Chapter 2. Configuring a private cluster

Procedure

1. Review the DNS CR for your cluster by running the following command and observing the output:

   $ oc get dnses.config.openshift.io/cluster -o yaml

   Example output

   apiVersion: config.openshift.io/v1
   kind: DNS
   metadata:
     creationTimestamp: "2019-10-25T18:27:09Z"
     generation: 2
     name: cluster
     resourceVersion: "37966"
     selfLink: /apis/config.openshift.io/v1/dnses/cluster
     uid: 0e714746-f755-11f9-9cb1-02ff55d8f976
   spec:
     baseDomain: <base_domain>
     privateZone:
       tags:
         Name: <infrastructure_id>-int
         kubernetes.io/cluster/<infrastructure_id>: owned
     publicZone:
       id: Z2XXXXXXXXXXA4
   status: {}

   Note that the spec section contains both a private and a public zone.

2. Patch the DNS CR to remove the public zone by running the following command:

   $ oc patch dnses.config.openshift.io/cluster --type=merge --patch='{"spec": {"publicZone": null}}'

   Example output

   dns.config.openshift.io/cluster patched

   The Ingress Operator consults the DNS CR definition when it creates DNS records for IngressController objects. If only private zones are specified, only private records are created.

   Important

   Existing DNS records are not modified when you remove the public zone. You must manually delete previously published public DNS records if you no longer want them to be published publicly.

Procedure

1. Modify the default Ingress Controller to use only an internal endpoint:

   $ oc replace --force --wait --filename - <<EOF
   apiVersion: operator.openshift.io/v1
   kind: IngressController
   metadata:
     namespace: openshift-ingress-operator
     name: default
   spec:
     endpointPublishingStrategy:
       type: LoadBalancerService
       loadBalancer:
         scope: Internal
   EOF

   Example output

   ingresscontroller.operator.openshift.io "default" deleted
   ingresscontroller.operator.openshift.io/default replaced

   The public DNS entry is removed, and the private zone entry is updated.

Procedure

1. In the web portal or console for your cloud provider, take the following actions:

   1. Locate and delete the appropriate load balancer component:

      • For AWS, delete the external load balancer. The API DNS entry in the private zone already points to the internal load balancer, which uses an identical configuration, so you do not need to modify the internal load balancer.
      • For Azure, delete the api-internal-v4 rule for the public load balancer.
   2. For Azure, configure the Ingress Controller endpoint publishing scope to Internal. For more information, see "Configuring the Ingress Controller endpoint publishing scope to Internal".
   3. For the Azure public load balancer, if you configure the Ingress Controller endpoint publishing scope to Internal and there are no existing inbound rules in the public load balancer, you must create an outbound rule explicitly to provide outbound traffic for the backend address pool. For more information, see the Microsoft Azure documentation about adding outbound rules.
   4. Delete the api.$clustername.$yourdomain or api.$clustername DNS entry in the public zone.

2. AWS clusters: Remove the external load balancers:

   Important

   You can run the following steps only for an installer-provisioned infrastructure (IPI) cluster. For a user-provisioned infrastructure (UPI) cluster, you must manually remove or disable the external load balancers.

   • If your cluster uses a control plane machine set, delete the lines in the control plane machine set custom resource that configure your public or external load balancer:

     # ...
     providerSpec:
       value:
     # ...
         loadBalancers:
         - name: lk4pj-ext 1
           type: network 2
         - name: lk4pj-int
           type: network
     # ...

     1

     Delete the name value for the external load balancer, which ends in -ext.

     2

     Delete the type value for the external load balancer.

   • If your cluster does not use a control plane machine set, you must delete the external load balancers from each control plane machine.

     1. From your terminal, list the cluster machines by running the following command:

        $ oc get machine -n openshift-machine-api

        Example output

        NAME                            STATE     TYPE        REGION      ZONE         AGE
        lk4pj-master-0                  running   m4.xlarge   us-east-1   us-east-1a   17m
        lk4pj-master-1                  running   m4.xlarge   us-east-1   us-east-1b   17m
        lk4pj-master-2                  running   m4.xlarge   us-east-1   us-east-1a   17m
        lk4pj-worker-us-east-1a-5fzfj   running   m4.xlarge   us-east-1   us-east-1a   15m
        lk4pj-worker-us-east-1a-vbghs   running   m4.xlarge   us-east-1   us-east-1a   15m
        lk4pj-worker-us-east-1b-zgpzg   running   m4.xlarge   us-east-1   us-east-1b   15m

        The control plane machines contain master in the name.

     2. Remove the external load balancer from each control plane machine:

        1. Edit a control plane machine object to by running the following command:

           $ oc edit machines -n openshift-machine-api <control_plane_name> 1

           1

           Specify the name of the control plane machine object to modify.

        2. Remove the lines that describe the external load balancer, which are marked in the following example:

           # ...
           providerSpec:
             value:
           # ...
               loadBalancers:
               - name: lk4pj-ext 1
                 type: network 2
               - name: lk4pj-int
                 type: network
           # ...

           1

           Delete the name value for the external load balancer, which ends in -ext.

           2

           Delete the type value for the external load balancer.

        3. Save your changes and exit the object specification.
        4. Repeat this process for each of the control plane machines.