Deploy in a restricted environment using GitOps

Deploy Che in a restricted network through Argo CD by mirroring the required container images to a private registry and storing the deployment manifests in an internal Git repository.

This page is for platform administrators who install, configure, and manage Che on Kubernetes clusters. To learn more about common roles and example tasks referenced in Che documentation, see Common user roles and tasks.

In a disconnected environment, the cluster cannot pull images from public registries or sync from external Git repositories. You mirror the required images to an internal registry, store the Che manifests in an internal Git repository, and let Argo CD reconcile the deployment from inside the network.

Prerequisites

You have a Kubernetes or Kubernetes cluster operating on a restricted network with administrative access.
You have mirrored the required Che container images and Operator catalogs to a private registry. See Install Che in a restricted environment on Kubernetes.
You have an ImageContentSourcePolicy or ImageDigestMirrorSet configured to redirect image pulls to your private registry.
You have Argo CD installed on the cluster. See Argo CD Getting Started.
You have an active kubectl session with administrative permissions to the cluster.
You have an internal Git repository accessible from the cluster.

Procedure

In your internal Git repository, create a directory for the Che manifests with three files: the Operator subscription, the CheCluster custom resource, and a Kustomize configuration.
Repository structure
```
<your-gitops-repo>/
└── che/
    ├── subscription.yaml
    ├── checluster.yaml
    └── kustomization.yaml
```

Create the subscription.yaml file with the namespace and Operator subscription pointing to the disconnected catalog source:

apiVersion: v1
kind: Namespace
metadata:
  name: eclipse-che
---
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: eclipse-che
  namespace: openshift-operators
spec:
  channel: stable
  installPlanApproval: Automatic
  name: eclipse-che
  source: eclipse-che-disconnected-install
  sourceNamespace: openshift-marketplace

The source field points to the disconnected catalog source created by the mirroring script.

Create the checluster.yaml file with the Che instance configuration pointing to your private registry:

apiVersion: org.eclipse.che/v2
kind: CheCluster
metadata:
  name: eclipse-che
  namespace: eclipse-che
spec:
  components:
    cheServer:
      debug: false
      logLevel: INFO
    metrics:
      enable: true
    pluginRegistry:
      openVSXURL: ""
  containerRegistry:
    hostname: <your-private-registry>
    organization: <your-registry-organization>
  devEnvironments:
    startTimeoutSeconds: 600
    defaultEditor: che-incubator/che-code/latest
    defaultNamespace:
      autoProvision: true
      template: <username>-che
    storage:
      pvcStrategy: per-user

containerRegistry.hostname: The hostname of your private container registry that holds the mirrored images.
containerRegistry.organization: The organization or project path in your private registry.
pluginRegistry.openVSXURL: Set to an empty string to disable external Open VSX access. Use an internal Open VSX instance if IDE extensions are required.
startTimeoutSeconds: Increased to 600 seconds to allow for slower image pulls from internal registries.

Create the kustomization.yaml file:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - subscription.yaml
  - checluster.yaml

Commit and push the files to your internal Git repository.

Grant the Argo CD service account the permissions required to create namespaces and install Operators:

$ kubectl apply -f - <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: argocd-cluster-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: argocd-application-controller
    namespace: argocd
EOF

Adjust the ServiceAccount name and namespace to match your Argo CD installation.

Create the Argo CD Application resource that points to your internal Git repository:

$ kubectl apply -f - <<EOF
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: che
  namespace: argocd
spec:
  project: default
  source:
    repoURL: <your-internal-git-repo-url>
    targetRevision: main
    path: che
  destination:
    server: https://kubernetes.default.svc
  syncPolicy:
    automated:
      selfHeal: true
      prune: true
    retry:
      limit: 10
      backoff:
        duration: 30s
        factor: 2
        maxDuration: 5m
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true
      - SkipDryRunOnMissingResource=true
EOF

Wait for Argo CD to sync the resources. In a restricted environment, the Operator installation takes longer because images are pulled from the internal registry.

Verification

Verify that the Argo CD Application reports Synced and Healthy:

$ kubectl get application che -n argocd \
    -o jsonpath='{.status.sync.status}{" "}{.status.health.status}'

Expected output: Synced Healthy

Verify that the CheCluster is active:

$ kubectl get checluster eclipse-che -n eclipse-che \
    -o jsonpath='{.status.chePhase}'

Expected output: Active

Retrieve the Che dashboard URL and open it in a browser:

$ kubectl get checluster eclipse-che -n eclipse-che \
    -o jsonpath='{.status.cheURL}'

Troubleshooting

Image pull errors: Verify that all required images are mirrored to your private registry and that the ImageContentSourcePolicy or ImageDigestMirrorSet is configured correctly.
Sync fails with "CheCluster CRD not found": Verify that the Argo CD Application includes SkipDryRunOnMissingResource=true in the syncOptions.
Sync retries but CheCluster is not created: The Operator may still be installing. Wait for the ClusterServiceVersion to reach Succeeded:
```
$ kubectl get csv -A | grep eclipse-che
```

Additional resources