air-gap/

flightctl-mirror-images — Air-gap Image Mirroring Tool

Enumerates all FlightCtl container images for a given deployment variant and either prints skopeo copy commands, executes them against a live registry, or packages everything into a self-contained offline bundle.

For user-facing installation documentation see:

• Installing the Flight Control service offline on Linux
• Installing the Flight Control agent offline on RHEL
• Packaging artifacts for portable media
• Setting up a local RPM repository

Quick start

# Build
make build-mirror-images

# Bundle: create a self-contained offline archive with all images + RPMs
./bin/flightctl-mirror-images --variant community-el9 \
    --bundle ~/flightctl-bundle.tar.gz \
    --bundle-rpms

# Dry-run: print all skopeo commands for review
./bin/flightctl-mirror-images --variant community-el9 \
    --dest-registry local-registry.example.com:5000

# Execute: mirror images directly to a running registry
./bin/flightctl-mirror-images --variant community-el9 \
    --dest-registry local-registry.example.com:5000 \
    --execute

# Agent-only bundle (no variant required)
./bin/flightctl-mirror-images --agent-only --bundle ~/flightctl-agent-bundle.tar.gz

Prerequisites

Flags

Variant (required unless --agent-only)

Destination (required in non-bundle mode)

Bundle mode

Available FlightCtl RPM packages

Pass multiple packages as a comma-separated list or by repeating the flag — both forms are equivalent:

# Comma-separated
--rpm-packages flightctl-services,flightctl-observability

# Repeated flag
--rpm-packages flightctl-services --rpm-packages flightctl-observability

Common combinations:

# Server with observability RPM (Prometheus + Grafana images must be mirrored separately)
./bin/flightctl-mirror-images --variant community-el9 \
    --bundle ~/flightctl-bundle.tar.gz \
    --bundle-rpms \
    --tag-override 1.2.0-rc1 \
    --rpm-packages flightctl-services,flightctl-observability

# Edge device agent + CLI only (no images)
./bin/flightctl-mirror-images \
    --agent-only \
    --bundle ~/flightctl-agent-bundle.tar.gz

Live-push / dry-run mode

Image sources

The tool reads from two sources and deduplicates:

The el9/el10 files are also consumed by packaging/rpm/flightctl.spec to drive flightctl-standalone render quadlets --config; they must remain complete. The rhel9/rhel10 files contain only the downstream registry.redhat.io equivalents for grafana and prometheus.

Code layout

scripts/air-gap/mirror-images/
├── main.go      — CLI flags, validation, workflow orchestration
├── parser.go    — YAML parsing (helm-chart-opts, images.yaml, Chart.yaml, RPM spec)
├── mirror.go    — ImagePair type, Dedup, GenerateCommands, skopeo execution
├── manifest.go  — artifact-manifest-<variant>.yaml generation
└── bundle.go    — BundleImages, DownloadRPMs, WriteImportScript,
                   WriteInstallRPMsScript, CreateArchive

Key env var overrides (for testing)

Testing

Flag validation smoke tests

make build-mirror-images

# Mutually exclusive flags
./bin/flightctl-mirror-images --variant community-el9 --bundle /tmp/x.tar.gz --execute 2>&1
./bin/flightctl-mirror-images --rpm-reposync --rpm-createrepo --agent-only --bundle /tmp/x.tar.gz 2>&1
./bin/flightctl-mirror-images --agent-only --execute --bundle /tmp/x.tar.gz 2>&1
./bin/flightctl-mirror-images --agent-only 2>&1
./bin/flightctl-mirror-images --rpm-reposync --variant community-el9 --bundle /tmp/x.tar.gz 2>&1

# Invalid variant / URL scheme
./bin/flightctl-mirror-images --variant bad --dest-registry localhost:5000 2>&1
./bin/flightctl-mirror-images --variant community-el9 --dest-registry https://localhost:5000 2>&1

Output correctness

# Image counts per variant
for v in community-el9 community-el10 rhem-el9 rhem-el10; do
    n=$(./bin/flightctl-mirror-images --variant "$v" --dest-registry localhost:5000 2>/dev/null | wc -l)
    echo "$v: $n images"
done

# Community variants must not include registry.redhat.io
for v in community-el9 community-el10; do
    hits=$(./bin/flightctl-mirror-images --variant "$v" --dest-registry localhost:5000 2>/dev/null \
           | grep -c "registry.redhat.io" || true)
    echo "$v: $hits registry.redhat.io sources (expect 0)"
done

# Docker Hub official images must use library/ namespace
hits=$(./bin/flightctl-mirror-images --variant community-el9 --dest-registry localhost:5000 2>/dev/null \
       | grep -c "library/redis" || true)
echo "library/redis entries: $hits (expect 1)"

# stdout must be clean (no log lines)
dirty=$(./bin/flightctl-mirror-images --variant community-el9 --dest-registry localhost:5000 2>/dev/null \
        | grep -cE "^\[INFO\]|^\[WARN\]|^\[ERROR\]" || true)
echo "dirty stdout lines: $dirty (expect 0)"

Fixture-based isolated test

export HELM_CHART_OPTS=scripts/air-gap/test/fixtures/helm-chart-opts.yaml
export CHART_YAML=scripts/air-gap/test/fixtures/Chart.yaml
export OBS_IMAGES_EL9=scripts/air-gap/test/fixtures/images-el9.yaml
export OBS_IMAGES_EL10=scripts/air-gap/test/fixtures/images-el10.yaml
export OBS_IMAGES_RHEL9=scripts/air-gap/test/fixtures/images-rhel9.yaml
export OBS_IMAGES_RHEL10=scripts/air-gap/test/fixtures/images-rhel10.yaml
export RPM_SPEC=/dev/null

./bin/flightctl-mirror-images --variant community-el9 --dest-registry localhost:5000

Troubleshooting