This page describes how to modify your system artifacts in Google Distributed Cloud (GDC) air-gapped appliance.
Modify system artifacts in GDC to manage and refine your deployment,
Before you begin
To modify system artifacts, you must get diagnostic access and have access to the necessary identity and access roles:
- Diagnostic access is a privileged access mode required to securely support a customer when they encounter an issue. You must create a ticket to have this access granted.
- System Artifact Registry Debugger: has read and write access to all Harbor resources. Ask your Security Admin to grant you the System Artifact Registry Debugger (
sar-debugger
) cluster role. - System Artifact Registry harbor-system secret Debugger: has debugger access in the
harbor-system
namespace. Ask your Security Admin to grant you the System Artifact Registry harbor-system secret Debugger (sar-harbor-system-secret-debugger
) role.
Upload Docker images
To modify system artifacts, you must upload new Docker images. The upload method depends on which of the following two registries you push your container images to:
- Upload container images to the Artifact Registry in the bootstrap machine.
- Upload container images to the Artifact Registry in the org infrastructure cluster.
The following sections show the upload instructions for the two registry types.
Upload container image in the bootstrap machine
To upload container images to the Artifact Registry in the bootstrap machine, complete the following steps:
Ensure you have the modified Docker image with the breaking issues fixed.
Transfer the new image to the bootstrap node in your GDC environment.
Sign in to the bootstrap node.
Locate the address of the Artifact Registry in the bootstrap machine at bootstrap time and set it as the
REGISTRY_IP
environment variable:REGISTRY=$(kubectl get harborcluster harbor -n harbor-system -o=jsonpath='{.spec.externalURL}') REGISTRY_IP=${REGISTRY#https://}
Retrieve the credential for accessing the Artifact Registry. Retrieve the administrator account and password:
ADMIN_PASS=$(kubectl -n harbor-system get secret harbor-admin \ -o jsonpath="{.data.secret}" | base64 -d)
Sign in to the Artifact Registry:
docker login $REGISTRY_IP -u admin -p $ADMIN_PASS
A
Login Succeeded
message prints to verify a successful login to the Artifact Registry.Tag the new image:
docker image tag CONTAINER_IMAGE_URL \ $REGISTRY_IP/PROJECT_NAME/IMAGE_NAME:TAG
Replace the following:
CONTAINER_IMAGE_URL
: the local container image URL, such asgcr.io/repository/image:tag
.PROJECT_NAME
: the Artifact Registry project name.IMAGE_NAME
: the container image name.TAG
: the container image tag.
Push the new image to the Artifact Registry:
docker image push $REGISTRY_IP/PROJECT_NAME/IMAGE_NAME:TAG
Upload container image to the org infrastructure cluster
To upload container images to the Artifact Registry on a org infrastructure cluster, complete the following steps:
Ensure you have the modified Docker image with the breaking issues fixed.
Transfer the new image to a node that has root access with a root
kubeconfig
file to the org infrastructure cluster in your air-gapped environment.Export the org infrastructure cluster
kubeconfig
path as an environment variable:export ORG_INFRA_KUBECONFIG=KUBECONFIG_FILE_PATH
Replace
KUBECONFIG_FILE_PATH
with the path to thekubeconfig
file.Locate the in-cluster Artifact Registry address and set it as the
REGISTRY_IP
environment variable:REGISTRY=$(kubectl --kubeconfig $ORG_INFRA_KUBECONFIG get harborcluster / harbor -n harbor-system -o=jsonpath='{.spec.externalURL}') REGISTRY_IP=${REGISTRY#https://}
Ensure the
REGISTRY_IP
contains a valid URL, such as10.200.0.36:10443
:echo ${REGISTRY_IP}
Check whether the certificate authority (CA) certificate exists:
ls -al /etc/docker/certs.d/${REGISTRY_IP}/ca.crt
If the certificate does not exist, create and configure it:
mkdir -p /etc/docker/certs.d/${REGISTRY_IP}/ chmod 755 /etc/docker/certs.d/${REGISTRY_IP}/ echo $(kubectl get secret harbor-cert-secret -n istio-system -o jsonpath='{.data.ca\.crt}' --kubeconfig $ORG_INFRA_KUBECONFIG) | openssl base64 -A -d > /etc/docker/certs.d/${REGISTRY_IP}/ca.crt chmod 755 /etc/docker/certs.d/${REGISTRY_IP}/ca.crt
Retrieve the credential for accessing the Artifact Registry. Use the following command to retrieve the administrator account and password:
ADMIN_PASS=$(kubectl --kubeconfig $ORG_INFRA_KUBECONFIG \ -n harbor-system get secret harbor-admin \ -o jsonpath="{.data.secret}" | base64 -d)
Sign in to the Artifact Registry:
docker login $REGISTRY_IP -u admin -p $ADMIN_PASS
A
Login Succeeded
message prints to verify a successful login to the Artifact Registry.Tag the new image:
docker image tag CONTAINER_IMAGE_URL \ $REGISTRY_IP/PROJECT_NAME/IMAGE_NAME:TAG
Replace the following:
CONTAINER_IMAGE_URL
: the local container image URL, such asgcr.io/repository/image:tag
.PROJECT_NAME
: the Artifact Registry project name.IMAGE_NAME
: the container image name.TAG
: the container image tag.
Push the new image to the Artifact Registry:
docker image push $REGISTRY_IP/PROJECT_NAME/IMAGE_NAME:TAG
Modify system artifacts
Use the gdcloud artifacts
commands to modify system artifacts in GDC. Update, customize, and secure your deployment by performing actions like replacing software packages, adjusting configurations, and applying patches.
Perform the following actions:
- Manage
apt
packages. - Build and extract images from OCI packages.
- List available versions of the root OCI image.
- Patch existing packages.
- Pull and push OCI packages to and from a registry.
- Display the structure of an OCI bundle.
- Unpack OCI bundles.
For more information, see gdcloud artifacts
.