local_repo_config.yml¶

This file configures the local repository mirror on the OIM. The local_repo.yml playbook uses these settings to synchronize RHEL, third-party, and custom package repositories to the OIM via Pulp, enabling air-gapped or bandwidth-efficient deployments.

Parameter Reference¶

Parameter	Details
user_registry list / optional	List of user container registries from which additional container images can be downloaded and synchronized into the Omnia local repository. Omnia connects to the specified registries, pulls the required images, and stores them in the local repository. These images are then accessed by the cluster nodes from the local repository. Each entry supports the following fields: `host`: Registry IP and port on which the user registry is hosted. User registry can use both HTTP and HTTPS. Must be specified in the format `IP:port`. `cert_path`: Path to the SSL certificate file. Required when the registry uses HTTPS. Must point to a file with a `.crt` extension. `key_path`: Path to the SSL private key file. Required when the registry operates over HTTPS. Must reference a file with a `.key` extension. Note: User registry certificates and private keys specified in `cert_path` and `key_path` must already exist at the given locations, and these paths must be accessible from within the `omnia_core` container.
user_repo_url_x86_64 list / optional	List of x86_64 repository URLs from which software packages/images will be downloaded and accessed by the cluster. Omnia downloads the software packages from the given list of URLs and stores them into a local Pulp container. These packages are then accessed by the cluster nodes from that Pulp container. Each entry supports the following fields: `url`: The base URL for the repository. Should always point to the `repodata` directory of the repository. `gpgkey`: GPG key for the repository. If omitted, `gpgcheck=0` is set for that repository. `name`: Name of the software `.rpm` package. `sslcacert`, `sslclientkey`, `sslclientcert`: SSL certificate fields. Include these if using SSL certificates for encryption. Omit entirely if SSL is not in use. `policy`: Irrespective of the value set to `repo_config` in `/opt/omnia/input/project_default/software_config.json`, you can set a policy (`always`, `partial`) for each repository individually. To do so, add the `policy` key and provide the desired value while providing the repository URLs. If not provided, the value of `repo_config` from `software_config.json` is used as the default. `caching`: Controls the Pulp download policy together with `policy`. Allowed values: `true`, `false` (OPTIONAL). When not specified, the default is derived automatically from `repo_config` in `software_config.json`: `repo_config: always` → caching defaults to `false`; `repo_config: partial` → caching defaults to `true`. To do so, add the `caching` key and provide the desired value while providing the repository URLs. Refer to the Policy and Caching Combination Reference below for more details. Example: `- { url: "https://download.docker.com/linux/centos/9/x86_64/stable", gpgkey: "https://download.docker.com/linux/centos/gpg", name: "docker-ce-repo", sslcacert: "", sslclientkey: "", sslclientcert: "", policy: "" }` Note: All SSL related certificates must be kept in `/opt/omnia/user-repo-certs/<user_repo_name>`. The certificate files are encrypted post `local_repo.yml` playbook execution. Execute `ansible-vault decrypt <certificate_file> --vault-password-file /opt/omnia/input/project_default/.local_repo_credentials_key` to decrypt the files.
user_repo_url_aarch64 list / optional	List of aarch64 repository URLs from which software packages/images will be downloaded and accessed by the cluster. Omnia downloads the software packages from the given list of URLs and stores them into a local Pulp container. These packages are then accessed by the cluster nodes from that Pulp container. Each entry supports the same fields as `user_repo_url_x86_64`: `url`, `gpgkey`, `name`, `sslcacert`, `sslclientkey`, `sslclientcert`, `policy`, and `caching`. Example: `- { url: "https://download.docker.com/linux/centos/9/aarch64/stable", gpgkey: "https://download.docker.com/linux/centos/gpg", name: "docker-ce-repo", sslcacert: "", sslclientkey: "", sslclientcert: "", policy: "" }` Note: All SSL related certificates must be kept in `/opt/omnia/user-repo-certs/<user_repo_name>`. The certificate files are encrypted post `local_repo.yml` playbook execution. Execute `ansible-vault decrypt <certificate_file> --vault-password-file /opt/omnia/input/project_default/.local_repo_credentials_key` to decrypt the files.
rhel_os_url_x86_64 list / required	Required when `cluster_os_type` is `rhel` in `/opt/omnia/input/project_default/software_config.json` and the RHEL subscription is not registered. For RHEL systems without a subscription, the repository URLs for `codeready-builder`, `appstream`, and `baseos` are mandatory. Additional packages required for the cluster are downloaded from the provided `rhel_os_url` and stored in the Pulp container. Each entry supports the following fields: `url`: The base URL for the repository where the OS package is hosted. `gpgkey`: GPG key for the repository. If omitted, `gpgcheck=0` is set for that repository. `name`: Name of the OS package. `sslcacert`, `sslclientkey`, `sslclientcert`: SSL certificate fields. Include these if using SSL certificates for encryption. Omit entirely if SSL is not in use. `policy`: Irrespective of the value set to `repo_config` in `/opt/omnia/input/project_default/software_config.json`, you can set a policy (`always`, `partial`) for each repository individually. To do so, add the `policy` key and provide the desired value while providing the repository URLs. If not provided, the value of `repo_config` from `software_config.json` is used as the default. `caching`: Controls the Pulp download policy together with `policy`. Allowed values: `true`, `false` (OPTIONAL). When not specified, the default is derived automatically from `repo_config` in `software_config.json`: `repo_config: always` → caching defaults to `false`; `repo_config: partial` → caching defaults to `true`. To do so, add the `caching` key and provide the desired value while providing the repository URLs. Refer to the Policy and Caching Combination Reference below for more details. Example: `- { url: "http://crb.com/CRB/x86_64/os/", gpgkey: "http://crb.com/CRB/x86_64/os/RPM-GPG-KEY", sslcacert: "", sslclientkey: "", sslclientcert: "", name: "codeready-builder" }` Note: All SSL related certificates must be kept in `/opt/omnia/rhel-repo-certs/<rhel_repo_name>`. The certificate files are encrypted post `local_repo.yml` playbook execution. Execute `ansible-vault decrypt <certificate_file> --vault-password-file /opt/omnia/input/project_default/.local_repo_credentials_key` to decrypt the files.
rhel_os_url_aarch64 list / required	Required when `cluster_os_type` is `rhel` in `/opt/omnia/input/project_default/software_config.json` and the RHEL subscription is not registered. For RHEL systems without a subscription, the repository URLs for `codeready-builder`, `appstream`, and `baseos` are mandatory. Additional packages required for the cluster are downloaded from the provided `rhel_os_url` and stored in the Pulp container. Each entry supports the same fields as `rhel_os_url_x86_64`: `url`, `gpgkey`, `name`, `sslcacert`, `sslclientkey`, `sslclientcert`, `policy`, and `caching`. Example: `- { url: "http://crb.com/CRB/aarch64/os/", gpgkey: "http://crb.com/CRB/aarch64/os/RPM-GPG-KEY", sslcacert: "", sslclientkey: "", sslclientcert: "", name: "codeready-builder" }` Note: All SSL related certificates must be kept in `/opt/omnia/rhel-repo-certs/<rhel_repo_name>`. The certificate files are encrypted post `local_repo.yml` playbook execution. Execute `ansible-vault decrypt <certificate_file> --vault-password-file /opt/omnia/input/project_default/.local_repo_credentials_key` to decrypt the files.
rhel_subscription_repo_config_x86_64 list / optional	Configuration for overriding policy and caching settings for RHEL subscription-based repositories on x86_64 architecture. When subscription is enabled, this config takes precedence over dynamically generated URLs for matching repositories and adds any additional repositories. Matching is done by repository name (e.g., `x86_64_appstream`). Non-matching repositories are added as additional repos. Each entry supports the following fields: `url`: The base URL for the repository where the OS package is hosted. `gpgkey`: GPG key for the repository. If omitted, `gpgcheck=0` is set for that repository. `name`: Name of the OS package. To override any of the 3 base repos, the `name` field must match exactly: `baseos`, `appstream`, or `codeready-builder`. `policy`: Irrespective of the value set to `repo_config` in `/opt/omnia/input/project_default/software_config.json`, you can set a policy (`always`, `partial`) for each repository individually. To do so, add the `policy` key and provide the desired value while providing the repository URLs. If not provided, the value of `repo_config` from `software_config.json` is used as the default. `caching`: Controls the Pulp download policy together with `policy`. Allowed values: `true`, `false` (OPTIONAL). When not specified, the default is derived automatically from `repo_config` in `software_config.json`: `repo_config: always` → caching defaults to `false`; `repo_config: partial` → caching defaults to `true`. To do so, add the `caching` key and provide the desired value while providing the repository URLs. Refer to the Policy and Caching Combination Reference below for more details. SSL certificates are always auto-populated from RHEL subscription defaults. Note: When RHEL subscription is enabled and `repo_config: always` is set in `software_config.json`, subscription-based repositories (`baseos`, `appstream`, `codeready-builder`) will use Pulp `immediate` policy by default — all RHEL packages are downloaded and stored on OIM. To override this per repository, specify `caching: true` or `caching: false` explicitly in `rhel_subscription_repo_config_x86_64`. Examples: Override baseos with standard URL (only url and name required, certs auto-populated): `- { url: "https://cdn.redhat.com/content/dist/rhel10/10.0/x86_64/baseos/os/", name: "baseos" }` Override appstream with custom URL and policy: `- { url: "https://cdn.redhat.com/content/dist/rhel10/10.0/x86_64/appstream/os/", name: "appstream", policy: "always" }` Add supplementary repo (non-base repo, certs auto-populated): `- { url: "https://cdn.redhat.com/content/dist/rhel10/10.0/x86_64/supplementary/os/", name: "supplementary", policy: "always", caching: false }` Note: All SSL related certificates must be kept in `/opt/omnia/rhel-repo-certs/<rhel_repo_name>`. The certificate files are encrypted post `local_repo.yml` playbook execution. Execute `ansible-vault decrypt <certificate_file> --vault-password-file /opt/omnia/input/project_default/.local_repo_credentials_key` to decrypt the files.
rhel_subscription_repo_config_aarch64 list / optional	Configuration for overriding policy and caching settings for RHEL subscription-based repositories on aarch64 architecture. When subscription is enabled, this config takes precedence over dynamically generated URLs for matching repositories and adds any additional repositories. Matching is done by repository name (e.g., `aarch64_appstream`). Non-matching repositories are added as additional repos. Each entry supports the same fields as `rhel_subscription_repo_config_x86_64`: `url`, `gpgkey`, `name`, `policy`, and `caching`. SSL certificates are always auto-populated from RHEL subscription defaults. Note: When RHEL subscription is enabled and `repo_config: always` is set in `software_config.json`, subscription-based repositories (`baseos`, `appstream`, `codeready-builder`) will use Pulp `immediate` policy by default — all RHEL packages are downloaded and stored on OIM. To override this per repository, specify `caching: true` or `caching: false` explicitly in `rhel_subscription_repo_config_aarch64`. Examples: Override baseos: `- { url: "https://cdn.redhat.com/content/dist/rhel10/10.0/aarch64/baseos/os/", name: "baseos" }` Override appstream with policy: `- { url: "https://cdn.redhat.com/content/dist/rhel10/10.0/aarch64/appstream/os/", name: "appstream", policy: "always" }` Add supplementary repo: `- { url: "https://cdn.redhat.com/content/dist/rhel10/10.0/aarch64/supplementary/os/", name: "supplementary", policy: "always", caching: false }` Note: All SSL related certificates must be kept in `/opt/omnia/rhel-repo-certs/<rhel_repo_name>`. The certificate files are encrypted post `local_repo.yml` playbook execution. Execute `ansible-vault decrypt <certificate_file> --vault-password-file /opt/omnia/input/project_default/.local_repo_credentials_key` to decrypt the files.
omnia_repo_url_rhel_x86_64 list / required	List of all x86_64 repository URLs from where `.rpm` packages will be downloaded for RHEL clusters. Each entry supports the following fields: `url`: The base URL for the repository where the package is hosted. `gpgkey`: GPG key for the repository. If omitted, `gpgcheck=0` is set for that repository. `name`: Name of the software `.rpm` package. `policy`: Irrespective of the value set to `repo_config` in `/opt/omnia/input/project_default/software_config.json`, you can set a policy (`always`, `partial`) for each repository individually. To do so, add the `policy` key and provide the desired value while providing the repository URLs. If not provided, the value of `repo_config` from `software_config.json` is used as the default. `caching`: Controls the Pulp download policy together with `policy`. Allowed values: `true`, `false` (OPTIONAL). When not specified, the default is derived automatically from `repo_config` in `software_config.json`: `repo_config: always` → caching defaults to `false`; `repo_config: partial` → caching defaults to `true`. To do so, add the `caching` key and provide the desired value while providing the repository URLs. Refer to the Policy and Caching Combination Reference below for more details. Default value: `- { url: "https://download.docker.com/linux/centos/10/x86_64/stable/", gpgkey: "https://download.docker.com/linux/centos/gpg", name: "docker-ce-repo" }` `- { url: "https://dl.fedoraproject.org/pub/epel/10/Everything/x86_64/", gpgkey: "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10", name: "epel" }` Note: These inputs are not validated by Omnia. Incorrect values provided to this variable can lead to unexpected failures during Omnia's deployment. Ensure that all the listed URLs are reachable from the OIM.
omnia_repo_url_rhel_aarch64 list / required	List of all aarch64 repository URLs from where `.rpm` packages will be downloaded for RHEL clusters. Each entry supports the same fields as `omnia_repo_url_rhel_x86_64`: `url`, `gpgkey`, `name`, `policy`, and `caching`. Default value: `- { url: "https://download.docker.com/linux/centos/10/aarch64/stable/", gpgkey: "https://download.docker.com/linux/centos/gpg", name: "docker-ce" }` `- { url: "https://dl.fedoraproject.org/pub/epel/10/Everything/aarch64/", gpgkey: "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10", name: "epel" }` Note: These inputs are not validated by Omnia. Incorrect values provided to this variable can lead to unexpected failures during Omnia's deployment. Ensure that all the listed URLs are reachable from the OIM.
additional_repos_x86_64 list / optional	List of additional repository URLs for x86_64 architecture. These repos are aggregated into a single Pulp repository. Each repository entry must include: `url`: Repository base URL. `name`: Unique repository name. `gpgkey`: URL to the repository GPG key, or empty string (`""`) if you are not using GPG. Example: `- { url: "https://nginx.org/packages/rhel/9/x86_64/", gpgkey: "", name: "test-nginx" }`
additional_repos_aarch64 list / optional	List of additional repository URLs for aarch64 architecture. These repos are aggregated into a single Pulp repository. Each repository entry must include: `url`: Repository base URL. `name`: Unique repository name. `gpgkey`: URL to the repository GPG key, or empty string (`""`) if you are not using GPG. Example: `- { url: "https://nginx.org/packages/rhel/9/aarch64/", gpgkey: "", name: "test-nginx-arm" }` Note: For systems with RedHat subscription, subscription URLs override `rhel_os_url_<arch>` and are processed automatically by the `local_repo.yml` playbook.

Policy and Caching Combination Reference

The combination of policy and caching determines the effective Pulp download policy applied to the repository:

policy	caching	Pulp download policy	Behavior
`always`	`false`	`immediate`	All packages are downloaded and stored in Pulp on OIM at sync time
`always`	`true`	`on_demand`	Pulp acts as a proxy; packages are fetched from upstream on demand
`partial`	`true`	`on_demand`	Pulp acts as a proxy; packages are fetched from upstream on demand
`partial`	`false`	`streamed`	Packages are streamed on demand but not stored locally

To achieve immediate (full local download), set repo_config: always in software_config.json (or set policy: always + caching: false per repository). To achieve on_demand (proxy mode), set repo_config: partial or policy: always + caching: true.

Usage example¶

File: /opt/omnia/input/project_default/local_repo_config.yml

---
user_registry:  

user_repo_url_x86_64:
user_repo_url_aarch64:

rhel_os_url_x86_64:
rhel_os_url_aarch64:

rhel_subscription_repo_config_x86_64:
 - { url: "https://cdn.redhat.com/content/dist/rhel10/10.0/x86_64/baseos/os/", name: "baseos" }
 - { url: "https://cdn.redhat.com/content/dist/rhel10/10.0/x86_64/appstream/os/", name: "appstream", policy: "always" }
 - { url: "https://cdn.redhat.com/content/dist/rhel10/10.0/x86_64/supplementary/os/", name: "supplementary", policy: "always", caching: false }

rhel_subscription_repo_config_aarch64:

omnia_repo_url_rhel_x86_64:
  - { url: "https://download.docker.com/linux/centos/10/x86_64/stable/", gpgkey: "https://download.docker.com/linux/centos/gpg", name: "docker-ce"}
  - { url: "https://dl.fedoraproject.org/pub/epel/10/Everything/x86_64/", gpgkey: "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10", name: "epel"}
  - { url: "https://pkgs.k8s.io/core:/stable:/v1.35/rpm/", gpgkey: "https://pkgs.k8s.io/core:/stable:/v1.35/rpm/repodata/repomd.xml.key", name: "kubernetes-v1-35"}
  - { url: "https://download.opensuse.org/repositories/isv:/cri-o:/stable:/v1.35/rpm/", gpgkey: "https://download.opensuse.org/repositories/isv:/cri-o:/stable:/v1.35/rpm/repodata/repomd.xml.key", name: "cri-o-v1-35"}
  - { url: "https://linux.mellanox.com/public/repo/doca/3.2.1/rhel10/x86_64/", gpgkey: "https://linux.mellanox.com/public/repo/doca/3.2.1/rhel10/x86_64/repodata/repomd.xml.key", name: "doca"}
  - { url: "https://developer.download.nvidia.com/compute/cuda/repos/rhel10/x86_64/", gpgkey: "https://developer.download.nvidia.com/compute/cuda/repos/rhel10/x86_64/repodata/repomd.xml.key", name: "cuda"}
  - { url: "https://developer.download.nvidia.com/hpc-sdk/rhel/x86_64", gpgkey: "https://developer.download.nvidia.com/hpc-sdk/rhel/RPM-GPG-KEY-NVIDIA-HPC-SDK", name: "nvidia-hpc-sdk"}
omnia_repo_url_rhel_aarch64:
  - { url: "https://download.docker.com/linux/centos/10/aarch64/stable/", gpgkey: "https://download.docker.com/linux/centos/gpg", name: "docker-ce"}
  - { url: "https://dl.fedoraproject.org/pub/epel/10/Everything/aarch64/", gpgkey: "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-10", name: "epel"}
  - { url: "https://linux.mellanox.com/public/repo/doca/3.2.1/rhel10/arm64-sbsa/", gpgkey: "https://linux.mellanox.com/public/repo/doca/3.2.1/rhel10/arm64-sbsa/repodata/repomd.xml.key", name: "doca"}
  - { url: "https://developer.download.nvidia.com/compute/cuda/repos/rhel10/sbsa/", gpgkey: "https://developer.download.nvidia.com/compute/cuda/repos/rhel10/sbsa/repodata/repomd.xml.key", name: "cuda"}
  - { url: "https://developer.download.nvidia.com/hpc-sdk/rhel/aarch64", gpgkey: "https://developer.download.nvidia.com/hpc-sdk/rhel/RPM-GPG-KEY-NVIDIA-HPC-SDK", name: "nvidia-hpc-sdk"}

additional_repos_x86_64:
additional_repos_aarch64:

Info

Playbook Reference -- The local_repo.yml playbook.
Disk Space -- Disk space for the repository mirror.
Software Config -- Which packages are selected for installation.