Containerized proxy deployment using internal registry

Table of Contents

1. Image copying from SUSE registry to internal registry
2. Air-gapped solution for Podman

It is possible to deploy containerized images in an environment without an internet connection. In such case, the images can be copied from SUSE registry to an internal registry, or saved to a tar file.

1. Image copying from SUSE registry to internal registry

This example illustrates deployment of Salt proxies only. Machines must have access to registry.suse.com.

Procedure: Deploying Salt Proxy from an internal image registry

On a machine with access to registry.suse.com install skopeo:
```
zypper in skopeo
```
This can be Uyuni Server.

Copy images between registries:

for image in httpd salt-broker squid ssh tftpd; do
    skopeo copy docker://registry.suse.com/suse/manager/4.3/proxy-$image:latest docker://<your_server>/registry.suse.com/suse/manager/4.3/proxy-$image
done
skopeo copy docker://k8s.gcr.io/pause:latest docker://<your_server>/k8s.gcr.io/pause:latest

For every skopeo command add --dest-tls-verify=false if the registry is not secured.

If the registry is unsecured, for example not configured with SSL, add the registry domain to the section registries.insecure on the containerized proxy virtual machine by editing:
```
/etc/containers/registries.conf
```
Before starting the pod, point the Podman where to get the pause image from on the internal registry:
```
echo -e '[engine]\ninfra_image = "<your_server>/pause:latest"'>>/etc/containers/containers.conf
```
To start using the images from the internal registry please adapt the NAMESPACE value in file /etc/sysconfig/uyuni-proxy-systemd-services.config.

For the k3s deployment, add --set repository=<your_server> to the helm install command line.

2. Air-gapped solution for Podman

This example illustrates deployment of containerized image on a machine with no access to internet.

Procedure: Deploying air-gapped proxy

Before starting the pod, point the Podman where to get the pause image from on the internal registry:
```
echo -e '[engine]\ninfra_image = "<your_server>/pause:latest"'>>/etc/containers/containers.conf
```
This command does not work on SLE 15 SP3 and earlier container hosts.

On a machine with internet access run:

for image in httpd salt-broker squid ssh tftpd; do
    podman pull registry.suse.com/suse/manager/4.3/proxy-$image
done
podman pull k8s.gcr.io/pause

podman save -m -o proxy-images.tar \
    k8s.gcr.io/pause \
    registry.suse.com/suse/manager/4.3/proxy-httpd \
    registry.suse.com/suse/manager/4.3/proxy-salt-broker \
    registry.suse.com/suse/manager/4.3/proxy-squid \
    registry.suse.com/suse/manager/4.3/proxy-ssh \
    registry.suse.com/suse/manager/4.3/proxy-tftpd

For the k3s deployment, add --set repository=<your_server> to the helm install command line.

Transfer the proxy-images.tar to the air-gapped proxy.
To make images available to be started when needed, run the command:
```
podman load -i proxy-images.tar
```