18.2. Installing a cluster with z/VM on IBM zSystems and IBM(R) LinuxONE

Procédure

1. Set up static IP addresses.
2. Set up an HTTP or HTTPS server to provide Ignition files to the cluster nodes.
3. Ensure that your network infrastructure provides the required network connectivity between the cluster components. See the Networking requirements for user-provisioned infrastructure section for details about the requirements.
4. Configure your firewall to enable the ports required for the OpenShift Container Platform cluster components to communicate. See Networking requirements for user-provisioned infrastructure section for details about the ports that are required.

5. Setup the required DNS infrastructure for your cluster.

   1. Configure DNS name resolution for the Kubernetes API, the application wildcard, the bootstrap machine, the control plane machines, and the compute machines.

   2. Configure reverse DNS resolution for the Kubernetes API, the bootstrap machine, the control plane machines, and the compute machines.

      See the User-provisioned DNS requirements section for more information about the OpenShift Container Platform DNS requirements.

6. Validate your DNS configuration.

   1. From your installation node, run DNS lookups against the record names of the Kubernetes API, the wildcard routes, and the cluster nodes. Validate that the IP addresses in the responses correspond to the correct components.

   2. From your installation node, run reverse DNS lookups against the IP addresses of the load balancer and the cluster nodes. Validate that the record names in the responses correspond to the correct components.

      See the Validating DNS resolution for user-provisioned infrastructure section for detailed DNS validation steps.

7. Provision the required API and application ingress load balancing infrastructure. See the Load balancing requirements for user-provisioned infrastructure section for more information about the requirements.

Procédure

1. From your installation node, run DNS lookups against the record names of the Kubernetes API, the wildcard routes, and the cluster nodes. Validate that the IP addresses contained in the responses correspond to the correct components.

   1. Perform a lookup against the Kubernetes API record name. Check that the result points to the IP address of the API load balancer:

      $ dig +noall +answer @<nameserver_ip> api.<cluster_name>.<base_domain> 

      1

      Copy to Clipboard Toggle word wrap

      1

      Replace <nameserver_ip> with the IP address of the nameserver, <cluster_name> with your cluster name, and <base_domain> with your base domain name.

      Exemple de sortie

      api.ocp4.example.com.		0	IN	A	192.168.1.5

      Copy to Clipboard Toggle word wrap

   2. Perform a lookup against the Kubernetes internal API record name. Check that the result points to the IP address of the API load balancer:

      $ dig +noall +answer @<nameserver_ip> api-int.<cluster_name>.<base_domain>

      Copy to Clipboard Toggle word wrap

      Exemple de sortie

      api-int.ocp4.example.com.		0	IN	A	192.168.1.5

      Copy to Clipboard Toggle word wrap

   3. Test an example *.apps.<cluster_name>.<base_domain> DNS wildcard lookup. All of the application wildcard lookups must resolve to the IP address of the application ingress load balancer:

      $ dig +noall +answer @<nameserver_ip> random.apps.<cluster_name>.<base_domain>

      Copy to Clipboard Toggle word wrap

      Exemple de sortie

      random.apps.ocp4.example.com.		0	IN	A	192.168.1.5

      Copy to Clipboard Toggle word wrap

      Note

      In the example outputs, the same load balancer is used for the Kubernetes API and application ingress traffic. In production scenarios, you can deploy the API and application ingress load balancers separately so that you can scale the load balancer infrastructure for each in isolation.

      You can replace random with another wildcard value. For example, you can query the route to the OpenShift Container Platform console:

      $ dig +noall +answer @<nameserver_ip> console-openshift-console.apps.<cluster_name>.<base_domain>

      Copy to Clipboard Toggle word wrap

      Exemple de sortie

      console-openshift-console.apps.ocp4.example.com. 0 IN	A 192.168.1.5

      Copy to Clipboard Toggle word wrap

   4. Run a lookup against the bootstrap DNS record name. Check that the result points to the IP address of the bootstrap node:

      $ dig +noall +answer @<nameserver_ip> bootstrap.<cluster_name>.<base_domain>

      Copy to Clipboard Toggle word wrap

      Exemple de sortie

      bootstrap.ocp4.example.com.		0	IN	A	192.168.1.96

      Copy to Clipboard Toggle word wrap

   5. Use this method to perform lookups against the DNS record names for the control plane and compute nodes. Check that the results correspond to the IP addresses of each node.

2. From your installation node, run reverse DNS lookups against the IP addresses of the load balancer and the cluster nodes. Validate that the record names contained in the responses correspond to the correct components.

   1. Perform a reverse lookup against the IP address of the API load balancer. Check that the response includes the record names for the Kubernetes API and the Kubernetes internal API:

      $ dig +noall +answer @<nameserver_ip> -x 192.168.1.5

      Copy to Clipboard Toggle word wrap

      Exemple de sortie

      5.1.168.192.in-addr.arpa. 0	IN	PTR	api-int.ocp4.example.com. 

      1

      
      5.1.168.192.in-addr.arpa. 0	IN	PTR	api.ocp4.example.com. 

      2

      Copy to Clipboard Toggle word wrap

      1

      Provides the record name for the Kubernetes internal API.

      2

      Provides the record name for the Kubernetes API.

      Note

      A PTR record is not required for the OpenShift Container Platform application wildcard. No validation step is needed for reverse DNS resolution against the IP address of the application ingress load balancer.

   2. Perform a reverse lookup against the IP address of the bootstrap node. Check that the result points to the DNS record name of the bootstrap node:

      $ dig +noall +answer @<nameserver_ip> -x 192.168.1.96

      Copy to Clipboard Toggle word wrap

      Exemple de sortie

      96.1.168.192.in-addr.arpa. 0	IN	PTR	bootstrap.ocp4.example.com.

      Copy to Clipboard Toggle word wrap

   3. Use this method to perform reverse lookups against the IP addresses for the control plane and compute nodes. Check that the results correspond to the DNS record names of each node.

Procédure

1. If you do not have an existing SSH key pair on your local machine to use for authentication onto your cluster nodes, create one. For example, on a computer that uses a Linux operating system, run the following command:

   $ ssh-keygen -t ed25519 -N '' -f <path>/<file_name> 

   1

   Copy to Clipboard Toggle word wrap

   1

   Specify the path and file name, such as ~/.ssh/id_ed25519, of the new SSH key. If you have an existing key pair, ensure your public key is in the your ~/.ssh directory.

   Note

   If you plan to install an OpenShift Container Platform cluster that uses FIPS Validated / Modules in Process cryptographic libraries on the x86_64 architecture, do not create a key that uses the ed25519 algorithm. Instead, create a key that uses the rsa or ecdsa algorithm.

2. View the public SSH key:

   $ cat <path>/<file_name>.pub

   Copy to Clipboard Toggle word wrap

   For example, run the following to view the ~/.ssh/id_ed25519.pub public key:

   $ cat ~/.ssh/id_ed25519.pub

   Copy to Clipboard Toggle word wrap

3. Add the SSH private key identity to the SSH agent for your local user, if it has not already been added. SSH agent management of the key is required for password-less SSH authentication onto your cluster nodes, or if you want to use the ./openshift-install gather command.

   Note

   On some distributions, default SSH private key identities such as ~/.ssh/id_rsa and ~/.ssh/id_dsa are managed automatically.

   1. If the ssh-agent process is not already running for your local user, start it as a background task:

      $ eval "$(ssh-agent -s)"

      Copy to Clipboard Toggle word wrap

      Exemple de sortie

      Agent pid 31874

      Copy to Clipboard Toggle word wrap

      Note

      If your cluster is in FIPS mode, only use FIPS-compliant algorithms to generate the SSH key. The key must be either RSA or ECDSA.

4. Add your SSH private key to the ssh-agent:

   $ ssh-add <path>/<file_name> 

   1

   Copy to Clipboard Toggle word wrap

   1

   Specify the path and file name for your SSH private key, such as ~/.ssh/id_ed25519

   Exemple de sortie

   Identity added: /home/<you>/<path>/<file_name> (<computer_name>)

   Copy to Clipboard Toggle word wrap

Procédure

1. Access the Infrastructure Provider page on the OpenShift Cluster Manager site. If you have a Red Hat account, log in with your credentials. If you do not, create an account.
2. Select your infrastructure provider.

3. Navigate to the page for your installation type, download the installation program that corresponds with your host operating system and architecture, and place the file in the directory where you will store the installation configuration files.

   Important

   The installation program creates several files on the computer that you use to install your cluster. You must keep the installation program and the files that the installation program creates after you finish installing the cluster. Both files are required to delete the cluster.

   Important

   Deleting the files created by the installation program does not remove your cluster, even if the cluster failed during installation. To remove your cluster, complete the OpenShift Container Platform uninstallation procedures for your specific cloud provider.

4. Extract the installation program. For example, on a computer that uses a Linux operating system, run the following command:

   $ tar -xvf openshift-install-linux.tar.gz

   Copy to Clipboard Toggle word wrap
5. Download your installation pull secret from the Red Hat OpenShift Cluster Manager. This pull secret allows you to authenticate with the services that are provided by the included authorities, including Quay.io, which serves the container images for OpenShift Container Platform components.

Procédure

1. Naviguez jusqu'à la page de téléchargements OpenShift Container Platform sur le portail client Red Hat.
2. Sélectionnez l'architecture dans la liste déroulante Product Variant.
3. Sélectionnez la version appropriée dans la liste déroulante Version.
4. Cliquez sur Download Now à côté de l'entrée OpenShift v4.12 Linux Client et enregistrez le fichier.

5. Décompressez l'archive :

   tar xvf <file>

   Copy to Clipboard Toggle word wrap

6. Placez le fichier binaire oc dans un répertoire situé sur votre site PATH.

   Pour vérifier votre PATH, exécutez la commande suivante :

   $ echo $PATH

   Copy to Clipboard Toggle word wrap

Procédure

1. Naviguez jusqu'à la page de téléchargements OpenShift Container Platform sur le portail client Red Hat.
2. Sélectionnez la version appropriée dans la liste déroulante Version.
3. Cliquez sur Download Now à côté de l'entrée OpenShift v4.12 Windows Client et enregistrez le fichier.
4. Décompressez l'archive à l'aide d'un programme ZIP.

5. Déplacez le fichier binaire oc dans un répertoire situé sur votre site PATH.

   Pour vérifier votre PATH, ouvrez l'invite de commande et exécutez la commande suivante :

   C:\N> path

   Copy to Clipboard Toggle word wrap

Procédure

1. Naviguez jusqu'à la page de téléchargements OpenShift Container Platform sur le portail client Red Hat.
2. Sélectionnez la version appropriée dans la liste déroulante Version.

3. Cliquez sur Download Now à côté de l'entrée OpenShift v4.12 macOS Client et enregistrez le fichier.

   Note

   Pour macOS arm64, choisissez l'entrée OpenShift v4.12 macOS arm64 Client.

4. Décompressez l'archive.

5. Déplacez le binaire oc dans un répertoire de votre PATH.

   Pour vérifier votre PATH, ouvrez un terminal et exécutez la commande suivante :

   $ echo $PATH

   Copy to Clipboard Toggle word wrap

Procédure

1. Create an installation directory to store your required installation assets in:

   $ mkdir <installation_directory>

   Copy to Clipboard Toggle word wrap
   Important

   You must create a directory. Some installation assets, like bootstrap X.509 certificates have short expiration intervals, so you must not reuse an installation directory. If you want to reuse individual files from another cluster installation, you can copy them into your directory. However, the file names for the installation assets might change between releases. Use caution when copying installation files from an earlier OpenShift Container Platform version.

2. Customize the sample install-config.yaml file template that is provided and save it in the <installation_directory>.

   Note

   You must name this configuration file install-config.yaml.

   Note

   For some platform types, you can alternatively run ./openshift-install create install-config --dir <installation_directory> to generate an install-config.yaml file. You can provide details about your cluster configuration at the prompts.

3. Back up the install-config.yaml file so that you can use it to install multiple clusters.

   Important

   The install-config.yaml file is consumed during the next step of the installation process. You must back it up now.

Procédure

1. Change to the directory that contains the OpenShift Container Platform installation program and generate the Kubernetes manifests for the cluster:

   $ ./openshift-install create manifests --dir <installation_directory> 

   1

   Copy to Clipboard Toggle word wrap

   1

   For <installation_directory>, specify the installation directory that contains the install-config.yaml file you created.

   Avertissement

   If you are installing a three-node cluster, skip the following step to allow the control plane nodes to be schedulable.

   Important

   When you configure control plane nodes from the default unschedulable to schedulable, additional subscriptions are required. This is because control plane nodes then become compute nodes.

2. Check that the mastersSchedulable parameter in the <installation_directory>/manifests/cluster-scheduler-02-config.yml Kubernetes manifest file is set to false. This setting prevents pods from being scheduled on the control plane machines:

   1. Open the <installation_directory>/manifests/cluster-scheduler-02-config.yml file.
   2. Locate the mastersSchedulable parameter and ensure that it is set to false.
   3. Save and exit the file.

3. To create the Ignition configuration files, run the following command from the directory that contains the installation program:

   $ ./openshift-install create ignition-configs --dir <installation_directory> 

   1

   Copy to Clipboard Toggle word wrap

   1

   For <installation_directory>, specify the same installation directory.

   Ignition config files are created for the bootstrap, control plane, and compute nodes in the installation directory. The kubeadmin-password and kubeconfig files are created in the ./<installation_directory>/auth directory:

   .
   ├── auth
   │   ├── kubeadmin-password
   │   └── kubeconfig
   ├── bootstrap.ign
   ├── master.ign
   ├── metadata.json
   └── worker.ign

   Copy to Clipboard Toggle word wrap

Procédure

1. Log in to Linux on your provisioning machine.

2. Obtain the Red Hat Enterprise Linux CoreOS (RHCOS) kernel, initramfs, and rootfs files from the RHCOS image mirror.

   Important

   The RHCOS images might not change with every release of OpenShift Container Platform. You must download images with the highest version that is less than or equal to the OpenShift Container Platform version that you install. Only use the appropriate kernel, initramfs, and rootfs artifacts described in the following procedure.

   The file names contain the OpenShift Container Platform version number. They resemble the following examples:

   • kernel: rhcos-<version>-live-kernel-<architecture>
   • initramfs: rhcos-<version>-live-initramfs.<architecture>.img

   • rootfs: rhcos-<version>-live-rootfs.<architecture>.img

     Note

     The rootfs image is the same for FCP and DASD.

3. Create parameter files. The following parameters are specific for a particular virtual machine:

   • For ip=, specify the following seven entries:

     1. The IP address for the machine.
     2. An empty string.
     3. The gateway.
     4. The netmask.
     5. The machine host and domain name in the form hostname.domainname. Omit this value to let RHCOS decide.
     6. The network interface name. Omit this value to let RHCOS decide.
     7. If you use static IP addresses, specify none.
   • For coreos.inst.ignition_url=, specify the Ignition file for the machine role. Use bootstrap.ign, master.ign, or worker.ign. Only HTTP and HTTPS protocols are supported.
   • For coreos.live.rootfs_url=, specify the matching rootfs artifact for the kernel and initramfs you are booting. Only HTTP and HTTPS protocols are supported.

   • For installations on DASD-type disks, complete the following tasks:

     1. For coreos.inst.install_dev=, specify dasda.
     2. Use rd.dasd= to specify the DASD where RHCOS is to be installed.

     3. Leave all other parameters unchanged.

        Example parameter file, bootstrap-0.parm, for the bootstrap machine:

        rd.neednet=1 \
        console=ttysclp0 \
        coreos.inst.install_dev=dasda \
        coreos.live.rootfs_url=http://cl1.provide.example.com:8080/assets/rhcos-live-rootfs.s390x.img \
        coreos.inst.ignition_url=http://cl1.provide.example.com:8080/ignition/bootstrap.ign \
        ip=172.18.78.2::172.18.78.1:255.255.255.0:::none nameserver=172.18.78.1 \
        rd.znet=qeth,0.0.bdf0,0.0.bdf1,0.0.bdf2,layer2=1,portno=0 \
        zfcp.allow_lun_scan=0 \
        rd.dasd=0.0.3490

        Copy to Clipboard Toggle word wrap

        Write all options in the parameter file as a single line and make sure you have no newline characters.

   • For installations on FCP-type disks, complete the following tasks:

     1. Use rd.zfcp=<adapter>,<wwpn>,<lun> to specify the FCP disk where RHCOS is to be installed. For multipathing repeat this step for each additional path.

        Note

        When you install with multiple paths, you must enable multipathing directly after the installation, not at a later point in time, as this can cause problems.

     2. Set the install device as: coreos.inst.install_dev=sda.

        Note

        If additional LUNs are configured with NPIV, FCP requires zfcp.allow_lun_scan=0. If you must enable zfcp.allow_lun_scan=1 because you use a CSI driver, for example, you must configure your NPIV so that each node cannot access the boot partition of another node.

     3. Leave all other parameters unchanged.

        Important

        Additional post-installation steps are required to fully enable multipathing. For more information, see “Enabling multipathing with kernel arguments on RHCOS" in Post-installation machine configuration tasks.

        The following is an example parameter file worker-1.parm for a worker node with multipathing:

        rd.neednet=1 \
        console=ttysclp0 \
        coreos.inst.install_dev=sda \
        coreos.live.rootfs_url=http://cl1.provide.example.com:8080/assets/rhcos-live-rootfs.s390x.img \
        coreos.inst.ignition_url=http://cl1.provide.example.com:8080/ignition/worker.ign \
        ip=172.18.78.2::172.18.78.1:255.255.255.0:::none nameserver=172.18.78.1 \
        rd.znet=qeth,0.0.bdf0,0.0.bdf1,0.0.bdf2,layer2=1,portno=0 \
        zfcp.allow_lun_scan=0 \
        rd.zfcp=0.0.1987,0x50050763070bc5e3,0x4008400B00000000 \
        rd.zfcp=0.0.19C7,0x50050763070bc5e3,0x4008400B00000000 \
        rd.zfcp=0.0.1987,0x50050763071bc5e3,0x4008400B00000000 \
        rd.zfcp=0.0.19C7,0x50050763071bc5e3,0x4008400B00000000

        Copy to Clipboard Toggle word wrap

        Write all options in the parameter file as a single line and make sure you have no newline characters.

4. Transfer the initramfs, kernel, parameter files, and RHCOS images to z/VM, for example with FTP. For details about how to transfer the files with FTP and boot from the virtual reader, see Installing under Z/VM.

5. Punch the files to the virtual reader of the z/VM guest virtual machine that is to become your bootstrap node.

   See PUNCH in IBM Documentation.

   Astuce

   You can use the CP PUNCH command or, if you use Linux, the vmur command to transfer files between two z/VM guest virtual machines.

6. Log in to CMS on the bootstrap machine.

7. IPL the bootstrap machine from the reader:

   $ ipl c

   Copy to Clipboard Toggle word wrap

   See IPL in IBM Documentation.

8. Repeat this procedure for the other machines in the cluster.

Procédure

1. Monitor the bootstrap process:

   $ ./openshift-install --dir <installation_directory> wait-for bootstrap-complete \ 

   1

   
       --log-level=info 

   2

   Copy to Clipboard Toggle word wrap

   1

   For <installation_directory>, specify the path to the directory that you stored the installation files in.

   2

   To view different installation details, specify warn, debug, or error instead of info.

   Exemple de sortie

   INFO Waiting up to 30m0s for the Kubernetes API at https://api.test.example.com:6443...
   INFO API v1.25.0 up
   INFO Waiting up to 30m0s for bootstrapping to complete...
   INFO It is now safe to remove the bootstrap resources

   Copy to Clipboard Toggle word wrap

   The command succeeds when the Kubernetes API server signals that it has been bootstrapped on the control plane machines.

2. After the bootstrap process is complete, remove the bootstrap machine from the load balancer.

   Important

   You must remove the bootstrap machine from the load balancer at this point. You can also remove or reformat the bootstrap machine itself.

Procédure

1. Export the kubeadmin credentials:

   $ export KUBECONFIG=<installation_directory>/auth/kubeconfig 

   1

   Copy to Clipboard Toggle word wrap

   1

   For <installation_directory>, specify the path to the directory that you stored the installation files in.

2. Verify you can run oc commands successfully using the exported configuration:

   $ oc whoami

   Copy to Clipboard Toggle word wrap

   Exemple de sortie

   system:admin

   Copy to Clipboard Toggle word wrap

Procédure

1. Confirm that the cluster recognizes the machines:

   $ oc get nodes

   Copy to Clipboard Toggle word wrap

   Exemple de sortie

   NAME      STATUS    ROLES   AGE  VERSION
   master-0  Ready     master  63m  v1.25.0
   master-1  Ready     master  63m  v1.25.0
   master-2  Ready     master  64m  v1.25.0

   Copy to Clipboard Toggle word wrap

   The output lists all of the machines that you created.

   Note

   The preceding output might not include the compute nodes, also known as worker nodes, until some CSRs are approved.

2. Review the pending CSRs and ensure that you see the client requests with the Pending or Approved status for each machine that you added to the cluster:

   $ oc get csr

   Copy to Clipboard Toggle word wrap

   Exemple de sortie

   NAME        AGE   REQUESTOR                                   CONDITION
   csr-mddf5   20m   system:node:master-01.example.com   Approved,Issued
   csr-z5rln   16m   system:node:worker-21.example.com   Approved,Issued

   Copy to Clipboard Toggle word wrap

3. If the CSRs were not approved, after all of the pending CSRs for the machines you added are in Pending status, approve the CSRs for your cluster machines:

   Note

   Because the CSRs rotate automatically, approve your CSRs within an hour of adding the machines to the cluster. If you do not approve them within an hour, the certificates will rotate, and more than two certificates will be present for each node. You must approve all of these certificates. After the client CSR is approved, the Kubelet creates a secondary CSR for the serving certificate, which requires manual approval. Then, subsequent serving certificate renewal requests are automatically approved by the machine-approver if the Kubelet requests a new certificate with identical parameters.

   Note

   For clusters running on platforms that are not machine API enabled, such as bare metal and other user-provisioned infrastructure, you must implement a method of automatically approving the kubelet serving certificate requests (CSRs). If a request is not approved, then the oc exec, oc rsh, and oc logs commands cannot succeed, because a serving certificate is required when the API server connects to the kubelet. Any operation that contacts the Kubelet endpoint requires this certificate approval to be in place. The method must watch for new CSRs, confirm that the CSR was submitted by the node-bootstrapper service account in the system:node or system:admin groups, and confirm the identity of the node.

   • To approve them individually, run the following command for each valid CSR:

     $ oc adm certificate approve <csr_name> 

     1

     Copy to Clipboard Toggle word wrap

     1

     <csr_name> est le nom d'un CSR figurant dans la liste des CSR actuels.

   • To approve all pending CSRs, run the following command:

     $ oc get csr -o go-template='{{range .items}}{{if not .status}}{{.metadata.name}}{{"\n"}}{{end}}{{end}}' | xargs --no-run-if-empty oc adm certificate approve

     Copy to Clipboard Toggle word wrap
     Note

     Some Operators might not become available until some CSRs are approved.

4. Now that your client requests are approved, you must review the server requests for each machine that you added to the cluster:

   $ oc get csr

   Copy to Clipboard Toggle word wrap

   Exemple de sortie

   NAME        AGE     REQUESTOR                                                                   CONDITION
   csr-bfd72   5m26s   system:node:ip-10-0-50-126.us-east-2.compute.internal                       Pending
   csr-c57lv   5m26s   system:node:ip-10-0-95-157.us-east-2.compute.internal                       Pending
   ...

   Copy to Clipboard Toggle word wrap

5. If the remaining CSRs are not approved, and are in the Pending status, approve the CSRs for your cluster machines:

   • To approve them individually, run the following command for each valid CSR:

     $ oc adm certificate approve <csr_name> 

     1

     Copy to Clipboard Toggle word wrap

     1

     <csr_name> est le nom d'un CSR figurant dans la liste des CSR actuels.

   • To approve all pending CSRs, run the following command:

     $ oc get csr -o go-template='{{range .items}}{{if not .status}}{{.metadata.name}}{{"\n"}}{{end}}{{end}}' | xargs oc adm certificate approve

     Copy to Clipboard Toggle word wrap

6. After all client and server CSRs have been approved, the machines have the Ready status. Verify this by running the following command:

   $ oc get nodes

   Copy to Clipboard Toggle word wrap

   Exemple de sortie

   NAME      STATUS    ROLES   AGE  VERSION
   master-0  Ready     master  73m  v1.25.0
   master-1  Ready     master  73m  v1.25.0
   master-2  Ready     master  74m  v1.25.0
   worker-0  Ready     worker  11m  v1.25.0
   worker-1  Ready     worker  11m  v1.25.0

   Copy to Clipboard Toggle word wrap

   Note

   It can take a few minutes after approval of the server CSRs for the machines to transition to the Ready status.

Procédure

1. Watch the cluster components come online:

   $ watch -n5 oc get clusteroperators

   Copy to Clipboard Toggle word wrap

   Exemple de sortie

   NAME                                       VERSION   AVAILABLE   PROGRESSING   DEGRADED   SINCE
   authentication                             4.12.0    True        False         False      19m
   baremetal                                  4.12.0    True        False         False      37m
   cloud-credential                           4.12.0    True        False         False      40m
   cluster-autoscaler                         4.12.0    True        False         False      37m
   config-operator                            4.12.0    True        False         False      38m
   console                                    4.12.0    True        False         False      26m
   csi-snapshot-controller                    4.12.0    True        False         False      37m
   dns                                        4.12.0    True        False         False      37m
   etcd                                       4.12.0    True        False         False      36m
   image-registry                             4.12.0    True        False         False      31m
   ingress                                    4.12.0    True        False         False      30m
   insights                                   4.12.0    True        False         False      31m
   kube-apiserver                             4.12.0    True        False         False      26m
   kube-controller-manager                    4.12.0    True        False         False      36m
   kube-scheduler                             4.12.0    True        False         False      36m
   kube-storage-version-migrator              4.12.0    True        False         False      37m
   machine-api                                4.12.0    True        False         False      29m
   machine-approver                           4.12.0    True        False         False      37m
   machine-config                             4.12.0    True        False         False      36m
   marketplace                                4.12.0    True        False         False      37m
   monitoring                                 4.12.0    True        False         False      29m
   network                                    4.12.0    True        False         False      38m
   node-tuning                                4.12.0    True        False         False      37m
   openshift-apiserver                        4.12.0    True        False         False      32m
   openshift-controller-manager               4.12.0    True        False         False      30m
   openshift-samples                          4.12.0    True        False         False      32m
   operator-lifecycle-manager                 4.12.0    True        False         False      37m
   operator-lifecycle-manager-catalog         4.12.0    True        False         False      37m
   operator-lifecycle-manager-packageserver   4.12.0    True        False         False      32m
   service-ca                                 4.12.0    True        False         False      38m
   storage                                    4.12.0    True        False         False      37m

   Copy to Clipboard Toggle word wrap

2. Configure the Operators that are not available.

Procédure

1. Confirm that all the cluster components are online with the following command:

   $ watch -n5 oc get clusteroperators

   Copy to Clipboard Toggle word wrap

   Exemple de sortie

   NAME                                       VERSION   AVAILABLE   PROGRESSING   DEGRADED   SINCE
   authentication                             4.12.0    True        False         False      19m
   baremetal                                  4.12.0    True        False         False      37m
   cloud-credential                           4.12.0    True        False         False      40m
   cluster-autoscaler                         4.12.0    True        False         False      37m
   config-operator                            4.12.0    True        False         False      38m
   console                                    4.12.0    True        False         False      26m
   csi-snapshot-controller                    4.12.0    True        False         False      37m
   dns                                        4.12.0    True        False         False      37m
   etcd                                       4.12.0    True        False         False      36m
   image-registry                             4.12.0    True        False         False      31m
   ingress                                    4.12.0    True        False         False      30m
   insights                                   4.12.0    True        False         False      31m
   kube-apiserver                             4.12.0    True        False         False      26m
   kube-controller-manager                    4.12.0    True        False         False      36m
   kube-scheduler                             4.12.0    True        False         False      36m
   kube-storage-version-migrator              4.12.0    True        False         False      37m
   machine-api                                4.12.0    True        False         False      29m
   machine-approver                           4.12.0    True        False         False      37m
   machine-config                             4.12.0    True        False         False      36m
   marketplace                                4.12.0    True        False         False      37m
   monitoring                                 4.12.0    True        False         False      29m
   network                                    4.12.0    True        False         False      38m
   node-tuning                                4.12.0    True        False         False      37m
   openshift-apiserver                        4.12.0    True        False         False      32m
   openshift-controller-manager               4.12.0    True        False         False      30m
   openshift-samples                          4.12.0    True        False         False      32m
   operator-lifecycle-manager                 4.12.0    True        False         False      37m
   operator-lifecycle-manager-catalog         4.12.0    True        False         False      37m
   operator-lifecycle-manager-packageserver   4.12.0    True        False         False      32m
   service-ca                                 4.12.0    True        False         False      38m
   storage                                    4.12.0    True        False         False      37m

   Copy to Clipboard Toggle word wrap

   Alternatively, the following command notifies you when all of the clusters are available. It also retrieves and displays credentials:

   $ ./openshift-install --dir <installation_directory> wait-for install-complete 

   1

   Copy to Clipboard Toggle word wrap

   1

   For <installation_directory>, specify the path to the directory that you stored the installation files in.

   Exemple de sortie

   INFO Waiting up to 30m0s for the cluster to initialize...

   Copy to Clipboard Toggle word wrap

   The command succeeds when the Cluster Version Operator finishes deploying the OpenShift Container Platform cluster from Kubernetes API server.

   Important
   • Les fichiers de configuration d'Ignition générés par le programme d'installation contiennent des certificats qui expirent après 24 heures et qui sont renouvelés à ce moment-là. Si le cluster est arrêté avant le renouvellement des certificats et qu'il est redémarré après l'expiration des 24 heures, le cluster récupère automatiquement les certificats expirés. L'exception est que vous devez approuver manuellement les demandes de signature de certificat (CSR) de node-bootstrapper en attente pour récupérer les certificats de kubelet. Pour plus d'informations, consultez la documentation relative à Recovering from expired control plane certificates.
   • Il est recommandé d'utiliser les fichiers de configuration Ignition dans les 12 heures suivant leur génération, car le certificat de 24 heures tourne entre 16 et 22 heures après l'installation du cluster. En utilisant les fichiers de configuration Ignition dans les 12 heures, vous pouvez éviter l'échec de l'installation si la mise à jour du certificat s'exécute pendant l'installation.

2. Confirm that the Kubernetes API server is communicating with the pods.

   1. To view a list of all pods, use the following command:

      $ oc get pods --all-namespaces

      Copy to Clipboard Toggle word wrap

      Exemple de sortie

      NAMESPACE                         NAME                                            READY   STATUS      RESTARTS   AGE
      openshift-apiserver-operator      openshift-apiserver-operator-85cb746d55-zqhs8   1/1     Running     1          9m
      openshift-apiserver               apiserver-67b9g                                 1/1     Running     0          3m
      openshift-apiserver               apiserver-ljcmx                                 1/1     Running     0          1m
      openshift-apiserver               apiserver-z25h4                                 1/1     Running     0          2m
      openshift-authentication-operator authentication-operator-69d5d8bf84-vh2n8        1/1     Running     0          5m
      ...

      Copy to Clipboard Toggle word wrap

   2. View the logs for a pod that is listed in the output of the previous command by using the following command:

      $ oc logs <pod_name> -n <namespace> 

      1

      Copy to Clipboard Toggle word wrap

      1

      Specify the pod name and namespace, as shown in the output of the previous command.

      If the pod logs display, the Kubernetes API server can communicate with the cluster machines.

3. For an installation with Fibre Channel Protocol (FCP), additional steps are required to enable multipathing. Do not enable multipathing during installation.

   See "Enabling multipathing with kernel arguments on RHCOS" in the Post-installation machine configuration tasks documentation for more information.