10.5.2. Configuring Amazon Web Services features for control plane machines


You can enable or change the configuration of features for your control plane machines by editing values in the control plane machine set specification.

When you save an update to the control plane machine set, the Control Plane Machine Set Operator updates the control plane machines according to your configured update strategy. For more information, see "Updating the control plane configuration".

If the security posture of your organization does not allow clusters to use an open API endpoint, you can restrict the API server to use only internal load balancers. To implement this API server restriction, use the Amazon Web Services (AWS) console and OpenShift CLI (oc) to delete the external load balancer components.

Prerequisites

  • You have installed an OpenShift Container Platform cluster on AWS.
  • You have access to the AWS console as a user with administrator privileges.
  • You have access to the OpenShift CLI (oc) as a user with administrator privileges.

Procedure

  1. Log in to the AWS console as a user with administrator privileges.
  2. Delete the external load balancer.

    注意

    The API DNS entry in the private zone already points to the internal load balancer, which uses an identical configuration, so you do not need to modify the internal load balancer.

  3. Delete the api.<cluster_name>.<domain_name> DNS entry in the public zone.

    where <cluster_name> is the name of the cluster and <domain_name> is the base domain for the cluster.

  4. To remove the external load balancers, log in to the OpenShift CLI (oc) as a user with administrator privileges.
  5. Edit the ControlPlaneMachineSet CR by running the following command:

    $ oc edit controlplanemachineset.machine.openshift.io cluster \
      -n openshift-machine-api
  6. Remove the external load balancers by deleting the corresponding lines in the control plane machine set custom resource (CR).

    In the spec.template.spec.providerSpec.value.loadBalancers section of the CR, the name value for the external load balancer ends in -ext. Delete the line with the external load balancer name value and the line with the external load balancer type value that accompanies it.

    apiVersion: machine.openshift.io/v1
    kind: ControlPlaneMachineSet
    metadata:
      name: cluster
      namespace: openshift-machine-api
    spec:
    # ...
      template:
    # ...
          spec:
            providerSpec:
              value:
                loadBalancers:
                - name: <cluster_id>-ext
                  type: network
                - name: <cluster_id>-int
                  type: network
    # ...
  7. Save your changes and exit the object specification.

    When you save an update to the control plane machine set, the Control Plane Machine Set Operator updates the control plane machines according to your configured update strategy. For more information, see "Updating the control plane configuration".

Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

關於紅帽

我们提供强化的解决方案,使企业能够更轻松地跨平台和环境(从核心数据中心到网络边缘)工作。

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情,请参阅红帽博客.

关于红帽文档

Legal Notice

Theme

© 2026 Red Hat
返回顶部