OpenShift Cluster Install Config Generator

Mirror registry setup (disconnected)

Enterprises often block Assisted / connected installs because firewall teams must whitelist many Red Hat endpoints. A dedicated mirror registry lets you pull once from the internet on a bastion, then install the cluster from an internal registry only.

This guide follows Red Hat’s mirror registry for Red Hat OpenShift (a small Quay-based appliance included with an OpenShift subscription). It is for bootstrapping disconnected clusters — not a HA production Quay.

1. Prerequisites

• RHEL (or compatible) host with DNS / FQDN for the registry (for example mirror.example.com)
• podman installed; SSH access if installing to a remote host
• Disk space: tens of GB for release images alone; much more if you also mirror Operator catalogs (Red Hat suggests planning for large streams — up to ~1 TB per stream in some guidance)
• A connected host (or jump path) that can download the installer and later run oc-mirror

2. Download the installer

1. Download mirror-registry from the OpenShift console Downloads page (included with your subscription), or from the quay/mirror-registry releases.
2. Copy the archive to the registry host and unpack it so ./mirror-registry is executable.

3. Install on the local host

Replace the hostname and install directory with your values:

./mirror-registry install \
  --quayHostname mirror.example.com \
  --quayRoot $HOME/quay-install

The installer creates local storage/config under --quayRoot, systemd units for persistence, and an initial user named init with a generated password (printed at the end — save it).

4. Optional: install on a remote host

./mirror-registry install -v \
  --targetHostname mirror.example.com \
  --targetUsername someuser \
  --ssh-key ~/.ssh/id_rsa \
  --quayHostname mirror.example.com \
  --quayRoot /home/someuser/quay-install

5. Log in and trust the certificate

Prefer trusting the generated root CA long term. For a first smoke test you can use --tls-verify=false (not recommended permanently):

podman login -u init \
  -p '<password-from-install>' \
  mirror.example.com:8443 \
  --tls-verify=false

UI: https://mirror.example.com:8443. Add the registry CA to this app’s additionalTrustBundle placeholder later when you generate install-config.yaml.

6. Wire this registry into the generator

7. What to mirror next

1. On a connected bastion that can reach both the internet and this registry, log in to registry.redhat.io and to your mirror.
2. Mirror the OpenShift release payload (required to install).
3. Optionally mirror Operators with the operator-mirror-config.yaml this app generates (day-2 OperatorHub — not required to bring the cluster up).
4. Copy the resulting ImageContentSourcePolicy / mirror mappings into your install config (this app provides placeholders under Disconnected).

8. Already have an enterprise registry?

If you already run Quay, Harbor, Artifactory, Nexus, or another Docker v2-2 registry reachable from the cluster, you can skip installing the appliance. Point “Mirror registry host” at that registry and trust its CA. The rest of the oc-mirror workflow is the same.

Official references

• Creating a mirror registry with mirror registry for Red Hat OpenShift
• quay/mirror-registry on GitHub
• Introducing Mirror Registry for Red Hat OpenShift (Red Hat blog)