feat: Add disconnected installation support for HCP KubeVirt on IBM Z - #532
feat: Add disconnected installation support for HCP KubeVirt on IBM Z#532jpattara wants to merge 10 commits into
Conversation
Signed-off-by: jpattara <Jibin.Pattara@ibm.com>
Signed-off-by: jpattara <Jibin.Pattara@ibm.com>
Signed-off-by: jpattara <Jibin.Pattara@ibm.com>
Signed-off-by: jpattara <Jibin.Pattara@ibm.com>
e7365e7 to
53ab8e2
Compare
Signed-off-by: jpattara <Jibin.Pattara@ibm.com>
Signed-off-by: jpattara <Jibin.Pattara@ibm.com>
isumitsolanki
left a comment
isumitsolanki
left a comment
There was a problem hiding this comment.
Hi @jpattara
Thanks for PR, Please address the below comments with respective line
| name: <mirror-host-name> | ||
| ip: <mirror-host-ip> | ||
| user: root | ||
| cluster_resources_dir: /root/ocpinst_disconnected/working-dir/cluster-resources |
There was a problem hiding this comment.
Hi @jpattara ,
Please change this hardcoded cluster_resources_dir to get the dynamic allocation based on user
| name: hostpath-provisioner | ||
| storageclass_name: hostpath-csi | ||
| storage_size: 50Gi | ||
| storage_path: /var/hpvolumes |
There was a problem hiding this comment.
Is it fixed path for HPP?
There was a problem hiding this comment.
@isumitsolanki Yes, this path is fixed for HPP.
| metallb: | ||
| version: stable | ||
| ip_pool: | ||
| - <ip-range> # e.g. 172.23.232.232-172.23.232.234 |
There was a problem hiding this comment.
can you remove this external ips and put x.x.x.x
There was a problem hiding this comment.
Done. I’ve removed the external IPs and replaced them with x.x.x.x.
| full: false | ||
| packages: | ||
| - name: serverless-operator | ||
| - name: multicluster-engine |
There was a problem hiding this comment.
This is common disconnected.yaml file it will be getting used in case of UPI and ABI disconnected installation.
Better to not touch the existing config, or if modification needed we need to do validation for ABI/UPI as well.
There was a problem hiding this comment.
@isumitsolanki Basically I have just given examples of the packages for mirroring. Also have updated the catalog version to the latest versions. It doesn't break any existing config.
| vars_files: | ||
| - "{{ inventory_dir }}/group_vars/secrets.yaml" | ||
| - "{{ inventory_dir }}/group_vars/hcp-kubevirt.yaml" | ||
| - "{{ playbook_dir }}/../inventories/default/group_vars/secrets.yaml" |
There was a problem hiding this comment.
I can see directory of inventory file has been changed at multiple places I hope it has been tested thoroughly both connected and disconnected installation.
There was a problem hiding this comment.
yes, It is tested for both connected and disconnected installation.
|
|
||
| - name: Render CAPI/importer IDMS for disconnected registry | ||
| ansible.builtin.copy: | ||
| dest: /root/ansible_workdir/idms-capi.yaml |
There was a problem hiding this comment.
please use user home directory here as well
| state: present | ||
| src: /root/ansible_workdir/{{ hcp.hpp.name }}-cr.yaml | ||
| ansible.builtin.command: | ||
| cmd: oc apply -f /root/ansible_workdir/{{ hcp.hpp.name }}-cr.yaml |
There was a problem hiding this comment.
please use user home directory here as well
| state: present | ||
| src: /root/ansible_workdir/{{ hcp.hpp.storageclass_name }}-sc.yaml | ||
| ansible.builtin.command: | ||
| cmd: oc apply -f /root/ansible_workdir/{{ hcp.hpp.storageclass_name }}-sc.yaml |
There was a problem hiding this comment.
please use user home directory here as well
| when: (hcp.odf | default({})).catalogsource_image is defined and (hcp.odf | default({})).catalogsource_image | string | length > 0 | ||
|
|
||
| - name: Deploy CatalogSource | ||
| ansible.builtin.command: oc apply -f /root/ansible_workdir/odf-CatalogSource.yaml |
There was a problem hiding this comment.
please use user home directory here as well
| oc login {{ vault_api_server }} | ||
| -u {{ vault_user_name }} | ||
| -p {{ vault_password }} | ||
| --insecure-skip-tls-verify=true |
There was a problem hiding this comment.
Is it always required to login with TLS verification
There was a problem hiding this comment.
Not really, but Solution team and myself have faced x509 certificate issue while accessing the OCP cluster. So have added this flag to bypass the issue.
Signed-off-by: jpattara <Jibin.Pattara@ibm.com>
Signed-off-by: jpattara <Jibin.Pattara@ibm.com>
Signed-off-by: jpattara <Jibin.Pattara@ibm.com>
@isumitsolanki All the comments mentioned has been addressed. Please take a look. |
Signed-off-by: jpattara <Jibin.Pattara@ibm.com>
2 participants
Summary
Adds end-to-end disconnected (air-gapped) installation support for Hosted Control Plane (HCP) on KubeVirt targeting IBM Z (s390x). This builds on top of the existing connected HCP KubeVirt implementation and introduces new playbooks, a new role, and updates to all operator installer roles to handle disconnected environments through
oc-mirror v2.Changes
New Playbooks
disconnected_mirror_hcp_artifacts.yaml— mirrors all required OCP release, operator, and additional images to the local registry using oc-mirror v2.disconnected_hcp_kubevirt_setup.yaml— applies the mirror manifests (IDMS, ITMS, CatalogSource, CAPI IDMS) and the registry CA trust bundle to the management cluster before operator installation.