Graph data for OKD

[Goose29]

As of right now OKD doesn't publish its cincinnati-graph-data configurations for people to create their own cincinnati-operator / update service, this makes it hard to perform upgrades in restricted networks where there is no access to https://amd64.origin.releases.ci.openshift.org/graph.

I have tried to work around this limitation by first, pruning the registry.redhat.io/redhat/redhat-operator-index:v4.11 image to only contain cincinnati-operator, which was done with the following commands:

mkdir -p pruned-catalog/configs

opm render registry.redhat.io/redhat/redhat-operator-index:v4.11 | jq 'select( .package == "cincinnati-operator" or .name == "cincinnati-operator" )' > pruned-catalog/configs/index.json

opm generate dockerfile pruned-catalog/configs

podman build -t localhost:5000/redhat/redhat-operator-index:v4.11 -f configs.Dockerfile ./pruned-catalog/
podman push localhost:5000/redhat/redhat-operator-index:v4.11 --tls-verify=false

oc adm catalog mirror \
    localhost:5000/redhat/redhat-operator-index:v4.11 \
    localhost:5000 \
    --insecure

This will save all the required images and configurations to create a custom CatalogSource, which could look something like this:

apiVersion: operator.openshift.io/v1alpha1
kind: ImageContentSourcePolicy
metadata:
  labels:
    operators.openshift.org/catalog: "true"
  name: redhat-operator-index-0
spec:
  repositoryDigestMirrors:
  - mirrors:
    - localhost:5000/openshift-update-service/openshift-update-service-rhel8-operator
    source: registry.redhat.io/openshift-update-service/openshift-update-service-rhel8-operator
  - mirrors:
    - localhost:5000/openshift-update-service/cincinnati-operator-bundle
    source: registry.redhat.io/openshift-update-service/cincinnati-operator-bundle
  - mirrors:
    - localhost:5000/openshift-update-service/openshift-update-service-rhel8
    source: registry.redhat.io/openshift-update-service/openshift-update-service-rhel8
---
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: custom-redhat-operator-index
  namespace: openshift-marketplace
spec:
  image: registry.redhat.io/redhat/redhat-operator-index:v4.11
  sourceType: grpc
---
apiVersion: v1
kind: Namespace
metadata:
  name: openshift-update-service
  annotations:
    openshift.io/node-selector: ""
  labels:
    openshift.io/cluster-monitoring: "true"
---
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: update-service-operator-group
  namespace: openshift-update-service
spec:
  targetNamespaces:
  - openshift-update-service
---
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: update-service-subscription
  namespace: openshift-update-service
spec:
  channel: v1
  installPlanApproval: "Automatic"
  source: "custom-redhat-operator-index"
  sourceNamespace: "openshift-marketplace"
  name: "cincinnati-operator"
---
apiVersion: cincinnati.openshift.io/v1beta1
kind: Cincinnati
metadata:
  name: cincinnati-update-service
  namespace: openshift-update-service
spec:
  replicas: 1
  releases: quay.io/openshift/okd (this needs to be mirrored as with a normal restricted OKD cluster)
  graphDataImage: <-----

This leaves us with one thing missing, and that is the graphDataImage which contains the graph data. In Openshift this is created with the following Dockerfile (As described in these docs):

FROM registry.access.redhat.com/ubi8/ubi:8.1

RUN curl -L -o cincinnati-graph-data.tar.gz https://github.com/openshift/cincinnati-graph-data/archive/master.tar.gz

CMD exec /bin/bash -c "tar xvzf cincinnati-graph-data.tar.gz -C /var/lib/cincinnati/graph-data/ --strip-components=1"

But there doesn't exist a .tar.gz for OKD, so this leaves a couple of options.

1. Copy the json data from https://amd64.origin.releases.ci.openshift.org/graph?channel=stable-4 and put it into a http server to be served as raw json data.
2. Clone https://github.com/openshift/cincinnati-graph-data/ then update all the channels files and delete the blocked-edges folder, and then execute the following https://github.com/openshift/cincinnati-graph-data/blob/master/deploy/2-build-config.yaml for the configs to be generated.
3. Create the configs manually.
4. Create necessary OKD related repositories to do the same thing as Openshift, and publish a tar file for OKD graph-data. (@vrutkovs mentioned that it is a large thing to do here, I would be interested in contributing to something like this)

I would highly prefer option 4 as it allows everyone later down the road to perform upgrades through a standard / best-practice method.