10.5.2. Configuring Amazon Web Services features for control plane machines
You can enable or change the configuration of features for your control plane machines by editing values in the control plane machine set specification.
When you save an update to the control plane machine set, the Control Plane Machine Set Operator updates the control plane machines according to your configured update strategy. For more information, see "Updating the control plane configuration".
If the security posture of your organization does not allow clusters to use an open API endpoint, you can restrict the API server to use only internal load balancers. To implement this API server restriction, use the Amazon Web Services (AWS) console and OpenShift CLI (oc) to delete the external load balancer components.
Prerequisites
- You have installed an OpenShift Container Platform cluster on AWS.
- You have access to the AWS console as a user with administrator privileges.
-
You have access to the OpenShift CLI (
oc) as a user with administrator privileges.
Procedure
- Log in to the AWS console as a user with administrator privileges.
Delete the external load balancer.
注意The API DNS entry in the private zone already points to the internal load balancer, which uses an identical configuration, so you do not need to modify the internal load balancer.
Delete the
api.<cluster_name>.<domain_name>DNS entry in the public zone.where
<cluster_name>is the name of the cluster and<domain_name>is the base domain for the cluster.-
To remove the external load balancers, log in to the OpenShift CLI (
oc) as a user with administrator privileges. Edit the
ControlPlaneMachineSetCR by running the following command:$ oc edit controlplanemachineset.machine.openshift.io cluster \ -n openshift-machine-apiRemove the external load balancers by deleting the corresponding lines in the control plane machine set custom resource (CR).
In the
spec.template.spec.providerSpec.value.loadBalancerssection of the CR, thenamevalue for the external load balancer ends in-ext. Delete the line with the external load balancernamevalue and the line with the external load balancertypevalue that accompanies it.apiVersion: machine.openshift.io/v1 kind: ControlPlaneMachineSet metadata: name: cluster namespace: openshift-machine-api spec: # ... template: # ... spec: providerSpec: value: loadBalancers: - name: <cluster_id>-ext type: network - name: <cluster_id>-int type: network # ...Save your changes and exit the object specification.
When you save an update to the control plane machine set, the Control Plane Machine Set Operator updates the control plane machines according to your configured update strategy. For more information, see "Updating the control plane configuration".