From 2a50eb15361072b191ae72155521a0a03e709a33 Mon Sep 17 00:00:00 2001 From: Marco Braga Date: Wed, 20 May 2026 15:11:33 -0300 Subject: [PATCH 1/2] Add custom release instructions for hosted cluster Added instructions for using a custom release with CI registry, including steps to disable image check and patch the policy. --- docs/guides/ocp-hcp-aws-devel.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/docs/guides/ocp-hcp-aws-devel.md b/docs/guides/ocp-hcp-aws-devel.md index 8597793..a782043 100644 --- a/docs/guides/ocp-hcp-aws-devel.md +++ b/docs/guides/ocp-hcp-aws-devel.md @@ -65,6 +65,33 @@ aws s3api put-bucket-policy --bucket ${OIDC_BUCKET_NAME} --policy file://${bucke Choose the desired target release from the [release controller](https://openshift-release.apps.ci.l2s4.p1.openshiftapps.com/). +!!! hint (Development Environment) + + When using custom release with CI registry (`registry.ci.openshift.org`), you need to disable image check or provide the registry CA. + We'll disable the check as we are runnning in controlled environment, as well disable CVO to prevent reverting it. + # 1. Scale down CVO + oc scale deploy/cluster-version-operator -n openshift-cluster-version --replicas=0 + + # 2. Patch the policy + # get current config + ``` + $ oc get clusterimagepolicy openshift -o yaml | yq ea .spec.scopes - + - quay.io/openshift-release-dev/ocp-release + - quay.io/openshift-release-dev/ocp-v4.0-art-dev + - quay.io/openshift-release-dev/ocp-v5.0-art-dev + ``` + # disable only v5 (position 2) + oc patch clusterimagepolicy openshift --type=json -p '[ + {"op": "remove", "path": "/spec/scopes/2"} + ]' + + # 3. Verify the scope is gone + oc get clusterimagepolicy openshift -o jsonpath='{.spec.scopes}' ; echo + + # 4. Watch MCO roll out the new config to nodes + oc get mcp -w + +Create the hosted cluster: ```sh OCP_RELEASE_IMAGE=quay.io/openshift-release-dev/ocp-release:4.21.0-ec.3-x86_64 HOSTED_CLUSTER_NAME=${CLUSTER_PREFIX}-hc1 From e9fa6ba553aa41c2a67380ce16ea886981dde0cc Mon Sep 17 00:00:00 2001 From: Marco Braga Date: Wed, 20 May 2026 15:17:32 -0300 Subject: [PATCH 2/2] Revise CVO scaling and policy patching steps Updated the instructions for scaling down CVO and patching the policy in the development environment section. --- docs/guides/ocp-hcp-aws-devel.md | 40 ++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 18 deletions(-) diff --git a/docs/guides/ocp-hcp-aws-devel.md b/docs/guides/ocp-hcp-aws-devel.md index a782043..d8fc7e5 100644 --- a/docs/guides/ocp-hcp-aws-devel.md +++ b/docs/guides/ocp-hcp-aws-devel.md @@ -65,31 +65,35 @@ aws s3api put-bucket-policy --bucket ${OIDC_BUCKET_NAME} --policy file://${bucke Choose the desired target release from the [release controller](https://openshift-release.apps.ci.l2s4.p1.openshiftapps.com/). -!!! hint (Development Environment) - +!!! warning "Development Environment" When using custom release with CI registry (`registry.ci.openshift.org`), you need to disable image check or provide the registry CA. We'll disable the check as we are runnning in controlled environment, as well disable CVO to prevent reverting it. - # 1. Scale down CVO - oc scale deploy/cluster-version-operator -n openshift-cluster-version --replicas=0 - - # 2. Patch the policy - # get current config - ``` - $ oc get clusterimagepolicy openshift -o yaml | yq ea .spec.scopes - - - quay.io/openshift-release-dev/ocp-release - - quay.io/openshift-release-dev/ocp-v4.0-art-dev - - quay.io/openshift-release-dev/ocp-v5.0-art-dev - ``` - # disable only v5 (position 2) + 1. Scale down CVO + ```sh + oc scale deploy/cluster-version-operator -n openshift-cluster-version --replicas=0` + ``` + 2. Patch the policy + a. get current config + ```sh + $ oc get clusterimagepolicy openshift -o yaml | yq ea .spec.scopes - + - quay.io/openshift-release-dev/ocp-release + - quay.io/openshift-release-dev/ocp-v4.0-art-dev + - quay.io/openshift-release-dev/ocp-v5.0-art-dev + ``` + b. disable only v5 (position 2) + ```sh oc patch clusterimagepolicy openshift --type=json -p '[ {"op": "remove", "path": "/spec/scopes/2"} ]' - - # 3. Verify the scope is gone + ``` + 3. Verify the scope is gone + ```sh oc get clusterimagepolicy openshift -o jsonpath='{.spec.scopes}' ; echo - - # 4. Watch MCO roll out the new config to nodes + ``` + 4. Watch MCO roll out the new config to nodes + ```sh oc get mcp -w + ``` Create the hosted cluster: ```sh