Chapter 3. Installing Fuse on Openshift in a restricted environment To install Fuse on OpenShift in a non-restricted environment, you pull imagestreams and templates from registry.redhat.io . In a production environment which has no or limited internet access, that is not possible. This section explains how to install Fuse on OpenShift in a restricted environment. Note Installing in a restricted environment is currently not supported on IBM Power Systems, IBM Z, and LinuxONE. Prerequisites You have installed and configured OpenShift server so that it can run in a restricted environment. 3.1. Setting up internal Docker registry This section explains how to set up internal docker registry which can be used to push or pull images. You must configure an internal docker registry where you can pull or push images. Procedure Install internal ROOT CA. This certificate allows the system to authenticate itself to the registry. Login to registry.redhat.io . Pull the Fuse on OpenShift images from registry.redhat.io . Tag the pulled imagestreams. Push the tagged imagestreams to the internal docker registry. 3.2. Configuring internal registry secrets After setting up the restricted docker registry and pushing all the images, it is necessary to configure the restricted OpenShift server so that it can communicate with the internal registry. Procedure Log into your OpenShift cluster as administrator: oc login --user system:admin --token=my-token --server=https://my-cluster.example.com:6443 Open the project in which you want to deploy Fuse: oc project myproject Create a docker-registry secret using your Red Hat Customer Portal account, replacing PULL_SECRET_NAME with psi-internal-registry to create: oc create secret docker-registry psi-internal-registry \ --docker-server=docker-registry.redhat.io \ --docker-username=CUSTOMER_PORTAL_USERNAME \ --docker-password=CUSTOMER_PORTAL_PASSWORD \ --docker-email=EMAIL_ADDRESS You should see the following output: secret/psi-internal-registry created Important You must create this docker-registry secret in every OpenShift project namespace that will authenticate to registry.redhat.io . Link the secret to your service account to use the secret for pulling images. The following example uses the default service account, builder service account, and deployer service account: oc secrets link default psi-internal-registry oc secrets link default psi-internal-registry --for=pull oc secrets link builder psi-internal-registry oc secrets link builder psi-internal-registry --for=pull oc secrets link deployer psi-internal-registry oc secrets link deployer psi-internal-registry --for=pull The service account name must match the name that the OpenShift pod uses. Note If you do not want to use your Red Hat username and password to create the pull secret, you can create an authentication token using a registry service account. 3.3. Installing Fuse on OpenShift images in a restricted environment The fis-image-streams.json file contains the imageStream definitions for Red Hat Fuse on OpenShift. But, all the imagestreams refer to registry.redhat.io . You must change all the registry.redhat.io references to the psi-internal-registry URL. Procedure Download Red Hat Fuse on OpenShift imagestream json file. Open the fis-image-streams.json file and locate all the references to ` registry.redhat.io . For example: Replace all the registry.redhat.io references in the file with psi-internal-registry name. For example: After all the references are replaced, run the following command to install Fuse on OpenShift imagestreams: 3.4. Using an internal Maven repository In a restricted environment, you need to use a different Maven Repository. You can specify it using a template parameter named MAVEN_MIRROR_URL . You can use this MAVEN_MIRROR_URL parameter to create a new application from command line. 3.4.1. Running a Spring Boot application with MAVEN_MIRROR_URL This example explains how to deploy and run a Spring Boot Application using MAVEN_MIRROR_URL. Procedure Download the Spring Boot Camel XML quickstart. Enter the following command to create the resources required for running the Spring Boot quickstart template using the MAVEN_MIRROR_URL parameter. In a restricted environment, you also need to specify the GIT_REPO and GIT_REF parameters for your local repository. This will create a deployment config and build config for the quickstart. The information about the default parameters of the quickstart and the resources created is displayed on the terminal. 3.4.2. Running a Spring Boot application with OpenShift Maven plugin This example explains how to deploy and run a Spring Boot application with OpenShift Maven plugin using internal Maven repository. Procedure To run the quickstart with OpenShift Maven plugin, download the Spring Boot 2 camel archetype from local repository and then deploy the quickstart. Replace {Maven Mirror URL} with the Maven mirror repository URL. The archetype plug-in switches to interactive mode to prompt you for the remaining fields. If the above command exited with the BUILD SUCCESS status, you should now have a new Fuse on OpenShift project under the fuse713-spring-boot2 subdirectory. You are now ready to build and deploy the fuse713-spring-boot2 project. Assuming you are still logged into OpenShift, change to the directory of the fuse713-spring-boot2 project, and then build and deploy the project, as follows.

Commands:
cd /etc/pki/ca-trust/source/anchors sudo curl -O https://password.corp.redhat.com/RH-IT-Root-CA.crt sudo update-ca-trust extract sudo update-ca-trust update
docker login -u USERNAME -p PASSWORD registry.redhat.io
docker pull registry.redhat.io/fuse7/fuse-java-openshift-rhel8:1.13 docker pull registry.redhat.io/fuse7/fuse-java-openshift-jdk11-rhel8:1.13 docker pull registry.redhat.io/fuse7/fuse-karaf-openshift-rhel8:1.13 docker pull registry.redhat.io/fuse7/fuse-console-rhel8:1.13 docker pull registry.redhat.io/fuse7/fuse-apicurito-rhel8:1.13 docker pull registry.redhat.io/fuse7/fuse-apicurito-generator-rhel8:1.13
docker tag registry.redhat.io/fuse7/fuse-java-openshift-rhel8:1.13 docker-registry.upshift.redhat.com/fuse7/fuse-java-openshift-rhel8:1.13 docker tag registry.redhat.io/fuse7/fuse-java-openshift-jdk11-rhel8:1.13 docker-registry.upshift.redhat.com/fuse7/fuse-java-openshift-jdk11-rhel8:1.13 docker tag registry.redhat.io/fuse7/fuse-karaf-openshift-rhel8:1.13 docker-registry.upshift.redhat.com/fuse-karaf-openshift-rhel8:1.13 docker tag registry.redhat.io/fuse7/fuse-console-rhel8:1.13 docker-registry.upshift.redhat.com/fuse7-fuse-console-rhel8:1.13 docker tag registry.redhat.io/fuse7/fuse-apicurito-rhel8:1.13 docker-registry.upshift.redhat.com/fuse7-fuse-apicurito-rhel8:1.13 docker tag registry.redhat.io/fuse7/fuse-apicurito-generator-rhel8:1.13 docker-registry.upshift.redhat.com/fuse7-fuse-apicurito-generator-rhel8:1.13
docker push docker-registry.upshift.redhat.com/fuse7/fuse-java-openshift-rhel8:1.13 docker push docker-registry.upshift.redhat.com/fuse7/fuse-java-openshift-jdk11-rhel8:1.13 docker push docker-registry.upshift.redhat.com/fuse-karaf-openshift-rhel8:1.13 docker push docker-registry.upshift.redhat.com/fuse7-fuse-console-rhel8:1.13 docker push docker-registry.upshift.redhat.com/fuse7-fuse-apicurito-rhel8:1.13 docker push docker-registry.upshift.redhat.com/fuse7-fuse-apicurito-generator-rhel8:1.13
login --user system:admin --token=my-token --server=https://my-cluster.example.com:6443
project myproject
create secret docker-registry psi-internal-registry --docker-server=docker-registry.redhat.io --docker-username=CUSTOMER_PORTAL_USERNAME --docker-password=CUSTOMER_PORTAL_PASSWORD --docker-email=EMAIL_ADDRESS
secret/psi-internal-registry created
secrets link default psi-internal-registry secrets link default psi-internal-registry --for=pull secrets link builder psi-internal-registry secrets link builder psi-internal-registry --for=pull secrets link deployer psi-internal-registry secrets link deployer psi-internal-registry --for=pull
curl -o fis-image-streams.json {BASEURL}
{ "name": "1.9", "annotations": { "description": "Red Hat Fuse 7.13 Karaf S2I images.", "openshift.io/display-name": "Red Hat Fuse 7.13 Karaf", "iconClass": "icon-rh-integration", "tags": "builder,jboss-fuse,java,karaf,xpaas,hidden", "supports":"jboss-fuse:7.13.0,java:8,xpaas:1.2", "version": "1.9" }, "referencePolicy": { "type": "Local" }, "from": { "kind": "DockerImage", "name": "registry.redhat.io/fuse7/fuse-karaf-openshift-rhel8:1.11" } },
{ "name": "1.9", "annotations": { "description": "Red Hat Fuse 7.13 Karaf S2I images.", "openshift.io/display-name": "Red Hat Fuse 7.13 Karaf", "iconClass": "icon-rh-integration", "tags": "builder,jboss-fuse,java,karaf,xpaas,hidden", "supports":"jboss-fuse:7.13.0,java:8,xpaas:1.2", "version": "1.9" }, "referencePolicy": { "type": "Local" }, "from": { "kind": "DockerImage", "name": "docker-registry.upshift.redhat.com/fuse7/fuse-karaf-openshift-rhel8:1.11" } },
create -f fis-image-streams.json -n {namespace}
create -f ./spring-boot-2-camel-xml-template.json -n openshift
new-app s2i-fuse713-spring-boot-2-camel-xml -n {namespace} -p IMAGE_STREAM_NAMESPACE={namespace} -p MAVEN_MIRROR_URL={Maven mirror URL} -p GIT_REPO={Git Repo URL} -p GIT_REF={Git branch/tag name}
mvn org.apache.maven.plugins:maven-archetype-plugin:2.4:generate -DarchetypeCatalog={Maven Mirror URL}/archetypes/archetypes-catalog/2.2.0.fuse-7_13_0-00014-redhat-00001/archetypes-catalog-2.2.0.fuse-7_13_0-00014-redhat-00001-archetype-catalog.xml -DarchetypeGroupId=org.jboss.fuse.fis.archetypes -DarchetypeArtifactId=spring-boot-camel-xml-archetype -DarchetypeVersion=2.2.0.fuse-7_13_0-00014-redhat-00001
Define value for property 'groupId': : org.example.fis Define value for property 'artifactId': : fuse713-spring-boot2 Define value for property 'version': 1.0-SNAPSHOT: : Define value for property 'package': org.example.fis: : Confirm properties configuration: groupId: org.example.fis artifactId: fuse713-spring-boot version: 1.0-SNAPSHOT package: org.example.fis Y: : Y
cd fuse713-spring-boot2 mvn oc:deploy -Popenshift