$ ssh-keygen -t ed25519 -N '' \
-f <path>/<file_name> (1)
In OKD version 4, you can install a customized
cluster on infrastructure that the installation program provisions on
Google Cloud Platform (GCP). To customize the installation, you modify
parameters in the install-config.yaml
file before you install the cluster.
Review details about the OKD installation and update processes.
Configure a GCP account to host the cluster.
If you use a firewall, you must configure it to allow the sites that your cluster requires access to.
If you do not allow the system to manage identity and access management (IAM), then a cluster administrator can manually create and maintain IAM credentials. Manual mode can also be used in environments where the cloud IAM APIs are not reachable.
If you want to perform installation debugging or disaster recovery on your cluster, you must provide an SSH key to both your ssh-agent
and the installation program. You can use this key to access the bootstrap machine in a public cluster to troubleshoot installation issues.
In a production environment, you require disaster recovery and debugging. |
You can use this key to SSH into the master nodes as the user core
. When you
deploy the cluster, the key is added to the core
user’s
~/.ssh/authorized_keys
list.
You must use a local key, not one that you configured with platform-specific approaches such as AWS key pairs. |
On clusters running Fedora CoreOS (FCOS), the SSH keys specified in the Ignition config files are written to the |
If you do not have an SSH key that is configured for password-less authentication on your computer, create one. For example, on a computer that uses a Linux operating system, run the following command:
$ ssh-keygen -t ed25519 -N '' \
-f <path>/<file_name> (1)
1 | Specify the path and file name, such as ~/.ssh/id_rsa , of the new SSH key. |
Running this command generates an SSH key that does not require a password in the location that you specified.
Start the ssh-agent
process as a background task:
$ eval "$(ssh-agent -s)"
Agent pid 31874
Add your SSH private key to the ssh-agent
:
$ ssh-add <path>/<file_name> (1)
Identity added: /home/<you>/<path>/<file_name> (<computer_name>)
1 | Specify the path and file name for your SSH private key, such as ~/.ssh/id_rsa |
When you install OKD, provide the SSH public key to the installation program.
Before you install OKD, download the installation file on a local computer.
You have a computer that runs Linux or macOS, with 500 MB of local disk space
Download installer from https://github.com/openshift/okd/releases
The installation program creates several files on the computer that you use to install your cluster. You must keep the installation program and the files that the installation program creates after you finish installing the cluster. Both files are required to delete the cluster. |
Deleting the files created by the installation program does not remove your cluster, even if the cluster failed during installation. To remove your cluster, complete the OKD uninstallation procedures for your specific cloud provider. |
Extract the installation program. For example, on a computer that uses a Linux operating system, run the following command:
$ tar xvf openshift-install-linux.tar.gz
From the
Pull Secret page on the Red Hat OpenShift Cluster Manager site, download your installation pull secret as a .txt
file. This pull secret allows you to authenticate with the services that
are provided by the included authorities, including Quay.io, which serves the
container images for OKD components.
If you do not use the pull secret from the Red Hat OpenShift Cluster Manager site:
Red Hat Operators are not available.
The Telemetry and Insights operators do not send data to Red Hat.
Content from the Red Hat Container Catalog registry, such as image streams and Operators, are not available.
You can customize the OKD cluster you install on Google Cloud Platform (GCP).
Obtain the OKD installation program and the pull secret for your cluster.
Create the install-config.yaml
file.
Change to the directory that contains the installation program and run the following command:
$ ./openshift-install create install-config --dir=<installation_directory> (1)
1 | For <installation_directory> , specify the directory name to store the
files that the installation program creates. |
Specify an empty directory. Some installation assets, like bootstrap X.509 certificates have short expiration intervals, so you must not reuse an installation directory. If you want to reuse individual files from another cluster installation, you can copy them into your directory. However, the file names for the installation assets might change between releases. Use caution when copying installation files from an earlier OKD version. |
At the prompts, provide the configuration details for your cloud:
Optional: Select an SSH key to use to access your cluster machines.
For production OKD clusters on which you want to perform installation debugging or disaster recovery, specify an SSH key that your |
Select gcp as the platform to target.
If you have not configured the service account key for your GCP account on your computer, you must obtain it from GCP and paste the contents of the file or enter the absolute path to the file.
Select the project ID to provision the cluster in. The default value is specified by the service account that you configured.
Select the region to deploy the cluster to.
Select the base domain to deploy the cluster to. The base domain corresponds to the public DNS zone that you created for your cluster.
Enter a descriptive name for your cluster. If you provide a name that is longer than 6 characters, only the first 6 characters will be used in the infrastructure ID that is generated from the cluster name.
Paste the pull secret that you obtained from the Pull Secret page on the Red Hat OpenShift Cluster Manager site. This field is optional.
Modify the install-config.yaml
file. You can find more information about
the available parameters in the Installation configuration parameters section.
Back up the install-config.yaml
file so that you can use
it to install multiple clusters.
The |
Before you deploy an OKD cluster, you provide parameter values to describe your account on the cloud platform that hosts your cluster and optionally customize your cluster’s platform. When you create the install-config.yaml
installation configuration file, you provide values for the required parameters through the command line. If you customize your cluster, you can modify the install-config.yaml
file to provide more details about the platform.
After installation, you cannot modify these parameters in the |
Parameter | Description | Values |
---|---|---|
|
The API version for the |
String |
|
The base domain of your cloud provider. The base domain is used to create routes to your OKD cluster components. The full DNS name for your cluster is a combination of the |
A fully-qualified domain or subdomain name, such as |
|
Kubernetes resource |
Object |
|
The name of the cluster. DNS records for the cluster are all subdomains of |
String of lowercase letters, hyphens ( |
|
The configuration for the specific platform upon which to perform the installation: |
Object |
Parameter | Description | Values | ||
---|---|---|---|---|
|
A PEM-encoded X.509 certificate bundle that is added to the nodes' trusted certificate store. This trust bundle may also be used when a proxy has been configured. |
String |
||
|
The configuration for the machines that comprise the compute nodes. |
Array of machine-pool objects. For details, see the following "Machine-pool" table. |
||
|
Determines the instruction set architecture of the machines in the pool. Currently, heteregeneous clusters are not supported, so all pools must specify the same architecture. Valid values are |
String |
||
|
Whether to enable or disable simultaneous multithreading, or
|
|
||
|
Required if you use |
|
||
|
Required if you use |
|
||
|
The number of compute machines, which are also known as worker machines, to provision. |
A positive integer greater than or equal to |
||
|
The configuration for the machines that comprise the control plane. |
Array of |
||
|
Determines the instruction set architecture of the machines in the pool. Currently, heterogeneous clusters are not supported, so all pools must specify the same architecture. Valid values are |
String |
||
|
Whether to enable or disable simultaneous multithreading, or
|
|
||
|
Required if you use |
|
||
|
Required if you use |
|
||
|
The number of control plane machines to provision. |
The only supported value is |
||
|
The Cloud Credential Operator (CCO) mode. If no mode is specified, the CCO dynamically tries to determine the capabilities of the provided credentials, with a preference for mint mode on the platforms where multiple modes are supported.
|
|
||
|
Enable or disable FIPS mode. The default is |
|
||
|
Sources and repositories for the release-image content. |
Array of objects. Includes a |
||
|
Required if you use |
String |
||
|
Specify one or more repositories that may also contain the same images. |
Array of strings |
||
|
The configuration for the pod network provider in the cluster. |
Object |
||
|
The IP address pools for pods. The default is |
Array of objects |
||
|
Required if you use |
IP network. IP networks are represented as strings using Classless Inter-Domain Routing (CIDR) notation with a traditional IP address or network number, followed by the forward slash (/) character, followed by a decimal value between 0 and 32 that describes the number of significant bits. For example, |
||
|
Required if you use |
Integer |
||
|
The IP address pools for machines. |
Array of objects |
||
|
Required if you use |
IP network. IP networks are represented as strings using Classless Inter-Domain Routing (CIDR) notation with a traditional IP address or network number, followed by the forward slash (/) character, followed by a decimal value between 0 and 32 that describes the number of significant bits. For example, |
||
|
The type of network to install. The default is |
String |
||
|
The IP address pools for services. The default is 172.30.0.0/16. |
Array of IP networks. IP networks are represented as strings using Classless Inter-Domain Routing (CIDR) notation with a traditional IP address or network number, followed by the forward slash (/) character, followed by a decimal value between 0 and 32 that describes the number of significant bits. For example, |
||
|
How to publish or expose the user-facing endpoints of your cluster, such as the Kubernetes API, OpenShift routes. |
|
||
|
The SSH key or keys to authenticate access your cluster machines.
|
One or more keys. For example:
|
Parameter | Description | Values |
---|---|---|
|
The name of the existing VPC that you want to deploy your cluster to. |
String. |
|
The GCP machine type. |
The GCP machine type. |
|
The availability zones where the installation program creates machines for the specified MachinePool. |
A list of valid GCP availability zones, such as |
|
The name of the existing subnet in your VPC that you want to deploy your control plane machines to. |
The subnet name. |
|
The name of the existing subnet in your VPC that you want to deploy your compute machines to. |
The subnet name. |
|
The name of the customer managed encryption key to be used for control plane machine disk encryption. |
The encryption key name. |
|
For control plane machines, the name of the KMS key ring to which the KMS key belongs. |
The KMS key ring name. |
|
For control plane machines, the GCP location in which the key ring exists. For more information on KMS locations, see Google’s documentation on Cloud KMS locations. |
The GCP location for the key ring. |
|
For control plane machines, the ID of the project in which the KMS key ring exists. This value defaults to the VM project ID if not set. |
The GCP project ID. |
|
The name of the customer managed encryption key to be used for compute machine disk encryption. |
The encryption key name. |
|
For compute machines, the name of the KMS key ring to which the KMS key belongs. |
The KMS key ring name. |
|
For compute machines, the GCP location in which the key ring exists. For more information on KMS locations, see Google’s documentation on Cloud KMS locations. |
The GCP location for the key ring. |
|
For compute machines, the ID of the project in which the KMS key ring exists. This value defaults to the VM project ID if not set. |
The GCP project ID. |
install-config.yaml
file for GCPYou can customize the install-config.yaml
file to specify more details about your OKD cluster’s platform or modify the values of the required parameters.
This sample YAML file is provided for reference only. You must obtain your |
apiVersion: v1
baseDomain: example.com (1)
controlPlane: (2)
hyperthreading: Enabled (3) (4)
name: master
platform:
gcp:
type: n2-standard-4
zones:
- us-central1-a
- us-central1-c
osDisk:
diskType: pd-ssd
diskSizeGB: 256
encryptionKey: (5)
kmsKey:
name: worker-key
keyRing: test-machine-keys
location: global
projectID: project-id
replicas: 3
compute: (2)
- hyperthreading: Enabled (3)
name: worker
platform:
gcp:
type: n2-standard-4
zones:
- us-central1-a
- us-central1-c
osDisk:
diskType: pd-standard
diskSizeGB: 128
encryptionKey: (5)
kmsKey:
name: worker-key
keyRing: test-machine-keys
location: global
projectID: project-id
replicas: 3
metadata:
name: test-cluster (1)
networking:
clusterNetwork:
- cidr: 10.128.0.0/14
hostPrefix: 23
machineNetwork:
- cidr: 10.0.0.0/16
networkType: OVNKubernetes
serviceNetwork:
- 172.30.0.0/16
platform:
gcp:
ProjectID: openshift-production (1)
region: us-central1 (1)
pullSecret: '{"auths": ...}' (1)
fips: false (6)
sshKey: ssh-ed25519 AAAA... (7)
1 | Required. The installation program prompts you for this value. | ||
2 | If you do not provide these parameters and values, the installation program provides the default value. | ||
3 | The controlPlane section is a single mapping, but the compute section is a sequence of mappings. To meet the requirements of the different data structures, the first line of the compute section must begin with a hyphen, - , and the first line of the controlPlane section must not. Although both sections currently define a single machine pool, it is possible that future versions of OKD will support defining multiple compute pools during installation. Only one control plane pool is used. |
||
4 | Whether to enable or disable simultaneous multithreading, or hyperthreading . By default, simultaneous multithreading is enabled to increase the performance of your machines' cores. You can disable it by setting the parameter value to Disabled . If you disable simultaneous multithreading in some cluster machines, you must disable it in all cluster machines.
|
||
5 | Optional: The custom encryption key section to encrypt both virtual machines and persistent volumes. Your default compute service account must have the permissions granted to use your KMS key and have the correct IAM role assigned. The default service account name follows the service-<project_number>@compute-system.iam.gserviceaccount.com pattern. For more information on granting the correct permissions for your service account, see "Machine management" → "Creating machine sets" → "Creating a machine set on GCP". |
||
6 | Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the Fedora CoreOS (FCOS) machines that OKD runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with FCOS instead. | ||
7 | You can optionally provide the sshKey value that you use to access the machines in your cluster.
|
You can install OKD on a compatible cloud platform.
You can run the |
Configure an account with the cloud platform that hosts your cluster.
Obtain the OKD installation program and the pull secret for your cluster.
Remove any existing GCP credentials that do not use the service account key for the GCP account that you configured for your cluster and that are stored in the following locations:
The GOOGLE_CREDENTIALS
, GOOGLE_CLOUD_KEYFILE_JSON
, or GCLOUD_KEYFILE_JSON
environment variables
The ~/.gcp/osServiceAccount.json
file
The gcloud cli
default credentials
Change to the directory that contains the installation program and initialize the cluster deployment:
$ ./openshift-install create cluster --dir=<installation_directory> \ (1)
--log-level=info (2)
1 | For <installation_directory> , specify the
location of your customized ./install-config.yaml file. |
2 | To view different installation details, specify warn , debug , or
error instead of info . |
If the cloud provider account that you configured on your host does not have sufficient permissions to deploy the cluster, the installation process stops, and the missing permissions are displayed. |
When the cluster deployment completes, directions for accessing your cluster,
including a link to its web console and credentials for the kubeadmin
user,
display in your terminal.
...
INFO Install complete!
INFO To access the cluster as the system:admin user when using 'oc', run 'export KUBECONFIG=/home/myuser/install_dir/auth/kubeconfig'
INFO Access the OpenShift web-console here: https://console-openshift-console.apps.mycluster.example.com
INFO Login to the console with user: "kubeadmin", and password: "4vYBz-Ee6gm-ymBZj-Wt5AL"
INFO Time elapsed: 36m22s
The cluster access and credential information also outputs to |
The Ignition config files that the installation program generates contain certificates that expire after 24 hours, which are then renewed at that time. If the cluster is shut down before renewing the certificates and the cluster is later restarted after the 24 hours have elapsed, the cluster automatically recovers the expired certificates. The exception is that you must manually approve the pending |
You must not delete the installation program or the files that the installation program creates. Both are required to delete the cluster. |
Optional: You can reduce the number of permissions for the service account that you used to install the cluster.
If you assigned the Owner
role to your service account, you can remove that role and replace it with the Viewer
role.
If you included the Service Account Key Admin
role,
you can remove it.
You can install the OpenShift CLI (oc
) in order to interact with OKD from a
command-line interface. You can install oc
on Linux, Windows, or macOS.
If you installed an earlier version of |
You can install the OpenShift CLI (oc
) binary on Linux by using the following procedure.
Navigate to https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/ and choose the folder for your operating system and architecture.
Download oc.tar.gz
.
Unpack the archive:
$ tar xvzf <file>
Place the oc
binary in a directory that is on your PATH
.
To check your PATH
, execute the following command:
$ echo $PATH
After you install the CLI, it is available using the oc
command:
$ oc <command>
You can install the OpenShift CLI (oc
) binary on Windows by using the following procedure.
Navigate to https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/ and choose the folder for your operating system and architecture.
Download oc.zip
.
Unzip the archive with a ZIP program.
Move the oc
binary to a directory that is on your PATH
.
To check your PATH
, open the command prompt and execute the following command:
C:\> path
After you install the CLI, it is available using the oc
command:
C:\> oc <command>
You can install the OpenShift CLI (oc
) binary on macOS by using the following procedure.
Navigate to https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/ and choose the folder for your operating system and architecture.
Download oc.tar.gz
.
Unpack and unzip the archive.
Move the oc
binary to a directory on your PATH.
To check your PATH
, open a terminal and execute the following command:
$ echo $PATH
After you install the CLI, it is available using the oc
command:
$ oc <command>
You can log in to your cluster as a default system user by exporting the cluster kubeconfig
file.
The kubeconfig
file contains information about the cluster that is used by the CLI to connect a client to the correct cluster and API server.
The file is specific to a cluster and is created during OKD installation.
You deployed an OKD cluster.
You installed the oc
CLI.
Export the kubeadmin
credentials:
$ export KUBECONFIG=<installation_directory>/auth/kubeconfig (1)
1 | For <installation_directory> , specify the path to the directory that you stored
the installation files in. |
Verify you can run oc
commands successfully using the exported configuration:
$ oc whoami
system:admin
If necessary, you can opt out of remote health reporting.