• Home
  • OpenShift Operator Hub on Restricted Networks

Local Private OpenShift Hub (AKA Offline Hub)


OpenShift’s Operator Lifecycle Manager (AKA Operator Hub) is designed to work with internet access.

But, sometimes we have to deal with an environment that does not have internet access (disconnected environment), thus preventing us from installing Operators.

To make things harder, some operators need related images (declared on its CSV) to work properly.

Creating a local disconnected registry and upload operator images to it is not enough to get things up and running.

So, what should I do to solve this?

Custom Repository Catalog

Before you proceed, it is important to understand a few things. Some Red Hat Operators are self contained, and don’t need related images. But some of them do. The process of pruning an index catalog is suitable for Operators that don’t need extra images. You must know how the operator was built to be able to consider which method is right for you.

Use a command like the one below to get some information about the operator.

# oc get packagemanifests quay-operator -o yaml

What options are available?

There is an very easy approach, which is to mirror the entire Operator Lifecycle Manager (OLM) catalog, but this will take up to 1.5TB of disk space as the time of this writing (November 2022), making this approach nearly impossible to adopt on the vast majority of disconnected OpenShift clusters.

Maybe that’s not what you’re looking for.

Some operators require related Images that aren’t downloaded in the index prune stage. Look at your Operator CSV to search if it requires additional images. For an example, OCS requires the following related images:


⚠️ If that's the case, you should upload the related images to your private registry in the same catalog as the operator bundle, otherwise your Operator installation will fail.

Now that you understand that some operators need additional content, let’s understand how to solve this issue.

You can do the whole process of creating a new catalog containing all the necessary content 100% manually, but everything becomes a little more time-consuming and complex.

To make things easier, you can use a python script developed by the Red Hat CoP to download the operator images from a predefined list, alongside with it’s related images.

⚠️ You should run it from your bastion host.


- OpenShift Version: 4.8

- Registry: You already have a local private registry up and running.

- Local Registry URL:

- Bastion has access to the internet.

You don’t have a local private registry? I wrote about building one. Click here to check it out.

External Registry Access

Install the python script requisites according to the file. Then do the logins to the required registries:

[root@bastion ocp]# podman login
[root@bastion ocp]# podman login
[root@bastion ocp]# podman login

This will generate the auth.json file (/run/user/0/containers/auth.json). Save it to be able to use it later.

Mirror List

Edit the files offline_operators_list and offline_operators_list.yaml to include the operators you wish to mirror.

In my scenario, I needed Quay and OCS with their related images. These operators also need local-storage (not declared in the CSV). It is also important to install cluster-logging.

✅ I’d recommend always enabling both.

[root@bastion openshift-disconnected-operators-master]# cat offline_operators_list
[root@bastion openshift-disconnected-operators-master]# cat offline_operators_list.yaml
  - name: local-storage-operator
  - name: ocs-operator
  - name: quay-operator
  - name: openshift-marketplace
  - name: ocs-must-gather-rhel8
  - name: odf-operator
  - name: cluster-logging

Now, run the mirror process:

[root@bastion openshift-disconnected-operators-master]# ./ \
--catalog-version v4.8 \
--authfile ~/ocp/localregistry/openshift-disconnected-operators-master/auth.json \
--registry-olm \
--registry-catalog \
--operator-file ~/ocp/localregistry/openshift-disconnected-operators-master/offline_operators_list \
--icsp-scope=namespace \
--ocp-version 4.8 \
--operator-channel 4.8

At the end of the process, you should see messages like this:

Finished mirroring related images.
Creating Image Content Source Policy YAML...
Creating Mapping File...
Creating Image manifest file...
Creating Catalog Source YAML...
Catalogue creation and image mirroring complete
See Publish folder for the image content source policy and catalog source yaml files to apply to your cluster

The mirror process will generate some YAML files in the publish directory.

[root@bastion openshift-disconnected-operators-master]# ls publish/
image_manifest.txt  mapping.txt  mirror_log.txt  olm-icsp.yaml  rh-catalog-source.yaml

Custom Mirrored Catalog

Disable the default OLM catalog sources:

[root@bastion publish]# oc patch OperatorHub cluster --type json -p '[{"op": "add", "path": "/spec/disableAllDefaultSources", "value": true}]'

Apply the yaml files in the publish directory. The image content source policy will create a new MCO (Machine Config Operator) render which will start a rolling reboot of your cluster nodes. Keep this in mind before performing this step.

⚠️ You have to wait until that is complete before attempting to install operators from the catalog.

[root@bastion publish]# oc create -f olm-icsp.yaml created
[root@bastion publish]# oc create -f rh-catalog-source.yaml created

After Operator Lifecycle Manager (OLM) automatically polls the index image referenced in the catalog source at its regular interval (30 minutes), verify that the new packages are successfully added:

[root@bastion localregistry]# oc get packagemanifests -n openshift-marketplace\
NAME                     CATALOG             AGE
quay-operator            Red Hat Operators   42m
ocs-operator             Red Hat Operators   42m
cluster-logging          Red Hat Operators   42m
local-storage-operator   Red Hat Operators   42m

Now go to your Openshift Operator Hub and check the available Operators.

Disconnected Custom OLM

The Operators added has its related images, making them complete in terms of requisites. Install them to check if everything is in place.

You can have as many custom catalogs as you need. Go to OpenShift Global Configuration and search for Operator Hub. The list of available catalogs can be found there.

Disconnected Operators Installed

That’s it. This one was a little tricky to sort out. Hope this post was useful to you. Drop a message if you have questions. See ya!

It worked!

Did you like the content? Check out these other interesting articles! 🔥

Could you help?

Please support this content by clicking on one of our advertisers’ banners. ❤️

comments powered by Disqus