NAME¶

oc adm catalog mirror - Mirror an operator-registry catalog

SYNOPSIS¶

oc adm catalog mirror [OPTIONS]

DESCRIPTION¶

Mirrors the contents of a catalog into a registry.

This command will pull down an image containing a catalog, extract it to disk, query it to find all of the images used in the manifests, and then mirror them to a target registry.

By default, the catalog files are extracted to a temporary directory, but can be saved locally via flags.

An image content source policy is written to a file that can be added to a cluster with access to the target registry. This will configure the cluster to pull from the mirrors instead of the locations referenced in the operator manifests.

A mapping.txt file is also created that is compatible with "oc image mirror". This may be used to further customize the mirroring configuration, but should not be needed in normal circumstances.

    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!


    !! DEPRECATION NOTICE:


    !!   Sqlite-based catalogs are deprecated. Support for them will be removed in a


    !!   future release. Please migrate your catalog workflows to the new file-based


    !!   catalog format.


    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

OPTIONS¶

--certificate-authority=""
The path to a certificate authority bundle to use when communicating with the managed container image registries. If --insecure is used, this flag will be ignored.

--continue-on-error=true
If an error occurs while mirroring, keep going and attempt to mirror as much as possible.

--dir=""
The directory on disk that file:// images will be copied under.

--dry-run=false
Print the actions that would be taken and exit without writing to the destinations.

--from-dir=""
The directory on disk that file:// images will be read from. Overrides --dir

--idms-scope="repository"
Scope of registry mirrors in imagedigestmirrorset file. Allowed values: repository, registry. Defaults to: repository

--index-filter-by-os=""
A regular expression to control which index image is picked when multiple variants are available. Images will be passed as '<platform>/<architecture>[/<variant>]'. This does not apply to images referenced by the index.

--insecure=false
Allow push and pull operations to registries to be made over HTTP

--manifests-only=false
Calculate the manifests required for mirroring, but do not actually mirror image content.

--max-components=2
The maximum number of path components allowed in a destination mapping. Example: quay.io/org/repo has two path components.

--max-idms-size=250000
The maximum number of bytes for the generated IDMS yaml(s). Defaults to 250000

--max-per-registry=4
Number of concurrent requests allowed per registry.

--path=""
Specify an in-container to local path mapping for the index file(s).

-a, --registry-config=""
Path to your registry credentials. Alternatively REGISTRY_AUTH_FILE env variable can be also specified. Defaults to ${XDG_RUNTIME_DIR}/containers/auth.json, /run/containers/${UID}/auth.json, ${XDG_CONFIG_HOME}/containers/auth.json, ${DOCKER_CONFIG},  /.docker/config.json,  /.dockercfg. The order can be changed via the REGISTRY_AUTH_PREFERENCE env variable (deprecated) to a "docker" value to prioritizes Docker credentials over Podman's.

--skip-verification=false
Skip verifying the integrity of the retrieved content. This is not recommended, but may be necessary when importing images from older image registries. Only bypass verification if the registry is known to be trustworthy.

--to-manifests=""
Local path to store manifests.

OPTIONS INHERITED FROM PARENT COMMANDS¶

--as=""
Username to impersonate for the operation. User could be a regular user or a service account in a namespace.

--as-group=[]
Group to impersonate for the operation, this flag can be repeated to specify multiple groups.

--as-uid=""
UID to impersonate for the operation.

--cache-dir="/home/abuild/.kube/cache"
Default cache directory

--client-certificate=""
Path to a client certificate file for TLS

--client-key=""
Path to a client key file for TLS

--cluster=""
The name of the kubeconfig cluster to use

--context=""
The name of the kubeconfig context to use

--disable-compression=false
If true, opt-out of response compression for all requests to the server

--insecure-skip-tls-verify=false
If true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure

--kubeconfig=""
Path to the kubeconfig file to use for CLI requests.

--match-server-version=false
Require server version to match client version

-n, --namespace=""
If present, the namespace scope for this CLI request

--profile="none"
Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)

--profile-output="profile.pprof"
Name of the file to write the profile to

--request-timeout="0"
The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.

-s, --server=""
The address and port of the Kubernetes API server

--tls-server-name=""
Server name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used

--token=""
Bearer token for authentication to the API server

--user=""
The name of the kubeconfig user to use

--warnings-as-errors=false
Treat warnings received from the server as errors and exit with a non-zero exit code

EXAMPLE¶

  # Mirror an operator-registry image and its contents to a registry


  oc adm catalog mirror quay.io/my/image:latest myregistry.com


  


  # Mirror an operator-registry image and its contents to a particular namespace in a registry


  oc adm catalog mirror quay.io/my/image:latest myregistry.com/my-namespace


  


  # Mirror to an airgapped registry by first mirroring to files


  oc adm catalog mirror quay.io/my/image:latest file:///local/index


  oc adm catalog mirror file:///local/index/my/image:latest my-airgapped-registry.com


  


  # Configure a cluster to use a mirrored registry


  oc apply -f manifests/imageDigestMirrorSet.yaml


  


  # Edit the mirroring mappings and mirror with "oc image mirror" manually


  oc adm catalog mirror --manifests-only quay.io/my/image:latest myregistry.com


  oc image mirror -f manifests/mapping.txt


  


  # Delete all ImageDigestMirrorSets generated by oc adm catalog mirror


  oc delete imagedigestmirrorset -l operators.openshift.org/catalog=true

SEE ALSO¶

oc-adm-catalog(1),

HISTORY¶

June 2016, Ported from the Kubernetes man-doc generator