Airgapped install support by nbykov0 · Pull Request #175 · cozystack/cozystack

Nikita (nbykov0) · 2024-06-19T16:05:45Z

example Makefile and generated Dockerfile for packages/system/capi-operator
script for generating/updating a dockerfile during make update
script for pushing an image to a custom registry with make image

Andrei Kvapil (@kvaps) please check if I'm moving in a right direction

Andrei Kvapil (kvaps)

Overall, you can split this PR into three parts:

First part should provide automation for creating structure of the used images for every package by calling:

make update

The second one should provide unified makefile target to build all the images from images/ directory and output <image>.json and <image>.tag files:

make image

so every image can be builded separately:

make image-<image>

It should always output metadata and tag files with same name as image
I can help you with writing this target.

In the third it should substitute builded image metadata and tag into helm chart, so the charts should be modified or override the named template to putting correct image infromaton from these files:

https://github.com/aenix-io/cozystack/blob/02a41e126bd1927fda7e395fcb6d81e5fcd12939/packages/system/cilium/templates/_helpers.tpl#L1-L3

This is a huge work :)

Andrei Kvapil (kvaps) · 2024-06-20T08:18:39Z

+
+
+function with_helm() {
+    helm template . | awk '/^[ \t"-]*image["]*: [a-zA-Z0-9/:@"\.-]+$/{print $NF}' | sed 's/"//g' | \


This wont work, because we have to replace all the images with ours in the helm chart, the output of helm template . will always return our values. Try parsing upstream helm chart instead

Nikita (nbykov0) · 2024-06-20T13:55:58Z

I think I'll leave the PR as a place for duscussion, and then make separate ones with actual changes.

Nikita (nbykov0) · 2024-06-26T17:06:43Z

Next steps:

a script for pushing all czk images to a provate repo without changing digests (see crane)
make a global override for registry from czk configmap

@nbykov0

Let's use approach suggested by @nbykov0 in #175 We will only update values.yaml and do not store build json artifact The reset charts include this change in - #262 - #263 - #264 - #265 Signed-off-by: Andrei Kvapil <[email protected]>

Sergio (RaSerge) · 2024-08-19T09:33:55Z

Hello, Nikita (@nbykov0)!
I'm interested in adopt cozystack for my campus lab air-gapped installation. Yesterday i tested your solution and found that isn't easy to use (for me at least). It looks like i need to change every Makefile for system/core/etc components, right. Maybe you have ideas how to move that to upper level (something in scripts/dir) or to solve this issue more globally?

Nikita (nbykov0) · 2024-08-21T20:40:16Z

Maybe you have ideas how to move that to upper level (something in scripts/dir) or to solve this issue more globally?

Hi Sergio (@RaSerge)! Yeah, I also dislike how it goes.
Seems to me like there is no good way to solve this on the upper level for every component, as each one of those generate image names in different ways. I'm thinking of parsing every values.yaml with yq or so, and adding this to every Makefile.
If you have any ideas please let me know.

Sergio (RaSerge) · 2024-08-22T07:53:09Z

My ideas:

Use Fluxcd Kustomization to globally add prefix (local registry) to all images - modified images will be like a myregitry.local/ghcr.io/aenix-io etc)
Run simple bash script with grep+sed at end of manifests build (target make manifests probably) to globaly replace external registries with local one.

Yesterday i found this helm plugin (it extracts images from charts).
https://github.com/nikhilsbhat/helm-images

Use helm-images plugin for extract all images, run crane to copy this images to local registry, modify this plugin with replace functionality or just use bash with grep+sed to replace registries in found images with local one

George Gaál (gecube) · 2024-08-22T07:56:38Z

no need to rewrite image names. It could be achieved simpler by

using harbor as local cache images
or patching image names directly in the cluster with any kind of policy engine

Sergio (RaSerge) · 2024-08-22T09:23:02Z

no need to rewrite image names. It could be achieved simpler by
1. using harbor as local cache images

2. or patching image names directly in the cluster with any kind of policy engine

Looks good. i already tried variant with mirroring, it works fine, and .. we need to populate caching registry with images.
Can you explain this solution, please

George Gaál (gecube) · 2024-08-22T09:45:03Z

Something like this

https://t.me/kubernetes_ru/838830

Nikita (nbykov0) · 2024-08-22T17:32:15Z

1. Looks good. i already tried variant with mirroring, it works fine, and .. we need to populate caching registry with images.

There is one more way by Talos itself, see
https://www.talos.dev/v1.7/talos-guides/configuration/pull-through-cache/

Nikita (nbykov0) · 2024-08-22T18:00:10Z

1. using harbor as local cache images
2. or patching image names directly in the cluster with any kind of policy engine

Well, it would work for sure, but to me it seems more like a workaround.

In case of a local cache I can almost feel all the concerns coming from security etc., who will notice images from public registries in private clusters :) And overriding image names on the fly might break image signing and all that.
I'll try to implement image names overides and stuff, but it will be done for every component, and by default all images will be replicated to cozystack repo, and a release will contain only them.

However, a pull-through/local cache is a needed feature for sure.
Sergio (@RaSerge) if it will work for you for now, maybe you could investigate that? I mean, a cache, and a way to upload unmodified images there. In this case you will not be not blocked in any way by this PR, and it would be a separate needed feature.

github-actions · 2026-05-03T05:44:02Z

This PR has had no activity for 60 days and was marked lifecycle/stale.
It will be closed in 14 days unless commented or labelled lifecycle/frozen.

github-actions · 2026-05-17T05:55:59Z

Closed because no activity followed the lifecycle/stale warning.
Reopen if the change is still wanted.

Nikita (nbykov0) added 2 commits June 19, 2024 18:59

capi-operator example for airgapped installation

fceba58

Add scripts for dockerfile update and docker image build/push

1af8b85

Nikita (nbykov0) self-assigned this Jun 19, 2024

Nikita (nbykov0) linked an issue Jun 19, 2024 that may be closed by this pull request

[EPIC] Support air-gapped installation #173

Closed

Andrei Kvapil (kvaps) reviewed Jun 20, 2024

View reviewed changes

Nikita (nbykov0) added 3 commits June 20, 2024 17:41

mv scripts to /hack

cffb825

dynamic targets for images

b4ad5f8

Update values.yaml with image metadata after build

dceff77

Andrei Kvapil (kvaps) mentioned this pull request Aug 7, 2024

Remove build artifacts from repository #266

Merged

Sergio (RaSerge) mentioned this pull request Aug 13, 2024

Talm air-gapped installation cozystack/talm#15

Closed

github-actions Bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale label May 3, 2026

github-actions Bot added the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed label May 17, 2026

github-actions Bot closed this May 17, 2026



		function with_helm() {
		helm template . \| awk '/^[ \t"-]image["]: [a-zA-Z0-9/:@"\.-]+$/{print $NF}' \| sed 's/"//g' \| \

Conversation

Nikita (nbykov0) commented Jun 19, 2024

Uh oh!

Andrei Kvapil (kvaps) left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Andrei Kvapil (kvaps) Jun 20, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Nikita (nbykov0) commented Jun 20, 2024

Uh oh!

Nikita (nbykov0) commented Jun 26, 2024

Uh oh!

Sergio (RaSerge) commented Aug 19, 2024

Uh oh!

Nikita (nbykov0) commented Aug 21, 2024

Uh oh!

Sergio (RaSerge) commented Aug 22, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

George Gaál (gecube) commented Aug 22, 2024

Uh oh!

Sergio (RaSerge) commented Aug 22, 2024

Uh oh!

George Gaál (gecube) commented Aug 22, 2024

Uh oh!

Nikita (nbykov0) commented Aug 22, 2024

Uh oh!

Nikita (nbykov0) commented Aug 22, 2024

Uh oh!

github-actions Bot commented May 3, 2026

Uh oh!

github-actions Bot commented May 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Andrei Kvapil (kvaps) left a comment •

edited

Loading

Sergio (RaSerge) commented Aug 22, 2024 •

edited

Loading