After successfully deploying an installer-provisioned cluster, consider the following post-installation procedures.

Configuring NTP for disconnected clusters

OKD installs the chrony Network Time Protocol (NTP) service on the cluster nodes. After successfully deploying an installer-provisioned disconnected cluster, configure NTP servers on the control plane nodes, and configure worker nodes as NTP clients of the control plane nodes.

Configuring NTP for disconnected clusters

OKD nodes must agree on a date and time to run properly. When worker nodes retrieve the date and time from the NTP servers on the control plane nodes, it enables the installation and operation of clusters that are not connected to a routable network and thereby do not have access to a higher stratum NTP server.

Procedure
  1. Create a ~/control-plane-chrony.conf configuration file for the control plane nodes.

    Configuration file example
    # Use public servers from the pool.ntp.org project.
    # Please consider joining the pool (https://www.pool.ntp.org/join.html).
    
    # This file is managed by the machine config operator
    server openshift-master-0.<cluster-name>.<domain> iburst (1)
    server openshift-master-1.<cluster-name>.<domain> iburst
    server openshift-master-2.<cluster-name>.<domain> iburst
    
    stratumweight 0
    driftfile /var/lib/chrony/drift
    rtcsync
    makestep 10 3
    bindcmdaddress 127.0.0.1
    bindcmdaddress ::1
    keyfile /etc/chrony.keys
    commandkey 1
    generatecommandkey
    noclientlog
    logchange 0.5
    logdir /var/log/chrony
    
    # Configure the control plane nodes to serve as local NTP servers
    # for all worker nodes, even if they are not in sync with an
    # upstream NTP server.
    
    # Allow NTP client access from the local network.
    allow all
    # Serve time even if not synchronized to a time source.
    local stratum 3 orphan

    Where:

    1 You must replace <cluster-name> with the name of the cluster and replace <domain> with the fully qualified domain name.
  2. Create a ~/worker-chrony.conf configuration file for the worker nodes such that worker nodes reference the NTP servers on the control plane nodes.

    Configuration file example
    # This file is managed by the machine config operator
    server openshift-master-0.<cluster-name>.<domain> iburst (1)
    server openshift-master-1.<cluster-name>.<domain> iburst
    server openshift-master-2.<cluster-name>.<domain> iburst
    
    stratumweight 0
    driftfile /var/lib/chrony/drift
    rtcsync
    makestep 10 3
    bindcmdaddress 127.0.0.1
    bindcmdaddress ::1
    keyfile /etc/chrony.keys
    commandkey 1
    generatecommandkey
    noclientlog
    logchange 0.5
    logdir /var/log/chrony

    Where:

    1 You must replace <cluster-name> with the name of the cluster and replace <domain> with the fully qualified domain name.
  3. Create a ~/ntp-server.yaml configuration file for telling the Machine Configuration Operator to apply the ~/control-plane-chrony.conf settings to the NTP servers on the control plane nodes.

    Configuration file example
    # This example MachineConfig replaces ~/control-plane-chrony.conf
    apiVersion: machineconfiguration.openshift.io/v1
    kind: MachineConfig
    metadata:
      labels:
        machineconfiguration.openshift.io/role: master
      name: 99-master-etc-chrony-conf-override-to-server
    spec:
      config:
        ignition:
          version: 2.2.0
        storage:
          files:
            - contents:
                source: data:text/plain;charset=utf-8;base64,BASE64ENCODEDCONFIGFILE(1)
              filesystem: root
              mode: 0644
              path: /etc/control-plane-chrony.conf

    Where:

    1 You must replace the BASE64ENCODEDCONFIGFILE string with the base64-encoded string of the ~/control-plane-chrony.conf file in the subsequent step.
  4. Generate a base64 string of the ~/control-plane-chrony.conf file.

    $ base64 ~/control-plane-chrony.conf
    Example output
    IyBVc2UgcHVibGljIHNlcnZlcnMgZnJvbSB0aGUgcG9vbC5udHAub3JnIHByb2plY3QuCiMgUGxl
    YXNlIGNvbnNpZGVyIGpvaW5pbmcgdGhlIHBvb2wgKGh0dHBzOi8vd3d3LnBvb2wubnRwLm9yZy9q
    b2luLmh0bWwpLgoKIyBUaGlzIGZpbGUgaXMgbWFuYWdlZCBieSB0aGUgbWFjaGluZSBjb25maWcg
    b3BlcmF0b3IKc2VydmVyIG9wZW5zaGlmdC1tYXN0ZXItMC48Y2x1c3Rlci1uYW1lPi48ZG9tYWlu
    PiBpYnVyc3QKc2VydmVyIG9wZW5zaGlmdC1tYXN0ZXItMS48Y2x1c3Rlci1uYW1lPi48ZG9tYWlu
    PiBpYnVyc3QKc2VydmVyIG9wZW5zaGlmdC1tYXN0ZXItMi48Y2x1c3Rlci1uYW1lPi48ZG9tYWlu
    PiBpYnVyc3QKCnN0cmF0dW13ZWlnaHQgMApkcmlmdGZpbGUgL3Zhci9saWIvY2hyb255L2RyaWZ0
    CnJ0Y3N5bmMKbWFrZXN0ZXAgMTAgMwpiaW5kY21kYWRkcmVzcyAxMjcuMC4wLjEKYmluZGNtZGFk
    ZHJlc3MgOjoxCmtleWZpbGUgL2V0Yy9jaHJvbnkua2V5cwpjb21tYW5ka2V5IDEKZ2VuZXJhdGVj
    b21tYW5ka2V5Cm5vY2xpZW50bG9nCmxvZ2NoYW5nZSAwLjUKbG9nZGlyIC92YXIvbG9nL2Nocm9u
    eQoKIyBDb25maWd1cmUgdGhlIGNvbnRyb2wgcGxhbmUgbm9kZXMgdG8gc2VydmUgYXMgbG9jYWwg
    TlRQIHNlcnZlcnMKIyBmb3IgYWxsIHdvcmtlciBub2RlcywgZXZlbiBpZiB0aGV5IGFyZSBub3Qg
    aW4gc3luYyB3aXRoIGFuCiMgdXBzdHJlYW0gTlRQIHNlcnZlci4KCiMgQWxsb3cgTlRQIGNsaWVu
    dCBhY2Nlc3MgZnJvbSB0aGUgbG9jYWwgbmV0d29yay4KYWxsb3cgYWxsCiMgU2VydmUgdGltZSBl
    dmVuIGlmIG5vdCBzeW5jaHJvbml6ZWQgdG8gYSB0aW1lIHNvdXJjZS4KbG9jYWwgc3RyYXR1bSAz
    IG9ycGhhbgo=

    Replace the BASE64ENCODEDCONFIGFILE string in the ~/ntp-server.yaml with the base64-encoded string.

  5. Apply the ntp-server.yaml policy to the control plane nodes.

    $ oc apply -f ~/ntp-server.yaml
    Example output
    machineconfig.machineconfiguration.openshift.io/99-master-etc-chrony-conf-override-for-server created
  6. Create a ~/ntp-client.yaml configuration file for telling the Machine Configuration Operator to apply the ~/worker-chrony.conf settings to the NTP clients on the worker nodes.

    Configuration file example
    # This example MachineConfig replaces ~/worker-chrony.conf
    apiVersion: machineconfiguration.openshift.io/v1
    kind: MachineConfig
    metadata:
      labels:
        machineconfiguration.openshift.io/role: worker
      name: 99-master-etc-chrony-conf-override-for-worker
    spec:
      config:
        ignition:
          version: 2.2.0
        storage:
          files:
            - contents:
                source: data:text/plain;charset=utf-8;base64,BASE64ENCODEDCONFIGFILE(1)
              filesystem: root
              mode: 0644
              path: /etc/worker-chrony.conf

    Where:

    1 You must replace the BASE64ENCODEDCONFIGFILE string with the base64-encoded string of the ~/worker-chrony.conf file in the subsequent step.
  7. Generate a base64-encoded string of the ~/worker-chrony.conf file.

    $ base64 ~/worker-chrony.conf
    Example output
    IyBUaGlzIGZpbGUgaXMgbWFuYWdlZCBieSB0aGUgbWFjaGluZSBjb25maWcgb3BlcmF0b3IKc2Vy
    dmVyIG9wZW5zaGlmdC1tYXN0ZXItMC48Y2x1c3Rlci1uYW1lPi48ZG9tYWluPiBpYnVyc3QKc2Vy
    dmVyIG9wZW5zaGlmdC1tYXN0ZXItMS48Y2x1c3Rlci1uYW1lPi48ZG9tYWluPiBpYnVyc3QKc2Vy
    dmVyIG9wZW5zaGlmdC1tYXN0ZXItMi48Y2x1c3Rlci1uYW1lPi48ZG9tYWluPiBpYnVyc3QKCnN0
    cmF0dW13ZWlnaHQgMApkcmlmdGZpbGUgL3Zhci9saWIvY2hyb255L2RyaWZ0CnJ0Y3N5bmMKbWFr
    ZXN0ZXAgMTAgMwpiaW5kY21kYWRkcmVzcyAxMjcuMC4wLjEKYmluZGNtZGFkZHJlc3MgOjoxCmtl
    eWZpbGUgL2V0Yy9jaHJvbnkua2V5cwpjb21tYW5ka2V5IDEKZ2VuZXJhdGVjb21tYW5ka2V5Cm5v
    Y2xpZW50bG9nCmxvZ2NoYW5nZSAwLjUKbG9nZGlyIC92YXIvbG9nL2Nocm9ueQo=

    Replace the BASE64ENCODEDCONFIGFILE string in the ~/ntp-client.yaml file with the base64-encoded string.

  8. Apply the ~/ntp-client.yaml policy to the worker nodes.

    $ oc apply -f ~/worker-chrony.conf
    Example output
    machineconfig.machineconfiguration.openshift.io/99-master-etc-chrony-conf-override-for-worker created
  9. Check the status of the applied NTP settings.

    $ oc describe machineconfigpool