<p>I have been working on an installation of OKD on an air-gapped environment. The first major step has been mirroring the OKD images so that they can be moved over to the new environment and pulled locally. I've been following a combination of the <a href="https://docs.okd.io/latest/installing/install_config/installing-restricted-networks-preparations.html#installing-restricted-networks-preparations" rel="nofollow noreferrer">OpenShift documentation</a> and <a href="https://zhimin-wen.medium.com/airgap-disconnected-installation-of-openshift-4-2-abd7794fc7fe" rel="nofollow noreferrer">this article</a>, as well as <a href="https://rob-blackbourn.medium.com/how-to-use-cfssl-to-create-self-signed-certificates-d55f76ba5781" rel="nofollow noreferrer">this resource</a> for getting my certificates set up. I have been making slow but consistent progress.</p>
<p>However, I am now having trouble when attempting to actually mirror the files using</p>
<pre class="lang-sh prettyprint-override"><code>oc adm -a ${LOCAL_SECRET_JSON} release mirror \ 
--from=quay.io/${PRODUCT_REPO}/${RELEASE_NAME}:${OCP_RELEASE}-${ARCHITECTURE} \ 
--to=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY} \ 
--to-release-image=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY}:${OCP_RELEASE}-${ARCHITECTURE}
</code></pre>
<p>I get the following, encouraging response:</p>
<pre><code>info: Mirroring 120 images to host.okd-registry.dns:5000/ocp4/openshift4 ...
</code></pre>
<p>followed by <code>blobs:</code> and <code>manifests:</code> lines, and finally the line</p>
<pre><code>stats: shared=0 unique=7 size=105.3MiB ratio=1.00
</code></pre>
<p>I then get about 50 lines stating</p>
<pre><code>error: unable to retrieve source image quay.io/openshift-release-dev/ocp-v4.0-art-dev manifest
sha256:{some value}: unauthorized: access to the requested resource is not authorized
</code></pre>
<p>I have a quay account but I am not sure if that is required even after my research, and if it is, where or how I would log into it. I have attempted doing so using <code>oc login</code> followed by various addresses within the release structure, but if this is the solution, I may be using the wrong arguments as I have not been able to find any instructions on doing this.</p>
<p>I have also tried the command with <code>sudo</code>. I doubt that is an issue but I tried it anyway.</p>
<p>I suppose the issue could be with my certificates, but I am not sure how to determine if this is the case.</p>
<p>Any guidance or suggestions would be much appreciated.</p>

Blake Simmons
<p>It has been determined that the OKD documentation is inaccurate at the time that I am posting this answer, and was instructing readers to pull from the OCP image repository rather than the OKD repository, which apparently requires additional credentials. A bug has been logged and the documentation will hopefully be updated soon.</p>
<p>The correct environment variables and full command to mirror the images are as follows:</p>
<pre><code>LOCAL_REGISTRY=localhost:5000 (or your local domain name and port for the registry)
LOCAL_REPOSITORY=okd
LOCAL_SECRET_JSON=&lt;full path to your pull secret&gt;
OCP_RELEASE=4.5.0-0.okd-2020-10-15-235428
PRODUCT_REPO=openshift
RELEASE_NAME=okd
ARCHITECTURE=not-used-in-okd


oc adm -a ${LOCAL_SECRET_JSON} release mirror \
--from=quay.io/${PRODUCT_REPO}/${RELEASE_NAME}:${OCP_RELEASE} \
--to=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY} \
--to-release-image=${LOCAL_REGISTRY}/${LOCAL_REPOSITORY}:${OCP_RELEASE} --dry-run
</code></pre>
