Kasten K10 – Air gap installation using Harbor Image Registry
Tags: kubernetes, airgap, harbor, install
Published: 2021-11-04 10:08:28

---
title: Kasten K10 – Air gap installation using Harbor Image Registry
published: true
date: 2021-10-26 19:03:14 UTC
tags: Kubernetes,AirGap,Harbor,Install
canonical_url: https://veducate.co.uk/kasten-air-gap/#utm_source=rss&utm_medium=rss&utm_campaign=kasten-air-gap
---

In this blog post, I will cover the steps for an air-gap installation for Kasten K10. For situations where your Kubernetes cluster doesn’t have available internet access to pull down the container images directly from their online locations.

###### Pre-requisites

- Image Registry that is accessible by your Kubernetes cluster
  - In this example I am using the [Harbor Image Registry](https://goharbor.io/).
- Client that has access to download the container images and then to the Image Registry
  - In this example, I am using my local machine which has docker installed.
- Helm downloaded
  - Run the following to get the helm files locally for the install.

```
helm repo update && \
    helm fetch kasten/k10 --version=<k10-version>

**Example for Kasten K10 4.5.0**

helm repo update && \ 
    helm fetch kasten/k10 --version=4.5.0

This will download a file, for example "k10-4.5.0.tgz"
```

###### Log into your Image Registry

First you need to ensure that your docker client (or similar) has authenticated to your Image Registry which your air-gap Kubernetes cluster can access.

When using Harbor and Docker, I typically use this method with a [robot account for programmatic access](https://veducate.co.uk/authenticate-docker-harbor-robot/).

However, when running the Kasten tooling which we’ll discuss next, I kept hitting an error.

```
54e42005468d: Waiting  File=kasten.io/k10/kio/tools/k10offline/k10offline.go Function=kasten.io/k10/kio/tools/k10offline.PushK10Images Line=179 hostname=3ffc0162e190

Error: {"message":"Failed to push K10 container images to harbor-repo.veducate.co.uk/deanl","function":"main.pullImages","linenumber":171,"cause":{"message":"Failed to push","function":"kasten.io/k10/kio/tools/k10offline.PushK10Images","linenumber":181,"fields":[{"name":"image","value":"harbor-repo.veducate.co.uk/deanl/kanister-tools:k10-0.69.0"}],"cause":{"Stderr":" **dW5hdXRob3JpemVkOiB1bmF1dGhvcml6ZWQgdG8gYWNjZXNzIHJlcG9zaXRvcnk6IGRlYW5sL2thbmlzdGVyLXRvb2xzLCBhY3Rpb246IHB1c2g6IHVuYXV0aG9yaXplZCB0byBhY2Nlc3MgcmVwb3NpdG9yeTogZGVhbmwva2FuaXN0ZXItdG9vbHMsIGFjdGlvbjogcHVzaAo=**"}}}

**Base64 decode the message above in light bold provides you the response:**

unauthorized: unauthorized to access repository: deanl/kanister-tools, action: push: unauthorized to access repository: deanl/kanister-tools, action: push
```

To resolve this, I had to remove the credsStore line from my ~/.docker/config.json file. Then log into my Harbor registry using the above method.

- This does mean your auth account details are stored in a JSON file locally.

[![docker login - remove credsStore](https://i1.wp.com/veducate.co.uk/wp-content/uploads/2021/10/docker-login-remove-credsStore.jpg?resize=604%2C383&ssl=1)](https://i1.wp.com/veducate.co.uk/wp-content/uploads/2021/10/docker-login-remove-credsStore.jpg?ssl=1)

###### Pull down the Kasten K10 images locally and Push to internal Air-Gap Image Registry

Kasten has provided an easy-to-use tool which can run locally on your docker client to make pulling the necessary images simple.

```
docker run --rm -ti -v /var/run/docker.sock:/var/run/docker.sock \
    -v ${HOME}/.docker:/root/.docker \
    gcr.io/kasten-images/k10offline: **{TAG}** pull images

# Example with Tag

docker run --rm -ti -v /var/run/docker.sock:/var/run/docker.sock \
    -v ${HOME}/.docker:/root/.docker \
    gcr.io/kasten-images/k10offline:4.5.0 pull images
```

By specifying the appropriate tag, you this will use a container image to pull down all the containers and store them within your docker client. To push to an internal repo, you simply add the argument:

```
--newrepo {repo url}
```

For example:

```
docker run --rm -ti -v /var/run/docker.sock:/var/run/docker.sock \
    -v ${HOME}/.docker:/root/.docker \
    gcr.io/kasten-images/k10offline:4.5.0 pull images --newrepo harbor-repo.veducate.co.uk/deanl
```

The below image shows the tool download containers and pushing them to the repo.

[![docker run k10offline-4.5.0 pull images --newrepo](https://i0.wp.com/veducate.co.uk/wp-content/uploads/2021/10/docker-run-k10offline-4.5.0-pull-images-newrepo-.jpg?resize=604%2C147&ssl=1)](https://i0.wp.com/veducate.co.uk/wp-content/uploads/2021/10/docker-run-k10offline-4.5.0-pull-images-newrepo-.jpg?ssl=1)

Here are my images in Harbor.

[![harbor - kasten images](https://i0.wp.com/veducate.co.uk/wp-content/uploads/2021/10/harbor-kasten-images.jpg?resize=604%2C242&ssl=1)](https://i0.wp.com/veducate.co.uk/wp-content/uploads/2021/10/harbor-kasten-images.jpg?ssl=1)

###### Installing Kasten K10 with a local Helm Chart and Container Images

Create your Kasten namespace

```
kubectl create namespace kasten-io
```

Then run the following Helm command

```
helm install k10 k10-4.5.0.tgz --namespace kasten-io \
--set global.airgapped.repository= **{registry URL}**

# Example

helm install k10 k10-4.5.0.tgz --namespace kasten-io \
  --set global.airgapped.repository=harbor-repo.veducate.co.uk/deanl
```

[![air gap - helm install k10 k10-4.5.0.tgz --set global.airgapped.repository](https://i2.wp.com/veducate.co.uk/wp-content/uploads/2021/10/air-gap-helm-install-k10-k10-4.5.0.tgz-set-global.airgapped.repository.jpg?resize=604%2C375&ssl=1)](https://i2.wp.com/veducate.co.uk/wp-content/uploads/2021/10/air-gap-helm-install-k10-k10-4.5.0.tgz-set-global.airgapped.repository.jpg?ssl=1)

We can now watch the pods start by using the command:

```
kubectl get pods -n kasten-io -w
```

[![air gap - kubectl get pods -n kasten-io -w](https://i2.wp.com/veducate.co.uk/wp-content/uploads/2021/10/air-gap-kubectl-get-pods-n-kasten-io-w.jpg?resize=586%2C316&ssl=1)](https://i2.wp.com/veducate.co.uk/wp-content/uploads/2021/10/air-gap-kubectl-get-pods-n-kasten-io-w.jpg?ssl=1)

We can check these are coming from our local image repository by running the describe command against one of our pods.

[![air gap - describe pod - pulled from airgap repo](https://i2.wp.com/veducate.co.uk/wp-content/uploads/2021/10/air-gap-describe-pod-pulled-from-airgap-repo.jpg?resize=604%2C221&ssl=1)](https://i2.wp.com/veducate.co.uk/wp-content/uploads/2021/10/air-gap-describe-pod-pulled-from-airgap-repo.jpg?ssl=1)

Finally, we can also see pulls in our Harbor image registry as well.

[![harbor - kasten image pulls](https://i1.wp.com/veducate.co.uk/wp-content/uploads/2021/10/harbor-kasten-image-pulls.jpg?resize=604%2C217&ssl=1)](https://i1.wp.com/veducate.co.uk/wp-content/uploads/2021/10/harbor-kasten-image-pulls.jpg?ssl=1)

**Summary**

Kasten has made it easy to perform an air-gap internet restricted installation of their software in a Kubernetes cluster, made especially easy thanks to the little k10offline tool you run in your docker client to grab the necessary images for you.

I did hit that little authentication issue where I had to remove the credsStore in docker, due to the way the tool reads the Image Registry auth details. I messaged the Kasten support team about this and they were quick to give me the workaround I documented earlier.

I’m not going to say outside of this I did anything more than follow the [Kasten docs on the subject](https://docs.kasten.io/latest/install/offline.html). But I always feel sometimes it’s good to add some more context and colour with screenshots and using real environments to demonstrate these capabilities and configurations.

Regards

[Follow @Saintdle](https://twitter.com/saintdle)<script async="" src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>

[Dean Lewis](https://uk.linkedin.com/in/saintdle?trk=profile-badge)

The post [Kasten K10 – Air gap installation using Harbor Image Registry](https://veducate.co.uk/kasten-air-gap/) appeared first on [vEducate.co.uk](https://veducate.co.uk).