Configuring

Red Hat build of MicroShift searches for a configuration file in the user-specific directory, ~/.microshift/config.yaml, then the system-wide /etc/microshift/config.yaml directory. You must create the configuration file and specify any settings that should override the defaults before starting Red Hat build of MicroShift.

dns:
  baseDomain: microshift.example.com 1
network:
  clusterNetwork:
    - cidr: 10.42.0.0/16 2
  serviceNetwork:
    - 10.43.0.0/16 3
  serviceNodePortRange: 30000-32767 4
node:
  hostnameOverride: "" 5
  nodeIP: "" 6
apiServer:
  subjectAltNames: [] 7
debugging:
  logLevel: "Normal" 8

The serviceNodePortRange setting extends the port range available to NodePort services. This option is useful when specific standard ports under the 30000-32767 range need to be exposed. For example, if your device needs to expose the 1883/tcp MQ Telemetry Transport (MQTT) port on the network because client devices cannot use a different port.

Consider the following when configuring the NodePort service ranges:

The two categories of kubeconfig files used in Red Hat build of MicroShift are local access and remote access. Every time Red Hat build of MicroShift starts, a set of kubeconfig files for local and remote access to the API server are generated. These files are generated in the /var/lib/microshift/resources/kubeadmin/ directory using preexisting configuration information.

Each access type requires a different authentication certificate signed by different Certificate Authorities (CAs). The generation of multiple kubeconfig files accommodates this need.

You can use the appropriate kubeconfig file for the access type needed in each case to provide authentication details. The contents of Red Hat build of MicroShift kubeconfig files are determined by either default built-in values or a config.yaml file.

/var/lib/microshift/resources/kubeadmin/
├── kubeconfig 1
├── alt-name-1 2
│   └── kubeconfig
├── 1.2.3.4 3
│   └── kubeconfig
└── microshift-rhel9 4
    └── kubeconfig

The local access kubeconfig file is written to /var/lib/microshift/resources/kubeadmin/kubeconfig. This kubeconfig file provides access to the API server using localhost. Choose this file when you are connecting the cluster locally.

clusters:
- cluster:
    certificate-authority-data: <base64 CA>
    server: https://localhost:6443

The localhost kubeconfig file can only be used from a client connecting to the API server from the same host. The certificates in the file do not work for remote connections.

When a Red Hat build of MicroShift cluster connects to the API server from an external source, a certificate with all of the alternative names in the SAN field is used for validation. Red Hat build of MicroShift generates a default kubeconfig for external access using the hostname value. The defaults are set in the <node.hostnameOverride>, <node.nodeIP> and api.<dns.baseDomain> parameter values of the default kubeconfig file.

The /var/lib/microshift/resources/kubeadmin/<hostname>/kubeconfig file uses the hostname of the machine, or node.hostnameOverride if that option is set, to reach the API server. The CA of the kubeconfig file is able to validate certificates when accessed externally.

clusters:
- cluster:
    certificate-authority-data: <base64 CA>
    server: https://microshift-rhel9:6443

You can generate additional kubeconfig files to use if you need more host names or IP addresses than the default remote access file provides.