Chapter 1. Installing on AWS

Procedure

1. Identify your domain, or subdomain, and registrar. You can transfer an existing domain and registrar or obtain a new one through AWS or another source.

   Note

   If you purchase a new domain through AWS, it takes time for the relevant DNS changes to propagate. For more information about purchasing domains through AWS, see Registering Domain Names Using Amazon Route 53 in the AWS documentation.

2. If you are using an existing domain and registrar, migrate its DNS to AWS. See Making Amazon Route 53 the DNS Service for an Existing Domain in the AWS documentation.

3. Create a public hosted zone for your domain or subdomain. See Creating a Public Hosted Zone in the AWS documentation.

   Use an appropriate root domain, such as openshiftcorp.com, or subdomain, such as clusters.openshiftcorp.com.

4. Extract the new authoritative name servers from the hosted zone records. See Getting the Name Servers for a Public Hosted Zone in the AWS documentation.
5. Update the registrar records for the AWS Route53 name servers that your domain uses. For example, if you registered your domain to a Route53 service in a different accounts, see the following topic in the AWS documentation: Adding or Changing Name Servers or Glue Records.
6. If you use a subdomain, follow your company’s procedures to add its delegation records to the parent domain.

Procedure

1. Specify the IAM user name and select Programmatic access.

2. Attach the AdministratorAccess policy to ensure that the account has sufficient permission to create the cluster. This policy provides the cluster with the ability to grant credentials to each OpenShift Container Platform component. The cluster grants the components only the credentials that they require.

   Note

   While it is possible to create a policy that grants the all of the required AWS permissions and attach it to the user, this is not the preferred option. The cluster will not have the ability to grant additional credentials to individual components, so the same credentials are used by all components.

3. Optional: Add metadata to the user by attaching tags.
4. Confirm that the user name that you specified is granted the AdministratorAccess policy.

5. Record the access key ID and secret access key values. You must use these values when you configure your local machine to run the installation program.

   Important

   You cannot use a temporary session token that you generated while using a multi-factor authentication device to authenticate to AWS when you deploy a cluster. The cluster continues to use your current AWS credentials to create AWS resources for the entire life of the cluster, so you must use key-based, long-lived credentials.

Procedure

1. If you do not have an SSH key that is configured for password-less authentication on your computer, create one. For example, on a computer that uses a Linux operating system, run the following command:

   $ ssh-keygen -t rsa -b 4096 -N '' \
       -f <path>/<file_name> 1

   1

   Specify the path and file name, such as ~/.ssh/id_rsa, of the SSH key.

   Running this command generates an SSH key that does not require a password in the location that you specified.

2. Start the ssh-agent process as a background task:

   $ eval "$(ssh-agent -s)"
   
   Agent pid 31874

3. Add your SSH private key to the ssh-agent:

   $ ssh-add <path>/<file_name> 1
   
   Identity added: /home/<you>/<path>/<file_name> (<computer_name>)

   1

   Specify the path and file name for your SSH private key, such as ~/.ssh/id_rsa

Procedure

1. Access the Infrastructure Provider page on the Red Hat OpenShift Cluster Manager site. If you have a Red Hat account, log in with your credentials. If you do not, create an account.

2. Navigate to the page for your installation type, download the installation program for your operating system, and place the file in the directory where you will store the installation configuration files.

   Important

   The installation program creates several files on the computer that you use to install your cluster. You must keep both the installation program and the files that the installation program creates after you finish installing the cluster.

   Important

   Deleting the files created by the installation program does not remove your cluster, even if the cluster failed during installation. You must complete the OpenShift Container Platform uninstallation procedures outlined for your specific cloud provider to remove your cluster entirely.

3. Extract the installation program. For example, on a computer that uses a Linux operating system, run the following command:

   $ tar xvf <installation_program>.tar.gz

4. From the Pull Secret page on the Red Hat OpenShift Cluster Manager site, download your installation pull secret as a .txt file. This pull secret allows you to authenticate with the services that are provided by the included authorities, including Quay.io, which serves the container images for OpenShift Container Platform components.

Procedure

1. Run the installation program:

   $ ./openshift-install create cluster --dir=<installation_directory> \ 1
       --log-level=info 2

   1

   For <installation_directory>, specify the directory name to store the files that the installation program creates.

   2

   To view different installation details, specify warn, debug, or error instead of info.

   Important

   Specify an empty directory. Some installation assets, like bootstrap X.509 certificates have short expiration intervals, so you must not reuse an installation directory. If you want to reuse individual files from another cluster installation, you can copy them into your directory. However, the file names for the installation assets might change between releases. Use caution when copying installation files from an earlier OpenShift Container Platform version.

   Provide values at the prompts:

   1. Optional: Select an SSH key to use to access your cluster machines.

      Note

      For production OpenShift Container Platform clusters on which you want to perform installation debugging or disaster recovery on, specify an SSH key that your ssh-agent process uses.

   2. Select aws as the platform to target.
   3. If you do not have an Amazon Web Services (AWS) profile stored on your computer, enter the AWS access key ID and secret access key for the user that you configured to run the installation program.
   4. Select the AWS region to deploy the cluster to.
   5. Select the base domain for the Route53 service that you configured for your cluster.
   6. Enter a descriptive name for your cluster.
   7. Paste the pull secret that you obtained from the Pull Secret page on the Red Hat OpenShift Cluster Manager site.
   Note

   If the cloud provider account that you configured on your host does not have sufficient permissions to deploy the cluster, the installation process stops, and the missing permissions are displayed.

   When the cluster deployment completes, directions for accessing your cluster, including a link to its web console and credentials for the kubeadmin user, display in your terminal.

   Important

   The Ignition config files that the installation program generates contain certificates that expire after 24 hours. You must keep the cluster running for 24 hours in a non-degraded state to ensure that the first certificate rotation has finished.

   Important

   You must not delete the installation program or the files that the installation program creates. Both are required to delete the cluster.

2. Optional: Remove or disable the AdministratorAccess policy from the IAM account that you used to install the cluster.

Procedure

1. Export the kubeadmin credentials:

   $ export KUBECONFIG=<installation_directory>/auth/kubeconfig 1

   1

   For <installation_directory>, specify the path to the directory that you stored the installation files in.

2. Verify you can run oc commands successfully using the exported configuration:

   $ oc whoami
   system:admin

Procedure

1. If you do not have an SSH key that is configured for password-less authentication on your computer, create one. For example, on a computer that uses a Linux operating system, run the following command:

   $ ssh-keygen -t rsa -b 4096 -N '' \
       -f <path>/<file_name> 1

   1

   Specify the path and file name, such as ~/.ssh/id_rsa, of the SSH key.

   Running this command generates an SSH key that does not require a password in the location that you specified.

2. Start the ssh-agent process as a background task:

   $ eval "$(ssh-agent -s)"
   
   Agent pid 31874

3. Add your SSH private key to the ssh-agent:

   $ ssh-add <path>/<file_name> 1
   
   Identity added: /home/<you>/<path>/<file_name> (<computer_name>)

   1

   Specify the path and file name for your SSH private key, such as ~/.ssh/id_rsa

Procedure

1. Access the Infrastructure Provider page on the Red Hat OpenShift Cluster Manager site. If you have a Red Hat account, log in with your credentials. If you do not, create an account.

2. Navigate to the page for your installation type, download the installation program for your operating system, and place the file in the directory where you will store the installation configuration files.

   Important

   The installation program creates several files on the computer that you use to install your cluster. You must keep both the installation program and the files that the installation program creates after you finish installing the cluster.

   Important

   Deleting the files created by the installation program does not remove your cluster, even if the cluster failed during installation. You must complete the OpenShift Container Platform uninstallation procedures outlined for your specific cloud provider to remove your cluster entirely.

3. Extract the installation program. For example, on a computer that uses a Linux operating system, run the following command:

   $ tar xvf <installation_program>.tar.gz

4. From the Pull Secret page on the Red Hat OpenShift Cluster Manager site, download your installation pull secret as a .txt file. This pull secret allows you to authenticate with the services that are provided by the included authorities, including Quay.io, which serves the container images for OpenShift Container Platform components.

Procedure

1. Create the install-config.yaml file.

   1. Run the following command:

      $ ./openshift-install create install-config --dir=<installation_directory> 1

      1

      For <installation_directory>, specify the directory name to store the files that the installation program creates.

      Important

      Specify an empty directory. Some installation assets, like bootstrap X.509 certificates have short expiration intervals, so you must not reuse an installation directory. If you want to reuse individual files from another cluster installation, you can copy them into your directory. However, the file names for the installation assets might change between releases. Use caution when copying installation files from an earlier OpenShift Container Platform version.

   2. At the prompts, provide the configuration details for your cloud:

      1. Optional: Select an SSH key to use to access your cluster machines.

         Note

         For production OpenShift Container Platform clusters on which you want to perform installation debugging or disaster recovery on, specify an SSH key that your ssh-agent process uses.

      2. Select AWS as the platform to target.
      3. If you do not have an Amazon Web Services (AWS) profile stored on your computer, enter the AWS access key ID and secret access key for the user that you configured to run the installation program.
      4. Select the AWS region to deploy the cluster to.
      5. Select the base domain for the Route53 service that you configured for your cluster.
      6. Enter a descriptive name for your cluster.
      7. Paste the pull secret that you obtained from the Pull Secret page on the Red Hat OpenShift Cluster Manager site.
2. Modify the install-config.yaml file. You can find more information about the available parameters in the Installation configuration parameters section.

3. Back up the install-config.yaml file so that you can use it to install multiple clusters.

   Important

   The install-config.yaml file is consumed during the installation process. If you want to reuse the file, you must back it up now.

Procedure

1. Run the installation program:

   $ ./openshift-install create cluster --dir=<installation_directory> \ 1
       --log-level=info 2

   1

   For <installation_directory>, specify the location of your customized ./install-config.yaml file. directory name to store the files that the installation program creates.

   2

   To view different installation details, specify warn, debug, or error instead of info.

   Important

   Specify an empty directory. Some installation assets, like bootstrap X.509 certificates have short expiration intervals, so you must not reuse an installation directory. If you want to reuse individual files from another cluster installation, you can copy them into your directory. However, the file names for the installation assets might change between releases. Use caution when copying installation files from an earlier OpenShift Container Platform version.

   Provide values at the prompts:

   1. Optional: Select an SSH key to use to access your cluster machines.

      Note

      For production OpenShift Container Platform clusters on which you want to perform installation debugging or disaster recovery on, specify an SSH key that your ssh-agent process uses.

   2. Select aws as the platform to target.
   3. If you do not have an Amazon Web Services (AWS) profile stored on your computer, enter the AWS access key ID and secret access key for the user that you configured to run the installation program.
   4. Select the AWS region to deploy the cluster to.
   5. Select the base domain for the Route53 service that you configured for your cluster.
   6. Enter a descriptive name for your cluster.
   7. Paste the pull secret that you obtained from the Pull Secret page on the Red Hat OpenShift Cluster Manager site.
   Note

   If the cloud provider account that you configured on your host does not have sufficient permissions to deploy the cluster, the installation process stops, and the missing permissions are displayed.

   When the cluster deployment completes, directions for accessing your cluster, including a link to its web console and credentials for the kubeadmin user, display in your terminal.

   Important

   The Ignition config files that the installation program generates contain certificates that expire after 24 hours. You must keep the cluster running for 24 hours in a non-degraded state to ensure that the first certificate rotation has finished.

   Important

   You must not delete the installation program or the files that the installation program creates. Both are required to delete the cluster.

2. Optional: Remove or disable the AdministratorAccess policy from the IAM account that you used to install the cluster.

Procedure

1. Export the kubeadmin credentials:

   $ export KUBECONFIG=<installation_directory>/auth/kubeconfig 1

   1

   For <installation_directory>, specify the path to the directory that you stored the installation files in.

2. Verify you can run oc commands successfully using the exported configuration:

   $ oc whoami
   system:admin

Procedure

1. If you do not have an SSH key that is configured for password-less authentication on your computer, create one. For example, on a computer that uses a Linux operating system, run the following command:

   $ ssh-keygen -t rsa -b 4096 -N '' \
       -f <path>/<file_name> 1

   1

   Specify the path and file name, such as ~/.ssh/id_rsa, of the SSH key.

   Running this command generates an SSH key that does not require a password in the location that you specified.

2. Start the ssh-agent process as a background task:

   $ eval "$(ssh-agent -s)"
   
   Agent pid 31874

3. Add your SSH private key to the ssh-agent:

   $ ssh-add <path>/<file_name> 1
   
   Identity added: /home/<you>/<path>/<file_name> (<computer_name>)

   1

   Specify the path and file name for your SSH private key, such as ~/.ssh/id_rsa

Procedure

1. Access the Infrastructure Provider page on the Red Hat OpenShift Cluster Manager site. If you have a Red Hat account, log in with your credentials. If you do not, create an account.

2. Navigate to the page for your installation type, download the installation program for your operating system, and place the file in the directory where you will store the installation configuration files.

   Important

   The installation program creates several files on the computer that you use to install your cluster. You must keep both the installation program and the files that the installation program creates after you finish installing the cluster.

   Important

   Deleting the files created by the installation program does not remove your cluster, even if the cluster failed during installation. You must complete the OpenShift Container Platform uninstallation procedures outlined for your specific cloud provider to remove your cluster entirely.

3. Extract the installation program. For example, on a computer that uses a Linux operating system, run the following command:

   $ tar xvf <installation_program>.tar.gz

4. From the Pull Secret page on the Red Hat OpenShift Cluster Manager site, download your installation pull secret as a .txt file. This pull secret allows you to authenticate with the services that are provided by the included authorities, including Quay.io, which serves the container images for OpenShift Container Platform components.

Procedure

1. Create the install-config.yaml file.

   1. Run the following command:

      $ ./openshift-install create install-config --dir=<installation_directory> 1

      1

      For <installation_directory>, specify the directory name to store the files that the installation program creates.

      Important

      Specify an empty directory. Some installation assets, like bootstrap X.509 certificates have short expiration intervals, so you must not reuse an installation directory. If you want to reuse individual files from another cluster installation, you can copy them into your directory. However, the file names for the installation assets might change between releases. Use caution when copying installation files from an earlier OpenShift Container Platform version.

   2. At the prompts, provide the configuration details for your cloud:

      1. Optional: Select an SSH key to use to access your cluster machines.

         Note

         For production OpenShift Container Platform clusters on which you want to perform installation debugging or disaster recovery on, specify an SSH key that your ssh-agent process uses.

      2. Select AWS as the platform to target.
      3. If you do not have an Amazon Web Services (AWS) profile stored on your computer, enter the AWS access key ID and secret access key for the user that you configured to run the installation program.
      4. Select the AWS region to deploy the cluster to.
      5. Select the base domain for the Route53 service that you configured for your cluster.
      6. Enter a descriptive name for your cluster.
      7. Paste the pull secret that you obtained from the Pull Secret page on the Red Hat OpenShift Cluster Manager site.
2. Modify the install-config.yaml file. You can find more information about the available parameters in the Installation configuration parameters section.

3. Back up the install-config.yaml file so that you can use it to install multiple clusters.

   Important

   The install-config.yaml file is consumed during the installation process. If you want to reuse the file, you must back it up now.

Procedure

1. Use the following command to create manifests:

   $ ./openshift-install create manifests --dir=<installation_directory> 1

   1

   For <installation_directory>, specify the name of the directory that contains the install-config.yaml file for your cluster.

2. Modify the <installation_directory>/manifests/cluster-scheduler-02-config.yml Kubernetes manifest file to prevent Pods from being scheduled on the control plane machines:

   1. Open the manifests/cluster-scheduler-02-config.yml file.
   2. Locate the mastersSchedulable parameter and set its value to False.
   3. Save and exit the file.
   Note

   Currently, due to a Kubernetes limitation, router Pods running on control plane machines will not be reachable by the ingress load balancer.

3. Create a file that is named cluster-network-03-config.yml in the <installation_directory>/manifests/ directory:

   $ touch <installation_directory>/manifests/cluster-network-03-config.yml 1

   1

   For <installation_directory>, specify the directory name that contains the manifests/ directory for your cluster.

   After creating the file, several network configuration files are in the manifests/ directory, as shown:

   $ ls <installation_directory>/manifests/cluster-network-*
   cluster-network-01-crd.yml
   cluster-network-02-config.yml
   cluster-network-03-config.yml

4. Open the cluster-network-03-config.yml file in an editor and enter a CR that describes the Operator configuration you want:

   apiVersion: operator.openshift.io/v1
   kind: Network
   metadata:
     name: cluster
   spec: 1
     clusterNetwork:
     - cidr: 10.128.0.0/14
       hostPrefix: 23
     serviceNetwork:
     - 172.30.0.0/16
     defaultNetwork:
       type: OpenShiftSDN
       openshiftSDNConfig:
         mode: NetworkPolicy
         mtu: 1450
         vxlanPort: 4789

   1

   The parameters for the spec parameter are only an example. Specify your configuration for the Cluster Network Operator in the CR.

   The CNO provides default values for the parameters in the CR, so you must specify only the parameters that you want to change.

5. Save the cluster-network-03-config.yml file and quit the text editor.
6. Optional: Back up the manifests/cluster-network-03-config.yml file. The installation program deletes the manifests/ directory when creating the cluster.

Procedure

1. Run the installation program:

   $ ./openshift-install create cluster --dir=<installation_directory> \ 1
       --log-level=info 2

   1

   For <installation_directory>, specify the location of your customized ./install-config.yaml file. directory name to store the files that the installation program creates.

   2

   To view different installation details, specify warn, debug, or error instead of info.

   Important

   Specify an empty directory. Some installation assets, like bootstrap X.509 certificates have short expiration intervals, so you must not reuse an installation directory. If you want to reuse individual files from another cluster installation, you can copy them into your directory. However, the file names for the installation assets might change between releases. Use caution when copying installation files from an earlier OpenShift Container Platform version.

   Provide values at the prompts:

   1. Optional: Select an SSH key to use to access your cluster machines.

      Note

      For production OpenShift Container Platform clusters on which you want to perform installation debugging or disaster recovery on, specify an SSH key that your ssh-agent process uses.

   2. Select aws as the platform to target.
   3. If you do not have an Amazon Web Services (AWS) profile stored on your computer, enter the AWS access key ID and secret access key for the user that you configured to run the installation program.
   4. Select the AWS region to deploy the cluster to.
   5. Select the base domain for the Route53 service that you configured for your cluster.
   6. Enter a descriptive name for your cluster.
   7. Paste the pull secret that you obtained from the Pull Secret page on the Red Hat OpenShift Cluster Manager site.
   Note

   If the cloud provider account that you configured on your host does not have sufficient permissions to deploy the cluster, the installation process stops, and the missing permissions are displayed.

   When the cluster deployment completes, directions for accessing your cluster, including a link to its web console and credentials for the kubeadmin user, display in your terminal.

   Important

   The Ignition config files that the installation program generates contain certificates that expire after 24 hours. You must keep the cluster running for 24 hours in a non-degraded state to ensure that the first certificate rotation has finished.

   Important

   You must not delete the installation program or the files that the installation program creates. Both are required to delete the cluster.

2. Optional: Remove or disable the AdministratorAccess policy from the IAM account that you used to install the cluster.

Procedure

1. Export the kubeadmin credentials:

   $ export KUBECONFIG=<installation_directory>/auth/kubeconfig 1

   1

   For <installation_directory>, specify the path to the directory that you stored the installation files in.

2. Verify you can run oc commands successfully using the exported configuration:

   $ oc whoami
   system:admin

Procedure

1. Access the Infrastructure Provider page on the Red Hat OpenShift Cluster Manager site. If you have a Red Hat account, log in with your credentials. If you do not, create an account.

2. Navigate to the page for your installation type, download the installation program for your operating system, and place the file in the directory where you will store the installation configuration files.

   Important

   The installation program creates several files on the computer that you use to install your cluster. You must keep both the installation program and the files that the installation program creates after you finish installing the cluster.

   Important

   Deleting the files created by the installation program does not remove your cluster, even if the cluster failed during installation. You must complete the OpenShift Container Platform uninstallation procedures outlined for your specific cloud provider to remove your cluster entirely.

3. Extract the installation program. For example, on a computer that uses a Linux operating system, run the following command:

   $ tar xvf <installation_program>.tar.gz

4. From the Pull Secret page on the Red Hat OpenShift Cluster Manager site, download your installation pull secret as a .txt file. This pull secret allows you to authenticate with the services that are provided by the included authorities, including Quay.io, which serves the container images for OpenShift Container Platform components.

Procedure

1. If you do not have an SSH key that is configured for password-less authentication on your computer, create one. For example, on a computer that uses a Linux operating system, run the following command:

   $ ssh-keygen -t rsa -b 4096 -N '' \
       -f <path>/<file_name> 1

   1

   Specify the path and file name, such as ~/.ssh/id_rsa, of the SSH key.

   Running this command generates an SSH key that does not require a password in the location that you specified.

2. Start the ssh-agent process as a background task:

   $ eval "$(ssh-agent -s)"
   
   Agent pid 31874

3. Add your SSH private key to the ssh-agent:

   $ ssh-add <path>/<file_name> 1
   
   Identity added: /home/<you>/<path>/<file_name> (<computer_name>)

   1

   Specify the path and file name for your SSH private key, such as ~/.ssh/id_rsa

Procedure

1. Create a JSON file that contains the parameter values that the template requires:

   [
     {
       "ParameterKey": "VpcCidr", 1
       "ParameterValue": "10.0.0.0/16" 2
     },
     {
       "ParameterKey": "AvailabilityZoneCount", 3
       "ParameterValue": "1" 4
     },
     {
       "ParameterKey": "SubnetBits", 5
       "ParameterValue": "12" 6
     }
   ]

   1

   The CIDR block for the VPC.

   2

   Specify a CIDR block in the format x.x.x.x/16-24.

   3

   The number of availability zones to deploy the VPC in.

   4

   Specify an integer between 1 and 3.

   5

   The size of each subnet in each availability zone.

   6

   Specify an integer between 5 and 13, where 5 is /27 and 13 is /19.

2. Copy the template from the CloudFormation template for the VPC section of this topic and save it as a YAML file on your computer. This template describes the VPC that your cluster requires.

3. Launch the template:

   Important

   You must enter the command on a single line.

   $ aws cloudformation create-stack --stack-name <name> 1
        --template-body file://<template>.yaml 2
        --parameters file://<parameters>.json 3

   1

   <name> is the name for the CloudFormation stack, such as cluster-vpc. You need the name of this stack if you remove the cluster.

   2

   <template> is the relative path to and name of the CloudFormation template YAML file that you saved.

   3

   <parameters> is the relative path to and name of the CloudFormation parameters JSON file.

4. Confirm that the template components exist:

   $ aws cloudformation describe-stacks --stack-name <name>

   After the StackStatus displays CREATE_COMPLETE, the output displays values for the following parameters. You must provide these parameter values to the other CloudFormation templates that you run to create your cluster:

   VpcId	The ID of your VPC.
   PublicSubnetIds	The IDs of the new public subnets.
   PrivateSubnetIds	The IDs of the new private subnets.

Procedure

1. Obtain the Hosted Zone ID for the Route53 zone that you specified in the install-config.yaml file for your cluster. You can obtain this ID from the AWS console or by running the following command:

   Important

   You must enter the command on a single line.

   $ aws route53 list-hosted-zones-by-name |
        jq --arg name "<route53_domain>." \ 1
        -r '.HostedZones | .[] | select(.Name=="\($name)") | .Id'

   1

   For the <route53_domain>, specify the Route53 base domain that you used when you generated the install-config.yaml file for the cluster.

2. Create a JSON file that contains the parameter values that the template requires:

   [
     {
       "ParameterKey": "ClusterName", 1
       "ParameterValue": "mycluster" 2
     },
     {
       "ParameterKey": "InfrastructureName", 3
       "ParameterValue": "mycluster-<random_string>" 4
     },
     {
       "ParameterKey": "HostedZoneId", 5
       "ParameterValue": "<random_string>" 6
     },
     {
       "ParameterKey": "HostedZoneName", 7
       "ParameterValue": "example.com" 8
     },
     {
       "ParameterKey": "PublicSubnets", 9
       "ParameterValue": "subnet-<random_string>" 10
     },
     {
       "ParameterKey": "PrivateSubnets", 11
       "ParameterValue": "subnet-<random_string>" 12
     },
     {
       "ParameterKey": "VpcId", 13
       "ParameterValue": "vpc-<random_string>" 14
     }
   ]

   1

   A short, representative cluster name to use for host names, etc.

   2

   Specify the cluster name that you used when you generated the install-config.yaml file for the cluster.

   3

   The name for your cluster infrastructure that is encoded in your Ignition config files for the cluster.

   4

   Specify the infrastructure name that you extracted from the Ignition config file metadata, which has the format <cluster-name>-<random-string>.

   5

   The Route53 public zone ID to register the targets with.

   6

   Specify the Route53 public zone ID, which as a format similar to Z21IXYZABCZ2A4. You can obtain this value from the AWS console.

   7

   The Route53 zone to register the targets with.

   8

   Specify the Route53 base domain that you used when you generated the install-config.yaml file for the cluster. Do not include the trailing period (.) that is displayed in the AWS console.

   9

   The public subnets that you created for your VPC.

   10

   Specify the PublicSubnetIds value from the output of the CloudFormation template for the VPC.

   11

   The private subnets that you created for your VPC.

   12

   Specify the PrivateSubnetIds value from the output of the CloudFormation template for the VPC.

   13

   The VPC that you created for the cluster.

   14

   Specify the VpcId value from the output of the CloudFormation template for the VPC.

3. Copy the template from the CloudFormation template for the network and load balancers section of this topic and save it as a YAML file on your computer. This template describes the networking and load balancing objects that your cluster requires.

4. Launch the template:

   Important

   You must enter the command on a single line.

   $ aws cloudformation create-stack --stack-name <name> 1
        --template-body file://<template>.yaml 2
        --parameters file://<parameters>.json 3
        --capabilities CAPABILITY_NAMED_IAM

   1

   <name> is the name for the CloudFormation stack, such as cluster-dns. You need the name of this stack if you remove the cluster.

   2

   <template> is the relative path to and name of the CloudFormation template YAML file that you saved.

   3

   <parameters> is the relative path to and name of the CloudFormation parameters JSON file.

5. Confirm that the template components exist:

   $ aws cloudformation describe-stacks --stack-name <name>

   After the StackStatus displays CREATE_COMPLETE, the output displays values for the following parameters. You must provide these parameter values to the other CloudFormation templates that you run to create your cluster:

   PrivateHostedZoneId	Hosted zone ID for the private DNS.
   ExternalApiLoadBalancerName	Full name of the external API load balancer.
   InternalApiLoadBalancerName	Full name of the internal API load balancer.
   ApiServerDnsName	Full host name of the API server.
   RegisterNlbIpTargetsLambda	Lambda ARN useful to help register/deregister IP targets for these load balancers.
   ExternalApiTargetGroupArn	ARN of external API target group.
   InternalApiTargetGroupArn	ARN of internal API target group.
   InternalServiceTargetGroupArn	ARN of internal service target group.

Procedure

1. Create a JSON file that contains the parameter values that the template requires:

   [
     {
       "ParameterKey": "InfrastructureName", 1
       "ParameterValue": "mycluster-<random_string>" 2
     },
     {
       "ParameterKey": "VpcCidr", 3
       "ParameterValue": "10.0.0.0/16" 4
     },
     {
       "ParameterKey": "PrivateSubnets", 5
       "ParameterValue": "subnet-<random_string>" 6
     },
     {
       "ParameterKey": "VpcId", 7
       "ParameterValue": "vpc-<random_string>" 8
     }
   ]

   1

   The name for your cluster infrastructure that is encoded in your Ignition config files for the cluster.

   2

   Specify the infrastructure name that you extracted from the Ignition config file metadata, which has the format <cluster-name>-<random-string>.

   3

   The CIDR block for the VPC.

   4

   Specify the CIDR block parameter that you used for the VPC that you defined in the form x.x.x.x/16-24.

   5

   The private subnets that you created for your VPC.

   6

   Specify the PrivateSubnetIds value from the output of the CloudFormation template for the VPC.

   7

   The VPC that you created for the cluster.

   8

   Specify the VpcId value from the output of the CloudFormation template for the VPC.

2. Copy the template from the CloudFormation template for security objects section of this topic and save it as a YAML file on your computer. This template describes the security groups and roles that your cluster requires.

3. Launch the template:

   Important

   You must enter the command on a single line.

   $ aws cloudformation create-stack --stack-name <name> 1
        --template-body file://<template>.yaml 2
        --parameters file://<parameters>.json 3
        --capabilities CAPABILITY_NAMED_IAM

   1

   <name> is the name for the CloudFormation stack, such as cluster-sec. You need the name of this stack if you remove the cluster.

   2

   <template> is the relative path to and name of the CloudFormation template YAML file that you saved.

   3

   <parameters> is the relative path to and name of the CloudFormation parameters JSON file.

4. Confirm that the template components exist:

   $ aws cloudformation describe-stacks --stack-name <name>

   After the StackStatus displays CREATE_COMPLETE, the output displays values for the following parameters. You must provide these parameter values to the other CloudFormation templates that you run to create your cluster:

   MasterSecurityGroupId	Master Security Group ID
   WorkerSecurityGroupId	Worker Security Group ID
   MasterInstanceProfile	Master IAM Instance Profile
   WorkerInstanceProfile	Worker IAM Instance Profile

Procedure

1. Provide a location to serve the bootstrap.ign Ignition config file to your cluster. This file is located in your installation directory. One way to do this is to create an S3 bucket in your cluster’s region and upload the Ignition config file to it.

   Important

   The provided CloudFormation Template assumes that the Ignition config files for your cluster are served from an S3 bucket. If you choose to serve the files from another location, you must modify the templates.

   Note

   The bootstrap Ignition config file does contain secrets, like X.509 keys. The following steps provide basic security for the S3 bucket. To provide additional security, you can enable an S3 bucket policy to allow only certain users, such as the OpenShift IAM user, to access objects that the bucket contains. You can avoid S3 entirely and serve your bootstrap Ignition config file from any address that the bootstrap machine can reach.

   1. Create the bucket:

      $ aws s3 mb s3://<cluster-name>-infra 1

      1

      <cluster-name>-infra is the bucket name.

   2. Upload the bootstrap.ign Ignition config file to the bucket:

      $ aws s3 cp bootstrap.ign s3://<cluster-name>-infra/bootstrap.ign

   3. Verify that the file uploaded:

      $ aws s3 ls s3://<cluster-name>-infra/
      
      2019-04-03 16:15:16     314878 bootstrap.ign

2. Create a JSON file that contains the parameter values that the template requires:

   [
     {
       "ParameterKey": "InfrastructureName", 1
       "ParameterValue": "mycluster-<random_string>" 2
     },
     {
       "ParameterKey": "RhcosAmi", 3
       "ParameterValue": "ami-<random_string>" 4
     },
     {
       "ParameterKey": "AllowedBootstrapSshCidr", 5
       "ParameterValue": "0.0.0.0/0" 6
     },
     {
       "ParameterKey": "PublicSubnet", 7
       "ParameterValue": "subnet-<random_string>" 8
     },
     {
       "ParameterKey": "MasterSecurityGroupId", 9
       "ParameterValue": "sg-<random_string>" 10
     },
     {
       "ParameterKey": "VpcId", 11
       "ParameterValue": "vpc-<random_string>" 12
     },
     {
       "ParameterKey": "BootstrapIgnitionLocation", 13
       "ParameterValue": "s3://<bucket_name>/bootstrap.ign" 14
     },
     {
       "ParameterKey": "AutoRegisterELB", 15
       "ParameterValue": "yes" 16
     },
     {
       "ParameterKey": "RegisterNlbIpTargetsLambdaArn", 17
       "ParameterValue": "arn:aws:lambda:<region>:<account_number>:function:<dns_stack_name>-RegisterNlbIpTargets-<random_string>" 18
     },
     {
       "ParameterKey": "ExternalApiTargetGroupArn", 19
       "ParameterValue": "arn:aws:elasticloadbalancing:<region>:<account_number>:targetgroup/<dns_stack_name>-Exter-<random_string>" 20
     },
     {
       "ParameterKey": "InternalApiTargetGroupArn", 21
       "ParameterValue": "arn:aws:elasticloadbalancing:<region>:<account_number>:targetgroup/<dns_stack_name>-Inter-<random_string>" 22
     },
     {
       "ParameterKey": "InternalServiceTargetGroupArn", 23
       "ParameterValue": "arn:aws:elasticloadbalancing:<region>:<account_number>:targetgroup/<dns_stack_name>-Inter-<random_string>" 24
     }
   ]

   1

   The name for your cluster infrastructure that is encoded in your Ignition config files for the cluster.

   2

   Specify the infrastructure name that you extracted from the Ignition config file metadata, which has the format <cluster-name>-<random-string>.

   3

   Current Red Hat Enterprise Linux CoreOS (RHCOS) AMI to use for the bootstrap node.

   4

   Specify a valid AWS::EC2::Image::Id value.

   5

   CIDR block to allow SSH access to the bootstrap node.

   6

   Specify a CIDR block in the format x.x.x.x/16-24.

   7

   The public subnet that is associated with your VPC to launch the bootstrap node into.

   8

   Specify the PublicSubnetIds value from the output of the CloudFormation template for the VPC.

   9

   The master security group ID (for registering temporary rules)

   10

   Specify the MasterSecurityGroupId value from the output of the CloudFormation template for the security group and roles.

   11

   The VPC created resources will belong to.

   12

   Specify the VpcId value from the output of the CloudFormation template for the VPC.

   13

   Location to fetch bootstrap Ignition config file from.

   14

   Specify location of the bootstrap file. Enter the S3 bucket and file name in the form s3://<bucket_name>/bootstrap.ign.

   15

   Whether or not to register a network load balancer (NLB).

   16

   Specify yes or no. If you specify yes, you must provide a Lambda Amazon Resource Name (ARN) value.

   17

   The ARN for NLB IP target registration lambda group.

   18

   Specify the RegisterNlbIpTargetsLambda value from the output of the CloudFormation template for DNS and load balancing.

   19

   The ARN for external API load balancer target group.

   20

   Specify the ExternalApiTargetGroupArn value from the output of the CloudFormation template for DNS and load balancing.

   21

   The ARN for internal API load balancer target group.

   22

   Specify the InternalApiTargetGroupArn value from the output of the CloudFormation template for DNS and load balancing.

   23

   The ARN for internal service load balancer target group.

   24

   Specify the InternalServiceTargetGroupArn value from the output of the CloudFormation template for DNS and load balancing.

3. Copy the template from the CloudFormation template for the bootstrap machine section of this topic and save it as a YAML file on your computer. This template describes the bootstrap machine that your cluster requires.

4. Launch the template:

   Important

   You must enter the command on a single line.

   $ aws cloudformation create-stack --stack-name <name> 1
        --template-body file://<template>.yaml 2
        --parameters file://<parameters>.json 3
        --capabilities CAPABILITY_NAMED_IAM

   1

   <name> is the name for the CloudFormation stack, such as cluster-bootstrap. You need the name of this stack if you remove the cluster.

   2

   <template> is the relative path to and name of the CloudFormation template YAML file that you saved.

   3

   <parameters> is the relative path to and name of the CloudFormation parameters JSON file.

5. Confirm that the template components exist:

   $ aws cloudformation describe-stacks --stack-name <name>

   After the StackStatus displays CREATE_COMPLETE, the output displays values for the following parameters. You must provide these parameter values to the other CloudFormation templates that you run to create your cluster:

   BootstrapInstanceId	The bootstrap Instance ID.
   BootstrapPublicIp	The bootstrap node public IP address.
   BootstrapPrivateIp	The bootstrap node private IP address.

Procedure

1. Create a JSON file that contains the parameter values that the template requires:

   [
     {
       "ParameterKey": "InfrastructureName", 1
       "ParameterValue": "mycluster-<random_string>" 2
     },
     {
       "ParameterKey": "RhcosAmi", 3
       "ParameterValue": "ami-<random_string>" 4
     },
     {
       "ParameterKey": "AutoRegisterDNS", 5
       "ParameterValue": "yes" 6
     },
     {
       "ParameterKey": "PrivateHostedZoneId", 7
       "ParameterValue": "<random_string>" 8
     },
     {
       "ParameterKey": "PrivateHostedZoneName", 9
       "ParameterValue": "mycluster.example.com" 10
     },
     {
       "ParameterKey": "Master0Subnet", 11
       "ParameterValue": "subnet-<random_string>" 12
     },
     {
       "ParameterKey": "Master1Subnet", 13
       "ParameterValue": "subnet-<random_string>" 14
     },
     {
       "ParameterKey": "Master2Subnet", 15
       "ParameterValue": "subnet-<random_string>" 16
     },
     {
       "ParameterKey": "MasterSecurityGroupId", 17
       "ParameterValue": "sg-<random_string>" 18
     },
     {
       "ParameterKey": "IgnitionLocation", 19
       "ParameterValue": "https://api-int.<cluster_name>.<domain_name>:22623/config/master" 20
     },
     {
       "ParameterKey": "CertificateAuthorities", 21
       "ParameterValue": "data:text/plain;charset=utf-8;base64,ABC...xYz==" 22
     },
     {
       "ParameterKey": "MasterInstanceProfileName", 23
       "ParameterValue": "<roles_stack>-MasterInstanceProfile-<random_string>" 24
     },
     {
       "ParameterKey": "MasterInstanceType", 25
       "ParameterValue": "m4.xlarge" 26
     },
     {
       "ParameterKey": "AutoRegisterELB", 27
       "ParameterValue": "yes" 28
     },
     {
       "ParameterKey": "RegisterNlbIpTargetsLambdaArn", 29
       "ParameterValue": "arn:aws:lambda:<region>:<account_number>:function:<dns_stack_name>-RegisterNlbIpTargets-<random_string>" 30
     },
     {
       "ParameterKey": "ExternalApiTargetGroupArn", 31
       "ParameterValue": "arn:aws:elasticloadbalancing:<region>:<account_number>:targetgroup/<dns_stack_name>-Exter-<random_string>" 32
     },
     {
       "ParameterKey": "InternalApiTargetGroupArn", 33
       "ParameterValue": "arn:aws:elasticloadbalancing:<region>:<account_number>:targetgroup/<dns_stack_name>-Inter-<random_string>" 34
     },
     {
       "ParameterKey": "InternalServiceTargetGroupArn", 35
       "ParameterValue": "arn:aws:elasticloadbalancing:<region>:<account_number>:targetgroup/<dns_stack_name>-Inter-<random_string>" 36
     }
   ]

   1

   The name for your cluster infrastructure that is encoded in your Ignition config files for the cluster.

   2

   Specify the infrastructure name that you extracted from the Ignition config file metadata, which has the format <cluster-name>-<random-string>.

   3

   CurrentRed Hat Enterprise Linux CoreOS (RHCOS) AMI to use for the control plane machines.

   4

   Specify an AWS::EC2::Image::Id value.

   5

   Whether or not to perform DNS etcd registration.

   6

   Specify yes or no. If you specify yes, you must provide Hosted Zone information.

   7

   The Route53 private zone ID to register the etcd targets with.

   8

   Specify the PrivateHostedZoneId value from the output of the CloudFormation template for DNS and load balancing.

   9

   The Route53 zone to register the targets with.

   10

   Specify <cluster_name>.<domain_name> where <domain_name> is the Route53 base domain that you used when you generated install-config.yaml file for the cluster. Do not include the trailing period (.) that is displayed in the AWS console.

   11 13 15

   A subnet, preferably private, to launch the control plane machines on.

   12 14 16

   Specify a subnet from the PrivateSubnets value from the output of the CloudFormation template for DNS and load balancing.

   17

   The master security group ID to associate with master nodes.

   18

   Specify the MasterSecurityGroupId value from the output of the CloudFormation template for the security group and roles.

   19

   The location to fetch control plane Ignition config file from.

   20

   Specify the generated Ignition config file location, https://api-int.<cluster_name>.<domain_name>:22623/config/master.

   21

   The base64 encoded certificate authority string to use.

   22

   Specify the value from the master.ign file that is in the installation directory. This value is the long string with the format data:text/plain;charset=utf-8;base64,ABC…​xYz==.

   23

   The IAM profile to associate with master nodes.

   24

   Specify the MasterInstanceProfile parameter value from the output of the CloudFormation template for the security group and roles.

   25

   The type of AWS instance to use for the control plane machines.

   26

   Allowed values:

   • m4.xlarge
   • m4.2xlarge
   • m4.4xlarge
   • m4.8xlarge
   • m4.10xlarge
   • m4.16xlarge
   • c4.2xlarge
   • c4.4xlarge
   • c4.8xlarge
   • r4.xlarge
   • r4.2xlarge
   • r4.4xlarge
   • r4.8xlarge

   • r4.16xlarge

     Important

     If m4 instance types are not available in your region, such as with eu-west-3, specify an m5 type, such as m5.xlarge, instead.

   27

   Whether or not to register a network load balancer (NLB).

   28

   Specify yes or no. If you specify yes, you must provide a Lambda Amazon Resource Name (ARN) value.

   29

   The ARN for NLB IP target registration lambda group.

   30

   Specify the RegisterNlbIpTargetsLambda value from the output of the CloudFormation template for DNS and load balancing.

   31

   The ARN for external API load balancer target group.

   32

   Specify the ExternalApiTargetGroupArn value from the output of the CloudFormation template for DNS and load balancing.

   33

   The ARN for internal API load balancer target group.

   34

   Specify the InternalApiTargetGroupArn value from the output of the CloudFormation template for DNS and load balancing.

   35

   The ARN for internal service load balancer target group.

   36

   Specify the InternalServiceTargetGroupArn value from the output of the CloudFormation template for DNS and load balancing.

2. Copy the template from the CloudFormation template for control plane machines section of this topic and save it as a YAML file on your computer. This template describes the control plane machines that your cluster requires.
3. If you specified an m5 instance type as the value for MasterInstanceType, add that instance type to the MasterInstanceType.AllowedValues parameter in the CloudFormation template.

4. Launch the template:

   Important

   You must enter the command on a single line.

   $ aws cloudformation create-stack --stack-name <name> 1
        --template-body file://<template>.yaml 2
        --parameters file://<parameters>.json 3

   1

   <name> is the name for the CloudFormation stack, such as cluster-control-plane. You need the name of this stack if you remove the cluster.

   2

   <template> is the relative path to and name of the CloudFormation template YAML file that you saved.

   3

   <parameters> is the relative path to and name of the CloudFormation parameters JSON file.

5. Confirm that the template components exist:

   $ aws cloudformation describe-stacks --stack-name <name>

Procedure

1. Change to the directory that contains the installation program and run the following command:

   $ ./openshift-install wait-for bootstrap-complete --dir=<installation_directory> \ 1
       --log-level=info 2

   1

   For <installation_directory>, specify the path to the directory that you stored the installation files in.

   2

   To view different installation details, specify warn, debug, or error instead of info.

   If the command exits without a FATAL warning, your production control plane has initialized.

Procedure

1. Export the kubeadmin credentials:

   $ export KUBECONFIG=<installation_directory>/auth/kubeconfig 1

   1

   For <installation_directory>, specify the path to the directory that you stored the installation files in.

2. Verify you can run oc commands successfully using the exported configuration:

   $ oc whoami
   system:admin

Procedure

1. Confirm that the cluster recognizes the machines:

   $ oc get nodes
   
   NAME      STATUS    ROLES   AGE  VERSION
   master-0  Ready     master  63m  v1.14.6+c4799753c
   master-1  Ready     master  63m  v1.14.6+c4799753c
   master-2  Ready     master  64m  v1.14.6+c4799753c
   worker-0  NotReady  worker  76s  v1.14.6+c4799753c
   worker-1  NotReady  worker  70s  v1.14.6+c4799753c

   The output lists all of the machines that you created.

2. Review the pending certificate signing requests (CSRs) and ensure that the you see a client and server request with Pending or Approved status for each machine that you added to the cluster:

   $ oc get csr
   
   NAME        AGE     REQUESTOR                                                                   CONDITION
   csr-8b2br   15m     system:serviceaccount:openshift-machine-config-operator:node-bootstrapper   Pending 1
   csr-8vnps   15m     system:serviceaccount:openshift-machine-config-operator:node-bootstrapper   Pending
   csr-bfd72   5m26s   system:node:ip-10-0-50-126.us-east-2.compute.internal                       Pending 2
   csr-c57lv   5m26s   system:node:ip-10-0-95-157.us-east-2.compute.internal                       Pending
   ...

   1

   A client request CSR.

   2

   A server request CSR.

   In this example, two machines are joining the cluster. You might see more approved CSRs in the list.

3. If the CSRs were not approved, after all of the pending CSRs for the machines you added are in Pending status, approve the CSRs for your cluster machines:

   Note

   Because the CSRs rotate automatically, approve your CSRs within an hour of adding the machines to the cluster. If you do not approve them within an hour, the certificates will rotate, and more than two certificates will be present for each node. You must approve all of these certificates. After you approve the initial CSRs, the subsequent node client CSRs are automatically approved by the cluster kube-controller-manager. You must implement a method of automatically approving the kubelet serving certificate requests.

   • To approve them individually, run the following command for each valid CSR:

     $ oc adm certificate approve <csr_name> 1

     1

     <csr_name> is the name of a CSR from the list of current CSRs.

   • To approve all pending CSRs, run the following command:

     $ oc get csr -o go-template='{{range .items}}{{if not .status}}{{.metadata.name}}{{"\n"}}{{end}}{{end}}' | xargs oc adm certificate approve

Procedure

1. Watch the cluster components come online:

   $ watch -n5 oc get clusteroperators
   
   NAME                                 VERSION   AVAILABLE   PROGRESSING   DEGRADED   SINCE
   authentication                       4.2.0     True        False         False      69s
   cloud-credential                     4.2.0     True        False         False      12m
   cluster-autoscaler                   4.2.0     True        False         False      11m
   console                              4.2.0     True        False         False      46s
   dns                                  4.2.0     True        False         False      11m
   image-registry                       4.2.0     False       True          False      5m26s
   ingress                              4.2.0     True        False         False      5m36s
   kube-apiserver                       4.2.0     True        False         False      8m53s
   kube-controller-manager              4.2.0     True        False         False      7m24s
   kube-scheduler                       4.2.0     True        False         False      12m
   machine-api                          4.2.0     True        False         False      12m
   machine-config                       4.2.0     True        False         False      7m36s
   marketplace                          4.2.0     True        False         False      7m54m
   monitoring                           4.2.0     True        False         False      7h54s
   network                              4.2.0     True        False         False      5m9s
   node-tuning                          4.2.0     True        False         False      11m
   openshift-apiserver                  4.2.0     True        False         False      11m
   openshift-controller-manager         4.2.0     True        False         False      5m943s
   openshift-samples                    4.2.0     True        False         False      3m55s
   operator-lifecycle-manager           4.2.0     True        False         False      11m
   operator-lifecycle-manager-catalog   4.2.0     True        False         False      11m
   service-ca                           4.2.0     True        False         False      11m
   service-catalog-apiserver            4.2.0     True        False         False      5m26s
   service-catalog-controller-manager   4.2.0     True        False         False      5m25s
   storage                              4.2.0     True        False         False      5m30s

2. Configure the Operators that are not available.

Procedure

1. Delete the bootstrap resources. If you used the CloudFormation template, delete its stack:

   $ aws cloudformation delete-stack --stack-name <name> 1

   1

   <name> is the name of your bootstrap stack.

Procedure

1. Determine the routes to create.

   • To create a wildcard record, use *.apps.<cluster_name>.<domain_name>, where <cluster_name> is your cluster name, and <domain_name> is the Route53 base domain for your OpenShift Container Platform cluster.

   • To create specific records, you must create a record for each route that your cluster uses, as shown in the output of the following command:

     $ oc get --all-namespaces -o jsonpath='{range .items[*]}{range .status.ingress[*]}{.host}{"\n"}{end}{end}' routes
     oauth-openshift.apps.<cluster_name>.<domain_name>
     console-openshift-console.apps.<cluster_name>.<domain_name>
     downloads-openshift-console.apps.<cluster_name>.<domain_name>
     alertmanager-main-openshift-monitoring.apps.<cluster_name>.<domain_name>
     grafana-openshift-monitoring.apps.<cluster_name>.<domain_name>
     prometheus-k8s-openshift-monitoring.apps.<cluster_name>.<domain_name>

2. Retrieve the Ingress Operator load balancer status and note the value of the external IP address that it uses, which is shown in the EXTERNAL-IP column:

   $ oc -n openshift-ingress get service router-default
   NAME             TYPE           CLUSTER-IP      EXTERNAL-IP                            PORT(S)                      AGE
   router-default   LoadBalancer   172.30.62.215   ab3...28.us-east-2.elb.amazonaws.com   80:31499/TCP,443:30693/TCP   5m

3. Locate the hosted zone ID for the load balancer:

   $ aws elb describe-load-balancers | jq -r '.LoadBalancerDescriptions[] | select(.DNSName == "<external_ip>").CanonicalHostedZoneNameID' 1
   
   Z3AADJGX6KTTL2

   1

   For <external_ip>, specify the value of the external IP address of the Ingress Operator load balancer that you obtained.

   The output of this command is the load balancer hosted zone ID.

4. Obtain the public hosted zone ID for your cluster’s domain:

   $ aws route53 list-hosted-zones-by-name \
               --dns-name "<domain_name>" \ 1
               --query 'HostedZones[? Config.PrivateZone != `true` && Name == `<domain_name>.`].Id' 2
               --output text
   
   /hostedzone/Z3URY6TWQ91KVV

   1 2

   For <domain_name>, specify the Route53 base domain for your OpenShift Container Platform cluster.

   The public hosted zone ID for your domain is shown in the command output. In this example, it is Z3URY6TWQ91KVV.

5. Add the alias records to your private zone:

   $ aws route53 change-resource-record-sets --hosted-zone-id "<private_hosted_zone_id>" --change-batch '{ 1
   >   "Changes": [
   >     {
   >       "Action": "CREATE",
   >       "ResourceRecordSet": {
   >         "Name": "\\052.apps.<cluster_domain>", 2
   >         "Type": "A",
   >         "AliasTarget":{
   >           "HostedZoneId": "<hosted_zone_id>", 3
   >           "DNSName": "<external_ip>.", 4
   >           "EvaluateTargetHealth": false
   >         }
   >       }
   >     }
   >   ]
   > }'

   1

   For <private_hosted_zone_id>, specify the value from the output of the CloudFormation template for DNS and load balancing.

   2

   For <cluster_domain>, specify the domain or subdomain that you use with your OpenShift Container Platform cluster.

   3

   For <hosted_zone_id>, specify the public hosted zone ID for the load balancer that you obtained.

   4

   For <external_ip>, specify the value of the external IP address of the Ingress Operator load balancer. Ensure that you include the trailing period (.) in this parameter value.

6. Add the records to your public zone:

   $ aws route53 change-resource-record-sets --hosted-zone-id "<public_hosted_zone_id>"" --change-batch '{ 1
   >   "Changes": [
   >     {
   >       "Action": "CREATE",
   >       "ResourceRecordSet": {
   >         "Name": "\\052.apps.<cluster_domain>", 2
   >         "Type": "A",
   >         "AliasTarget":{
   >           "HostedZoneId": "<hosted_zone_id>", 3
   >           "DNSName": "<external_ip>.", 4
   >           "EvaluateTargetHealth": false
   >         }
   >       }
   >     }
   >   ]
   > }'

   1

   For <public_hosted_zone_id>, specify the public hosted zone for your domain.

   2

   For <cluster_domain>, specify the domain or subdomain that you use with your OpenShift Container Platform cluster.

   3

   For <hosted_zone_id>, specify the public hosted zone ID for the load balancer that you obtained.

   4

   For <external_ip>, specify the value of the external IP address of the Ingress Operator load balancer. Ensure that you include the trailing period (.) in this parameter value.