Cluster administration

Procedure

1. Log in to the Red Hat OpenShift Service on AWS AWS Account Dashboard, and navigate to the VPC Dashboard.
2. Click on Your VPCs and identify the name and VPC ID for the VPC containing the Red Hat OpenShift Service on AWS cluster.
3. From the VPC Dashboard, click Customer Gateway.
4. Click Create Customer Gateway and give it a meaningful name.
5. Select the routing method: Dynamic or Static.
6. If Dynamic, enter the BGP ASN in the field that appears.
7. Paste in the VPN gateway endpoint IP address.
8. Click Create.

9. If you do not already have a Virtual Private Gateway attached to the intended VPC:

   1. From the VPC Dashboard, click on Virtual Private Gateway.
   2. Click Create Virtual Private Gateway, give it a meaningful name, and click Create.
   3. Leave the default Amazon default ASN.
   4. Select the newly created gateway, click Attach to VPC, and attach it to the cluster VPC you identified earlier.

Procedure

1. From the VPC dashboard, click on Site-to-Site VPN Connections.

2. Click Create VPN Connection.

   1. Give it a meaningful name tag.
   2. Select the virtual private gateway created previously.
   3. For Customer Gateway, select Existing.
   4. Select the customer gateway device by name.
   5. If the VPN will use BGP, select Dynamic, otherwise select Static. Enter Static IP CIDRs. If there are multiple CIDRs, add each CIDR as Another Rule.
   6. Click Create.
   7. Wait for VPN status to change to Available, approximately 5 to 10 minutes.

3. Select the VPN you just created and click Download Configuration.

   1. From the dropdown list, select the vendor, platform, and version of the customer gateway device, then click Download.
   2. The Generic vendor configuration is also available for retrieving information in a plain text format.

Procedure

1. From the VPC Dashboard, click on Route Tables.

2. Select the private Route table associated with the VPC that contains your Red Hat OpenShift Service on AWS cluster.

   Note

   On some clusters, there may be more than one route table for a particular VPC. Select the private one that has a number of explicitly associated subnets.

3. Click on the Route Propagation tab.

4. In the table that appears, you should see the virtual private gateway you created previously. Check the value in the Propagate column.

   1. If Propagate is set to No, click Edit route propagation, check the Propagate checkbox next to the virtual private gateway’s name and click Save.

Procedure

1. Log in to the Red Hat OpenShift Service on AWS AWS Account Dashboard and select the correct region.
2. Select Direct Connect from the Services menu.
3. There will be one or more Virtual Interfaces waiting to be accepted, select one of them to view the Summary.
4. View the Virtual Interface type: private or public.
5. Record the Amazon side ASN value.

Procedure

1. Log in to the Red Hat OpenShift Service on AWS AWS Account Dashboard and select the correct region.
2. From the AWS region, select VPC from the Services menu.
3. Select Virtual Private Gateways from VPN Connections.
4. Click Create Virtual Private Gateway.
5. Give the Virtual Private Gateway a suitable name.
6. Select Custom ASN and enter the Amazon side ASN value gathered previously.
7. Create the Virtual Private Gateway.
8. Click the newly created Virtual Private Gateway and choose Attach to VPC from the Actions tab.
9. Select the Red Hat OpenShift Service on AWS Cluster VPC from the list, and attach the Virtual Private Gateway to the VPC.
10. From the Services menu, click Direct Connect. Choose one of the Direct Connect Virtual Interfaces from the list.
11. Acknowledge the I understand that Direct Connect port charges apply once I click Accept Connection message, then choose Accept Connection.
12. Choose to Accept the Virtual Private Gateway Connection and select the Virtual Private Gateway that was created in the previous steps.
13. Select Accept to accept the connection.
14. Repeat the previous steps if there is more than one Virtual Interface.

Procedure

1. Log in to the Red Hat OpenShift Service on AWS AWS Account Dashboard and select the correct region.
2. From the Red Hat OpenShift Service on AWS AWS Account region, select Direct Connect from the Services menu.
3. Select Direct Connect Gateways and Create Direct Connect Gateway.
4. Give the Direct Connect Gateway a suitable name.
5. In the Amazon side ASN, enter the Amazon side ASN value gathered previously.
6. Create the Direct Connect Gateway.
7. Select Direct Connect from the Services menu.
8. Select one of the Direct Connect Virtual Interfaces from the list.
9. Acknowledge the I understand that Direct Connect port charges apply once I click Accept Connection message, then choose Accept Connection.
10. Choose to Accept the Direct Connect Gateway Connection and select the Direct Connect Gateway that was created in the previous steps.
11. Click Accept to accept the connection.
12. Repeat the previous steps if there is more than one Virtual Interface.

Procedure

1. Log in to the Red Hat OpenShift Service on AWS AWS Account Dashboard and select the correct region.
2. From the Red Hat OpenShift Service on AWS AWS Account region, select Direct Connect from the Services menu.
3. Select one of the Direct Connect Virtual Interfaces from the list.
4. Check the Interface State has become Available
5. Check the Interface BGP Status has become Up.
6. Repeat this verification for any remaining Direct Connect Interfaces.

Procedure

1. Navigate to OpenShift Cluster Manager and select your cluster.
2. Under the Machine pools tab, click Add machine pool.
3. Add a Machine pool name.

4. Select a Compute node instance type from the drop-down menu. The instance type defines the vCPU and memory allocation for each compute node in the machine pool.

   Note

   You cannot change the instance type for a machine pool after the pool is created.

5. Optional: Configure autoscaling for the machine pool:

   1. Select Enable autoscaling to automatically scale the number of machines in your machine pool to meet the deployment needs.

   2. Set the minimum and maximum node count limits for autoscaling. The cluster autoscaler does not reduce or increase the machine pool node count beyond the limits that you specify.

      • If you deployed your cluster using a single availability zone, set the Minimum and maximum node count. This defines the minimum and maximum compute node limits in the availability zone.

      • If you deployed your cluster using multiple availability zones, set the Minimum nodes per zone and Maximum nodes per zone. This defines the minimum and maximum compute node limits per zone.

        Note

        Alternatively, you can set your autoscaling preferences for the machine pool after the machine pool is created.

6. If you did not enable autoscaling, select a compute node count:

   • If you deployed your cluster using a single availability zone, select a Compute node count from the drop-down menu. This defines the number of compute nodes to provision to the machine pool for the zone.
   • If you deployed your cluster using multiple availability zones, select a Compute node count (per zone) from the drop-down menu. This defines the number of compute nodes to provision to the machine pool per zone.
7. Optional: Configure Root disk size.

8. Optional: Add node labels and taints for your machine pool:

   1. Expand the Edit node labels and taints menu.
   2. Under Node labels, add Key and Value entries for your node labels.

   3. Under Taints, add Key and Value entries for your taints.

      Note

      Creating a machine pool with taints is only possible if the cluster already has at least one machine pool without a taint.

   4. For each taint, select an Effect from the drop-down menu. Available options include NoSchedule, PreferNoSchedule, and NoExecute.

      Note

      Alternatively, you can add the node labels and taints after you create the machine pool.

9. Optional: Select additional custom security groups to use for nodes in this machine pool. You must have already created the security groups and associated them with the VPC that you selected for this cluster. You cannot add or edit security groups after you create the machine pool. For more information, see the requirements for security groups in the "Additional resources" section.

10. Optional: Use Amazon EC2 Spot Instances if you want to configure your machine pool to deploy machines as non-guaranteed AWS Spot Instances:

    1. Select Use Amazon EC2 Spot Instances.

    2. Leave Use On-Demand instance price selected to use the on-demand instance price. Alternatively, select Set maximum price to define a maximum hourly price for a Spot Instance.

       For more information about Amazon EC2 Spot Instances, see the AWS documentation.

       Important

       Your Amazon EC2 Spot Instances might be interrupted at any time. Use Amazon EC2 Spot Instances only for workloads that can tolerate interruptions.

       Note

       If you select Use Amazon EC2 Spot Instances for a machine pool, you cannot disable the option after the machine pool is created.

11. Click Add machine pool to create the machine pool.

1. List the available machine pools on your cluster:

   $ rosa list machinepools --cluster=<cluster_name>

   Example output

   ID             AUTOSCALING  REPLICAS  INSTANCE TYPE  LABELS                  TAINTS    AVAILABILITY ZONES                    SPOT INSTANCES
   Default        No           3         m5.xlarge                                        us-east-1a, us-east-1b, us-east-1c    N/A
   mymachinepool  Yes          3-6       m5.xlarge      app=db, tier=backend              us-east-1a, us-east-1b, us-east-1c    No

2. Describe the information of a specific machine pool in your cluster:

   $ rosa describe machinepool --cluster=<cluster_name> --machinepool=mymachinepool

   Example output

   ID:                         mymachinepool
   Cluster ID:                 27iimopsg1mge0m81l0sqivkne2qu6dr
   Autoscaling:                Yes
   Replicas:                   3-6
   Instance type:              m5.xlarge
   Labels:                     app=db, tier=backend
   Taints:
   Availability zones:         us-east-1a, us-east-1b, us-east-1c
   Subnets:
   Spot instances:             No
   Disk size:                  300 GiB
   Security Group IDs:

3. Verify that the machine pool is included in the output and the configuration is as expected.

Procedure for cluster creation

1. From ROSA cluster wizard, navigate to Cluster settings.
2. Navigate to Machine pool step.
3. Select the desired Root disk size.
4. Select Next to continue creating your cluster.

Procedure for machine pool creation

1. Navigate to OpenShift Cluster Manager and select your cluster.
2. Navigate to Machine pool tab.
3. Click Add machine pool.
4. Select the desired Root disk size.
5. Select Add machine pool to create the machine pool.

Procedure for machine pool creation

1. Scale up the cluster by executing the following command:

   $ rosa create machinepool --cluster=<cluster_id> \1
                             --disk-size=<disk_size> 2

   1

   Specifies the ID or name of your existing OpenShift cluster.

   2

   Specifies the worker node disk size. The value can be in GB, GiB, TB, or TiB. Replace <disk_size> with a numeric value and unit, for example --disk-size=200GiB. You cannot separate the digit and the unit. No spaces are allowed.

2. Confirm new machine pool disk volume size by logging into the AWS console and find the EC2 virtual machine root volume size.

Procedure

1. From OpenShift Cluster Manager, navigate to the Cluster List page and select the cluster that contains the machine pool that you want to delete.
2. On the selected cluster, select the Machine pools tab.
3. Under the Machine pools tab, click the options menu for the machine pool that you want to delete.

4. Click Delete.

   The selected machine pool is deleted.

Procedure

1. From the ROSA CLI, run the following command:

   $ rosa delete machinepool -c=<cluster_name> <machine_pool_ID>

   Example output

   ? Are you sure you want to delete machine pool <machine_pool_ID> on cluster <cluster_name>? (y/N)

2. Enter y to delete the machine pool.

   The selected machine pool is deleted.

Procedure

1. List the machine pools in the cluster:

   $ rosa list machinepools --cluster=<cluster_name>

   Example output

   ID           AUTOSCALING  REPLICAS  INSTANCE TYPE  LABELS    TAINTS    AVAILABILITY ZONES    SPOT INSTANCES
   Default      No           2         m5.xlarge                          us-east-1a            N/A
   db-nodes-mp  No           2         m5.xlarge                          us-east-1a            No

2. Add or update the node labels for a machine pool:

   • To add or update node labels for a machine pool that does not use autoscaling, run the following command:

     $ rosa edit machinepool --cluster=<cluster_name> \
                             --replicas=<replica_count> \1
                             --labels=<key>=<value>,<key>=<value> \2
                             <machine_pool_id>

     1

     For machine pools that do not use autoscaling, you must provide a replica count when adding node labels. If you do not specify the --replicas argument, you are prompted for a replica count before the command completes. If you deployed Red Hat OpenShift Service on AWS (ROSA) using a single availability zone, the replica count defines the number of compute nodes to provision to the machine pool for the zone. If you deployed your cluster using multiple availability zones, the count defines the total number of compute nodes in the machine pool across all zones and must be a multiple of 3.

     2

     Replace <key>=<value>,<key>=<value> with a comma-delimited list of key-value pairs, for example --labels=key1=value1,key2=value2. This list overwrites any modifications made to node labels on an ongoing basis.

     The following example adds labels to the db-nodes-mp machine pool:

     $ rosa edit machinepool --cluster=mycluster --replicas=2 --labels=app=db,tier=backend db-nodes-mp

     Example output

     I: Updated machine pool 'db-nodes-mp' on cluster 'mycluster'

   • To add or update node labels for a machine pool that uses autoscaling, run the following command:

     $ rosa edit machinepool --cluster=<cluster_name> \
                             --min-replicas=<minimum_replica_count> \1
                             --max-replicas=<maximum_replica_count> \2
                             --labels=<key>=<value>,<key>=<value> \3
                             <machine_pool_id>

     1 2

     For machine pools that use autoscaling, you must provide minimum and maximum compute node replica limits. If you do not specify the arguments, you are prompted for the values before the command completes. The cluster autoscaler does not reduce or increase the machine pool node count beyond the limits that you specify. If you deployed ROSA using a single availability zone, the --min-replicas and --max-replicas arguments define the autoscaling limits in the machine pool for the zone. If you deployed your cluster using multiple availability zones, the arguments define the autoscaling limits in total across all zones and the counts must be multiples of 3.

     3

     Replace <key>=<value>,<key>=<value> with a comma-delimited list of key-value pairs, for example --labels=key1=value1,key2=value2. This list overwrites any modifications made to node labels on an ongoing basis.

     The following example adds labels to the db-nodes-mp machine pool:

     $ rosa edit machinepool --cluster=mycluster --min-replicas=2 --max-replicas=3 --labels=app=db,tier=backend db-nodes-mp

     Example output

     I: Updated machine pool 'db-nodes-mp' on cluster 'mycluster'

Verification

1. Describe the details of the machine pool with the new labels:

   $ rosa describe machinepool --cluster=<cluster_name> --machinepool=<machine-pool-name>

   Example output

   ID:                         db-nodes-mp
   Cluster ID:                 <ID_of_cluster>
   Autoscaling:                No
   Replicas:                   2
   Instance type:              m5.xlarge
   Labels:                     app=db, tier=backend
   Taints:
   Availability zones:         us-east-1a
   Subnets:
   Spot instances:             No
   Disk size:                  300 GiB
   Security Group IDs:

2. Verify that the labels are included for your machine pool in the output.

Procedure

1. Navigate to OpenShift Cluster Manager and select your cluster.
2. Under the Machine pools tab, click the options menu for the machine pool that you want to add a taint to.
3. Select Edit taints.
4. Add Key and Value entries for your taint.
5. Select an Effect for your taint from the drop-down menu. Available options include NoSchedule, PreferNoSchedule, and NoExecute.
6. Optional: Select Add taint if you want to add more taints to the machine pool.
7. Click Save to apply the taints to the machine pool.

Verification

1. Under the Machine pools tab, select > next to your machine pool to expand the view.
2. Verify that your taints are listed under Taints in the expanded view.

Procedure

1. List the machine pools in the cluster by running the following command:

   $ rosa list machinepools --cluster=<cluster_name>

2. Add or update the taints for a machine pool:

   • To add or update taints for a machine pool that does not use autoscaling, run the following command:

     $ rosa edit machinepool --cluster=<cluster_name> \
                             --replicas=<replica_count> \1
                             --taints=<key>=<value>:<effect>,<key>=<value>:<effect> \2
                             <machine_pool_id>

     1

     For machine pools that do not use autoscaling, you must provide a replica count when adding taints. If you do not specify the --replicas argument, you are prompted for a replica count before the command completes. If you deployed Red Hat OpenShift Service on AWS (ROSA) using a single availability zone, the replica count defines the number of compute nodes to provision to the machine pool for the zone. If you deployed your cluster using multiple availability zones, the count defines the total number of compute nodes in the machine pool across all zones and must be a multiple of 3.

     2

     Replace <key>=<value>:<effect>,<key>=<value>:<effect> with a key, value, and effect for each taint, for example --taints=key1=value1:NoSchedule,key2=value2:NoExecute. Available effects include NoSchedule, PreferNoSchedule, and NoExecute.This list overwrites any modifications made to node taints on an ongoing basis.

     The following example adds taints to the db-nodes-mp machine pool:

     $ rosa edit machinepool --cluster=mycluster --replicas 2 --taints=key1=value1:NoSchedule,key2=value2:NoExecute db-nodes-mp

     Example output

     I: Updated machine pool 'db-nodes-mp' on cluster 'mycluster'

   • To add or update taints for a machine pool that uses autoscaling, run the following command:

     $ rosa edit machinepool --cluster=<cluster_name> \
                             --min-replicas=<minimum_replica_count> \1
                             --max-replicas=<maximum_replica_count> \2
                             --taints=<key>=<value>:<effect>,<key>=<value>:<effect> \3
                             <machine_pool_id>

     1 2

     For machine pools that use autoscaling, you must provide minimum and maximum compute node replica limits. If you do not specify the arguments, you are prompted for the values before the command completes. The cluster autoscaler does not reduce or increase the machine pool node count beyond the limits that you specify. If you deployed ROSA using a single availability zone, the --min-replicas and --max-replicas arguments define the autoscaling limits in the machine pool for the zone. If you deployed your cluster using multiple availability zones, the arguments define the autoscaling limits in total across all zones and the counts must be multiples of 3.

     3

     Replace <key>=<value>:<effect>,<key>=<value>:<effect> with a key, value, and effect for each taint, for example --taints=key1=value1:NoSchedule,key2=value2:NoExecute. Available effects include NoSchedule, PreferNoSchedule, and NoExecute. This list overwrites any modifications made to node taints on an ongoing basis.

     The following example adds taints to the db-nodes-mp machine pool:

     $ rosa edit machinepool --cluster=mycluster --min-replicas=2 --max-replicas=3 --taints=key1=value1:NoSchedule,key2=value2:NoExecute db-nodes-mp

     Example output

     I: Updated machine pool 'db-nodes-mp' on cluster 'mycluster'

Verification

1. Describe the details of the machine pool with the new taints:

   $ rosa describe machinepool --cluster=<cluster_name> --machinepool=<machinepool_name>

   Example output

   ID:                         db-nodes-mp
   Cluster ID:                 <ID_of_cluster>
   Autoscaling:                No
   Replicas:                   2
   Instance type:              m5.xlarge
   Labels:
   Taints:                     key1=value1:NoSchedule, key2=value2:NoExecute
   Availability zones:         us-east-1a
   Subnets:
   Spot instances:             No
   Disk size:                  300 GiB
   Security Group IDs:

2. Verify that the taints are included for your machine pool in the output.

1. Determine expected container memory usage

   Determine expected mean and peak container memory usage, empirically if necessary (for example, by separate load testing). Remember to consider all the processes that may potentially run in parallel in the container: for example, does the main application spawn any ancillary scripts?

2. Determine risk appetite

   Determine risk appetite for eviction. If the risk appetite is low, the container should request memory according to the expected peak usage plus a percentage safety margin. If the risk appetite is higher, it may be more appropriate to request memory according to the expected mean usage.

3. Set container memory request

   Set container memory request based on the above. The more accurately the request represents the application memory usage, the better. If the request is too high, cluster and quota usage will be inefficient. If the request is too low, the chances of application eviction increase.

4. Set container memory limit, if required

   Set container memory limit, if required. Setting a limit has the effect of immediately killing a container process if the combined memory usage of all processes in the container exceeds the limit, and is therefore a mixed blessing. On the one hand, it may make unanticipated excess memory usage obvious early ("fail fast"); on the other hand it also terminates processes abruptly.

   Note that some Red Hat OpenShift Service on AWS clusters may require a limit value to be set; some may override the request based on the limit; and some application images rely on a limit value being set as this is easier to detect than a request value.

   If the memory limit is set, it should not be set to less than the expected peak container memory usage plus a percentage safety margin.

5. Ensure application is tuned

   Ensure application is tuned with respect to configured request and limit values, if appropriate. This step is particularly relevant to applications which pool memory, such as the JVM. The rest of this page discusses this.