GitOps workloads on infrastructure nodes

Procedure

1. Label existing nodes as infrastructure by running the following command:

   $ oc label node <node-name> node-role.kubernetes.io/infra=

2. Edit the GitOpsService custom resource (CR) to add the infrastructure node selector:

   $ oc edit gitopsservice -n openshift-gitops

3. In the GitOpsService CR file, add runOnInfra field to the spec section and set it to true. This field moves the control plane workloads in openshift-gitops namespace to the infrastructure nodes:

   apiVersion: pipelines.openshift.io/v1alpha1
   kind: GitopsService
   metadata:
     name: cluster
   spec:
     runOnInfra: true

4. Optional: Apply taints and isolate the workloads on infrastructure nodes and prevent other workloads from scheduling on these nodes.

   $ oc adm taint nodes -l node-role.kubernetes.io/infra
   infra=reserved:NoSchedule infra=reserved:NoExecute

5. Optional: If you apply taints to the nodes, you can add tolerations in the GitOpsService CR:

   spec:
     runOnInfra: true
     tolerations:
     - effect: NoSchedule
       key: infra
       value: reserved
     - effect: NoExecute
       key: infra
       value: reserved

Procedure

1. Label an existing node as infrastructure node by running the following command:

   $ oc label node <node_name> node-role.kubernetes.io/infra= 1

   1

   Replace <node_name> with the name of the node you want to label as infrastructure node.

   Example output

   node/<node_name> labeled

2. Edit the Red Hat OpenShift GitOps Subscription resource by running the following command:

   $ oc -n openshift-gitops-operator edit subscription openshift-gitops-operator

3. Add nodeSelector and tolerations to the spec.config field in the Subscription resource:

   Example Subscription

   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: openshift-gitops-operator
     namespace: openshift-gitops-operator
   spec:
     config:
       nodeSelector: 1
         node-role.kubernetes.io/infra: ""
       tolerations: 2
       - key: node-role.kubernetes.io/infra
         operator: Exists
         effect: NoSchedule

   1

   This ensures that the operator pod is only scheduled on an infrastructure node.

   2

   This ensures that the pod is accepted by the infrastructure node.

   Example output

   subscription.operators.coreos.com/openshift-gitops-operator edited

4. Verify that the GitOps Operator pod is running on the infrastructure node by running the following command:

   $ oc -n openshift-gitops-operator get po -owide

   Example output

   NAME                                                            READY   STATUS    RESTARTS   AGE   IP              NODE            NOMINATED NODE   READINESS GATES
   openshift-gitops-operator-controller-manager-abcd               2/2     Running   0          11m   94.142.44.126   <node_name>     <none>           <none> 1

   1

   Ensure that the listed <node_name> is the node with the node-role.kubernetes.io/infra label.