L1 — Bastion & air-gap services
The services plane every cluster depends on. All kept across cluster rebuilds — they hold the images, secrets, git, and object storage.
Services
| Service | Endpoint | VM | FIPS | Role |
|---|---|---|---|---|
| Bastion | .10 (+192.168.122.61) |
ocp420-bastion | Yes | Quay mirror, DNS, NTP, root CA, /root/gitops, install dirs |
| Quay mirror registry | registry.airgap.lab:8443 |
(bastion) | Yes | All mirrored release/operator/guest images |
| MinIO | s3.airgap.lab:9000 (console :9001) |
ocp420-minio | Yes | Velero/backups, Loki, Tempo, Thanos, pgBackRest |
| GitLab CE | gitlab.airgap.lab |
ocp420-gitlab | No | Repo platform/gitops (private) |
| Vault (HA raft) | vault.airgap.lab:8200 |
ocp420-vault-0/1/2 | Yes | PKI, KMS, k8s-auth, apps/ KV |
| Vault transit | — | ocp420-vault-transit | Yes | Auto-unseal for the HA nodes |
| FreeIPA | — | ipa-0/1 | Yes | DNS + LDAP + CA |
| Jenkins / Nexus | jenkins.airgap.lab / nexus.airgap.lab |
ocp420-jenkins / -nexus | Yes | CI / artifacts |
Vault (secret backbone)
| Item | Value |
|---|---|
| Init / root token | on-host /root/vault-ha-init.json (transit: /root/vault-transit-init.json) |
| KV mount | apps/ (app secrets served to clusters via ESO) |
| PKI | pki intermediate (3y) → cert-manager ClusterIssuer vault-issuer |
| KMS | odf/ per-OSD keys (policy odf-kms, token secret ocs-kms-token) |
| k8s auth mounts | per cluster — k8s-hub, k8s-wl, k8s-wl-dr (each needs a reviewer SA) |
| CLI | no vault CLI on bastion — use HTTP API + X-Vault-Token |
Reach Vault nodes via the host (bastion has no key): ssh ze@dl385-2 'ssh root@192.168.130.21 ...'.
Registry / air-gap supply chain
- oc-mirror v2, two modes: sneakernet tar (phase1 on host → phase2 on bastion) or mirror-to-mirror direct from
dl385-2→ Quay. - Disconnected OLM:
disableAllDefaultSources, catalogcs-redhat-operator-index-v4-20. - ⚠️ The shared catalog tag is one overwrite target — every mirror run touching the catalog must use the full imageset (~30 packages) or it silently drops operators. See Operations and Gotchas.
- CNV guest images →
registry.airgap.lab:8443/containerdisks/*(~/cnv-mirror.sh).
GitLab + GitOps repo
| Item | Value |
|---|---|
| Repo | platform/gitops (private) — worktree bastion:/root/gitops |
| Argo auth | read-only deploy token (Vault apps/gitlab/argo-deploy), not a user password |
| Layout | hub/ · spoke/{base,overlays} · bootstrap/root-app.yaml · scripts/ · docs/ |
PKI / CA trust
| CA | Signs |
|---|---|
Airgap Lab root CA (offline, /root/ca) |
MinIO, Keycloak, GitLab, Vault, cert-manager/Vault-PKI leaves |
| Quay registry CA (separate, self-signed) | registry.airgap.lab |
⚠️ The cluster trust bundle (user-ca-bundle) must contain BOTH CAs — see Platform / cluster-trust and Gotchas.
GitOps vs. out-of-band
Entirely out-of-band (these are the foundation GitOps itself depends on). Vault holds every secret value; GitLab holds the GitOps repo; Quay holds the images.