Installing Che in a restricted environment on OpenShift

On an OpenShift cluster operating in a restricted network, public resources are not available.

However, deploying Che and running workspaces requires the following public resources:

  • Operator catalog

  • Container images

  • Sample projects

To make these resources available, you can replace them with their copy in a registry accessible by the OpenShift cluster.

Prerequisites
Procedure
  1. Download and execute the mirroring script to install a custom Operator catalog and mirror the related images: prepare-restricted-environment.sh.

    $ bash prepare-restricted-environment.sh \
      --devworkspace_operator_index quay.io/devfile/devworkspace-operator-index:release-digest\
      --devworkspace_operator_version "v0.25.0" \
      --prod_operator_index "registry.access.redhat.com/redhat/community-operator-index:v4.12" \
      --prod_operator_package_name "eclipse-che" \
      --prod_operator_bundle_name "eclipse-che" \
      --prod_operator_version "v7.83.0" \
      --my_registry "<my_registry>" (1)
    1 The private Docker registry where the images will be mirrored
  2. Install Che with the configuration set in the che-operator-cr-patch.yaml during the previous step:

    $ chectl server:deploy \
      --platform=openshift \
      --olm-channel stable \
      --catalog-source-name=eclipse-che-disconnected-install \
      --catalog-source-namespace=openshift-marketplace \
      --skip-devworkspace-operator \
      --che-operator-cr-patch-yaml=che-operator-cr-patch.yaml
  3. Allow incoming traffic from the Che namespace to all Pods in the user namespaces. See: Configuring network policies.