-
Bug
-
Resolution: Unresolved
-
Undefined
-
None
-
None
-
None
-
False
-
-
False
-
?
-
rhos-docs
-
None
-
-
-
-
Critical
The current procedure doesn't mention the signature preservation.
If oc-mirror v2 drop the signature, EDPM nodes deployment will fail at pulling container image on EDPM node because the signature verification failed due to the default configuration in /etc/containers/policy.json.
This caused by oc-mirror v2 plugin which is earlier than OCP4.19 doesn't support to preserve the signature.
The latest oc-mirror plugin itself is supported regardless of which OCP version is used in the deployment.
So, we need to add the following sentences.
1. Use the latest oc-mirror v2 plugin according to the OCP guide, https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/disconnected_environments/about-installing-oc-mirror-v2#oc-mirror-v2-support_about-installing-oc-mirror-v2
2. If your using oc-mirror v2 plugin is between OCP4.19 and OCP4.20, add `--remove-signature=false` for mirror the image.
refer to https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/disconnected_environments/about-installing-oc-mirror-v2#oc-mirror-signature-mirroring_about-installing-oc-mirror-v2
3. If your using oc-mirror v2 plugin is 4.21 and later, the plugin mirrors signatures for all images.