Chapter 8. Installing a cluster on Google Cloud into a shared VPC

Procedure

1. Create an installation directory to store your required installation assets in:

   $ mkdir <installation_directory>

   Important

   You must create a directory. Some installation assets, such as bootstrap X.509 certificates have short expiration intervals, so you must not reuse an installation directory. If you want to reuse individual files from another cluster installation, you can copy them into your directory. However, the file names for the installation assets might change between releases. Use caution when copying installation files from an earlier OpenShift Container Platform version.

2. Customize the provided sample

   install-config.yaml

   file template and save the file in the

   <installation_directory>

   .
   Note

   You must name this configuration file

   install-config.yaml

   .

3. Back up the

   install-config.yaml

   file so that you can use it to install many clusters.
   Important

   Back up the

   install-config.yaml

   file now, because the installation process consumes the file in the next step.

Procedure

1. Edit your

   install-config.yaml

   file and add the proxy settings. For example:

   apiVersion: v1
   baseDomain: my.domain.com
   proxy:
     httpProxy: http://<username>:<pswd>@<ip>:<port> 

   1

   
     httpsProxy: https://<username>:<pswd>@<ip>:<port> 

   2

   
     noProxy: example.com 

   3

   
   additionalTrustBundle: | 

   4

   
       -----BEGIN CERTIFICATE-----
       <MY_TRUSTED_CA_CERT>
       -----END CERTIFICATE-----
   additionalTrustBundlePolicy: <policy_to_add_additionalTrustBundle> 

   5

   1

   A proxy URL to use for creating HTTP connections outside the cluster. The URL scheme must be http.

   2

   A proxy URL to use for creating HTTPS connections outside the cluster.

   3

   A comma-separated list of destination domain names, IP addresses, or other network CIDRs to exclude from proxying. Preface a domain with . to match subdomains only. For example, .y.com matches x.y.com, but not y.com. Use * to bypass the proxy for all destinations.

   4

   If provided, the installation program generates a config map that is named user-ca-bundle in the openshift-config namespace that contains one or more additional CA certificates that are required for proxying HTTPS connections. The Cluster Network Operator then creates a trusted-ca-bundle config map that merges these contents with the Red Hat Enterprise Linux CoreOS (RHCOS) trust bundle, and this config map is referenced in the trustedCA field of the Proxy object. The additionalTrustBundle field is required unless the proxy’s identity certificate is signed by an authority from the RHCOS trust bundle.

   5

   Optional: The policy to determine the configuration of the Proxy object to reference the user-ca-bundle config map in the trustedCA field. The allowed values are Proxyonly and Always. Use Proxyonly to reference the user-ca-bundle config map only when http/https proxy is configured. Use Always to always reference the user-ca-bundle config map. The default value is Proxyonly.

   Note

   The installation program does not support the proxy

   readinessEndpoints

   field.

   Note

   If the installer times out, restart and then complete the deployment by using the

   wait-for

   command of the installer. For example:

   $ ./openshift-install wait-for install-complete --log-level debug

2. Save the file and reference it when installing OpenShift Container Platform.

Procedure

1. Navigate to the OpenShift Container Platform downloads page on the Red Hat Customer Portal.
2. Select the architecture from the Product Variant drop-down list.
3. Select the appropriate version from the Version drop-down list.
4. Click Download Now next to the OpenShift v4.14 Linux Client entry and save the file.

5. Unpack the archive:

   $ tar xvf <file>

6. Place the

   oc

   binary in a directory that is on your

   PATH

   .

   To check your

   PATH

   , execute the following command:

   $ echo $PATH

Procedure

1. Navigate to the OpenShift Container Platform downloads page on the Red Hat Customer Portal.
2. Select the appropriate version from the Version drop-down list.
3. Click Download Now next to the OpenShift v4.14 Windows Client entry and save the file.
4. Unzip the archive with a ZIP program.

5. Move the

   oc

   binary to a directory that is on your

   PATH

   .

   To check your

   PATH

   , open the command prompt and execute the following command:

   C:\> path

Procedure

1. Navigate to the OpenShift Container Platform downloads page on the Red Hat Customer Portal.
2. Select the appropriate version from the Version drop-down list.

3. Click Download Now next to the OpenShift v4.14 macOS Client entry and save the file.

   Note

   For macOS arm64, choose the OpenShift v4.14 macOS arm64 Client entry.

4. Unpack and unzip the archive.

5. Move the

   oc

   binary to a directory on your PATH.

   To check your

   PATH

   , open a terminal and execute the following command:

   $ echo $PATH

Procedure

1. If you did not set the

   credentialsMode

   parameter in the

   install-config.yaml

   configuration file to

   Manual

   , modify the value as shown:

   Sample configuration file snippet

   apiVersion: v1
   baseDomain: example.com
   credentialsMode: Manual
   # ...

2. If you have not previously created installation manifest files, do so by running the following command:

   $ openshift-install create manifests --dir <installation_directory>

   where

   <installation_directory>

   is the directory in which the installation program creates files.

3. Set a

   $RELEASE_IMAGE

   variable with the release image from your installation file by running the following command:

   $ RELEASE_IMAGE=$(./openshift-install version | awk '/release image/ {print $3}')

4. Extract the list of

   CredentialsRequest

   custom resources (CRs) from the OpenShift Container Platform release image by running the following command:

   $ oc adm release extract \
     --from=$RELEASE_IMAGE \
     --credentials-requests \
     --included \

   1

   
     --install-config=<path_to_directory_with_installation_configuration>/install-config.yaml \

   2

   
     --to=<path_to_directory_for_credentials_requests> 

   3

   1

   The --included parameter includes only the manifests that your specific cluster configuration requires.

   2

   Specify the location of the install-config.yaml file.

   3

   Specify the path to the directory where you want to store the CredentialsRequest objects. If the specified directory does not exist, this command creates it.

   This command creates a YAML file for each

   CredentialsRequest

   object.

   Sample CredentialsRequest object

   apiVersion: cloudcredential.openshift.io/v1
   kind: CredentialsRequest
   metadata:
     name: <component_credentials_request>
     namespace: openshift-cloud-credential-operator
     ...
   spec:
     providerSpec:
       apiVersion: cloudcredential.openshift.io/v1
       kind: GCPProviderSpec
       predefinedRoles:
       - roles/storage.admin
       - roles/iam.serviceAccountUser
       skipServiceCheck: true
     ...

5. Create YAML files for secrets in the

   openshift-install

   manifests directory that you generated previously. The secrets must be stored using the namespace and secret name defined in the

   spec.secretRef

   for each

   CredentialsRequest

   object.

   Sample CredentialsRequest object with secrets

   apiVersion: cloudcredential.openshift.io/v1
   kind: CredentialsRequest
   metadata:
     name: <component_credentials_request>
     namespace: openshift-cloud-credential-operator
     ...
   spec:
     providerSpec:
       apiVersion: cloudcredential.openshift.io/v1
         ...
     secretRef:
       name: <component_secret>
       namespace: <component_namespace>
     ...

   Sample Secret object

   apiVersion: v1
   kind: Secret
   metadata:
     name: <component_secret>
     namespace: <component_namespace>
   data:
     service_account.json: <base64_encoded_gcp_service_account_file>