AGENT-1193: Add --mirror-path flag to support pre-mirrored images by rwsu · Pull Request #634 · openshift/appliance

rwsu · 2025-12-19T23:38:37Z

Adds support for using pre-mirrored OCP release images instead of running oc-mirror during the build process. This is useful when images have already been mirrored in a separate step, avoiding redundant mirroring operations.

Changes

Add `--mirror-path` flag to the build command — Specifies the location of pre-mirrored registry data. When provided, the appliance builder skips running `oc-mirror` and uses the pre-mirrored images directly.
Fix image reference parsing for registries with ports — When a custom release URL contains a tag (e.g. `registry:5000/img:tag`), appending a digest directly would produce a `tag@digest` reference rejected by image validation. Uses `LastIndex` to correctly strip the tag while preserving the registry port.
Refactor mirror-path handling — Extract registry data copy logic into `copyMirrorRegistryData()` and reorder `mirrorImages()` condition so the normal flow comes first.

Assisted-by: Claude Sonnet 4.6 noreply@anthropic.com

openshift-ci-robot · 2026-01-14T23:05:03Z

@rwsu: This pull request references AGENT-1193 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Add --mirror-path flag to build command

Support using pre-mirrored registry data instead of running oc-mirror

Add debug logging in genisoimage

🤖 Generated with Claude Code

Assisted-by: Claude Sonnet 4.5 noreply@anthropic.com

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-01-14T23:08:07Z

@rwsu: This pull request references AGENT-1193 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Adds support for using pre-mirrored OCP release images instead of running
oc-mirror during the build process. This is useful when images have already
been mirrored in a separate step, avoiding redundant mirroring operations.

Changes:

Add --mirror-path command-line flag to build command

Fix custom registry support with IDMS and image reference parsing

Add --registry-config to oc commands for custom registry authentication

When using custom registries instead of official OpenShift release images,
oc commands need authentication credentials to pull images. This adds the
--registry-config flag to all oc commands and --authfile to skopeo.

Fix EnvConfig persistence to preserve runtime flags

Without persistence, when EnvConfig is loaded as a dependency by other
assets, it creates a new instance with empty values for these runtime
flags. This caused MirrorPath to be lost when DataISO needed EnvConfig,
breaking the --mirror-path functionality.

Assisted-by: Claude Sonnet 4.5 noreply@anthropic.com

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-01-23T20:59:03Z

@rwsu: This pull request references AGENT-1193 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Adds support for using pre-mirrored OCP release images instead of running
oc-mirror during the build process. This is useful when images have already
been mirrored in a separate step, avoiding redundant mirroring operations.

Changes:

Add --mirror-path command-line flag to build command

Fix custom registry support with IDMS and image reference parsing

Add --registry-config to oc commands for custom registry authentication

When using custom registries instead of official OpenShift release images,
oc commands need authentication credentials to pull images. This adds the
--registry-config flag to all oc commands and --authfile to skopeo.

Use singleton asset store to preserve EnvConfig state. By caching the asset store instance and reusing it throughout the command execution, we ensure EnvConfig is only generated once with the correct values and not overwritten.

Assisted-by: Claude Sonnet 4.5 noreply@anthropic.com

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-01-23T20:59:14Z

@rwsu: This pull request references AGENT-1193 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Adds support for using pre-mirrored OCP release images instead of running
oc-mirror during the build process. This is useful when images have already
been mirrored in a separate step, avoiding redundant mirroring operations.

Changes:

Add --mirror-path command-line flag to build command

Fix custom registry support with IDMS and image reference parsing

Add --registry-config to oc commands for custom registry authentication

When using custom registries instead of official OpenShift release images,
oc commands need authentication credentials to pull images. This adds the
--registry-config flag to all oc commands and --authfile to skopeo.

Use singleton asset store to preserve EnvConfig state. By caching the asset
store instance and reusing it throughout the command execution, we ensure
EnvConfig is only generated once with the correct values and not overwritten.

Assisted-by: Claude Sonnet 4.5 noreply@anthropic.com

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

rwsu · 2026-02-03T16:29:38Z

/cc @danielerez

openshift-ci · 2026-02-10T19:20:08Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rwsu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [rwsu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Add support for using pre-mirrored images from oc-mirror workspace by specifying the mirror path in appliance-config.yaml. When mirrorPath is configured, the appliance skips running oc-mirror and uses the pre-mirrored registry data directly. Also fixes issues when using custom registries (non-quay.io) where oc adm release info may return incomplete image references missing port and repository path. Adds IDMS entries to ensure the cluster redirects pulls from custom registries to the appliance's internal registry. Changes: - Add MirrorPath field to top level of ApplianceConfig in types - Update appliance-config.yaml template to document the new field - Update code to read mirrorPath from ApplianceConfig.Config.MirrorPath - Add validateMirrorPath() to ApplianceConfig with comprehensive validation - Use pre-mirrored images when mirrorPath is provided - Add fixImageReference() to repair incomplete image refs from oc commands Example: registry.example.com@sha256:... becomes registry.example.com:5000/repo/image@sha256:... - Add addLocalRegistryIDMS() to generate IDMS for custom registry mirrors - Fix release image tag parsing to preserve port in registry URLs The mirror-path can be specified in appliance-config.yaml as: mirrorPath: /path/to/oc-mirror/workspace Assisted-by: Claude Sonnet 4.5 <noreply@anthropic.com> Add debug logging for IsLiveISO tracking

Pass --registry-config ~/.docker/config.json to all oc commands (release info, release extract, oc mirror) and --authfile to skopeo. This allows the appliance builder to authenticate against private registries such as the one used in dev-scripts (virthost.ostest.test.metalkube.org:5000). The pull secret from appliance-config is written to ~/.docker/config.json (existing behavior) so no separate credential management is needed. Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>

strings.Split(image, ":")[0] incorrectly strips the registry port when the release image URL contains one. For example, with the dev-scripts local registry virthost.ostest.test.metalkube.org:5000/openshift/release-images:tag, Split on ":" takes only "virthost.ostest.test.metalkube.org", losing the port and path entirely. Use LastIndex to locate the tag colon after the last "/" so the port is preserved, producing the correct digest reference: virthost.ostest.test.metalkube.org:5000/openshift/release-images@sha256:... Extract the logic into appendDigest() with a unit test. Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>

- Swap mirrorPath condition in mirrorImages() so normal flow comes first - Extract mirror-path registry data copy logic into copyMirrorRegistryData() Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>

danielerez · 2026-04-19T08:35:53Z

-	templateExtractCmd   = "oc adm release extract --command=%s --to=%s %s"
-	templateImageExtract = "oc image extract --path %s:%s --confirm %s"
-	ocMirror             = "oc mirror --v2 --config=%s docker://127.0.0.1:%d --workspace=file://%s --src-tls-verify=false --dest-tls-verify=false --parallel-images=4 --parallel-layers=4 --retry-times=5 --ignore-release-signature"
+	templateGetImage     = "oc adm release info --registry-config %s --image-for=%s %s"


Same here about the pull secret. Which scenario requires passing the pull secret explicitly now?

Good catch. You're correct — oc and skopeo already pick up credentials from ~/.docker/config.json automatically, which is where storePullSecret() already writes them. We've removed --registry-config from all oc commands and --authfile from skopeo — they were redundant. Verified the ISO build and cluster install succeed without them.

bfournie · 2026-04-20T23:16:02Z

With this PR I've been able to use a local image (machine-config-operator in this case) and successfully install a cluster via the dev-scripts UI-driven installation, confirming that my local changes were picked up.
Changes look good to me but will wait for all of Daniel's questions to be answered.

openshift-ci-robot · 2026-04-21T05:43:32Z

@rwsu: This pull request references AGENT-1193 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target either version "5.0." or "openshift-5.0.", but it targets "openshift-4.22" instead.

Details

In response to this:

Adds support for using pre-mirrored OCP release images instead of running oc-mirror during the build process. This is useful when images have already been mirrored in a separate step, avoiding redundant mirroring operations.

Changes

Add `--mirror-path` flag to the build command — Specifies the location of pre-mirrored registry data. When provided, the appliance builder skips running `oc-mirror` and uses the pre-mirrored images directly.

Fix image reference parsing for registries with ports — When a custom release URL contains a tag (e.g. `registry:5000/img:tag`), appending a digest directly would produce a `tag@digest` reference rejected by image validation. Uses `LastIndex` to correctly strip the tag while preserving the registry port.

Refactor mirror-path handling — Extract registry data copy logic into `copyMirrorRegistryData()` and reorder `mirrorImages()` condition so the normal flow comes first.

Assisted-by: Claude Sonnet 4.6 noreply@anthropic.com

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

…opeo oc and skopeo automatically pick up credentials from ~/.docker/config.json, which is already written by storePullSecret(). Passing the flags explicitly is redundant and was only introduced when the pull secret was temporarily stored in a separate temp file. Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>

bfournie · 2026-04-21T19:14:17Z

Testing the PR, one thing we've noticed that we're missing in the mirrored data is openshift/release-bundles, and the operator data. We can probably work around the missing operator data by adding these in dev-scripts but it seems that the openshift/release-bundles should be added here if possible.

This is what the local catalog looks like on an installed cluster (using a local mco image):

$ curl -sk https://192.168.111.20:22625/v2/_catalog | jq -r
{
  "repositories": [
    "localimages/agent-installer-utils",
    "localimages/machine-config-operator",
    "openshift/release",
    "openshift/release-images",
    "rhel9/support-tools",
    "ubi8/ubi"
  ]
}

Compared to a system installed without the local mirror:

{
  "repositories": [
   <operator specific repos>
    "openshift/release",
    "openshift/release-bundles",
    "openshift/release-images",
    "rhel9/support-tools",
  ]
}

So we're missing openshift/release-bundles and the operator info.

rwsu · 2026-04-22T15:24:51Z

So we're missing openshift/release-bundles and the operator info.

@bfournie The missing release-bundles should be fixed by this commit the missing operators can be added through this dev-scripts PR.

danielerez · 2026-04-22T22:47:13Z

/retest

Two related bugs in the --mirror-path flow: 1. copyMirrorRegistryData was called after bundle.Push(), causing the mirror-path docker data to overwrite the release-bundles image that was just pushed to the registry. Move the copy before starting the registry so bundle.Push() adds release-bundles on top of the pre-populated mirror data. 2. Moving the copy earlier exposed a path mismatch: registryDir from GetRegistryDataPath() was mangled (e.g. /assetstemp/data instead of /assets/temp/data). Switch to dataDirPath (filepath.Join(envConfig.TempDir, dataDir)) throughout, consistent with how CopyRegistryImageIfNeeded computes paths. Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>

rwsu · 2026-04-23T09:46:07Z

/retest-required

rwsu · 2026-04-23T09:46:40Z

/test e2e-agent-compact-ipv4-iso-no-registry

openshift-ci · 2026-04-23T11:57:30Z

@rwsu: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

bfournie · 2026-04-24T11:31:23Z

With the latest change I confirmed that the release-bundles are now available

curl -sk https://192.168.111.20:22625/v2/_catalog?n=1000 | jq -r
{
  "repositories": [
    "localimages/agent-installer-utils",
    "localimages/machine-config-operator",
    "openshift/release",
    "openshift/release-bundles",
    "openshift/release-images",
    "rhel9/support-tools",
    "ubi8/ubi"
  ]
}
$ curl -sk https://localhost:22625/v2/openshift/release-bundles/tags/list
{"name":"openshift/release-bundles","tags":["ocp-release-bundle-4.23.0-0.ci-2026-04-20-103815"]}

bfournie · 2026-04-24T11:31:32Z

/lgtm

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 19, 2025

openshift-ci Bot requested review from avishayt and oourfali December 19, 2025 23:39

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 25, 2025

rwsu force-pushed the AGENT-1193-v2 branch 2 times, most recently from be9a81e to c10ba39 Compare January 14, 2026 23:03

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 14, 2026

rwsu changed the title ~~WIP: Add mirror-path support to appliance builder~~ AGENT-1193: Add --mirror-path flag to support pre-mirrored images Jan 14, 2026

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 14, 2026

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jan 14, 2026

rwsu force-pushed the AGENT-1193-v2 branch from c10ba39 to 5a6299f Compare January 23, 2026 20:56

rwsu force-pushed the AGENT-1193-v2 branch from 5a6299f to b220118 Compare February 3, 2026 16:29

openshift-ci Bot requested a review from danielerez February 3, 2026 16:29

danielerez reviewed Feb 4, 2026

View reviewed changes

rwsu force-pushed the AGENT-1193-v2 branch from b220118 to 2df7f75 Compare February 10, 2026 19:18

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 10, 2026

rwsu force-pushed the AGENT-1193-v2 branch 3 times, most recently from 9e775e7 to 17dc5e3 Compare February 17, 2026 21:42

danielerez reviewed Feb 18, 2026

View reviewed changes

Comment thread pkg/asset/config/appliance_config.go Outdated

Comment thread pkg/release/release.go

Comment thread pkg/asset/data/data_iso.go Outdated

rwsu added 4 commits April 17, 2026 14:22

Refactor mirror-path handling in mirrorImages and DataISO

bbc59ce

- Swap mirrorPath condition in mirrorImages() so normal flow comes first - Extract mirror-path registry data copy logic into copyMirrorRegistryData() Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>

rwsu force-pushed the AGENT-1193-v2 branch from 17dc5e3 to bbc59ce Compare April 17, 2026 08:12

danielerez reviewed Apr 19, 2026

View reviewed changes

Comment thread pkg/asset/config/appliance_config.go Outdated

danielerez reviewed Apr 19, 2026

View reviewed changes

rwsu force-pushed the AGENT-1193-v2 branch from d5e1da9 to e8752e1 Compare April 21, 2026 06:06

rwsu force-pushed the AGENT-1193-v2 branch from a16c731 to 07d2058 Compare April 23, 2026 07:00

openshift-ci Bot assigned bfournie Apr 24, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Apr 24, 2026

openshift-merge-bot Bot merged commit efbda15 into openshift:master Apr 24, 2026
9 checks passed

Conversation

rwsu commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

openshift-ci-robot commented Jan 14, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Jan 14, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Jan 23, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Jan 23, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rwsu commented Feb 3, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

openshift-ci Bot commented Feb 10, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

danielerez Apr 19, 2026

Choose a reason for hiding this comment

Uh oh!

rwsu Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

bfournie commented Apr 20, 2026

Uh oh!

openshift-ci-robot commented Apr 21, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

bfournie commented Apr 21, 2026

Uh oh!

rwsu commented Apr 22, 2026

Uh oh!

danielerez commented Apr 22, 2026

Uh oh!

rwsu commented Apr 23, 2026

Uh oh!

rwsu commented Apr 23, 2026

Uh oh!

openshift-ci Bot commented Apr 23, 2026

Uh oh!

bfournie commented Apr 24, 2026

Uh oh!

bfournie commented Apr 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

rwsu commented Dec 19, 2025 •

edited

Loading

openshift-ci-robot commented Jan 14, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Jan 14, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Jan 23, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Jan 23, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Apr 21, 2026 •

edited by openshift-ci Bot

Loading