Adding support tools for restricted network

day-two.md

@@ -61,6 +61,12 @@ oc patch imagepruner.imageregistry.operator.openshift.io/cluster --type merge --
 Refer to these instructions to configure chrony time service
 * [Chrony time service]
 
+### 5. [Restricted Network] - Configure support tools
+
+Refer to these instructions to configure support tools for a restricted network
+* [Support tools]
+
+
 ## License
 GPLv3
 
@@ -77,3 +83,4 @@ Kevin Chung
 [3scale operator]: ./operator/3scale/
 [automatically pruning images]: https://docs.openshift.com/container-platform/latest/applications/pruning-objects.html#pruning-images_pruning-objects
 [Chrony time service]: ./machineconfig/chrony/
+[Support tools]: ./imagecontentsourcepolicy/support-tools/

imagecontentsourcepolicy/support-tools/README.md

@@ -0,0 +1,14 @@
+# [Restricted Network] - Configure Support Tools
+
+The following must-gather and support-tools images from upstream quay.io and registry.redhat.io are not accessible from a restricted network.
+* registry.redhat.io/rhel7/support-tools
+* quay.io/openshift/origin-must-gather
+
+Configure the cluster to pull the images above from your mirror Docker repository:
+```
+# Replace '<local-registry>:<local-port>' with your own mirror Docker repository host and port
+vi support-tools-policy.yaml
+
+# Apply the ImageContentSourcePolicy, which will also reboot the nodes
+oc apply -f support-tools-policy.yaml
+```

imagecontentsourcepolicy/support-tools/support-tools-policy.yaml

@@ -0,0 +1,12 @@
+apiVersion: operator.openshift.io/v1alpha1
+kind: ImageContentSourcePolicy
+metadata:
+  name: support-tools-policy
+spec:
+  repositoryDigestMirrors:
+  - mirrors:
+    - <local-registry>:<local-port>/rhel7/support-tools
+    source: registry.redhat.io/rhel7/support-tools
+  - mirrors:
+    - <local-registry>:<local-port>/openshift/origin-must-gather
+    source: quay.io/openshift/origin-must-gather