    podman login registry.redhat.io
  4. Add the OpenShift Helm chart repository and pin the chart and image version to install. List available chart versions: 
    helm repo add openshift-helm-charts https://charts.openshift.io/
helm repo update
helm search repo openshift-helm-charts/redhat-rhem
    Important

    Image tags in your mirror must match the Helm chart version you install. Pass --tag-override with the release version (for example v1.3.0).
  5. Mirror images using one of the following options.
  6. Option A: Direct push when the prep machine can reach the internal registry. 
    ./mirror-images \
    --variant <variant> \
    --dest-registry <local-registry>/<path> \
    --execute \
    --tag-override <version>

    Add --insecure when your internal registry uses a self-signed TLS certificate. The tool writes artifact-manifest-<variant>.yaml in the current directory.

  7. Option B: Bundle when no direct path exists from prep to the internal registry.
    1. On the prep machine, create a portable archive: 
      ./mirror-images \
    --variant <variant> \
    --bundle ~/flightctl-bundle.tar.gz \
    --tag-override <version>
    2. Plan transfer capacity. Approximate archive sizes:
      Table 1. Approximate artifact sizes
      Artifact set Approximate size Recommended media

      Standard image set (rhem-el9 or rhem-el10)

      10–15 GB

      32 GB or larger USB, or network share

      Image builder service images (optional)

      ~3 GB additional

      Add to the totals above
      Important

      Do not use FAT32 when a single archive exceeds 4 GB. Format USB drives with exFAT or ext4. See Transfer an offline installation bundle for filesystem and checksum guidance.
    3. Generate a checksum on the prep machine before transfer: 
      sha256sum ~/flightctl-bundle.tar.gz | tee ~/flightctl-bundle.tar.gz.sha256
    4. Transfer the archive and .sha256 file to a host inside the disconnected site. When the archive exceeds your media capacity, split it into chunks on the prep machine: 
      split -b 3G ~/flightctl-bundle.tar.gz ~/flightctl-bundle.tar.gz.part-

      Transfer all parts. On the target host, reassemble before you verify or extract:

      cat ~/flightctl-bundle.tar.gz.part-* > ~/flightctl-bundle.tar.gz
sha256sum -c ~/flightctl-bundle.tar.gz.sha256

      The command must report OK. If verification fails, re-transfer the archive.

    5. On a host inside the site that can reach the internal registry, extract the archive and import images: 
      mkdir ~/flightctl-bundle
tar -xzf ~/flightctl-bundle.tar.gz -C ~/flightctl-bundle
cd ~/flightctl-bundle
./import.sh --registry <local-registry>/<path>

      Copy artifact-manifest-<variant>.yaml from the bundle to your workstation if you need it to build ImageTagMirrorSet for Red Hat Edge Manager images.

    Replace <variant> with rhem-el9 or rhem-el10 to match your cluster base image. Replace <local-registry>/<path> with the hostname and repository path your disconnected cluster uses (for example registry.internal.example.com/edge-manager).

  8. Download the Helm chart for the target release: 
    helm pull openshift-helm-charts/redhat-rhem --version <chart_version>

    The command creates redhat-rhem-<chart_version>.tgz in the current directory. Transfer the chart archive with the mirrored registry content and artifact-manifest-<variant>.yaml when you use Option B.

    Note

    If you already added the openshift-helm-charts repository in the version pinning step, you do not need to run helm repo add again.

Results

  • From a host on the internal network, skopeo inspect docker://<local-registry>/<path>/<image>:<tag> succeeds for a sample image listed in the manifest.
  • The manifest lists every source registry prefix referenced by your chart variant.
  • The redhat-rhem-<chart_version>.tgz file is present and extracts without errors.

    The Prometheus and Grafana container images are not included in the standard mirror run. Mirror those images separately when you plan to deploy the observability stack.