Image migration script

The migrate-images.sh script automates the process of pulling OpenIAM Docker images from the official source registry, retagging them, and pushing them to a target registry (such as a self-hosted Harbor instance). This is useful for:

• Air-gapped / offline Kubernetes environments that cannot access the internet.
• Internal enterprise registries for security compliance.
• Version-controlled image promotion between environments (dev, staging, prod).
• Disaster recovery — maintaining a local mirror of all required images.

The script interactively prompts for all credentials, auto-detects the current image tag from the live Kubernetes cluster, and automatically creates Harbor projects if they do not exist.

Prerequisites

Ensure all of the following are in place before running the script.

Software requirements

Network requirements

• Outbound HTTPS (port 443) to registry.openiam.com from the migration host
• Outbound access to hub.docker.com (port 443) for public images: busybox and hashicorp/consul-k8s-control-plane
• Inbound/outbound access to the target registry (default port 80 for Harbor HTTP, 443 for HTTPS)
• If using HTTP (insecure) for target registry — Docker daemon must be configured with insecure-registries

Credentials required

Disk space

To clean up local images after a successful migration run the following.

# Remove all pulled openiam images after migration
docker images | grep 'registry.openiam.com' | awk '{print $3}' | xargs docker rmi -f
# Check remaining disk usage
docker system df

Docker insecure registry (HTTP only)

If the target registry runs on HTTP (not HTTPS), Docker must be configured to allow insecure connections. Skip this step if using HTTPS with a valid certificate.

# Edit or create /etc/docker/daemon.json
cat > /etc/docker/daemon.json << 'EOF'
{
  "insecure-registries": ["<TARGET_REGISTRY_IP_OR_HOST>:<PORT>"]
}
EOF
# Restart Docker to apply
sudo systemctl restart docker
# Verify
docker info | grep -A5 'Insecure Registries'

Harbor target registry setup

If using Harbor as the target registry, it can be set up on the same Linux host using the harbor-setup.sh script. Harbor requires:

• Linux host (RHEL 8/9/10, Ubuntu 20.04+, or CentOS 8+)
• Docker 20.10+ and Docker Compose v2+
• Minimum 4 GB RAM, 2 vCPUs, 80 GB disk for Harbor data
• Port 80 (HTTP) or 443 (HTTPS) available — not used by another service

Image Inventory

The following 46 images are migrated by the script. This list was captured from the live Kubernetes cluster on June 2026.

Infrastructure images (openiam_infra)

Service images (openiam_service)

Public / Third-party images

Environment Variables

All credentials and settings can be pre-set as environment variables to avoid interactive prompts. This is recommended for CI/CD pipelines or automated deployments.

Usage

Interactive mode (recommended for first run)

Download the repository which contains the migration script and Harbor repository setup.

git clone https://github.com/openiam-platform/kubernetes-docker-configuration.git
cd kubernetes-docker-configuration
git checkout RC-2026.6.2

Run the script (migrate-images.sh) without any environment variables. It will prompt for all required inputs:

bash migrate-images.sh
# The script will ask for:
#   Source registry URL  (default: registry.openiam.com)
#   Source username
#   Source password      (hidden — no echo)
#   Target registry URL  (e.g. 10.1.0.10:80)
#   Target username
#   Target password      (hidden — no echo)
#   New tag              (Enter to keep same as detected source tag)

Non-interactive mode

Set environment variables before running. The script skips prompts for any pre-set variables.

export SOURCE_REGISTRY="registry.openiam.com"
export SOURCE_USER="openiam_user"
export SOURCE_PASS="openiam_password"
export TARGET_REGISTRY="10.1.0.10:80"
export TARGET_USER="admin"
export TARGET_PASS="Harbor12345"
export SOURCE_TAG="2026.5.1-prod"
export NEW_TAG="2026.6.0-prod"      # New version tag on target
# Run non-interactively (auto-confirm)
bash migrate-images.sh <<< "yes"

Mirror same version (no tag change)

To simply mirror images with the same tag (no version bump):

export NEW_TAG=""   # Leave empty — script keeps same tag
bash migrate-images.sh
# Or press Enter when prompted for new tag

Upgrading to new OpenIAM version

When OpenIAM releases a new version (e.g. 2026.6.1), simply update the NEW_TAG:

# Script auto-detects current cluster tag: 2026.5.1-prod
# Set the new version as target tag
export NEW_TAG="2026.6.0-prod"
bash migrate-images.sh <<< "yes"
# Result:
#   Pulls:  registry.openiam.com/openiam_infra/cassandra:2026.5.1-prod
#   Pushes: 10.1.0.10:80/openiam_infra/cassandra:2026.6.0-prod

How the script works

The script follows this workflow for each image:

Troubleshooting

Pull failed: unauthorized

Source registry credentials are incorrect or the account does not have pull access. Verify:

• Username and password are correct
• Account has pull permissions on registry.openiam.com
• Check with OpenIAM support if the account is active

Push failed: project does not exist

The target registry is not Harbor, or the Harbor API is not reachable. Manually create the projects:

# Manually create projects via Harbor API
for PROJECT in openiam_infra openiam_service public; do
  curl -u admin:Harbor12345 -X POST http://10.1.0.10:80/api/v2.0/projects \
    -H 'Content-Type: application/json' \
    -d "{\"project_name\": \"${PROJECT}\", \"public\": true}"
done

Push failed: server gave HTTP response to HTTPS client

Docker is trying to use HTTPS but the registry is running HTTP. Add the registry to insecure-registries in /etc/docker/daemon.json and restart Docker. See Section 2.5.

Auto tag detection not working

kubectl is not installed or not configured with the correct kubeconfig. Either:

• Install kubectl and configure it: export KUBECONFIG=/path/to/kubeconfig
• Set the SOURCE_TAG environment variable manually before running the script

No space left on device during pull

Free up disk space on the migration host. See Section 2.4 for cleanup commands. Alternatively, migrate in batches by temporarily commenting out image entries in the build_image_list function.

Quick reference

# ── First time setup ─────────────────────────────────────────
sudo bash harbor-setup.sh                    # Install Harbor
bash migrate-images.sh                       # Run migration (interactive)

# ── Check Harbor status ──────────────────────────────────────
cd /opt/harbor && docker compose ps

# ── Stop / Start Harbor ──────────────────────────────────────
cd /opt/harbor && docker compose down
cd /opt/harbor && docker compose up -d

# ── Verify images in Harbor ──────────────────────────────────
curl -s -u admin:Harbor12345 \
  http://10.1.0.10:80/api/v2.0/repositories?page_size=50 \
  | python3 -m json.tool | grep name

# ── Refresh image list from cluster ─────────────────────────
kubectl get pods -o json | python3 -c "
import json,sys; data=json.load(sys.stdin); imgs=set()
[imgs.add(c['image']) for i in data['items']
 for c in i['spec'].get('containers',[])+i['spec'].get('initContainers',[])]
[print(i) for i in sorted(imgs) if i]"

# ── Next version upgrade ─────────────────────────────────────
NEW_TAG="2026.6.0-prod" bash migrate-images.sh <<< "yes"