Chapter 6. Creating a provider connection
A provider connection is required to create a Red Hat OpenShift Container Platform cluster on a cloud service provider with Red Hat Advanced Cluster Management for Kubernetes.
The provider connection stores the access credentials and configuration information for a provider. Each provider account requires its own provider connection, as does each domain on a single provider.
The following files detail the information that is required for creating a connection document for each supported provider:
6.1. Creating a provider connection for Amazon Web Services
You need a provider connection to use Red Hat Advanced Cluster Management for Kubernetes console to deploy and manage an OpenShift cluster on Amazon Web Services (AWS).
Note: This procedure must be done before you can create a cluster with Red Hat Advanced Cluster Management for Kubernetes.
6.1.1. Prerequisites
You must have the following prerequisites before creating a provider connection:
- A deployed Red Hat Advanced Cluster Management for Kubernetes hub cluster
- Internet access for your Red Hat Advanced Cluster Management for Kubernetes hub cluster so it can create the Kubernetes cluster on Amazon Web Services
- Amazon Web Services (AWS) login credentials, which include access key ID and secret access key. See Understanding and getting your security credentials.
- Account permissions that allow installing clusters on AWS. See Configuring an AWS account for instructions on how to configure.
6.1.2. Creating a provider connection by using the console
To create a provider connection from the Red Hat Advanced Cluster Management for Kubernetes console, complete the following steps:
- From the navigation menu, navigate to Automate infrastructure > Clusters.
On the Clusters page, select the Provider connections tab.
Existing provider connections are displayed.
- Select Add a connection.
- Select Amazon Web Services as your provider.
- Add a name for your provider connection.
Select a namespace for your provider connection from the list.
Tip: Create a namespace specifically to host your provider connections, both for convenience and added security.
- You can optionally add a Base DNS domain for your provider connection. If you add the base DNS domain to the provider connection, it is automatically populated in the correct field when you create a cluster with this provider connection.
- Add your AWS access key ID for your Amazon Web Services account. Log in to AWS to find the ID.
- Add your AWS Secret Access Key.
- Enter your Red Hat OpenShift pull secret. You can download your pull secret from Pull secret.
- Add your SSH private key and SSH public key, which allows you to connect to the cluster. You can use an existing key pair, or create a new one with key generation program. See Generating an SSH private key and adding it to the agent for more information about how to generate a key.
- Click Create. When you create the provider connection, it is added to the list of provider connections.
You can create a cluster that uses this provider connection by completing the steps in Creating a cluster on Amazon Web Services.
6.1.3. Deleting your provider connection
When you are no longer managing a cluster that is using a provider connection, delete the provider connection to protect the information in the provider connection.
- From the navigation menu, navigate to Automate infrastructure > Clusters.
- Select Provider connections.
- Select the options menu beside the provider connection that you want to delete.
- Select Delete connection.
6.2. Creating a provider connection for Microsoft Azure
You need a provider connection to use Red Hat Advanced Cluster Management for Kubernetes console to create and manage a Red Hat OpenShift Container Platform cluster on Microsoft Azure.
Note: This procedure is a prerequisite for creating a cluster with Red Hat Advanced Cluster Management for Kubernetes.
6.2.1. Prerequisites
You must have the following prerequisites before creating a provider connection:
- A deployed Red Hat Advanced Cluster Management for Kubernetes hub cluster.
- Internet access for your Red Hat Advanced Cluster Management for Kubernetes hub cluster so that it can create the Kubernetes cluster on Azure.
- Azure login credentials, which include your Base Domain Resource Group and Azure Service Principal JSON. See azure.microsoft.com.
- Account permissions that allow installing clusters on Azure. See How to configure Cloud Services and Configuring an Azure account for more information.
6.2.2. Creating a provider connection by using the console
To create a provider connection from the Red Hat Advanced Cluster Management for Kubernetes console, complete the following steps:
- From the navigation menu, navigate to Automate infrastructure > Clusters.
On the Clusters page, select the Provider connections tab.
Existing provider connections are displayed.
- Select Add a connection.
- Select Microsoft Azure as your provider.
- Add a name for your provider connection.
Select a namespace for your provider connection from the list.
Tip: You can create a namespace specifically to host your provider connections, both for convenience and added security.
- You can optionally add a Base DNS domain for your provider connection. If you add the base DNS domain to the provider connection, it is automatically populated in the correct field when you create a cluster with this provider connection.
- Add your Base domain resource group name for your Azure account. This entry is the resource name that you created with your Azure account. You can find your Base Domain Resource Group Name by selecting Home > DNS Zones in the Azure interface. Your Base domain resource group name is in the Resource Group column of the entry that contains the Base DNS domain that applies to your account.
Add your Client ID. This value is generated as the
appId
property when you create a service principal with the following command:az ad sp create-for-rbac --role Contributor --name <service_principal>
Replace service_principal with the name of your service principal.
Add your Client Secret. This value is generated as the
password
property when you create a service principal with the following command:az ad sp create-for-rbac --role Contributor --name <service_principal>
Replace service_principal with the name of your service principal.
Add your Subscription ID. This value is the
id
property in the output of the following command:az account show
Add your Tenant ID. This value is the
tenantId
property in the output of the following command:az account show
- Enter your Red Hat OpenShift pull secret. You can download your pull secret from Pull secret.
- Add your SSH private key and SSH public key to use to connect to the cluster. You can use an existing key pair, or create a new pair using a key generation program. See Generating an SSH private key and adding it to the agent for more information about how to generate a key.
- Click Create. When you create the provider connection, it is added to the list of provider connections.
You can create a cluster that uses this provider connection by completing the steps in Creating a cluster on Microsoft Azure.
6.2.3. Deleting your provider connection
When you are no longer managing a cluster that is using a provider connection, delete the provider connection to protect the information in the provider connection.
- From the navigation menu, navigate to Automate infrastructure > Clusters.
- Select Provider connections.
- Select the options menu for the provider connection that you want to delete.
- Select Delete connection.
6.3. Creating a provider connection for Google Cloud Platform
You need a provider connection to use Red Hat Advanced Cluster Management for Kubernetes console to create and manage a Red Hat OpenShift Container Platform cluster on Google Cloud Platform (GCP).
Note: This procedure is a prerequisite for creating a cluster with Red Hat Advanced Cluster Management for Kubernetes.
6.3.1. Prerequisites
You must have the following prerequisites before creating a provider connection:
- A deployed Red Hat Advanced Cluster Management for Kubernetes hub cluster
- Internet access for your Red Hat Advanced Cluster Management for Kubernetes hub cluster so it can create the Kubernetes cluster on GCP
- GCP login credentials, which include user Google Cloud Platform Project ID and Google Cloud Platform service account JSON key. See Creating and managing projects.
- Account permissions that allow installing clusters on GCP. See Configuring a GCP project for instructions on how to configure an account.
6.3.2. Creating a provider connection by using the console
To create a provider connection from the Red Hat Advanced Cluster Management for Kubernetes console, complete the following steps:
- From the navigation menu, navigate to Automate infrastructure > Clusters.
On the Clusters page, select the Provider connections tab.
Existing provider connections are displayed.
- Select Add a connection.
- Select Google Cloud Platform as your provider.
- Add a name for your provider connection.
Select a namespace for your provider connection from the list.
TipCreate a namespace specifically to host your provider connections, for both convenience and security.
- You can optionally add a Base DNS domain for your provider connection. If you add the base DNS domain to the provider connection, it is automatically populated in the correct field when you create a cluster with this provider connection.
- Add your Google Cloud Platform project ID for your GCP account. Log in to GCP to retrieve your settings.
Add your Google Cloud Platform service account JSON key. Complete the following steps to create one with the correct permissions:
- In the GCP main menu, select IAM & Admin and start the Service Accounts applet
- Select Create Service Account.
- Provide the Name, Service account ID, and Description of your service account.
- Select Create to create the service account.
- Select a role of Owner, and click Continue.
- Click Create Key
- Select JSON, and click Create.
- Save the resulting file to your computer.
- Provide the contents for the Google Cloud Platform service account JSON key.
- Enter your Red Hat OpenShift pull secret. You can download your pull secret from Pull secret.
- Add your SSH private key and SSH public key so you can access the cluster. You can use an existing key pair, or create a new pair using a key generation program. See Generating an SSH private key and adding it to the agent for more information about how to generate a key.
- Click Create. When you create the provider connection, it is added to the list of provider connections.
You can use this connection when you create a cluster by completing the steps in Creating a cluster on Google Cloud Platform.
6.3.3. Deleting your provider connection
When you are no longer managing a cluster that is using a provider connection, delete the provider connection to protect the information in the provider connection.
- From the navigation menu, navigate to Automate infrastructure > Clusters.
- Select Provider connections.
- Select the options menu beside the provider connection that you want to delete.
- Select Delete connection.
6.4. Creating a provider connection for VMware vSphere
You need a provider connection to use Red Hat Advanced Cluster Management for Kubernetes console to deploy and manage a Red Hat OpenShift Container Platform cluster on VMware vSphere. Note: Only OpenShift Container Platform versions 4.5.x and later, are supported.
Note: This procedure must be done before you can create a cluster with Red Hat Advanced Cluster Management.
6.4.1. Prerequisites
You must have the following prerequisites before you create a provider connection:
- A deployed Red Hat Advanced Cluster Management hub cluster on OpenShift Container Platform version 4.5, or later.
- Internet access for your Red Hat Advanced Cluster Management hub cluster so it can create the Kubernetes cluster on VMware vSphere.
VMware vSphere login credentials and vCenter requirements configured for OpenShift Container Platform when using installer-provisioned infrastructure. See Installing a cluster on vSphere. These credentials include the following information:
- vCenter account privileges.
- Cluster resources.
- DHCP available.
- ESXi hosts have time synchronized (for example, NTP).
6.4.2. Creating a provider connection by using the console
To create a provider connection from the Red Hat Advanced Cluster Management console, complete the following steps:
- From the navigation menu, navigate to Automate infrastructure > Clusters.
On the Clusters page, select the Provider connections tab.
Existing provider connections are displayed.
- Select Add a connection.
- Select VMware vSphere as your provider.
- Add a name for your provider connection.
Select a namespace for your provider connection from the list.
Tip: Create a namespace specifically to host your provider connections for both convenience and added security.
- You can optionally add a Base DNS domain for your provider connection. If you add the base DNS domain to the provider connection, it is automatically populated in the correct field when you create a cluster with this provider connection.
- Add your VMware vCenter server fully-qualified host name or IP address. The value must be defined in the vCenter server root CA certificate. If possible, use the fully-qualified host name.
- Add your VMware vCenter username.
- Add your VMware vCenter password.
Add your VMware vCenter root CA certificate.
-
You can download your certificate in the
download.zip
package with the certificate from your VMware vCenter server at:https://<vCenter_address>/certs/download.zip
. ReplacevCenter_address
with the address to your vCenter server. -
Unpackage the
download.zip
file. Use the certificate from the
certs/<platform>
directory that has a.0
extension. Tip: You can use thels certs/<platform>
command to list all of the available certificates for your platform.Replace
platform
with the abbreviation for your platform:lin
,mac
, orwin
.For example:
certs/lin/3a343545.0
-
You can download your certificate in the
- Add your VMware vSphere cluster name.
- Add your VMware vSphere datacenter.
- Add your VMware vSphere default datastore.
- Enter your OpenShift Container Platform pull secret. You can download your pull secret from Pull secret.
- Add your SSH private key and your SSH public key, which allows you to connect to the cluster. You can use an existing key pair, or create a new one with key generation program. See Generating an SSH private key and adding it to the agent for more information.
- Click Create. When you create the provider connection, it is added to the list of provider connections.
You can create a cluster that uses this provider connection by completing the steps in Creating a cluster on VMware vSphere.
6.4.3. Deleting your provider connection
When you are no longer managing a cluster that is using a provider connection, delete the provider connection to protect the information in the provider connection.
- From the navigation menu, navigate to Automate infrastructure > Clusters.
- Select Provider connections.
- Select the options menu for the provider connection that you want to delete.
- Select Delete connection.
6.5. Creating a provider connection for bare metal
You need a provider connection to use Red Hat Advanced Cluster Management for Kubernetes console to deploy and manage a Red Hat OpenShift Container Platform cluster in a bare metal environment.
6.5.1. Prerequisites
You need the following prerequisites before creating a provider connection:
- A Red Hat Advanced Cluster Management for Kubernetes hub cluster that is deployed. When managing bare metal clusters, you must have the hub cluster installed on Red Hat OpenShift Container Platform version 4.5, or later.
- Internet access for your Red Hat Advanced Cluster Management for Kubernetes hub cluster so it can create the Kubernetes cluster on your bare metal server.
- Your bare metal server login credentials, which include the libvirt URI, SSH Private Key, and a list of SSH known hosts; see Generating an SSH private key and adding it to the agent
- For a disconnected environment, you must have a configured mirror registry where you can copy the release images for your cluster creation. See Mirroring images for a disconnected installation in the OpenShift Container Platform documentation for more information.
- Account permissions that allow installing clusters on the bare metal infrastructure
6.5.2. Preparing a provisioning host
When you create a bare metal credential and cluster, you must have a provisioning host. The provisioning host is an available bootstrap host VM for the installation. This can be a VM or a service running Kernel-based virtual machine (KVM). You need the details of this host when you are creating the credential and the cluster. Complete the following steps to configure a provisioner host:
-
Log in to the provisioner node using
SSH
. Create a non-root user (user-name) and provide that user with sudo privileges by running the following commands:
useradd <user-name> passwd <password> echo "<user-name> ALL=(root) NOPASSWD:ALL" | tee -a /etc/sudoers.d/<user-name> chmod 0440 /etc/sudoers.d/<user-name>
Create an SSH key for the new user by entering the following command:
su - <user-name> -c "ssh-keygen -t rsa -f /home/<user-name>/.ssh/id_rsa -N ''"
Log in as the new user on the provisioner node.
su - <user-name> [user-name@provisioner ~]$
Use Red Hat Subscription Manager to register the provisioner node by entering the following commands:
sudo subscription-manager register --username=<user-name> --password=<password> --auto-attach sudo subscription-manager repos --enable=rhel-8-for-x86_64-appstream-rpms --enable=rhel-8-for-x86_64-baseos-rpms
For more information about Red Hat Subscription Manager, see Using and Configuring Red Hat Subscription Manager in the Red Hat OpenShift Container Platform documentation.
Install required packages by running the following command:
sudo dnf install -y libvirt qemu-kvm mkisofs python3-devel jq ipmitool
Modify the user to add the
libvirt
group to the newly created user.sudo usermod --append --groups libvirt <user-name>
Restart
firewalld
and enable thehttp
service by entering the following commands:sudo systemctl start firewalld sudo firewall-cmd --zone=public --add-service=http --permanent sudo firewall-cmd --add-port=5000/tcp --zone=libvirt --permanent sudo firewall-cmd --add-port=5000/tcp --zone=public --permanent sudo firewall-cmd --reload
Start and enable the
libvirtd
service by entering the following commands:sudo systemctl start libvirtd sudo systemctl enable libvirtd --now
Create the default storage pool and start it by entering the following commands:
sudo virsh pool-define-as --name default --type dir --target /var/lib/libvirt/images sudo virsh pool-start default sudo virsh pool-autostart default
View the following examples to configure networking:
Provisioning Network (IPv4 address)
sudo nohup bash -c """ nmcli con down "$PROV_CONN" nmcli con delete "$PROV_CONN" # RHEL 8.1 appends the word "System" in front of the connection, delete in case it exists nmcli con down "System $PROV_CONN" nmcli con delete "System $PROV_CONN" nmcli connection add ifname provisioning type bridge con-name provisioning nmcli con add type bridge-worker ifname "$PROV_CONN" master provisioning nmcli connection modify provisioning ipv4.addresses 172.22.0.1/24 ipv4.method manual nmcli con down provisioning nmcli con up provisioning"""
The SSH connection might disconnect after you complete this step.
The IPv4 address can be any address as long as it is not routable using the baremetal network.
Provisioning Network (IPv6 address)
sudo nohup bash -c """ nmcli con down "$PROV_CONN" nmcli con delete "$PROV_CONN" # RHEL 8.1 appends the word "System" in front of the connection, delete in case it exists nmcli con down "System $PROV_CONN" nmcli con delete "System $PROV_CONN" nmcli connection add ifname provisioning type bridge con-name provisioning nmcli con add type bridge-worker ifname "$PROV_CONN" master provisioning nmcli connection modify provisioning ipv6.addresses fd00:1101::1/64 ipv6.method manual nmcli con down provisioning nmcli con up provisioning"""
The SSH connection might disconnect after you complete this step.
The IPv6 address can be any address as long as it is not routable using the baremetal network.
Ensure that UEFI is enabled and UEFI PXE settings are set to the IPv6 protocol when using IPv6 addressing.
Reconnect to the provisioner node by using
ssh
(if required).# ssh <user-name>@provisioner.<cluster-name>.<domain>
Verify the connection bridges have been correctly created by running the following command:
nmcli con show
Your returned results resemble the following content:
NAME
UUID
TYPE
DEVICE
baremetal
4d5133a5-8351-4bb9-bfd4-3af264801530
bridge
baremetal
provisioning
43942805-017f-4d7d-a2c2-7cb3324482ed
bridge
provisioning
virbr0
d9bca40f-eee1-410b-8879-a2d4bb0465e7
bridge
virbr0
bridge-worker-eno1
76a8ed50-c7e5-4999-b4f6-6d9014dd0812
ethernet
eno1
bridge-worker-eno2
f31c3353-54b7-48de-893a-02d2b34c4736
ethernet
eno2
Create a
pull-secret.txt
file by completing the following steps:vim pull-secret.txt
- In a web browser, navigate to Install OpenShift on Bare Metal with user-provisioned infrastructure, and scroll down to the Downloads section.
- Click Copy pull secret.
-
Paste the contents into the
pull-secret.txt
file and save the contents in the home directory of theuser-name
user.
You are ready to create your bare metal credential.
6.5.3. Creating a provider connection by using the console
To create a provider connection from the Red Hat Advanced Cluster Management for Kubernetes console, complete the following steps:
- From the navigation menu, navigate to Automate infrastructure > Clusters.
On the Clusters page, select the Provider connections tab.
Existing provider connections are displayed.
- Select Add connection.
- Select Bare metal as your provider.
- Add a name for your provider connection.
Select a namespace for your provider connection from the list.
Tip: Create a namespace specifically to host your provider connections, both for convenience and added security.
- You can optionally add a Base DNS domain for your provider connection. If you add the base DNS domain to the provider connection, it is automatically populated in the correct field when you create a cluster with this provider connection.
Add your libvirt URI. The libvirt URI is for your provisioning node that you created for your bootstrap node. Your libvirt URI should resemble the following example:
<qemu+ssh>:://<user-name>@<provision-host.com>/system
-
Replace
qemu+ssh
with your method of connecting to the libvirt daemon on the provisioning host. -
Replace
user-name
with the user name that has access to create the bootstrap node on the provisioning host. Replace
provision-host.com
with a link to your provisioning host. This can be either an IP address or a fully-qualified domain name address.See Connection URIs for more information.
-
Replace
- Add a list of your SSH known hosts for the provisioning host. This value can be an IP address or a fully-qualified domain name address, but is best to use the same format that you used in the libvirt URI value.
- Enter your Red Hat OpenShift pull secret. You can download your pull secret from Pull secret.
- Add your SSH private key and your SSH public key so you can access the cluster. You can use an existing key, or use a key generation program to create a new one. See Generating an SSH private key and adding it to the agent for more information about how to generate a key.
For disconnected installations only: Complete the fields in the Configuration for disconnected installation subsection with the required information:
Image registry mirror: This value contains the disconnected registry path. The path contains the hostname, port, and repository path to all of the installation images for disconnected installations. Example:
repository.com:5000/openshift/ocp-release
.The path creates an image content source policy mapping in the
install-config.yaml
to the Red Hat OpenShift Container Platform release images. As an example,repository.com:5000
produces thisimageContentSource
content:imageContentSources: - mirrors: - registry.example.com:5000/ocp4 source: quay.io/openshift-release-dev/ocp-release-nightly - mirrors: - registry.example.com:5000/ocp4 source: quay.io/openshift-release-dev/ocp-release - mirrors: - registry.example.com:5000/ocp4 source: quay.io/openshift-release-dev/ocp-v4.0-art-dev
- Bootstrap OS image: This value contains the URL to the image to use for the bootstrap machine.
- Cluster OS image: This value contains the URL to the image to use for Red Hat OpenShift Container Platform cluster machines.
Additional trust bundle: This value provides the contents of the certificate file that is required to access the mirror registry.
Note: If you are deploying managed clusters from a hub that is in a disconnected environment, and want them to be automatically imported post install, add an Image Content Source Policy to the
install-config.yaml
file by using theYAML
editor. A sample entry is shown in the following example:imageContentSources: - mirrors: - registry.example.com:5000/rhacm2 source: registry.redhat.io/rhacm2
- Click Create. When you create the provider connection, it is added to the list of provider connections.
You can create a cluster that uses this provider connection by completing the steps in Creating a cluster on bare metal.
6.5.4. Deleting your provider connection
When you are no longer managing a cluster that is using a provider connection, delete the provider connection to protect the information in the provider connection.
- From the navigation menu, navigate to Automate infrastructure > Clusters.
- Select Provider connections.
- Select the options menu beside the provider connection that you want to delete.
- Select Delete connection.