Procedure

1. In the navigation menu, click Ecosystem > Software Catalog.
2. In the Filter by keyword text box, enter Connectivity to find the Red Hat Connectivity Link Operator.
3. Read the information about the Operator, and click Install to display the Operator subscription page.

4. Select your subscription settings as follows:

   • Update Channel: stable
   • Version: 1.4.0
   • Installation mode: All namespaces on the cluster (default).
   • Installed namespace: Select the namespace where you want to install the Operator, for example, kuadrant-system. If the namespace does not already exist, click this field and select Create Project to create the namespace.
   • Approval Strategy: Select Automatic or Manual.
5. Click Install, and wait a few moments until the Operator is installed and ready for use.
6. Click Ecosystem > Installed Operators > Red Hat Connectivity Link.
7. Click the Kuadrant tab, and click Create Kuadrant to create a Kuadrant custom resource (CR).
8. In the Configure via field, click YAML view to edit the definition, for example, the Kuadrant CR name.

9. Click Create and wait for the deployment to be displayed in the list.

   Note

   If you are using OpenShift Service Mesh, no additional configuration is required. Connectivity Link automatically detects and uses OpenShift Service Mesh as your Gateway object controller.

Procedure

1. Create the namespace where you want to install Connectivity Link by running the following command:

   $ oc create ns <kuadrant_system>

   Copy code to clipboard

   You can replace the default <kuadrant_system> with the namespace you want to use.

2. Create the Subscription custom resource (CR) by using the following example:

   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: rhcl-operator
     namespace: <kuadrant_system>
   spec:
     channel: stable
     installPlanApproval: Automatic
     name: rhcl-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace

   Copy code to clipboard

   • Replace <kuadrant_system> with the name of the namespace where you want to deploy Connectivity Link.

     Important

     For disconnected installations, you must replace the spec.source parameter value of the Subscription object with the name of the CatalogSource object created by oc-mirror. You can find the catalog source name by running the following command:

     $ oc get catalogsource -n openshift-marketplace

     Copy code to clipboard

3. Apply the Subscription CR by running the following command:

   $ oc apply -f subscription.yaml

   Copy code to clipboard

4. Create the OperatorGroup custom resource (CR) by using the following example:

   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: kuadrant
     namespace: <kuadrant_system>
   spec:
     upgradeStrategy: Default

   Copy code to clipboard
   • Replace <kuadrant_system> with the namespace you used.

5. Apply the OperatorGroup CR by running the following command:

   $ oc apply -f operatorgroup.yaml

   Copy code to clipboard

6. Confirm that the Connectivity Link installation has finished by running one of the following commands:

   $ oc wait --for=jsonpath={.status.installPlanRef.name} subscription rhcl-operator --timeout=10s
   ip=$(oc get subscription rhcl-operator -o=jsonpath={.status.installPlanRef.name})

   Copy code to clipboard

   $ oc wait --for=condition=Installed installplan ${ip} --timeout=60s

   Copy code to clipboard

   Expect the status of installplan.operators.coreos.com/install-<suffix> when Connectivity Link is ready. The name of the install plan has a random suffix, for example, 4rql7.

7. Create your Connectivity Link custom resource (CR) by using the following example:

   apiVersion: kuadrant.io/v1beta1
   kind: Kuadrant
   metadata:
     name: kuadrant
     namespace: <kuadrant_system>
   spec: {}

   Copy code to clipboard

   Replace <kuadrant_system> with the namespace you used.

8. Apply the Connectivity Link CR by running the following command:

   $ oc apply -f kuadrant.yaml

   Copy code to clipboard

Verification

1. Check the status of the Connectivity Link CR generation by running the following command:

   $ oc wait kuadrant/kuadrant --for="condition=Ready=true" -n <kuadrant_system> --timeout=300s

   Copy code to clipboard

   Replace <kuadrant_system> with the namespace you used.

   Example output

   kuadrant.kuadrant.io/kuadrant Ready

   Copy code to clipboard

2. Verify that all component Operator pods are running by entering the following command:

   $ oc get pods -n <kuadrant_system>

   Copy code to clipboard

   • Replace <kuadrant_system> with the namespace you used.

     Example output

     NAME                                                READY   STATUS    RESTARTS   AGE
     authorino-operator-controller-manager-<hash>        2/2     Running   0          5m
     dns-operator-controller-manager-<hash>              2/2     Running   0          5m
     kuadrant-operator-controller-manager-<hash>         2/2     Running   0          7m
     limitador-operator-controller-manager-<hash>        2/2     Running   0          5m

     Copy code to clipboard

3. For a disconnected installation, verify that there are no image pull errors by running the following command:

   $ oc get events -n <kuadrant_system> --field-selector reason=Failed

   Copy code to clipboard

   • Replace <kuadrant_system> with the namespace you used.

     The output should show no image pull failures.

     Note

     Pod specifications still show original image references, for example, registry.redhat.io/redhat/…​, even when images are pulled from your mirror registry. The redirection happens transparently at the CRI-O level through ImageDigestMirrorSet or ImageTagMirrorSet configuration objects.

Procedure

1. Create the namespace where you want to install Connectivity Link by running the following command:

   $ oc create ns <kuadrant-system>

   Copy code to clipboard

   You can replace the default <kuadrant-system> with the namespace you want to use.

2. Install Connectivity Link by running the following command:

   $ oc apply -f - <<EOF
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: rhcl-operator
     namespace: kuadrant-system
   spec:
     channel: stable
     installPlanApproval: Automatic
     name: rhcl-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace
     config:
       env:
       - name: ISTIO_GATEWAY_CONTROLLER_NAMES
         value: istio.io/gateway-controller
   ---
   kind: OperatorGroup
   apiVersion: operators.coreos.com/v1
   metadata:
     name: kuadrant
     namespace: kuadrant-system
   spec:
     upgradeStrategy: Default
   EOF

   Copy code to clipboard

   Replace <kuadrant-system> with the namespace you used.

3. Confirm that the Connectivity Link installation has finished by running one of the following commands:

   $ oc wait --for=jsonpath={.status.installPlanRef.name} subscription rhcl-operator --timeout=10s
   ip=$(oc get subscription rhcl-operator -o=jsonpath={.status.installPlanRef.name})

   Copy code to clipboard

   $ oc wait --for=condition=Installed installplan ${ip} --timeout=60s

   Copy code to clipboard

   Expect the status of installplan.operators.coreos.com/install-<suffix> when Connectivity Link is ready. The name of the install plan has a random suffix, for example, 4rql7.

4. Create your Connectivity Link custom resource (CR) by running the following command:

   $ oc apply -f - <<EOF
   apiVersion: kuadrant.io/v1beta1
   kind: Kuadrant
   metadata:
     name: kuadrant
     namespace: <kuadrant-system>
   EOF

   Copy code to clipboard

   Replace <kuadrant-system> with the namespace you used.

Procedure

1. Optional: Set up your environment variables as follows:

   1. Assign AWS_ACCESS_KEY_ID, which is the key ID from AWS with Route 53 access:

      $ export AWS_ACCESS_KEY_ID=xxxxxxx

      Copy code to clipboard

   2. Assign AWS_SECRET_ACCESS_KEY`, which is the key from AWS with Route 53 access.

      $ export AWS_SECRET_ACCESS_KEY=xxxxxxx

      Copy code to clipboard

   3. Assign AWS_REGION, which is your AWS region, for example, us-east-2 or eu-west-1.

      $ export AWS_REGION=your-aws-region

      Copy code to clipboard

2. Create a Secret resource for your credentials as follows:

   $ oc create secret generic aws-credentials \
     --namespace=api-gateway \
     --type=kuadrant.io/aws \
     --from-literal=AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID \
     --from-literal=AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY \
     --from-literal=AWS_REGION=$AWS_REGION

   Copy code to clipboard
   Important

   You must configure the secret in the same namespace as your gateway.

Procedure

1. Optional: Specify your GOOGLE environment variable by running the following commands:

   $ export GOOGLE=xxxxxxx

   Copy code to clipboard

   where:

   • GOOGLE: The GOOGLE variable specifies the JSON credentials generated by the gcloud CLI or by the service account. For example, $HOME/.config/gcloud/application_default_credentials.json, which has the following credentials:

     {"client_id": "***","client_secret": "***","refresh_token": "***","type": "authorized_user"}

     Copy code to clipboard

2. Optional: Specify your PROJECT_ID environment variable by running the following commands:

   $ export PROJECT_ID=xxxxxxx

   Copy code to clipboard

   PROJECT_ID: Google project ID.

3. Create a Secret resource for your credentials by running the following command:

   $ oc create secret generic test-gcp-credentials \
     --namespace=api-gateway \
     --type=kuadrant.io/gcp \
     --from-literal=PROJECT_ID=$PROJECT_ID \
     --from-file=GOOGLE=$GOOGLE

   Copy code to clipboard
   Important

   You must configure the secret in the same namespace as your gateway.

Procedure

1. Create a new Azure service principal for managing DNS by setting the following environment variables:

   $ DNS_NEW_SP_NAME=kuadrantDnsPrincipal \
     DNS_SP=$(az ad sp create-for-rbac --name $DNS_NEW_SP_NAME) \
     DNS_SP_APP_ID=$(echo $DNS_SP | jq -r '.appId') \
     DNS_SP_PASSWORD=$(echo $DNS_SP | jq -r '.password')

   Copy code to clipboard

   For more details on service principals, see the Content from learn.microsoft.com is not included.Microsoft Azure documentation.

2. Set the resource group environment variable by running the following command:

   $ DNS_RESOURCE_GROUP="ExampleDNSResourceGroup"

   Copy code to clipboard

   Replace "ExampleDNSResourceGroup" with the DNS resource group that you want to use.

3. To grant read and contributor access to the zones that you want managed for the service principal you are using, perform the following steps:

   1. Fetch the DNS ID used to grant access to the service principal as follows:

      $ DNS_ID=$(az network dns zone show --name example.com \
       --resource-group $DNS_RESOURCE_GROUP --query "id" --output tsv)

      Copy code to clipboard

   2. Get your resource group ID by running the following command:

      $ RESOURCE_GROUP_ID=$(az group show --resource-group $DNS_RESOURCE_GROUP | jq ".id" -r)

      Copy code to clipboard

   3. Give reader access to the resource group as follows:

      $ az role assignment create --role "Reader" --assignee $DNS_SP_APP_ID --scope $DNS_ID

      Copy code to clipboard

   4. Give contributor access to the DNS zone as follows:

      $ az role assignment create --role "Contributor" --assignee $DNS_SP_APP_ID --scope $DNS_ID

      Copy code to clipboard

4. Because you are setting up advanced traffic rules for geographic and weighted responses, you must also grant traffic manager and DNS zone access:

   1. Create the role assignment for the traffic manager contributor by running the following command:

      $ az role assignment create --role "Traffic Manager Contributor" --assignee $DNS_SP_APP_ID --scope $RESOURCE_GROUP_ID

      Copy code to clipboard

   2. Create the role assignment for the DNA zone contributor by running the following command:

      $ az role assignment create --role "DNS Zone Contributor" --assignee $DNS_SP_APP_ID --scope $RESOURCE_GROUP_ID

      Copy code to clipboard

   3. Configure the DNS zone access by running the following command:

      $ cat <<-EOF > /local/path/to/azure.json
      {
        "tenantId": "$(az account show --query tenantId -o tsv)",
        "subscriptionId": "$(az account show --query id -o tsv)",
        "resourceGroup": "$DNS_RESOURCE_GROUP",
        "aadClientId": "$DNS_SP_APP_ID",
        "aadClientSecret": "$DNS_SP_PASSWORD"
      }
      EOF

      Copy code to clipboard

5. Create a Secret resource for your credentials by running the following command:

   $ oc create secret generic test-azure-credentials \
     --namespace=api-gateway \
     --type=kuadrant.io/azure \
     --from-file=azure.json=/local/path/to/azure.json

   Copy code to clipboard
   Important

   You must configure the secret in the same namespace as your gateway.

Procedure

1. Set the following environment variable to your shared Redis-based instance URL:

   $ export REDIS_URL=rediss://user:xxxxxx@some-redis.com:10340

   Copy code to clipboard

   Include the appropriate URI scheme for your environment:

   • Secure Redis: rediss://
   • Standard Redis: redis://

2. Create a Secret resource for your Redis URL as follows:

   $ oc -n kuadrant-system create secret generic redis-config \
     --from-literal=URL=$REDIS_URL

   Copy code to clipboard

3. Update your Limitador custom resource to use the secret that you created as follows:

   $ oc patch limitador limitador --type=merge -n kuadrant-system -p '
   spec:
     storage:
       redis:
         configSecretRef:
           name: redis-config
   '

   Copy code to clipboard

Procedure

1. In the navigation menu, select the Administrator perspective.
2. Click Home > Overview.
3. In the Status panel, click Dynamic Plugins > View all.
4. On the Console plugins tab, find the kuadrant-console-plugin entry in the table, which should be listed but disabled.
5. In the kuadrant-console-plugin row, click Disabled.
6. Select the Enable option, and click Save.
7. Wait for the plugin status to change to Loaded.

Verification

1. Refresh the OpenShift Container Platform web console. A new Connectivity Link menu item is displayed in the navigation sidebar.

   1. You can click Connectivity Link > Overview to explore the available resources and to get started with creating a Gateway and configuring policies in the OpenShift Container Platform web console.

1. Go to access.redhat.com.
2. If you do not already have an account, create one.
3. Log in to your account.
4. In the menu bar, click Subscriptions to view and manage your subscriptions.

1. Mirror the Red Hat Operator catalog containing the Connectivity Link Operator package to your local registry.
2. Configure your OpenShift Container Platform cluster to use the mirrored catalog.
3. Install the Connectivity Link Operator using Operator Lifecycle Manager (OLM).

Procedure

1. On your internet-connected workstation, create an ImageSetConfiguration file named rhcl-imageset-config.yaml by using the following example:

   Example ImageSetConfiguration YAML

   apiVersion: mirror.openshift.io/v2alpha1
   kind: ImageSetConfiguration
   mirror:
     operators:
     - catalog: registry.redhat.io/redhat/redhat-operator-index:v4.22
       packages:
       - name: rhcl-operator
     additionalImages:
     - name: registry.redhat.io/rhcl-1/coredns-rhel9:vX.Y.Z

   Copy code to clipboard

   • In the mirror.operators.catalog parameter, specify the Red Hat Operator catalog version matching your OpenShift Container Platform cluster version.
   • The value of the mirror.operators.packages parameter is the Connectivity Link Operator group. Authorino, Limitador, and DNS Operators are included automatically.
   • Optional. The value of the mirror.additionalImages.name parameter is the dns-operator Operator version. Set this value if you want to use the Core DNS Operator. Replace vX.Y.Z with the version matching the Connectivity Link Operator release.

2. Mirror the catalog to a local directory by running the following command:

   $ oc mirror --v2 --config rhcl-imageset-config.yaml file://./rhcl-mirror

   Copy code to clipboard

   This command downloads the catalog and Operator images to the rhcl-mirror directory.

3. Transfer the rhcl-mirror directory to your disconnected environment using removable media.

4. On a host in the disconnected environment that has access to your mirror registry, push the images to the registry by running the following command:

   $ oc mirror --v2 --config rhcl-imageset-config.yaml \
     --from file://./rhcl-mirror \
     docker://<mirror_registry:port>

   Copy code to clipboard

   Replace <mirror_registry:port> with the path and port to your mirror registry.

5. Apply either or both the ImageDigestMirrorSet and ImageTagMirrorSet files to configure the cluster to use the mirrored images by running the following commands:

   1. Apply the ImageDigestMirrorSet by running the following command:

      $ oc apply -f results-*/cluster-resources/idms-oc-mirror.yaml

      Copy code to clipboard

   2. Apply the ImageTagMirrorSet by running the following command:

      $ oc apply -f results-*/cluster-resources/itms-oc-mirror.yaml

      Copy code to clipboard
      Note

      The oc-mirror tool generates these manifests based on how you reference your images in the mirrored Operators.

6. Wait for the MachineConfigPool object to update by running the following command:

   $ oc wait mcp --all --for=condition=Updated --timeout=30m

   Copy code to clipboard

   Example output

   machineconfigpool.machineconfiguration.openshift.io/master condition met
   machineconfigpool.machineconfiguration.openshift.io/worker condition met

   Copy code to clipboard

7. From your disconnected cluster, apply the generated CatalogSource manifest by running the following command:

   $ oc apply -f cluster-resources/cs-redhat-operator-index-v4-21.yaml

   Copy code to clipboard

8. Wait for the Operator catalog to be ready by running the following command:

   $ oc wait catalogsource -n openshift-marketplace --all --for=condition=Ready --timeout=5m

   Copy code to clipboard

   Example output

   catalogsource.operators.coreos.com/cs-redhat-operator-index-v4-21 condition met

   Copy code to clipboard

Procedure

1. Create the namespace where you want to install Connectivity Link by running the following command:

   $ oc create ns <kuadrant_system>

   Copy code to clipboard

   You can replace the default <kuadrant_system> with the namespace you want to use.

2. Create the Subscription custom resource (CR) by using the following example:

   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: rhcl-operator
     namespace: <kuadrant_system>
   spec:
     channel: stable
     installPlanApproval: Automatic
     name: rhcl-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace

   Copy code to clipboard

   • Replace <kuadrant_system> with the name of the namespace where you want to deploy Connectivity Link.

     Important

     For disconnected installations, you must replace the spec.source parameter value of the Subscription object with the name of the CatalogSource object created by oc-mirror. You can find the catalog source name by running the following command:

     $ oc get catalogsource -n openshift-marketplace

     Copy code to clipboard

3. Apply the Subscription CR by running the following command:

   $ oc apply -f subscription.yaml

   Copy code to clipboard

4. Create the OperatorGroup custom resource (CR) by using the following example:

   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: kuadrant
     namespace: <kuadrant_system>
   spec:
     upgradeStrategy: Default

   Copy code to clipboard
   • Replace <kuadrant_system> with the namespace you used.

5. Apply the OperatorGroup CR by running the following command:

   $ oc apply -f operatorgroup.yaml

   Copy code to clipboard

6. Confirm that the Connectivity Link installation has finished by running one of the following commands:

   $ oc wait --for=jsonpath={.status.installPlanRef.name} subscription rhcl-operator --timeout=10s
   ip=$(oc get subscription rhcl-operator -o=jsonpath={.status.installPlanRef.name})

   Copy code to clipboard

   $ oc wait --for=condition=Installed installplan ${ip} --timeout=60s

   Copy code to clipboard

   Expect the status of installplan.operators.coreos.com/install-<suffix> when Connectivity Link is ready. The name of the install plan has a random suffix, for example, 4rql7.

7. Create your Connectivity Link custom resource (CR) by using the following example:

   apiVersion: kuadrant.io/v1beta1
   kind: Kuadrant
   metadata:
     name: kuadrant
     namespace: <kuadrant_system>
   spec: {}

   Copy code to clipboard

   Replace <kuadrant_system> with the namespace you used.

8. Apply the Connectivity Link CR by running the following command:

   $ oc apply -f kuadrant.yaml

   Copy code to clipboard

Verification

1. Check the status of the Connectivity Link CR generation by running the following command:

   $ oc wait kuadrant/kuadrant --for="condition=Ready=true" -n <kuadrant_system> --timeout=300s

   Copy code to clipboard

   Replace <kuadrant_system> with the namespace you used.

   Example output

   kuadrant.kuadrant.io/kuadrant Ready

   Copy code to clipboard

2. Verify that all component Operator pods are running by entering the following command:

   $ oc get pods -n <kuadrant_system>

   Copy code to clipboard

   • Replace <kuadrant_system> with the namespace you used.

     Example output

     NAME                                                READY   STATUS    RESTARTS   AGE
     authorino-operator-controller-manager-<hash>        2/2     Running   0          5m
     dns-operator-controller-manager-<hash>              2/2     Running   0          5m
     kuadrant-operator-controller-manager-<hash>         2/2     Running   0          7m
     limitador-operator-controller-manager-<hash>        2/2     Running   0          5m

     Copy code to clipboard

3. For a disconnected installation, verify that there are no image pull errors by running the following command:

   $ oc get events -n <kuadrant_system> --field-selector reason=Failed

   Copy code to clipboard

   • Replace <kuadrant_system> with the namespace you used.

     The output should show no image pull failures.

     Note

     Pod specifications still show original image references, for example, registry.redhat.io/redhat/…​, even when images are pulled from your mirror registry. The redirection happens transparently at the CRI-O level through ImageDigestMirrorSet or ImageTagMirrorSet configuration objects.

Procedure

1. Check the catalog pod logs by running the following command:

   $ oc logs -n openshift-marketplace -l olm.catalogSource=cs-redhat-operator-index-v{ocp-latest-version}

   Copy code to clipboard

   Make sure you use the information that was created by the oc mirror tool to run this command.

2. Verify that the catalog image exists in the mirror registry by running the following command:

   $ oc image info <mirror_registry>/redhat/redhat-operator-index:v{ocp-latest-version}

   Copy code to clipboard

   Replace <mirror_registry> with the path to your mirror registry.

Procedure

1. Verify that all four Operators are available as PackageManifest resources by running the following command:

   $ oc get packagemanifest -n openshift-marketplace | grep -E '(rhcl|authorino|limitador|dns)-operator'

   Copy code to clipboard
2. If any packages are missing, the catalog was not mirrored or applied correctly. Check that the catalog is ready and running with no errors and that the ImageSetConfiguration was created correctly.

3. Check that the InstallPlan shows all dependencies by running the following command:

   $ oc get installplan -n <kuadrant_system> -o yaml

   Copy code to clipboard

   Replace <kuadrant_system> with the namespace in which you installed Connectivity Link.

   Look for all four Operators in the InstallPlan specification output.

4. If an Operator is missing, check the InstallPlan for errors or re-mirror the catalog.

Procedure

1. Verify that ImageDigestMirrorSet exists by running the following command:

   $ oc get imagedigestmirrorset

   Copy code to clipboard

2. Check whether the specific image was mirrored by running the following command:

   $ oc image info <mirror_registry>/rhcl-1/rhcl-operator@sha256:_<digest>_

   Copy code to clipboard
   • Replace <mirror_registry> with the path to your mirror registry.
   • Replace <digest> with the complete digest value.

3. Check pod events by running the following command:

   $ oc describe pod <pod_name> -n <kuadrant_system>

   Copy code to clipboard
   • Replace <pod_name> with the name of the stuck pod.
   • Replace <kuadrant_system> with the namespace in which you installed Connectivity Link.