Chapter 4. Creating a cluster on GCP

Procedure

1. Log in to OpenShift Cluster Manager and click Create cluster.
2. On the Create an OpenShift cluster page, select Create cluster in the Red Hat OpenShift Dedicated row.

3. Under Billing model, configure the subscription type and infrastructure type:

   1. Select a subscription type. For information about OpenShift Dedicated subscription options, see Cluster subscriptions and registration in the OpenShift Cluster Manager documentation.

      Note

      The subscription types that are available to you depend on your OpenShift Dedicated subscriptions and resource quotas. For more information, contact your sales representative or Red Hat support.

   2. Select the Customer Cloud Subscription infrastructure type to deploy OpenShift Dedicated in an existing cloud provider account that you own.
   3. Click Next.
4. Select Run on Google Cloud Platform.

5. Select either Service account or Workload Identity Federation as the Authentication type.

   Note

   For more information about authentication types, click the question icon located next to Authentication type.

6. Review and complete the listed Prerequisites.
7. Select the checkbox to acknowledge that you have read and completed all of the prerequisites.
8. If you selected Service account as the Authentication type, provide your GCP service account private key in JSON format. You can either click Browse to locate and attach a JSON file or add the details in the Service account JSON field.

9. If you selected Workload Identity Federation as the Authentication type, you will first need to create a new WIF configuration. Open a terminal window and run the following ocm CLI command.

   $ ocm gcp create wif-config --name <wif_name> \ 1
     --project <gcp_project_id> 2

   1

   Replace <wif_name> with the name of your WIF configuration.

   2

   Replace <gcp_project_id> with the ID of the Google Cloud Platform (GCP) project where the WIF configuration will be implemented.

10. Select a configured WIF configuration from the WIF configuration drop-down list. If you want to select the WIF configuration you created in the last step, click Refresh first.
11. Click Next to validate your cloud provider account and go to the Cluster details page.

12. On the Cluster details page, provide a name for your cluster and specify the cluster details:

    1. Add a Cluster name.

    2. Optional: Cluster creation generates a domain prefix as a subdomain for your provisioned cluster on openshiftapps.com. If the cluster name is less than or equal to 15 characters, that name is used for the domain prefix. If the cluster name is longer than 15 characters, the domain prefix is randomly generated to a 15 character string.

       To customize the subdomain, select the Create customize domain prefix checkbox, and enter your domain prefix name in the Domain prefix field. The domain prefix cannot be longer than 15 characters, must be unique within your organization, and cannot be changed after cluster creation.

    3. Select a cluster version from the Version drop-down menu.

       Note

       Workload Identity Federation (WIF) is only supported on OpenShift Dedicated version 4.17 and later.

    4. Select a cloud provider region from the Region drop-down menu.
    5. Select a Single zone or Multi-zone configuration.

    6. Optional: Select Enable Secure Boot for Shielded VMs to use Shielded VMs when installing your cluster. For more information, see Shielded VMs.

       Important

       To successfully create a cluster, you must select Enable Secure Boot support for Shielded VMs if your organization has the policy constraint constraints/compute.requireShieldedVm enabled. For more information regarding GCP organizational policy constraints, see Organization policy constraints.

    7. Leave Enable user workload monitoring selected to monitor your own projects in isolation from Red Hat Site Reliability Engineer (SRE) platform metrics. This option is enabled by default.

    8. Optional: Expand Advanced Encryption to make changes to encryption settings.

       1. Select Use Custom KMS keys to use custom KMS keys. If you prefer not to use custom KMS keys, leave the default setting Use default KMS Keys.

          Important

          To use custom KMS keys, the IAM service account osd-ccs-admin must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role. For more information about granting roles on a resource, see Granting roles on a resource.

          With Use Custom KMS keys selected:

          1. Select a key ring location from the Key ring location drop-down menu.
          2. Select a key ring from the Key ring drop-down menu.
          3. Select a key name from the Key name drop-down menu.
          4. Provide the KMS Service Account.

       2. Optional: Select Enable FIPS cryptography if you require your cluster to be FIPS validated.

          Note

          If Enable FIPS cryptography is selected, Enable additional etcd encryption is enabled by default and cannot be disabled. You can select Enable additional etcd encryption without selecting Enable FIPS cryptography.

       3. Optional: Select Enable additional etcd encryption if you require etcd key value encryption. With this option, the etcd key values are encrypted, but the keys are not. This option is in addition to the control plane storage encryption that encrypts the etcd volumes in OpenShift Dedicated clusters by default.

          Note

          By enabling etcd encryption for the key values in etcd, you will incur a performance overhead of approximately 20%. The overhead is a result of introducing this second layer of encryption, in addition to the default control plane storage encryption that encrypts the etcd volumes. Consider enabling etcd encryption only if you specifically require it for your use case.

    9. Click Next.

13. On the Default machine pool page, select a Compute node instance type and a Compute node count. The number and types of nodes that are available depend on your OpenShift Dedicated subscription. If you are using multiple availability zones, the compute node count is per zone.

    Note

    After your cluster is created, you can change the number of compute nodes in your cluster, but you cannot change the compute node instance type in a machine pool. The number and types of nodes available to you depend on your OpenShift Dedicated subscription.

14. Optional: Expand Edit node labels to add labels to your nodes. Click Add label to add more node labels and select Next.

    Important

    This step refers to labels within Kubernetes, not Google Cloud. For more information regarding Kubernetes labels, see Labels and Selectors.

15. On the Network configuration page, select Public or Private to use either public or private API endpoints and application routes for your cluster. If you select Private, Use Private Service Connect is selected by default. Private Service Connect (PSC) is Google Cloud’s security-enhanced networking feature. You can disable PSC by clicking the Use Private Service Connect checkbox.

    Note

    Red Hat recommends using Private Service Connect when deploying a private OpenShift Dedicated cluster on Google Cloud. Private Service Connect ensures there is a secured, private connectivity between Red Hat infrastructure, Site Reliability Engineering (SRE) and private OpenShift Dedicated clusters.

    Important

    If you are using private API endpoints, you cannot access your cluster until you update the network settings in your cloud provider account.

16. Optional: To install the cluster in an existing GCP Virtual Private Cloud (VPC):

    1. Select Install into an existing VPC.

       Important

       Private Service Connect is supported only with Install into an existing VPC.

    2. If you are installing into an existing VPC and you want to enable an HTTP or HTTPS proxy for your cluster, select Configure a cluster-wide proxy.

       Important

       In order to configure a cluster-wide proxy for your cluster, you must first create the Cloud network address translation (NAT) and a Cloud router. See the Additional resources section for more information.

17. Accept the default application ingress settings, or to create your own custom settings, select Custom Settings.

    1. Optional: Provide route selector.
    2. Optional: Provide excluded namespaces.
    3. Select a namespace ownership policy.

    4. Select a wildcard policy.

       For more information about custom application ingress settings, click on the information icon provided for each setting.

18. Click Next.

19. Optional: To install the cluster into a GCP Shared VPC:

    Important

    To install a cluster into a Shared VPC, you must use OpenShift Dedicated version 4.13.15 or later. Additionally, the VPC owner of the host project must enable a project as a host project in their Google Cloud console. For more information, see Enable a host project.

    1. Select Install into GCP Shared VPC.

    2. Specify the Host project ID. If the specified host project ID is incorrect, cluster creation fails.

       Important

       Once you complete the steps within the cluster configuration wizard and click Create Cluster, the cluster will go into the "Installation Waiting" state. At this point, you must contact the VPC owner of the host project, who must assign the dynamically-generated service account the following roles: Compute Network Administrator, Compute Security Administrator, Project IAM Admin, and DNS Administrator. The VPC owner of the host project has 30 days to grant the listed permissions before the cluster creation fails. For information about Shared VPC permissions, see Provision Shared VPC.

20. If you opted to install the cluster in an existing GCP VPC, provide your Virtual Private Cloud (VPC) subnet settings and select Next. You must have created the Cloud network address translation (NAT) and a Cloud router. See the "Additional resources" section for information about Cloud NATs and Google VPCs.

    Note

    If you are installing a cluster into a Shared VPC, the VPC name and subnets are shared from the host project.

21. If you opted to configure a cluster-wide proxy, provide your proxy configuration details on the Cluster-wide proxy page:

    1. Enter a value in at least one of the following fields:

       • Specify a valid HTTP proxy URL.
       • Specify a valid HTTPS proxy URL.
       • In the Additional trust bundle field, provide a PEM encoded X.509 certificate bundle. The bundle is added to the trusted certificate store for the cluster nodes. An additional trust bundle file is required if you use a TLS-inspecting proxy unless the identity certificate for the proxy is signed by an authority from the Red Hat Enterprise Linux CoreOS (RHCOS) trust bundle. This requirement applies regardless of whether the proxy is transparent or requires explicit configuration using the http-proxy and https-proxy arguments.

    2. Click Next.

       For more information about configuring a proxy with OpenShift Dedicated, see Configuring a cluster-wide proxy.

22. In the CIDR ranges dialog, configure custom classless inter-domain routing (CIDR) ranges or use the defaults that are provided.

    Note

    If you are installing into a VPC, the Machine CIDR range must match the VPC subnets.

    Important

    CIDR configurations cannot be changed later. Confirm your selections with your network administrator before proceeding.

23. On the Cluster update strategy page, configure your update preferences:

    1. Choose a cluster update method:

       • Select Individual updates if you want to schedule each update individually. This is the default option.

       • Select Recurring updates to update your cluster on your preferred day and start time, when updates are available.

         Note

         You can review the end-of-life dates in the update lifecycle documentation for OpenShift Dedicated. For more information, see OpenShift Dedicated update life cycle.

    2. Provide administrator approval based on your cluster update method:

       • Individual updates: If you select an update version that requires approval, provide an administrator’s acknowledgment and click Approve and continue.
       • Recurring updates: If you selected recurring updates for your cluster, provide an administrator’s acknowledgment and click Approve and continue. OpenShift Cluster Manager does not start scheduled y-stream updates for minor versions without receiving an administrator’s acknowledgment.
    3. If you opted for recurring updates, select a preferred day of the week and upgrade start time in UTC from the drop-down menus.
    4. Optional: You can set a grace period for Node draining during cluster upgrades. A 1 hour grace period is set by default.

    5. Click Next.

       Note

       In the event of critical security concerns that significantly impact the security or stability of a cluster, Red Hat Site Reliability Engineering (SRE) might schedule automatic updates to the latest z-stream version that is not impacted. The updates are applied within 48 hours after customer notifications are provided. For a description of the critical impact security rating, see Understanding Red Hat security ratings.

24. Review the summary of your selections and click Create cluster to start the cluster installation. The installation takes approximately 30-40 minutes to complete.

25. Optional: On the Overview tab, you can enable the delete protection feature by selecting Enable, which is located directly under Delete Protection: Disabled. This will prevent your cluster from being deleted. To disable delete protection, select Disable. By default, clusters are created with the delete protection feature disabled.

    Note

    If you delete a cluster that was installed into a GCP Shared VPC, inform the VPC owner of the host project to remove the IAM policy roles granted to the service account that was referenced during cluster creation.

Procedure

1. Log in to OpenShift Cluster Manager and click Create cluster.
2. In the Cloud tab, click Create cluster in the Red Hat OpenShift Dedicated row.

3. Under Billing model, configure the subscription type and infrastructure type:

   1. Select the On-Demand subscription type.
   2. From the drop-down menu, select Google Cloud Marketplace.
   3. Select the Customer Cloud Subscription infrastructure type.
   4. Click Next.
4. On the Cloud provider page, select Run on Google Cloud Platform.

5. Select either Service account or Workload Identity Federation as the Authentication type.

   Note

   For more information about authentication types, click the question icon located next to Authentication type.

6. Review and complete the listed Prerequisites.
7. Select the checkbox to acknowledge that you have read and completed all of the prerequisites.
8. If you selected Service account as the Authentication type, provide your GCP service account private key in JSON format. You can either click Browse to locate and attach a JSON file or add the details in the Service account JSON field.

9. If you selected Workload Identity Federation as the Authentication type, you will first need to create a new WIF configuration. Open a terminal window and run the following ocm CLI command.

   $ ocm gcp create wif-config --name <wif_name> \ 1
     --project <gcp_project_id> 2

   1

   Replace <wif_name> with the name of your WIF configuration.

   2

   Replace <gcp_project_id> with the ID of the Google Cloud Platform (GCP) project where the WIF configuration will be implemented.

10. Select a configured WIF configuration from the WIF configuration drop-down list. If you want to select the WIF configuration you created in the last step, click Refresh first.
11. Click Next to validate your cloud provider account and go to the Cluster details page.

12. On the Cluster details page, provide a name for your cluster and specify the cluster details:

    1. Add a Cluster name.

    2. Optional: Cluster creation generates a domain prefix as a subdomain for your provisioned cluster on openshiftapps.com. If the cluster name is less than or equal to 15 characters, that name is used for the domain prefix. If the cluster name is longer than 15 characters, the domain prefix is randomly generated as a 15-character string.

       To customize the subdomain, select the Create custom domain prefix checkbox, and enter your domain prefix name in the Domain prefix field. The domain prefix cannot be longer than 15 characters, must be unique within your organization, and cannot be changed after cluster creation.

    3. Select a cluster version from the Version drop-down menu.

       Note

       Workload Identity Federation (WIF) is only supported on OpenShift Dedicated version 4.17 and later.

    4. Select a cloud provider region from the Region drop-down menu.
    5. Select a Single zone or Multi-zone configuration.

    6. Optional: Select Enable Secure Boot for Shielded VMs to use Shielded VMs when installing your cluster. For more information, see Shielded VMs.

       Important

       To successfully create a cluster, you must select Enable Secure Boot support for Shielded VMs if your organization has the policy constraint constraints/compute.requireShieldedVm enabled. For more information regarding GCP organizational policy constraints, see Organization policy constraints.

    7. Leave Enable user workload monitoring selected to monitor your own projects in isolation from Red Hat Site Reliability Engineer (SRE) platform metrics. This option is enabled by default.

13. Optional: Expand Advanced Encryption to make changes to encryption settings.

    1. Select Use Custom KMS keys to use custom KMS keys. If you prefer not to use custom KMS keys, leave the default setting Use default KMS Keys.

       Important

       To use custom KMS keys, the IAM service account osd-ccs-admin must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role. For more information about granting roles on a resource, see Granting roles on a resource.

       With Use Custom KMS keys selected:

       1. Select a key ring location from the Key ring location drop-down menu.
       2. Select a key ring from the Key ring drop-down menu.
       3. Select a key name from the Key name drop-down menu.
       4. Provide the KMS Service Account.

    2. Optional: Select Enable FIPS cryptography if you require your cluster to be FIPS validated.

       Note

       If Enable FIPS cryptography is selected, Enable additional etcd encryption is enabled by default and cannot be disabled. You can select Enable additional etcd encryption without selecting Enable FIPS cryptography.

    3. Optional: Select Enable additional etcd encryption if you require etcd key value encryption. With this option, the etcd key values are encrypted, but the keys are not. This option is in addition to the control plane storage encryption that encrypts the etcd volumes in OpenShift Dedicated clusters by default.

       Note

       By enabling etcd encryption for the key values in etcd, you incur a performance overhead of approximately 20%. The overhead is a result of introducing this second layer of encryption, in addition to the default control plane storage encryption that encrypts the etcd volumes. Consider enabling etcd encryption only if you specifically require it for your use case.

14. Click Next.

15. On the Default machine pool page, select a Compute node instance type and a Compute node count. The number and types of nodes that are available depend on your OpenShift Dedicated subscription. If you are using multiple availability zones, the compute node count is per zone.

    Note

    After your cluster is created, you can change the number of compute nodes, but you cannot change the compute node instance type in a created machine pool. You can add machine pools after installation that use a customized instance type. The number and types of nodes available to you depend on your OpenShift Dedicated subscription.

16. Optional: Expand Add node labels to add labels to your nodes. Click Add additional label to add more node labels.

    Important

    This step refers to labels within Kubernetes, not Google Cloud. For more information regarding Kubernetes labels, see Labels and Selectors.

17. Click Next.

18. In the Cluster privacy dialog, select Public or Private to use either public or private API endpoints and application routes for your cluster. If you select Private, Use Private Service Connect is selected by default. Private Service Connect (PSC) is Google Cloud’s security-enhanced networking feature. You can disable PSC by clicking the Use Private Service Connect checkbox.

    Note

    Red Hat recommends using Private Service Connect when deploying a private OpenShift Dedicated cluster on Google Cloud. Private Service Connect ensures there is a secured, private connectivity between Red Hat infrastructure, Site Reliability Engineering (SRE) and private OpenShift Dedicated clusters.

19. Optional: To install the cluster in an existing GCP Virtual Private Cloud (VPC):

    1. Select Install into an existing VPC.

       Important

       Private Service Connect is supported only with Install into an existing VPC.

    2. If you are installing into an existing VPC and you want to enable an HTTP or HTTPS proxy for your cluster, select Configure a cluster-wide proxy.

       Important

       In order to configure a cluster-wide proxy for your cluster, you must first create the Cloud network address translation (NAT) and a Cloud router. See the Additional resources section for more information.

20. Accept the default application ingress settings, or to create your own custom settings, select Custom Settings.

    1. Optional: Provide route selector.
    2. Optional: Provide excluded namespaces.
    3. Select a namespace ownership policy.

    4. Select a wildcard policy.

       For more information about custom application ingress settings, click on the information icon provided for each setting.

21. Click Next.

22. Optional: To install the cluster into a GCP Shared VPC:

    Important

    To install a cluster into a Shared VPC, you must use OpenShift Dedicated version 4.13.15 or later. Additionally, the VPC owner of the host project must enable a project as a host project in their Google Cloud console. For more information, see Enable a host project.

    1. Select Install into GCP Shared VPC.

    2. Specify the Host project ID. If the specified host project ID is incorrect, cluster creation fails.

       Important

       Once you complete the steps within the cluster configuration wizard and click Create Cluster, the cluster will go into the "Installation Waiting" state. At this point, you must contact the VPC owner of the host project, who must assign the dynamically-generated service account the following roles: Compute Network Administrator, Compute Security Administrator, Project IAM Admin, and DNS Administrator. The VPC owner of the host project has 30 days to grant the listed permissions before the cluster creation fails. For information about Shared VPC permissions, see Provision Shared VPC.

23. If you opted to install the cluster in an existing GCP VPC, provide your Virtual Private Cloud (VPC) subnet settings and select Next.

    Note

    If you are installing a cluster into a Shared VPC, the VPC name and subnets are shared from the host project.

24. Click Next.

25. If you opted to configure a cluster-wide proxy, provide your proxy configuration details on the Cluster-wide proxy page:

    1. Enter a value in at least one of the following fields:

       • Specify a valid HTTP proxy URL.
       • Specify a valid HTTPS proxy URL.
       • In the Additional trust bundle field, provide a PEM encoded X.509 certificate bundle. The bundle is added to the trusted certificate store for the cluster nodes. An additional trust bundle file is required if you use a TLS-inspecting proxy unless the identity certificate for the proxy is signed by an authority from the Red Hat Enterprise Linux CoreOS (RHCOS) trust bundle. This requirement applies regardless of whether the proxy is transparent or requires explicit configuration using the http-proxy and https-proxy arguments.

    2. Click Next.

       For more information about configuring a proxy with OpenShift Dedicated, see Configuring a cluster-wide proxy.

26. In the CIDR ranges dialog, configure custom classless inter-domain routing (CIDR) ranges or use the defaults that are provided.

    Important

    CIDR configurations cannot be changed later. Confirm your selections with your network administrator before proceeding.

    If the cluster privacy is set to Private, you cannot access your cluster until you configure private connections in your cloud provider.

27. On the Cluster update strategy page, configure your update preferences:

    1. Choose a cluster update method:

       • Select Individual updates if you want to schedule each update individually. This is the default option.

       • Select Recurring updates to update your cluster on your preferred day and start time, when updates are available.

         Note

         You can review the end-of-life dates in the update lifecycle documentation for OpenShift Dedicated. For more information, see OpenShift Dedicated update life cycle.

    2. Provide administrator approval based on your cluster update method:

       • Individual updates: If you select an update version that requires approval, provide an administrator’s acknowledgment and click Approve and continue.
       • Recurring updates: If you selected recurring updates for your cluster, provide an administrator’s acknowledgment and click Approve and continue. OpenShift Cluster Manager does not start scheduled y-stream updates for minor versions without receiving an administrator’s acknowledgment.
    3. If you opted for recurring updates, select a preferred day of the week and upgrade start time in UTC from the drop-down menus.
    4. Optional: You can set a grace period for Node draining during cluster upgrades. A 1 hour grace period is set by default.

    5. Click Next.

       Note

       In the event of critical security concerns that significantly impact the security or stability of a cluster, Red Hat Site Reliability Engineering (SRE) might schedule automatic updates to the latest z-stream version that is not impacted. The updates are applied within 48 hours after customer notifications are provided. For a description of the critical impact security rating, see Understanding Red Hat security ratings.

28. Review the summary of your selections and click Create cluster to start the cluster installation. The installation takes approximately 30-40 minutes to complete.

29. Optional: On the Overview tab, you can enable the delete protection feature by selecting Enable, which is located directly under Delete Protection: Disabled. This will prevent your cluster from being deleted. To disable delete protection, select Disable. By default, clusters are created with the delete protection feature disabled.

    Verification

    • You can monitor the progress of the installation in the Overview page for your cluster. You can view the installation logs on the same page. Your cluster is ready when the Status in the Details section of the page is listed as Ready.

Procedure

1. Log in to OpenShift Cluster Manager and click Create cluster.
2. In the Cloud tab, click Create cluster in the Red Hat OpenShift Dedicated row.

3. Under Billing model, configure the subscription type and infrastructure type:

   1. Select the Annual subscription type. Only the Annual subscription type is available when you deploy a cluster using a Red Hat cloud account.

      For information about OpenShift Dedicated subscription options, see Cluster subscriptions and registration in the OpenShift Cluster Manager documentation.

      Note

      You must have the required resource quota for the Annual subscription type to be available. For more information, contact your sales representative or Red Hat support.

   2. Select the Red Hat cloud account infrastructure type to deploy OpenShift Dedicated in a cloud provider account that is owned by Red Hat.
   3. Click Next.
4. Select Run on Google Cloud Platform and click Next.

5. On the Cluster details page, provide a name for your cluster and specify the cluster details:

   1. Add a Cluster name.

   2. Optional: Cluster creation generates a domain prefix as a subdomain for your provisioned cluster on openshiftapps.com. If the cluster name is less than or equal to 15 characters, that name is used for the domain prefix. If the cluster name is longer than 15 characters, the domain prefix is randomly generated as a 15-character string.

      To customize the subdomain, select the Create custom domain prefix checkbox, and enter your domain prefix name in the Domain prefix field. The domain prefix cannot be longer than 15 characters, must be unique within your organization, and cannot be changed after cluster creation.

   3. Select a cluster version from the Version drop-down menu.
   4. Select a cloud provider region from the Region drop-down menu.
   5. Select a Single zone or Multi-zone configuration.
   6. Select a Persistent storage capacity for the cluster. For more information, see the Storage section in the OpenShift Dedicated service definition.
   7. Specify the number of Load balancers that you require for your cluster. For more information, see the Load balancers section in the OpenShift Dedicated service definition.

   8. Optional: Select Enable Secure Boot for Shielded VMs to use Shielded VMs when installing your cluster. For more information, see Shielded VMs.

      Important

      To successfully create a cluster, you must select Enable Secure Boot support for Shielded VMs if your organization has the policy constraint constraints/compute.requireShieldedVm enabled. For more information regarding GCP organizational policy constraints, see Organization policy constraints.

   9. Leave Enable user workload monitoring selected to monitor your own projects in isolation from Red Hat Site Reliability Engineer (SRE) platform metrics. This option is enabled by default.

6. Optional: Expand Advanced Encryption to make changes to encryption settings.

   1. Optional: Select Enable FIPS cryptography if you require your cluster to be FIPS validated.

      Note

      If Enable FIPS cryptography is selected, Enable additional etcd encryption is enabled by default and cannot be disabled. You can select Enable additional etcd encryption without selecting Enable FIPS cryptography.

   2. Optional: Select Enable additional etcd encryption if you require etcd key value encryption. With this option, the etcd key values are encrypted, but not the keys. This option is in addition to the control plane storage encryption that encrypts the etcd volumes in OpenShift Dedicated clusters by default.

      Note

      By enabling etcd encryption for the key values in etcd, you will incur a performance overhead of approximately 20%. The overhead is a result of introducing this second layer of encryption, in addition to the default control plane storage encryption that encrypts the etcd volumes. Consider enabling etcd encryption only if you specifically require it for your use case.

   3. Click Next.

7. On the Default machine pool page, select a Compute node instance type and a Compute node count. The number and types of nodes that are available depend on your OpenShift Dedicated subscription. If you are using multiple availability zones, the compute node count is per zone.

   Note

   After your cluster is created, you can change the number of compute nodes, but you cannot change the compute node instance type in a machine pool. For clusters that use the CCS model, you can add machine pools after installation that use a different instance type. The number and types of nodes available to you depend on your OpenShift Dedicated subscription.

8. Optional: Expand Edit node labels to add labels to your nodes. Click Add label to add more node labels and select Next.
9. In the Cluster privacy dialog, select Public or Private to use either public or private API endpoints and application routes for your cluster.
10. Click Next.

11. In the CIDR ranges dialog, configure custom classless inter-domain routing (CIDR) ranges or use the defaults that are provided.

    Important

    CIDR configurations cannot be changed later. Confirm your selections with your network administrator before proceeding.

    If the cluster privacy is set to Private, you cannot access your cluster until you configure private connections in your cloud provider.

12. On the Cluster update strategy page, configure your update preferences:

    1. Choose a cluster update method:

       • Select Individual updates if you want to schedule each update individually. This is the default option.

       • Select Recurring updates to update your cluster on your preferred day and start time, when updates are available.

         Note

         You can review the end-of-life dates in the update lifecycle documentation for OpenShift Dedicated. For more information, see OpenShift Dedicated update life cycle.

    2. Provide administrator approval based on your cluster update method:

       • Individual updates: If you select an update version that requires approval, provide an administrator’s acknowledgment and click Approve and continue.
       • Recurring updates: If you selected recurring updates for your cluster, provide an administrator’s acknowledgment and click Approve and continue. OpenShift Cluster Manager does not start scheduled y-stream updates for minor versions without receiving an administrator’s acknowledgment.
    3. If you opted for recurring updates, select a preferred day of the week and upgrade start time in UTC from the drop-down menus.
    4. Optional: You can set a grace period for Node draining during cluster upgrades. A 1 hour grace period is set by default.

    5. Click Next.

       Note

       In the event of critical security concerns that significantly impact the security or stability of a cluster, Red Hat Site Reliability Engineering (SRE) might schedule automatic updates to the latest z-stream version that is not impacted. The updates are applied within 48 hours after customer notifications are provided. For a description of the critical impact security rating, see Understanding Red Hat security ratings.

13. Review the summary of your selections and click Create cluster to start the cluster installation. The installation takes approximately 30-40 minutes to complete.

14. Optional: On the Overview tab, you can enable the delete protection feature by selecting Enable, which is located directly under Delete Protection: Disabled. This will prevent your cluster from being deleted. To disable delete protection, select Disable. By default, clusters are created with the delete protection feature disabled.

    Verification

    • You can monitor the progress of the installation in the Overview page for your cluster. You can view the installation logs on the same page. Your cluster is ready when the Status in the Details section of the page is listed as Ready.

Procedure

1. Log in to OpenShift Cluster Manager and click Create cluster.
2. In the Cloud tab, click Create cluster in the Red Hat OpenShift Dedicated row.

3. Under Billing model, configure the subscription type and infrastructure type:

   1. Select the On-Demand subscription type.
   2. From the drop-down menu, select Red Hat Marketplace.
   3. Click Next.
4. On the Cloud provider page, select Run on Google Cloud Platform.

5. Select either Service account or Workload Identity Federation as the Authentication type.

   Note

   For more information about authentication types, click the question icon located next to Authentication type.

6. Review and complete the listed Prerequisites.
7. Select the checkbox to acknowledge that you have read and completed all of the prerequisites.
8. If you selected Service account as the Authentication type, provide your GCP service account private key in JSON format. You can either click Browse to locate and attach a JSON file or add the details in the Service account JSON field.

9. If you selected Workload Identity Federation as the Authentication type, you will first need to create a new WIF configuration. Open a terminal window and run the following ocm CLI command.

   $ ocm gcp create wif-config --name <wif_name> \ 1
     --project <gcp_project_id> 2

   1

   Replace <wif_name> with the name of your WIF configuration.

   2

   Replace <gcp_project_id> with the ID of the Google Cloud Platform (GCP) project where the WIF configuration will be implemented.

10. Select a configured WIF configuration from the WIF configuration drop-down list. If you want to select the WIF configuration you created in the last step, click Refresh first.

    1. Click Next to validate your cloud provider account and go to the Cluster details page.

11. On the Cluster details page, provide a name for your cluster and specify the cluster details:

    1. Add a Cluster name.

    2. Optional: Cluster creation generates a domain prefix as a subdomain for your provisioned cluster on openshiftapps.com. If the cluster name is less than or equal to 15 characters, that name is used for the domain prefix. If the cluster name is longer than 15 characters, the domain prefix is randomly generated as a 15-character string.

       To customize the subdomain, select the Create custom domain prefix checkbox, and enter your domain prefix name in the Domain prefix field. The domain prefix cannot be longer than 15 characters, must be unique within your organization, and cannot be changed after cluster creation.

    3. Select a cluster version from the Version drop-down menu.

       Note

       Workload Identity Federation (WIF) is only supported on OpenShift Dedicated version 4.17 and later.

    4. Select a cloud provider region from the Region drop-down menu.
    5. Select a Single zone or Multi-zone configuration.

    6. Optional: Select Enable Secure Boot for Shielded VMs to use Shielded VMs when installing your cluster. For more information, see Shielded VMs.

       Important

       To successfully create a cluster, you must select Enable Secure Boot support for Shielded VMs if your organization has the policy constraint constraints/compute.requireShieldedVm enabled. For more information regarding GCP organizational policy constraints, see Organization policy constraints.

    7. Leave Enable user workload monitoring selected to monitor your own projects in isolation from Red Hat Site Reliability Engineer (SRE) platform metrics. This option is enabled by default.

12. Optional: Expand Advanced Encryption to make changes to encryption settings.

    1. Select Use Custom KMS keys to use custom KMS keys. If you prefer not to use custom KMS keys, leave the default setting Use default KMS Keys.

       Important

       To use custom KMS keys, the IAM service account osd-ccs-admin must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role. For more information about granting roles on a resource, see Granting roles on a resource.

       With Use Custom KMS keys selected:

       1. Select a key ring location from the Key ring location drop-down menu.
       2. Select a key ring from the Key ring drop-down menu.
       3. Select a key name from the Key name drop-down menu.
       4. Provide the KMS Service Account.

    2. Optional: Select Enable FIPS cryptography if you require your cluster to be FIPS validated.

       Note

       If Enable FIPS cryptography is selected, Enable additional etcd encryption is enabled by default and cannot be disabled. You can select Enable additional etcd encryption without selecting Enable FIPS cryptography.

    3. Optional: Select Enable additional etcd encryption if you require etcd key value encryption. With this option, the etcd key values are encrypted, but not the keys. This option is in addition to the control plane storage encryption that encrypts the etcd volumes in OpenShift Dedicated clusters by default.

       Note

       By enabling etcd encryption for the key values in etcd, you incur a performance overhead of approximately 20%. The overhead is a result of introducing this second layer of encryption, in addition to the default control plane storage encryption that encrypts the etcd volumes. Consider enabling etcd encryption only if you specifically require it for your use case.

13. Click Next.

14. On the Default machine pool page, select a Compute node instance type and a Compute node count. The number and types of nodes that are available depend on your OpenShift Dedicated subscription. If you are using multiple availability zones, the compute node count is per zone.

    Note

    After your cluster is created, you can change the number of compute nodes, but you cannot change the compute node instance type in a created machine pool. You can add machine pools after installation that use a customized instance type. The number and types of nodes available to you depend on your OpenShift Dedicated subscription.

15. Optional: Expand Add node labels to add labels to your nodes. Click Add additional label to add more node labels.

    Important

    This step refers to labels within Kubernetes, not Google Cloud. For more information regarding Kubernetes labels, see Labels and Selectors.

16. Click Next.

17. In the Cluster privacy dialog, select Public or Private to use either public or private API endpoints and application routes for your cluster. If you select Private, Use Private Service Connect is selected by default. Private Service Connect (PSC) is Google Cloud’s security-enhanced networking feature. You can disable PSC by clicking the Use Private Service Connect checkbox.

    Note

    Red Hat recommends using Private Service Connect when deploying a private OpenShift Dedicated cluster on Google Cloud. Private Service Connect ensures there is a secured, private connectivity between Red Hat infrastructure, Site Reliability Engineering (SRE) and private OpenShift Dedicated clusters.

18. Optional: To install the cluster in an existing GCP Virtual Private Cloud (VPC):

    1. Select Install into an existing VPC.

       Important

       Private Service Connect is supported only with Install into an existing VPC.

    2. If you are installing into an existing VPC and you want to enable an HTTP or HTTPS proxy for your cluster, select Configure a cluster-wide proxy.

       Important

       In order to configure a cluster-wide proxy for your cluster, you must first create the Cloud network address translation (NAT) and a Cloud router. See the Additional resources section for more information.

19. Accept the default application ingress settings, or to create your own custom settings, select Custom Settings.

    1. Optional: Provide route selector.
    2. Optional: Provide excluded namespaces.
    3. Select a namespace ownership policy.

    4. Select a wildcard policy.

       For more information about custom application ingress settings, click on the information icon provided for each setting.

20. Click Next.

21. Optional: To install the cluster into a GCP shared VPC:

    Important

    To install a cluster into a GCP shared VPC, you must use OpenShift Dedicated version 4.13.15 or later. Additionally, the VPC owner of the host project must enable a project as a host project in their Google Cloud console. For more information, see Enable a host project.

    1. Select Install into GCP Shared VPC.

    2. Specify the Host project ID. If the specified host project ID is incorrect, cluster creation fails.

       Important

       Once you complete the steps within the cluster configuration wizard and click Create Cluster, the cluster will go into the "Installation Waiting" state. At this point, you must contact the VPC owner of the host project, who must assign the dynamically-generated service account the following roles: Compute Network Administrator, Compute Security Administrator, Project IAM Admin, and DNS Administrator. The VPC owner of the host project has 30 days to grant the listed permissions before the cluster creation fails. For information about Shared VPC permissions, see Provision Shared VPC.

22. If you opted to install the cluster into an existing VPC, provide your Virtual Private Cloud (VPC) subnet settings and select Next.

    Note

    If you are installing a cluster into a GCP Shared VPC, the VPC name and subnets are shared from the host project.

23. Click Next.

24. If you opted to configure a cluster-wide proxy, provide your proxy configuration details on the Cluster-wide proxy page:

    1. Enter a value in at least one of the following fields:

       • Specify a valid HTTP proxy URL.
       • Specify a valid HTTPS proxy URL.
       • In the Additional trust bundle field, provide a PEM encoded X.509 certificate bundle. The bundle is added to the trusted certificate store for the cluster nodes. An additional trust bundle file is required if you use a TLS-inspecting proxy unless the identity certificate for the proxy is signed by an authority from the Red Hat Enterprise Linux CoreOS (RHCOS) trust bundle. This requirement applies regardless of whether the proxy is transparent or requires explicit configuration using the http-proxy and https-proxy arguments.

    2. Click Next.

       For more information about configuring a proxy with OpenShift Dedicated, see Configuring a cluster-wide proxy.

25. In the CIDR ranges dialog, configure custom classless inter-domain routing (CIDR) ranges or use the defaults that are provided.

    Important

    CIDR configurations cannot be changed later. Confirm your selections with your network administrator before proceeding.

    If the cluster privacy is set to Private, you cannot access your cluster until you configure private connections in your cloud provider.

26. On the Cluster update strategy page, configure your update preferences:

    1. Choose a cluster update method:

       • Select Individual updates if you want to schedule each update individually. This is the default option.

       • Select Recurring updates to update your cluster on your preferred day and start time, when updates are available.

         Note

         You can review the end-of-life dates in the update lifecycle documentation for OpenShift Dedicated. For more information, see OpenShift Dedicated update life cycle.

    2. Provide administrator approval based on your cluster update method:

       • Individual updates: If you select an update version that requires approval, provide an administrator’s acknowledgment and click Approve and continue.
       • Recurring updates: If you selected recurring updates for your cluster, provide an administrator’s acknowledgment and click Approve and continue. OpenShift Cluster Manager does not start scheduled y-stream updates for minor versions without receiving an administrator’s acknowledgment.
    3. If you opted for recurring updates, select a preferred day of the week and upgrade start time in UTC from the drop-down menus.
    4. Optional: You can set a grace period for Node draining during cluster upgrades. A 1 hour grace period is set by default.

    5. Click Next.

       Note

       In the event of critical security concerns that significantly impact the security or stability of a cluster, Red Hat Site Reliability Engineering (SRE) might schedule automatic updates to the latest z-stream version that is not impacted. The updates are applied within 48 hours after customer notifications are provided. For a description of the critical impact security rating, see Understanding Red Hat security ratings.

27. Review the summary of your selections and click Create cluster to start the cluster installation. The installation takes approximately 30-40 minutes to complete.

28. Optional: On the Overview tab, you can enable the delete protection feature by selecting Enable, which is located directly under Delete Protection: Disabled. This will prevent your cluster from being deleted. To disable delete protection, select Disable. By default, clusters are created with the delete protection feature disabled.

    Verification

    • You can monitor the progress of the installation in the Overview page for your cluster. You can view the installation logs on the same page. Your cluster is ready when the Status in the Details section of the page is listed as Ready.