Chapter 6. Installing a cluster on Azure with customizations

Procedure

1. If you do not have an existing SSH key pair on your local machine to use for authentication onto your cluster nodes, create one. For example, on a computer that uses a Linux operating system, run the following command:

   $ ssh-keygen -t ed25519 -N '' -f <path>/<file_name> 

   1

   1

   Specify the path and file name, such as ~/.ssh/id_ed25519, of the new SSH key. If you have an existing key pair, ensure your public key is in the your ~/.ssh directory.

   Note

   If you plan to install an OpenShift Container Platform cluster that uses FIPS validated or Modules In Process cryptographic libraries on the

   x86_64

   ,

   ppc64le

   , and

   s390x

   architectures. do not create a key that uses the

   ed25519

   algorithm. Instead, create a key that uses the

   rsa

   or

   ecdsa

   algorithm.

2. View the public SSH key:

   $ cat <path>/<file_name>.pub

   For example, run the following to view the

   ~/.ssh/id_ed25519.pub

   public key:

   $ cat ~/.ssh/id_ed25519.pub

3. Add the SSH private key identity to the SSH agent for your local user, if it has not already been added. SSH agent management of the key is required for password-less SSH authentication onto your cluster nodes, or if you want to use the

   ./openshift-install gather

   command.
   Note

   On some distributions, default SSH private key identities such as

   ~/.ssh/id_rsa

   and

   ~/.ssh/id_dsa

   are managed automatically.

   1. If the

      ssh-agent

      process is not already running for your local user, start it as a background task:

      $ eval "$(ssh-agent -s)"

      Example output

      Agent pid 31874

      Note

      If your cluster is in FIPS mode, only use FIPS-compliant algorithms to generate the SSH key. The key must be either RSA or ECDSA.

4. Add your SSH private key to the

   ssh-agent

   :

   $ ssh-add <path>/<file_name> 

   1

   1

   Specify the path and file name for your SSH private key, such as ~/.ssh/id_ed25519

   Example output

   Identity added: /home/<you>/<path>/<file_name> (<computer_name>)

Procedure

1. Display all of the available OpenShift Container Platform images by running one of the following commands:

   • North America:

     $  az vm image list --all --offer rh-ocp-worker --publisher redhat -o table

     Example output

     Offer          Publisher       Sku                 Urn                                                             Version
     -------------  --------------  ------------------  --------------------------------------------------------------  --------------
     rh-ocp-worker  RedHat          rh-ocp-worker       RedHat:rh-ocp-worker:rh-ocpworker:4.8.2021122100               4.8.2021122100
     rh-ocp-worker  RedHat          rh-ocp-worker-gen1  RedHat:rh-ocp-worker:rh-ocp-worker-gen1:4.8.2021122100         4.8.2021122100

   • EMEA:

     $  az vm image list --all --offer rh-ocp-worker --publisher redhat-limited -o table

     Example output

     Offer          Publisher       Sku                 Urn                                                             Version
     -------------  --------------  ------------------  --------------------------------------------------------------  --------------
     rh-ocp-worker  redhat-limited  rh-ocp-worker       redhat-limited:rh-ocp-worker:rh-ocp-worker:4.8.2021122100       4.8.2021122100
     rh-ocp-worker  redhat-limited  rh-ocp-worker-gen1  redhat-limited:rh-ocp-worker:rh-ocp-worker-gen1:4.8.2021122100  4.8.2021122100

   Note

   Regardless of the version of OpenShift Container Platform that you install, the correct version of the Azure Marketplace image to use is 4.8. If required, your VMs are automatically upgraded as part of the installation process.

2. Inspect the image for your offer by running one of the following commands:

   • North America:

     $ az vm image show --urn redhat:rh-ocp-worker:rh-ocp-worker:<version>

   • EMEA:

     $ az vm image show --urn redhat-limited:rh-ocp-worker:rh-ocp-worker:<version>

3. Review the terms of the offer by running one of the following commands:

   • North America:

     $ az vm image terms show --urn redhat:rh-ocp-worker:rh-ocp-worker:<version>

   • EMEA:

     $ az vm image terms show --urn redhat-limited:rh-ocp-worker:rh-ocp-worker:<version>

4. Accept the terms of the offering by running one of the following commands:

   • North America:

     $ az vm image terms accept --urn redhat:rh-ocp-worker:rh-ocp-worker:<version>

   • EMEA:

     $ az vm image terms accept --urn redhat-limited:rh-ocp-worker:rh-ocp-worker:<version>

5. Record the image details of your offer. You must update the

   compute

   section in the

   install-config.yaml

   file with values for

   publisher

   ,

   offer

   ,

   sku

   , and

   version

   before deploying the cluster.

Procedure

1. Access the Infrastructure Provider page on the OpenShift Cluster Manager site. If you have a Red Hat account, log in with your credentials. If you do not, create an account.
2. Select your infrastructure provider.

3. Navigate to the page for your installation type, download the installation program that corresponds with your host operating system and architecture, and place the file in the directory where you will store the installation configuration files.

   Important

   The installation program creates several files on the computer that you use to install your cluster. You must keep the installation program and the files that the installation program creates after you finish installing the cluster. Both files are required to delete the cluster.

   Important

   Deleting the files created by the installation program does not remove your cluster, even if the cluster failed during installation. To remove your cluster, complete the OpenShift Container Platform uninstallation procedures for your specific cloud provider.

4. Extract the installation program. For example, on a computer that uses a Linux operating system, run the following command:

   $ tar -xvf openshift-install-linux.tar.gz

5. Download your installation pull secret from the Red Hat OpenShift Cluster Manager. This pull secret allows you to authenticate with the services that are provided by the included authorities, including Quay.io, which serves the container images for OpenShift Container Platform components.

Procedure

1. Create the

   install-config.yaml

   file.

   1. Change to the directory that contains the installation program and run the following command:

      $ ./openshift-install create install-config --dir <installation_directory> 

      1

      1

      For <installation_directory>, specify the directory name to store the files that the installation program creates.

      When specifying the directory:

      • Verify that the directory has the

        execute

        permission. This permission is required to run Terraform binaries under the installation directory.
      • Use an empty directory. Some installation assets, such as bootstrap X.509 certificates, have short expiration intervals, therefore you must not reuse an installation directory. If you want to reuse individual files from another cluster installation, you can copy them into your directory. However, the file names for the installation assets might change between releases. Use caution when copying installation files from an earlier OpenShift Container Platform version.

   2. At the prompts, provide the configuration details for your cloud:

      1. Optional: Select an SSH key to use to access your cluster machines.

         Note

         For production OpenShift Container Platform clusters on which you want to perform installation debugging or disaster recovery, specify an SSH key that your

         ssh-agent

         process uses.

      2. Select azure as the platform to target.

      3. If you do not have a Microsoft Azure profile stored on your computer, specify the following Azure parameter values for your subscription and service principal:

         • azure subscription id: The subscription ID to use for the cluster. Specify the

           id

           value in your account output.
         • azure tenant id: The tenant ID. Specify the

           tenantId

           value in your account output.
         • azure service principal client id: The value of the

           appId

           parameter for the service principal.
         • azure service principal client secret: The value of the

           password

           parameter for the service principal.
      4. Select the region to deploy the cluster to.
      5. Select the base domain to deploy the cluster to. The base domain corresponds to the Azure DNS Zone that you created for your cluster.

      6. Enter a descriptive name for your cluster.

         Important

         All Azure resources that are available through public endpoints are subject to resource name restrictions, and you cannot create resources that use certain terms. For a list of terms that Azure restricts, see Resolve reserved resource name errors in the Azure documentation.

      7. Paste the pull secret from the Red Hat OpenShift Cluster Manager.
2. Modify the

   install-config.yaml

   file. You can find more information about the available parameters in the "Installation configuration parameters" section.

3. Back up the

   install-config.yaml

   file so that you can use it to install multiple clusters.
   Important

   The

   install-config.yaml

   file is consumed during the installation process. If you want to reuse the file, you must back it up now.

Procedure

1. Obtain the identity of the cluster resource group used by the installer:

   1. If you specified an existing resource group in

      install-config.yaml

      , obtain its Azure identity by running the following command:

      $ az identity list --resource-group "<existing_resource_group>"

   2. If you did not specify a existing resource group in

      install-config.yaml

      , locate the resource group that the installer created, and then obtain its Azure identity by running the following commands:

      $ az group list

      $ az identity list --resource-group "<installer_created_resource_group>"

2. Grant a role assignment to the cluster resource group so that it can write to the Disk Encryption Set by running the following command:

   $ az role assignment create --role "<privileged_role>" \

   1

   
       --assignee "<resource_group_identity>" 

   2

   1

   Specifies an Azure role that has read/write permissions to the disk encryption set. You can use the Owner role or a custom role with the necessary permissions.

   2

   Specifies the identity of the cluster resource group.

3. Obtain the

   id

   of the disk encryption set you created prior to installation by running the following command:

   $ az disk-encryption-set show -n <disk_encryption_set_name> \

   1

   
        --resource-group <resource_group_name> 

   2

   1

   Specifies the name of the disk encryption set.

   2

   Specifies the resource group that contains the disk encryption set. The id is in the format of "/subscriptions/…​/resourceGroups/…​/providers/Microsoft.Compute/diskEncryptionSets/…​".

4. Obtain the identity of the cluster service principal by running the following command:

   $ az identity show -g <cluster_resource_group> \

   1

   
        -n <cluster_service_principal_name> \

   2

   
        --query principalId --out tsv

   1

   Specifies the name of the cluster resource group created by the installation program.

   2

   Specifies the name of the cluster service principal created by the installation program. The identity is in the format of 12345678-1234-1234-1234-1234567890.

5. Create a role assignment that grants the cluster service principal necessary privileges to the disk encryption set by running the following command:

   $ az role assignment create --assignee <cluster_service_principal_id> \

   1

   
        --role <privileged_role> \

   2

   
        --scope <disk_encryption_set_id> \

   3

   1

   Specifies the ID of the cluster service principal obtained in the previous step.

   2

   Specifies the Azure role name. You can use the Contributor role or a custom role with the necessary permissions.

   3

   Specifies the ID of the disk encryption set.

6. Create a storage class that uses the user-managed disk encryption set:

   1. Save the following storage class definition to a file, for example

      storage-class-definition.yaml

      :

      kind: StorageClass
      apiVersion: storage.k8s.io/v1
      metadata:
        name: managed-premium
      provisioner: kubernetes.io/azure-disk
      parameters:
        skuname: Premium_LRS
        kind: Managed
        diskEncryptionSetID: "<disk_encryption_set_ID>" 

      1

      
        resourceGroup: "<resource_group_name>" 

      2

      
      reclaimPolicy: Delete
      allowVolumeExpansion: true
      volumeBindingMode: WaitForFirstConsumer

      1

      Specifies the ID of the disk encryption set that you created in the prerequisite steps, for example "/subscriptions/xxxxxx-xxxxx-xxxxx/resourceGroups/test-encryption/providers/Microsoft.Compute/diskEncryptionSets/disk-encryption-set-xxxxxx".

      2

      Specifies the name of the resource group used by the installer. This is the same resource group from the first step.

   2. Create the storage class

      managed-premium

      from the file you created by running the following command:

      $ oc create -f storage-class-definition.yaml

7. Select the

   managed-premium

   storage class when you create persistent volumes to use encrypted storage.

Procedure

1. Navigate to the OpenShift Container Platform downloads page on the Red Hat Customer Portal.
2. Select the architecture from the Product Variant drop-down list.
3. Select the appropriate version from the Version drop-down list.
4. Click Download Now next to the OpenShift v4.12 Linux Client entry and save the file.

5. Unpack the archive:

   $ tar xvf <file>

6. Place the

   oc

   binary in a directory that is on your

   PATH

   .

   To check your

   PATH

   , execute the following command:

   $ echo $PATH

Procedure

1. Navigate to the OpenShift Container Platform downloads page on the Red Hat Customer Portal.
2. Select the appropriate version from the Version drop-down list.
3. Click Download Now next to the OpenShift v4.12 Windows Client entry and save the file.
4. Unzip the archive with a ZIP program.

5. Move the

   oc

   binary to a directory that is on your

   PATH

   .

   To check your

   PATH

   , open the command prompt and execute the following command:

   C:\> path

Procedure

1. Navigate to the OpenShift Container Platform downloads page on the Red Hat Customer Portal.
2. Select the appropriate version from the Version drop-down list.

3. Click Download Now next to the OpenShift v4.12 macOS Client entry and save the file.

   Note

   For macOS arm64, choose the OpenShift v4.12 macOS arm64 Client entry.

4. Unpack and unzip the archive.

5. Move the

   oc

   binary to a directory on your PATH.

   To check your

   PATH

   , open a terminal and execute the following command:

   $ echo $PATH

Procedure

1. Export the

   kubeadmin

   credentials:

   $ export KUBECONFIG=<installation_directory>/auth/kubeconfig 

   1

   1

   For <installation_directory>, specify the path to the directory that you stored the installation files in.

2. Verify you can run

   oc

   commands successfully using the exported configuration:

   $ oc whoami

   Example output

   system:admin