Mirrors OpenShift Container Platform release content into a registry with
oc-mirror --v2.
The component writes an ImageSetConfiguration for one OCP release and invokes
the oc-mirror v2 workflow against the configured repository URL.
Inputs
| Name | Required | Default | Description |
|---|---|---|---|
repository-url | yes | Target mirror registry repository, for example registry.example.com/ocp/mirror. | |
ocp-version | no | 4.22 | OpenShift Container Platform release version to mirror. |
architecture | no | x86_64 | Release architecture suffix. |
channel | no | stable-4.22 | OpenShift update channel included in the image set configuration. |
auth-file | no | Optional path to a containers auth file passed to oc-mirror --authfile. | |
dry-run | no | false | Generate and validate the mirror configuration without pushing images. |
oc-image | no | registry.gitlab.com/xrow-public/ci-tools/tools:main | Container image providing oc-mirror v2 and Python 3. |
Usage
Create a GitLab pipeline file .gitlab-ci.yml:
include:
- component: $CI_SERVER_FQDN/xrow-public/ci-tools/mirror-ocp@main
inputs:
repository-url: registry.example.com/ocp/mirror
ocp-version: "4.22"
The job is manual by default because an OCP release mirror can push a large
payload into the destination registry. Set dry-run: true for validation-only
test pipelines.
When repository-url points at the current project's GitLab Container Registry,
the component automatically writes a temporary registry auth file from
CI_REGISTRY_USER and CI_REGISTRY_PASSWORD.
Migration from oc-tools
Replace xrow-public/oc-tools/oc-ocp-mirror with
xrow-public/ci-tools/mirror-ocp in the include. The inputs and mirror:<name>
job name remain compatible. The default image now uses CI Tools, which includes
oc-mirror v2. Custom oc-image overrides must provide oc-mirror and Python 3.
The v2 invocation uses --authfile and a workspace under the project directory;
see the upstream oc-mirror interface.
ocp-version, channel, and architecture keep the source component defaults.
Set a complete published release version and its matching channel explicitly for
an actual mirror. Source registry credentials, network access and sufficient
workspace/destination capacity remain prerequisites. A dry run does not push
images but can still contact registries and fetch release metadata.
Generated GitLab registry credentials use a private temporary file removed on
success or failure. An explicit auth-file remains caller-owned. Only the image
set configuration is retained as a job artifact, never credentials or the mirror
workspace. Include the common component when using the CI Tools shared setup.
Validation
The internal test compiles and executes the component automatically with a local oc-mirror process fixture. It validates release selection, destination, v2 flags, and dry-run behavior without contacting a registry. Separate contract regressions exercise explicit and generated authentication, cleanup on failure, and quoting. A real CLI availability check runs before the fixture. These tests do not claim a complete OpenShift release was mirrored; the production job remains manual by default because it transfers a large payload.
Inputs
| Name | Description | Default | Type |
| --- | --- | --- | --- |
| architecture | OpenShift release architecture suffix. | x86_64 | string |
| auth-file | Optional path to a containers auth file used by oc mirror. | string | |
| channel | OpenShift update channel to include in the image set configuration. | stable-4.22 | string |
| dry-run | Generate and validate the mirror configuration without pushing images. | false | boolean |
| name | Job name suffix. | ocp-release | string |
| needs | Jobs that this job depends on. | [] | array |
| oc-image | Container image providing oc-mirror v2 and Python 3. | registry.gitlab.com/xrow-public/ci-tools/tools:main | string |
| ocp-version | OpenShift Container Platform release version to mirror. | 4.22 | string |
| repository-url | Target mirror registry repository, for example registry.example.com/ocp/mirror. | string | |
| rules | Rules controlling when the mirror job runs. | [{"when":"manual","allow_failure":false}] | array |
| stage | Pipeline stage for the mirror job. | deploy | string |
| tags | Runner tags for the mirror job. | [] | array |