OpenShift - Install and Configure the OpenShift Update Service Operator

The prerequisites include configuring a local registry mirror for OpenShift images and ensuring a functional OpenShift cluster with administrative privileges. 

Optionally, if you are using a custom certificate authority (CA), a ConfigMap containing the CA certificate must be configured in the 'openshift-config' namespace under the 'updateservice-registry' key. For example:

 [archy@helper01 ~]$ oc -n openshift-config get configmap/custom-ca -o yaml  
 apiVersion: v1  
 kind: ConfigMap  
 metadata:  
   namespace: openshift-config  
   name: custom-ca  
 spec:  
   ca-bundle.crt: |  
   -----BEGIN CERTIFICATE-----  
   ...  
   -----END CERTIFICATE-----  
   updateservice-registry: |  
   -----BEGIN CERTIFICATE-----  
   ...  
   -----END CERTIFICATE-----  

You can add additional trusted CAs by updating the 'image.config.openshift.io/cluster' resource:

 [archy@helper01 ~]$ oc patch image.config.openshift.io/cluster -p '{"spec":{"additionalTrustedCA":{"name":"custom-ca"}}}' --type merge  

To begin, create the namespace for deploying the OpenShift Update Service Operator:

 [archy@helper01 ~]$ cat << EOF > 0-namespace.yml  
 ---  
 apiVersion: v1  
 kind: Namespace  
 metadata:  
   name: openshift-update-service  
   annotations:  
     openshift.io/node-selector: ""  
   labels:  
     openshift.io/cluster-monitoring: "true"  
 ...  
 EOF  
 [archy@helper01 ~]$ oc apply -f 0-namespace.yml  

Following this, create the OperatorGroup required for the OpenShift Update Service Operator:

 [archy@helper01 ~]$ cat << EOF > 1-operatorgroup.yml  
 ---  
 apiVersion: operators.coreos.com/v1  
 kind: OperatorGroup  
 metadata:  
   namespace: openshift-update-service  
   name: openshift-update-service-operatorgroup  
 spec:  
   upgradeStrategy: Default
   targetNamespaces:  
     - openshift-update-service  
 ...  
 [archy@helper01 ~]$ oc -n openshift-update-service apply -f 1-operatorgroup.yml  

Subsequently, create the Subscription, which enables the installation and automatic updates of the OpenShift Update Service Operator:

 [archy@helper01 ~]$ cat << EOF > 2-subscription.yml  
 ---  
 apiVersion: operators.coreos.com/v1alpha1  
 kind: Subscription  
 metadata:  
   namespace: openshift-update-service  
   name: openshift-update-service-subscription  
 spec:  
   channel: v1  
   installPlanApproval: Automatic  
   source: redhat-operators  
   sourceNamespace: openshift-marketplace  
   name: cincinnati-operator  
 ...  
 EOF  
 [archy@helper01 ~]$ oc -n openshift-update-service apply -f 2-subscription.yml  

Then, create the 'UpdateService' Custom Resource:

 [archy@helper01 ~]$ cat << EOF > 3-update-service.yml  
 ---  
 apiVersion: updateservice.operator.openshift.io/v1  
 kind: UpdateService  
 metadata:  
   namespace: openshift-update-service  
   name: osus  
 spec:  
   replicas: 2  
   releases: ocp-registry.archyslife.lan/openshift-mirror/release-images  
   graphDataImage: ocp-registry.archyslife.lan/openshift-mirror/graphdata:latest  
 ...  
 [archy@helper01 ~]$ oc -n openshift-update-service apply -f 3-update-service.yml  

The final step is to patch the 'clusterversion/version' Custom Resource:

 [archy@helper01 ~]$ POLICY_ENGINE_GRAPH_URI="$(oc -n openshift-update-service get updateservice/osus -o jsonpath='{.status.policyEngineURI}/api/upgrades_info/v1/graph{"\n"}')"  
 [archy@helper01 ~]$ PATCH="{\"spec\":{\"upstream\":"${POLICY_ENGINE_GRAPH_URI}\"}}"  
 [archy@helper01 ~]$ oc patch clusterversion/version -p "${PATCH}" --type merge  

Configuring the 'clusterversion/version' Custom Resource adjusts the upstream update graph and enables graphical updates for the disconnected cluster.

Feel free to comment and / or suggest a topic.