Chapter 2. Configuring a private cluster

Procedure

1. Review the DNS custom resource for your cluster:

   $ oc get dnses.config.openshift.io/cluster -o yaml

   Example output

   apiVersion: config.openshift.io/v1
   kind: DNS
   metadata:
     creationTimestamp: "2019-10-25T18:27:09Z"
     generation: 2
     name: cluster
     resourceVersion: "37966"
     selfLink: /apis/config.openshift.io/v1/dnses/cluster
     uid: 0e714746-f755-11f9-9cb1-02ff55d8f976
   spec:
     baseDomain: <base_domain>
     privateZone:
       tags:
         Name: <infrastructure_id>-int
         kubernetes.io/cluster/<infrastructure_id>: owned
     publicZone:
       id: Z2XXXXXXXXXXA4
   status: {}

   Note that the spec section contains both a private and a public zone.

2. Patch the DNS custom resource to remove the public zone:

   $ oc patch dnses.config.openshift.io/cluster --type=merge --patch='{"spec": {"publicZone": null}}'
   dns.config.openshift.io/cluster patched

   Because the Ingress Controller consults the DNS definition when it creates Ingress objects, when you create or modify Ingress objects, only private records are created.

   Important

   DNS records for the existing Ingress objects are not modified when you remove the public zone.

3. Optional: Review the DNS custom resource for your cluster and confirm that the public zone was removed:

   $ oc get dnses.config.openshift.io/cluster -o yaml

   Example output

   apiVersion: config.openshift.io/v1
   kind: DNS
   metadata:
     creationTimestamp: "2019-10-25T18:27:09Z"
     generation: 2
     name: cluster
     resourceVersion: "37966"
     selfLink: /apis/config.openshift.io/v1/dnses/cluster
     uid: 0e714746-f755-11f9-9cb1-02ff55d8f976
   spec:
     baseDomain: <base_domain>
     privateZone:
       tags:
         Name: <infrastructure_id>-int
         kubernetes.io/cluster/<infrastructure_id>-wfpg4: owned
   status: {}

Procedure

1. Modify the default Ingress Controller to use only an internal endpoint:

   $ oc replace --force --wait --filename - <<EOF
   apiVersion: operator.openshift.io/v1
   kind: IngressController
   metadata:
     namespace: openshift-ingress-operator
     name: default
   spec:
     endpointPublishingStrategy:
       type: LoadBalancerService
       loadBalancer:
         scope: Internal
   EOF

   Example output

   ingresscontroller.operator.openshift.io "default" deleted
   ingresscontroller.operator.openshift.io/default replaced

   The public DNS entry is removed, and the private zone entry is updated.

Procedure

1. In the web portal or console for AWS or Azure, take the following actions:

   1. Locate and delete appropriate load balancer component.

      • For AWS, delete the external load balancer. The API DNS entry in the private zone already points to the internal load balancer, which uses an identical configuration, so you do not need to modify the internal load balancer.
      • For Azure, delete the api-internal rule for the load balancer.
   2. Delete the api.$clustername.$yourdomain DNS entry in the public zone.

2. Remove the external load balancers:

   Important

   You can run the following steps only for an installer-provisioned infrastructure (IPI) cluster. For a user-provisioned infrastructure (UPI) cluster, you must manually remove or disable the external load balancers.

   1. From your terminal, list the cluster machines:

      $ oc get machine -n openshift-machine-api

      Example output

      NAME                            STATE     TYPE        REGION      ZONE         AGE
      lk4pj-master-0                  running   m4.xlarge   us-east-1   us-east-1a   17m
      lk4pj-master-1                  running   m4.xlarge   us-east-1   us-east-1b   17m
      lk4pj-master-2                  running   m4.xlarge   us-east-1   us-east-1a   17m
      lk4pj-worker-us-east-1a-5fzfj   running   m4.xlarge   us-east-1   us-east-1a   15m
      lk4pj-worker-us-east-1a-vbghs   running   m4.xlarge   us-east-1   us-east-1a   15m
      lk4pj-worker-us-east-1b-zgpzg   running   m4.xlarge   us-east-1   us-east-1b   15m

      You modify the control plane machines, which contain master in the name, in the following step.

   2. Remove the external load balancer from each control plane machine.

      1. Edit a control plane Machine object to remove the reference to the external load balancer:

         $ oc edit machines -n openshift-machine-api <master_name> 1

         1

         Specify the name of the control plane, or master, Machine object to modify.

      2. Remove the lines that describe the external load balancer, which are marked in the following example, and save and exit the object specification:

         ...
         spec:
           providerSpec:
             value:
             ...
               loadBalancers:
               - name: lk4pj-ext 1
                 type: network 2
               - name: lk4pj-int
                 type: network

         1 2

         Delete this line.

      3. Repeat this process for each of the machines that contains master in the name.