Chapter 13. Provisioning virtual machines on OpenShift Virtualization

Procedure

1. Enter the following satellite-installer command to enable the OpenShift Virtualization plugin for Satellite:

   # satellite-installer --enable-foreman-plugin-kubevirt

2. Obtain a token to use for HTTP and HTTPs authentication:

   1. Create a service account:

      $ oc create serviceaccount My_Service_Account --namespace My_Namespace

   2. Add the kubevirt.io:edit role to the service account:

      $ oc create rolebinding My_Service_Account-kubevirt-edit --clusterrole=kubevirt.io:edit --serviceaccount=My_Namespace:My_Service_Account

   3. Add the view role to the service account:

      $ oc create rolebinding My_Service_Account-view --clusterrole=view --serviceaccount=My_Namespace:My_Service_Account

   4. Create a persistent token for the account:

      $ oc create --filename=- <<EOF
      apiVersion: v1
      kind: Secret
      metadata:
        name: My_SA_Token
        annotations:
          kubernetes.io/service-account.name: My_Service_Account
      type: kubernetes.io/service-account-token
      EOF

   5. Record the token to use later in this procedure.

      $ oc get secrets My_SA_Token --template='{{.data.token | base64decode}}'

3. In the Satellite web UI, navigate to Infrastructure > Compute Resources, and click Create Compute Resource.
4. In the Name field, enter a name for the new compute resource.
5. From the Provider list, select OpenShift Virtualization.
6. In the Description field, enter a description for the compute resource.
7. In the Hostname field, enter the FQDN, hostname, or IP address of the OpenShift Container Platform cluster.
8. In the API Port field, enter the port number that you want to use for provisioning requests from Satellite to OpenShift Virtualization.
9. In the Namespace field, enter the namespace of the OpenShift Container Platform cluster.
10. In the Token field, enter the token you recorded.
11. Optional: In the X509 Certification Authorities field, enter a certificate to enable client certificate authentication for API server calls.