SlideShare a Scribd company logo

OpenShift_Installation_Deep_Dive_Robert_Bohne.pdf

•
S
ssuser9e06a61

The document discusses Red Hat OpenShift 4 installation methods. It describes the Full Stack Automation method where the installer provisions all infrastructure components including hosts running Red Hat Enterprise Linux CoreOS (RHCOS). It also covers deploying to pre-existing infrastructure where the user provisions infrastructure like VMs, load balancers, and DNS, while the installer configures the OpenShift cluster and RHCOS hosts.

Technology
1 of 40
Downloaded 10 times
1
2
3
4
5
6
7
8
9
10
11
Most read
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
Red Hat OpenShift 4 - Installation Robert Bohne SR. SPECIALIST SOLUTION ARCHITECT | OPENSHIFT Twitter: @RobertBohne 1
OPENSHIFT CONTAINER PLATFORM | Architectural Overview 2 WORKER MASTER Red Hat® OpenShift® services STORAGE Kubernetes services Monitoring | Logging | Tuned SDN | DNS | Kubelet Infrastructure services etcd NETWORK COMPUTE Registry Prometheus | Grafana Alertmanager Kibana | Elasticsearch Router Developers Admins WORKER Monitoring | Logging | Tuned SDN | DNS | Kubelet Registry Prometheus | Grafana Alertmanager Kibana | Elasticsearch Router
3 The New Platform Boundary OpenShift 4 is aware of the entire infrastructure and brings the Operating System under management AUTOMATED OPERATIONS KUBERNETES RHEL or RHEL CoreOS OpenShift & Kubernetes certificates & security settings container runtime config allowed maintenance windows software defined networking kernel modules device drivers network interfaces security groups Nodes & Operating System
OPERATING SYSTEM OPERATING SYSTEM OPENSHIFT PLATFORM OPENSHIFT PLATFORM OPENSHIFT 4 (only) OPENSHIFT 3 & 4 INFRASTRUCTURE Full-stack automated install
Red Hat Enterprise Linux CoreOS 5 Immutable foundation for OpenShift clusters Ignition-based Metal and Cloud host configuration Over-the-air automated updates Decreased attack surface Optimized for running containers Minimal Linux distribution RED HAT OPENSHIFT 4
Immutable Operating System OPENSHIFT PLATFORM Red Hat Enterprise Linux CoreOS is versioned with OpenShift CoreOS is tested and shipped in conjunction with the platform. Red Hat runs thousands of tests against these configurations. Red Hat Enterprise Linux CoreOS is managed by the cluster The Operating system is operated as part of the cluster, with the config for components managed by Machine Config Operator: ● CRI-O config ● Kubelet config ● Authorized registries ● SSH config v4.1.6 v4.1.6 RHEL CoreOS admins are responsible for: Nothing. All is installed via Operators and Container Images! There are no RPM’s anymore!
OpenShift Architecture 7 A lightweight, OCI-compliant container runtime Minimal and Secure Architecture Optimized for Kubernetes Runs any OCI-compliant image (including docker)
BROAD ECOSYSTEM OF WORKLOADS CRI-O Support in OpenShift CRI-O 1.13 Kubernetes 1.13 OpenShift 4.1 CRI-O 1.14 Kubernetes 1.14 OpenShift 4.2 CRI-O 1.12 Kubernetes 1.12 OpenShift 4.0 CRI-O tracks and versions identical to Kubernetes, simplifying support permutations
● A Kubernetes thing ● Now part of CNCF! (April 8th) ● OCI daemon ● Implements Kubelet Container Runtime Interface (CRI) CRI-O Container Host Container Container Container Kubernetes READONLY SECURITY FEATURES Run securely in a production cluster No daemon Read-only containers Enable fewer capabilities User namespaces FIPS mode support 9 OCI AND CRI-O
● Built for interfacing with Docker registry ● CLI for images and image registries ● Rejected by upstream Docker ¯_(ツ)_/¯ ● Allows remote inspection of image meta-data - no downloading ● Can copy from one storage to another SKOPEO Image Repository Image Registry Host /var/lib/containers or /var/lib/docker SECURITY FEATURES Share securely No daemon Inspect remote images No pulling potentially malicious images Non-root copy. Bridge between registries. 10 IMAGE COPY WITH SKOPEO
● @ podman.io ● Client only tool, based on the Docker CLI. (same+) ● No daemon! ● Storage for ○ Images - containers/image ○ Containers - containers/storage ● Runtime - runc ● Shares state with CRI-O and with Buildah! PODMAN Images Image Registry Containers Kernel SECURITY FEATURES Run and develop securely No daemon Run without root Isolate with user namespaces Audit who runs what 11 The new container CLI
12 ● Now buildah.io ● Builds OCI compliant images ● No daemon - no “docker socket” ● Does not require a running container ● Can use the host’s user’s secrets. ● Single layer, from scratch images are made easy and it ensures limited manifest. ● If needed you can still maintain Dockerfile based workflow Base RHEL OS Update Layer Java Runtime Layer Application Layer Java runtime and dependencies, and Application From scratch, single layer From base, multi-layer SECURITY FEATURES Build securely No daemon Shrink the attack surface Fine-grained control of the layers Run builds isolated Better secret management Why use Buildah?
13 ● Docker, Red Hat et al. June 2015 ● Two specifications ○ Image format ■ How to package an OCI Image with sufficient information to launch the application on the target platform ○ Runtime ■ How to launch a “filesystem bundle” that is unpacked on disk ● Version 1.0 of each released July 19th 2017 ● Distribution spec started in April, 2018.
14 { "ignition": { "config": {}, "timeouts": {}, "version": "2.1.0" }, "passwd": { "users": [ { "name": "core", "passwordHash": "$6$43y3tkl...", "sshAuthorizedKeys": [ "key1" ] } ] }, "storage": {}, "systemd": {} } Ignition applies a declarative node configuration early in the boot process. Unifies kickstart and cloud-init. ● Generated via openshift-install & MCO ● Configures storage, systemd units, users, & remote configs ● Executed in the initramfs One Touch provisioning via Ignition Machine generated; machine validated
15 ● RHCSA Step 1 ○ Boot into “early userspace” and change a file (/etc/shadow) ● Ignition works the same way ○ Boots into “early userspace” ○ Change disks, files based on JSON ○ Starts the machine ● Based on standard Linux startup process How Ignition works
Network configuration label linux menu label ^Install RHEL CoreOS kernel /images/vmlinuz append initrd=/images/initramfs.img nomodeset rd.neednet=1 coreos.inst=yes ip=192.168.122.9::192.168.122.1:255.255.255.0:core2.example.com:enp1s0:none nameserver=192.168.122.1 coreos.inst.install_dev=sda coreos.inst.image_url=http://192.168.122.1/rhcos.raw.gz coreos.inst.ignition_url=http://192.168.122.1/static.ign 16 ● Default: DHCP! ● Static IP via Kernel Arguments:
17 ● First-boot only ○ Provisioning tool not a CM tool ○ Pass .ign ■ to the firmware via HTTP! ■ or cloud metadata svc (i.e. AWS user-data) ● There’s a great deep dive on Ignition here Ignition Essentials If the first-boot cfg needs tweaks, re-provision the node from scratch!
CONFIDENTIAL designator Updating - Patching 18 Q: How to perform updating, patching? A: Red Hat Enterprise Linux CoreOS, or RHCOS, is intended to be consumed as an embedded version of RHEL that is purpose built-to run OpenShift v4. RHCOS isn't managed or updated outside of OpenShift. Updates are pushed to the platform and pick up OS security errata. If a customer is staying on top of OCP updates, then RHCOS will always be current. The management, and the fact that updates are not independent from the platform make RHCOS behave much closer to an appliance than a traditional OS.
CONFIDENTIAL designator Satellite 19 Q: Can we integrate with Satellite? A: RHEL CoreOS does not include subscription-manager and cannot be registered to Satellite like RHEL. Satellite can provide value in two major ways for RHEL CoreOS: ▸ Provisioning - Satellite is able to serve ignition configurations as well as serve the bits needed for a PXE install. ▸ Mirroring updates - Satellite’s registry can be used to serve the containerized content in disconnected environments.
Installation Experiences OPENSHIFT PLATFORM Full Stack Automated Simplified opinionated “Best Practices” for cluster provisioning Fully automated installation and updates including host container OS. Pre-existing Infrastructure Customer managed resources & infrastructure provisioning Plug into existing DNS and security boundaries OPENSHIFT CONTAINER PLATFORM Generally Available Product Manager: Katherine Dubé HOSTED OPENSHIFT Azure Red Hat OpenShift Deploy directly from the Azure console. Jointly managed by Red Hat and Microsoft Azure engineers. OpenShift Dedicated Get a powerful cluster, fully Managed by Red Hat engineers and support.
What's new in OpenShift 4.3 4.3 Supported Providers Generally Available Full Stack Automation (IPI) Pre-existing Infrastructure (UPI) PMs: Katherine Dubé (AWS, Azure, GCP), Maria Bracho (BM UPI, VMware, Upgrades), Peter Lauterbach (RHV), Ramon Acedo Rodriguez (OSP, BM IPI), Mike Barrett (IBM Z & Power) * * Support planned for an upcoming 4.3 z-stream release OPENSHIFT PLATFORM *
What means OPENSHIFT PLATFORM ● Installation on physical hardware ;-) ● Installation on Virtual Machines WITHOUT any guest tool / cloud integration! Deploying OpenShift 4.x on non-tested platforms using the bare metal install method For example Hyper-V: Red Hat Enterprise Linux 8 Ecosystem
Full Stack Automated Deployments OPENSHIFT PLATFORM Generally Available Product Manager: Katherine Dubé Day 1: openshift-install - Day 2: Operators openshift-install deployed Control Plane Worker Nodes User managed Operator managed Cloud Resources RH CoreOS OCP Cluster OCP Cluster Resources RH CoreOS RHEL CoreOS Cloud Resources RH CoreOS RH CoreOS RHEL CoreOS
Full Stack Automated Deployments OPENSHIFT PLATFORM Generally Available Product Manager: Katherine Dubé Simplified Cluster Creation Designed to easily provision a “best practices” OpenShift cluster ● New CLI-based installer with interactive guided workflow that allows for customization at each step ● Installer takes care of provisioning the underlying Infrastructure significantly reducing deployment complexity ● Leverages RHEL CoreOS for all node types enabling full stack automation of installation and updates of both platform and host OS content Faster Install The installer typically finishes within 30 minutes ● Only minimal user input needed with all non-essential install config options now handled by component operator CRD’s ● 4.x provides support for AWS deployments with additional provider support planned in future releases ● See the OpenShift documentation for more details $ ./openshift-install --dir ./demo create cluster ? SSH Public Key /Users/demo/.ssh/id_rsa.pub ? Platform aws ? Region us-west-2 ? Base Domain example.com ? Cluster Name demo ? Pull Secret [? for help] ************************************************************* INFO Creating cluster... INFO Waiting up to 30m0s for the Kubernetes API... INFO API v1.11.0+c69f926354 up INFO Waiting up to 30m0s for the bootstrap-complete event... INFO Destroying the bootstrap resources... INFO Waiting up to 10m0s for the openshift-console route to be created... INFO Install complete! INFO Run 'export KUBECONFIG=<your working directory>/auth/kubeconfig' to manage the cluster with 'oc', the OpenShift CLI. INFO The cluster is ready when 'oc login -u kubeadmin -p <provided>' succeeds (wait a few minutes). INFO Access the OpenShift web-console here: https://console-openshift-console.apps.demo.example.com INFO Login to the console with user: kubeadmin, password: <provided>
Deploying to Pre-existing Infrastructure OPENSHIFT PLATFORM Generally Available Product Manager: Katherine Dubé Day 1: openshift-install - Day 2: Operators + Customer Managed Infra & Workers openshift-install deployed Cloud Resources RH CoreOS OCP Cluster OCP Cluster Resources Control Plane Cloud Resources Worker Nodes Customer deployed User managed Operator managed Note: Control plane nodes must run RHEL CoreOS! RH CoreOS RHEL CoreOS RHEL 7 RHEL CoreOS
Comparison between deployments methods OPENSHIFT PLATFORM Generally Available Product Manager: Katherine Dubé Full Stack Automation Pre-existing Infrastructure Build Network Installer User Setup Load Balancers Installer User Configure DNS Installer User Hardware/VM Provisioning Installer User OS Installation Installer User Generate Ignition Configs Installer Installer OS Support Installer: RHEL CoreOS User: RHEL CoreOS + RHEL 7 Node Provisioning / Autoscaling Yes Only for providers with OpenShift Machine API support Customization & Provider Support Best Practices: AWS Yes: AWS, Bare Metal, & VMware
Provider Ignition stored in? Load balancer? Registry Storage? IPI AWS, GCP, Azure S3 Cloud Provider S3 IPI OpenStack Swift KeepaliveD Swift UPI Bare Metal Own Web Server Own Nothing! NFS?* UPI VMware Own Web Server Own Nothing! NFS?* Some dirty details:
DNS Nodes ● A records ● PTR records - at every reboot RH Core OS determination hostname via PTR record! Cluster / Load Balancer ● *.apps.<CN>.<BD>. 86400 IN A <IP of load balancer> ● api.<CN>.<BD>. 86400 IN A <IP of load balancer> ● api-int.<CN>.<BD>. 86400 IN A <IP of load balancer> Etcd Cluster ● SRV Records ○ # _service._proto.name. TTL class SRV priority weight port target. ○ _etcd-server-ssl._tcp.<CN>.<BD> 86400 IN SRV 0 10 2380 etcd-0.<CN>.<BD>. ○ _etcd-server-ssl._tcp.<CN>.<BD> 86400 IN SRV 0 10 2380 etcd-1.<CN>.<BD>. ○ _etcd-server-ssl._tcp.<CN>.<BD> 86400 IN SRV 0 10 2380 etcd-2.<CN>.<BD>. ● Additional A records to the Node/Host-names ○ etcd-0.<CN>.<BD>. 86400 IN A <IP of controleplan/master node 0> ○ etcd-1.<CN>.<BD>. 86400 IN A <IP of controleplan/master node 1> ○ etcd-2.<CN>.<BD>. 86400 IN A <IP of controleplan/master node 2> Do NOT create PTR’s! <CN> = Cluster Name <BD> = Base Domain
29
Load balancer & DHCP 30 Bildquelle: Timo Klostermeier / pixelio.de
Deploy to pre-existing infrastructure for AWS, Bare Metal, GCP, & VMware! OPENSHIFT PLATFORM Generally Available Product Manager: Katherine Dubé Customized OpenShift Deployments Enables OpenShift to be deployed to user managed resources and pre-existing infrastructure. ● Customers are responsible for provisioning all infrastructure objects including networks, load balancers, DNS, hardware/VMs and performing host OS installation ● Deployments can be performed both on-premise and to the public cloud ● OpenShift installer handles generating cluster assets (such as node ignition configs and kubeconfig) and aids with cluster bring-up by monitoring for bootstrap-complete and cluster-ready events ● Example native provider templates (AWS CloudFormation and Google Deployment Manager) included to help with user provisioning tasks for creating infrastructure objects ● While RHEL CoreOS is mandatory for the control plane, either RHEL CoreOS or RHEL 7 can be used for the worker/infra nodes $ cat ./demo/install-config.yaml apiVersion: v1 baseDomain: example.com compute: - name: worker replicas: 0 controlPlane: name: master ... $ ./openshift-install --dir ./demo create ignition-config INFO Consuming "Install Config" from target directory $ ./openshift-install --dir ./demo wait-for bootstrap-complete INFO Waiting up to 30m0s for the Kubernetes API at https://api.demo.example.com:6443... INFO API v1.11.0+c69f926354 up INFO Waiting up to 30m0s for the bootstrap-complete event... $ ./openshift-install --dir ./demo wait-for cluster-ready INFO Waiting up to 30m0s for the cluster at https://api.demo.example.com:6443 to initialize... INFO Install complete! Pitfall ● Generates certificates that are only valid for 24 hours! ● To restart: delete the config dir “./demo” !!
Booting all machines Bootstrap Master N Master N Master N Master N Master N Worker Web Server "ignition": { "config": { "append": [ { "source": "https://api-int.demo.openshift.pub:22623/config/(master|worker)", "verification": {} [...snipped...] "security": { "tls": { "certificateAuthorities": [ { "source": "data:text/plain;charset=utf-8;base64,LS0t..==", "verification": {} } [...snipped...] The Ignition is quite huge! It contains everything you need to install OpenShift 4, except the images.
Boot the cluster Bootstrap Master N Master N Master N Master N Master N Worker Bootstrapping process step by step: 1. Bootstrap machine boots and starts hosting the remote resources required for master machines to boot. 2. Master machines fetch the remote resources from the bootstrap machine and finish booting. 3. Master machines use the bootstrap node to form an etcd cluster. 4. Bootstrap node starts a temporary Kubernetes control plane using the newly-created etcd cluster. 5. Temporary control plane schedules the production control plane to the master machines. 6. Temporary control plane shuts down, yielding to the production control plane. 7. Bootstrap node injects OpenShift-specific components into the newly formed control plane. 8. Installer then tears down the bootstrap node or if user-provisioned, this needs to be performed by the administrator.
label linux menu label ^Install RHEL CoreOS kernel /images/vmlinuz append initrd=/images/initramfs.img nomodeset rd.neednet=1 coreos.inst=yes ip=192.168.122.9::192.168.122.1:255.255.255.0:core2.example.com:enp1s0:none nameserver=192.168.122.1 coreos.inst.install_dev=sda coreos.inst.image_url=http://192.168.122.1/rhcos.raw.gz coreos.inst.ignition_url=http://192.168.122.1/static.ign Add a node BareMetal Machine Set
1. Boot a node with minimal ignition config: a. certificateAuthorities b. Point to MCO: https://api-int.demo.openshift.pub:22623/config/(master|worker) 2. Node create a CSR (oc get csr) 3. Someone approved CSR a. UPI: administrator 👨🏻‍💻 - during installation auto-approve! b. IPI: Machine Operator 4. Node join the cluster 5. Node starts all pods they need to be a perfect member! (sdn, registry ca,....) Add a node
36 subscription-manager register --username=<user_name> --password=<password> subscription-manager repos --enable="rhel-7-server-rpms" --enable="rhel-7-server-extras-rpms" --enable="rhel-7-server-ose-4.2-rpms" # vi inventory/hosts ---- [all:vars] ansible_user=root #ansible_become=True openshift_kubeconfig_path="~/.kube/config" [new_workers] mycluster-worker-0.example.com mycluster-worker-1.example.com ---- ansible-playbook -i /<path>/inventory/hosts playbooks/scaleup.yml Add a node RHEL Node WIHTOUT Over the Air (OTA) Updates!
● OpenShift retrieves the list of available updates ● Admin selects the target version ● OpenShift is updated over the air ● Auto-update support Over the Air (OTA) Updates Only with Red Hat CoreOS - it doesn’t matter how (IPI vs UPI) you install the cluster!
OPENSHIFT PLATFORM Disconnected “Air-gapped” Installation & Upgrading Generally Available Product Manager: Katherine Dubé Installation Procedure ● Mirror OpenShift content to local container registry in the disconnected environment ● Generate install-config.yaml: $ ./openshift-install create install-config --dir <dir> ○ Edit and add pull secret (PullSecret), CA certificate (additionalTrustBundle), and image content sources (ImageContentSources) to install-config.yaml ● Set the OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE environment variable during the creation of the ignition configs ● Generate the ignition configuration: $ ./openshift-install create ignition-configs --dir <dir> ● Use the resulting ignition files to bootstrap the cluster deployment Overview ● 4.2 introduces support for installing and updating OpenShift clusters in disconnected environments ● Requires local Docker 2.2 spec compliant container registry to host OpenShift content ● Designed to work with the user provisioned infrastructure deployment method ○ Note: Will not work with Installer provisioned infrastructure deployments Admin Local Container Registry Quay.io Container Registry # mirror update image: $ oc adm -a <secret_json> release mirror --from=quay.io/<repo>/<release:version> --to=<local registry>/<repo> --to-release-image=<local registry>/<repo:version> # provide cluster with update image to update to: $ oc adm upgrade --to-mirror=<local repo:version> Local Copy of Update Image Disconnected OpenShift Cluster Red Hat sourced Update Image Mirrored to local registry Cluster updated locally Customer Cluster
OPENSHIFT PLATFORM Cluster-wide Egress Proxy Generally Available Product Manager: Marc Curry & Katherine Dubé Overview ● 4.2 introduces support for installing and updating OpenShift clusters through a corporate proxy server ● Leverages new proxy controller within the cluster-network-operator, which is responsible for: ○ Reconciling a proxy object and writing spec > status upon successful validation. ○ Reconciling user-provided trust bundles referenced by trustedCA, validating the trust bundle certificates, merging the certificates with the system trust bundle and publishing the merged bundle to the openshift-config-managed/trusted-ca-bundle configmap. Installation Procedure ● Installer will use PROXY* environment variables from the shell it’s invoked from ● Generate install-config.yaml: $ ./openshift-install create install-config --dir <dir> ○ Edit proxy information (httpProxy, httpsProxy, & noProxy) and CA certificate (‘additionalTrustBundle’) to install-config.yaml ● Installer validates the provided install-config.yaml parameters, renders the necessary assets to create the cluster, and initiates the installation process based on the install method used: $ ./openshift-install create cluster --dir <dir> Corporate Proxy Server Proxy Connected OpenShift Cluster Customer Cluster Internet Quay.io Container Registry Backend Services $ oc get proxy/cluster -o yaml apiVersion: config.openshift.io/v1 kind: Proxy metadata: creationTimestamp: "2019-08-21T22:36:49Z" generation: 2 name: cluster resourceVersion: "24913" selfLink: /apis/config.openshift.io/v1/proxies/cluster uid: 2a344b01-d267-11f9-a4f3-025de4b59c38 spec: httpProxy: http://<username>:<pswd>@<ip>:<port> httpsProxy: https://<username>:<pswd>@<ip>:<port> noProxy: example.com readinessEndpoints: - http://www.google.com - https://www.google.com trustedCA: name: user-ca-bundle status: httpProxy: http://<username>:<pswd>@<ip>:<port> httpsProxy: https://<username>:<pswd>@<ip>:<port> noProxy: 10.0.0.0/16,10.128.0.0/14,127.0.0.1,169.254.169.254,172.30 .0.0/16,api-int.demo.example.com,api.demo.example.openshif t.com,etcd-0.demo.example.com,etcd-1.demo.example.com,etcd -2.demo.example.com,example.com,localhost An admin with privileges can interact with the proxy object using ‘oc’ commands (use the ‘oc edit’ command to modify the proxy information.) Here is an example proxy config:
CONFIDENTIAL Designator linkedin.com/company/red-hat youtube.com/user/RedHatVideos facebook.com/redhatinc twitter.com/RedHat 40 Questions?

More Related Content

Similar to OpenShift_Installation_Deep_Dive_Robert_Bohne.pdf (20)

PDF
Meetup Openshift Geneva 03/10
MagaliDavidCruz
 
PDF
OpenShift Container Platform 4.12 Release Notes
GerryJamisola1
 
PDF
HPC on OpenStack
Erich Birngruber
 
PPTX
Docker - Demo on PHP Application deployment
Arun prasath
 
PDF
Learn OpenStack from trystack.cn
OpenCity Community
 
PDF
Red Hat and kubernetes: awesome stuff coming your way
Johannes Brännström
 
PPTX
DR_PRESENT 1
Ahmed Salman
 
PDF
CNCF Meetup - OpenShift Overview
Sumit Shatwara
 
PDF
Security of Linux containers in the cloud
Dobrica Pavlinušić
 
PDF
Openshift 3.10 & Container solutions for Blockchain, IoT and Data Science
John Archer
 
PPTX
Introduction to Docker
Nissan Dookeran
 
PDF
Red hat cloud platforms
Giovanni Galloro
 
PDF
Rhel8 Beta - Halifax RHUG
Nicole Maselli
 
PPTX
What's New in Docker - February 2017
Patrick Chanezon
 
PDF
RHEL8-BETA-RHUG.pdf
Harsh Shah
 
ODP
Openshift: Build, deploy & manage open, standard containers
Jonh Wendell
 
PDF
The Future of Security and Productivity in Our Newly Remote World
DevOps.com
 
PDF
Build Your Own PaaS, Just like Red Hat's OpenShift from LinuxCon 2013 New Orl...
OpenShift Origin
 
PPTX
Docker Security and Orchestration for DevSecOps wins
Sharath Kumar
 
PDF
Navigating container technology for enhanced security by Niklas Saari
Metosin Oy
 
Meetup Openshift Geneva 03/10
MagaliDavidCruz
 
OpenShift Container Platform 4.12 Release Notes
GerryJamisola1
 
HPC on OpenStack
Erich Birngruber
 
Docker - Demo on PHP Application deployment
Arun prasath
 
Learn OpenStack from trystack.cn
OpenCity Community
 
Red Hat and kubernetes: awesome stuff coming your way
Johannes Brännström
 
DR_PRESENT 1
Ahmed Salman
 
CNCF Meetup - OpenShift Overview
Sumit Shatwara
 
Security of Linux containers in the cloud
Dobrica Pavlinušić
 
Openshift 3.10 & Container solutions for Blockchain, IoT and Data Science
John Archer
 
Introduction to Docker
Nissan Dookeran
 
Red hat cloud platforms
Giovanni Galloro
 
Rhel8 Beta - Halifax RHUG
Nicole Maselli
 
What's New in Docker - February 2017
Patrick Chanezon
 
RHEL8-BETA-RHUG.pdf
Harsh Shah
 
Openshift: Build, deploy & manage open, standard containers
Jonh Wendell
 
The Future of Security and Productivity in Our Newly Remote World
DevOps.com
 
Build Your Own PaaS, Just like Red Hat's OpenShift from LinuxCon 2013 New Orl...
OpenShift Origin
 
Docker Security and Orchestration for DevSecOps wins
Sharath Kumar
 
Navigating container technology for enhanced security by Niklas Saari
Metosin Oy
 

Recently uploaded (20)

PPTX
AI in Daily Life: How Artificial Intelligence Helps Us Every Day
vanshrpatil7
 
PDF
Economic Impact of Data Centres to the Malaysian Economy
flintglobalapac
 
PPTX
IT Runs Better with ThousandEyes AI-driven Assurance
ThousandEyes
 
PDF
Generative AI vs Predictive AI-The Ultimate Comparison Guide
Lily Clark
 
PPTX
Simple and concise overview about Quantum computing..pptx
mughal641
 
PPTX
cloud computing vai.pptx for the project
vaibhavdobariyal79
 
PDF
Data_Analytics_vs_Data_Science_vs_BI_by_CA_Suvidha_Chaplot.pdf
CA Suvidha Chaplot
 
PPTX
Farrell_Programming Logic and Design slides_10e_ch02_PowerPoint.pptx
bashnahara11
 
PPTX
What-is-the-World-Wide-Web -- Introduction
tonifi9488
 
PPTX
Applied-Statistics-Mastering-Data-Driven-Decisions.pptx
parmaryashparmaryash
 
PPTX
Agile Chennai 18-19 July 2025 Ideathon | AI Powered Microfinance Literacy Gui...
AgileNetwork
 
PPTX
Introduction to Flutter by Ayush Desai.pptx
ayushdesai204
 
PDF
State-Dependent Conformal Perception Bounds for Neuro-Symbolic Verification
Ivan Ruchkin
 
PDF
Build with AI and GDG Cloud Bydgoszcz- ADK .pdf
jaroslawgajewski1
 
PDF
The Future of Mobile Is Context-Aware—Are You Ready?
iProgrammer Solutions Private Limited
 
PPTX
Agentic AI in Healthcare Driving the Next Wave of Digital Transformation
danielle hunter
 
PPTX
AVL ( audio, visuals or led ), technology.
Rajeshwri Panchal
 
PDF
Tea4chat - another LLM Project by Kerem Atam
a0m0rajab1
 
PDF
Presentation about Hardware and Software in Computer
snehamodhawadiya
 
PPTX
Agile Chennai 18-19 July 2025 | Workshop - Enhancing Agile Collaboration with...
AgileNetwork
 
AI in Daily Life: How Artificial Intelligence Helps Us Every Day
vanshrpatil7
 
Economic Impact of Data Centres to the Malaysian Economy
flintglobalapac
 
IT Runs Better with ThousandEyes AI-driven Assurance
ThousandEyes
 
Generative AI vs Predictive AI-The Ultimate Comparison Guide
Lily Clark
 
Simple and concise overview about Quantum computing..pptx
mughal641
 
cloud computing vai.pptx for the project
vaibhavdobariyal79
 
Data_Analytics_vs_Data_Science_vs_BI_by_CA_Suvidha_Chaplot.pdf
CA Suvidha Chaplot
 
Farrell_Programming Logic and Design slides_10e_ch02_PowerPoint.pptx
bashnahara11
 
What-is-the-World-Wide-Web -- Introduction
tonifi9488
 
Applied-Statistics-Mastering-Data-Driven-Decisions.pptx
parmaryashparmaryash
 
Agile Chennai 18-19 July 2025 Ideathon | AI Powered Microfinance Literacy Gui...
AgileNetwork
 
Introduction to Flutter by Ayush Desai.pptx
ayushdesai204
 
State-Dependent Conformal Perception Bounds for Neuro-Symbolic Verification
Ivan Ruchkin
 
Build with AI and GDG Cloud Bydgoszcz- ADK .pdf
jaroslawgajewski1
 
The Future of Mobile Is Context-Aware—Are You Ready?
iProgrammer Solutions Private Limited
 
Agentic AI in Healthcare Driving the Next Wave of Digital Transformation
danielle hunter
 
AVL ( audio, visuals or led ), technology.
Rajeshwri Panchal
 
Tea4chat - another LLM Project by Kerem Atam
a0m0rajab1
 
Presentation about Hardware and Software in Computer
snehamodhawadiya
 
Agile Chennai 18-19 July 2025 | Workshop - Enhancing Agile Collaboration with...
AgileNetwork
 
Ad

OpenShift_Installation_Deep_Dive_Robert_Bohne.pdf

  • 1. Red Hat OpenShift 4 - Installation Robert Bohne SR. SPECIALIST SOLUTION ARCHITECT | OPENSHIFT Twitter: @RobertBohne 1
  • 2. OPENSHIFT CONTAINER PLATFORM | Architectural Overview 2 WORKER MASTER Red Hat® OpenShift® services STORAGE Kubernetes services Monitoring | Logging | Tuned SDN | DNS | Kubelet Infrastructure services etcd NETWORK COMPUTE Registry Prometheus | Grafana Alertmanager Kibana | Elasticsearch Router Developers Admins WORKER Monitoring | Logging | Tuned SDN | DNS | Kubelet Registry Prometheus | Grafana Alertmanager Kibana | Elasticsearch Router
  • 3. 3 The New Platform Boundary OpenShift 4 is aware of the entire infrastructure and brings the Operating System under management AUTOMATED OPERATIONS KUBERNETES RHEL or RHEL CoreOS OpenShift & Kubernetes certificates & security settings container runtime config allowed maintenance windows software defined networking kernel modules device drivers network interfaces security groups Nodes & Operating System
  • 4. OPERATING SYSTEM OPERATING SYSTEM OPENSHIFT PLATFORM OPENSHIFT PLATFORM OPENSHIFT 4 (only) OPENSHIFT 3 & 4 INFRASTRUCTURE Full-stack automated install
  • 5. Red Hat Enterprise Linux CoreOS 5 Immutable foundation for OpenShift clusters Ignition-based Metal and Cloud host configuration Over-the-air automated updates Decreased attack surface Optimized for running containers Minimal Linux distribution RED HAT OPENSHIFT 4
  • 6. Immutable Operating System OPENSHIFT PLATFORM Red Hat Enterprise Linux CoreOS is versioned with OpenShift CoreOS is tested and shipped in conjunction with the platform. Red Hat runs thousands of tests against these configurations. Red Hat Enterprise Linux CoreOS is managed by the cluster The Operating system is operated as part of the cluster, with the config for components managed by Machine Config Operator: ● CRI-O config ● Kubelet config ● Authorized registries ● SSH config v4.1.6 v4.1.6 RHEL CoreOS admins are responsible for: Nothing. All is installed via Operators and Container Images! There are no RPM’s anymore!
  • 7. OpenShift Architecture 7 A lightweight, OCI-compliant container runtime Minimal and Secure Architecture Optimized for Kubernetes Runs any OCI-compliant image (including docker)
  • 8. BROAD ECOSYSTEM OF WORKLOADS CRI-O Support in OpenShift CRI-O 1.13 Kubernetes 1.13 OpenShift 4.1 CRI-O 1.14 Kubernetes 1.14 OpenShift 4.2 CRI-O 1.12 Kubernetes 1.12 OpenShift 4.0 CRI-O tracks and versions identical to Kubernetes, simplifying support permutations
  • 9. ● A Kubernetes thing ● Now part of CNCF! (April 8th) ● OCI daemon ● Implements Kubelet Container Runtime Interface (CRI) CRI-O Container Host Container Container Container Kubernetes READONLY SECURITY FEATURES Run securely in a production cluster No daemon Read-only containers Enable fewer capabilities User namespaces FIPS mode support 9 OCI AND CRI-O
  • 10. ● Built for interfacing with Docker registry ● CLI for images and image registries ● Rejected by upstream Docker ¯_(ツ)_/¯ ● Allows remote inspection of image meta-data - no downloading ● Can copy from one storage to another SKOPEO Image Repository Image Registry Host /var/lib/containers or /var/lib/docker SECURITY FEATURES Share securely No daemon Inspect remote images No pulling potentially malicious images Non-root copy. Bridge between registries. 10 IMAGE COPY WITH SKOPEO
  • 11. ● @ podman.io ● Client only tool, based on the Docker CLI. (same+) ● No daemon! ● Storage for ○ Images - containers/image ○ Containers - containers/storage ● Runtime - runc ● Shares state with CRI-O and with Buildah! PODMAN Images Image Registry Containers Kernel SECURITY FEATURES Run and develop securely No daemon Run without root Isolate with user namespaces Audit who runs what 11 The new container CLI
  • 12. 12 ● Now buildah.io ● Builds OCI compliant images ● No daemon - no “docker socket” ● Does not require a running container ● Can use the host’s user’s secrets. ● Single layer, from scratch images are made easy and it ensures limited manifest. ● If needed you can still maintain Dockerfile based workflow Base RHEL OS Update Layer Java Runtime Layer Application Layer Java runtime and dependencies, and Application From scratch, single layer From base, multi-layer SECURITY FEATURES Build securely No daemon Shrink the attack surface Fine-grained control of the layers Run builds isolated Better secret management Why use Buildah?
  • 13. 13 ● Docker, Red Hat et al. June 2015 ● Two specifications ○ Image format ■ How to package an OCI Image with sufficient information to launch the application on the target platform ○ Runtime ■ How to launch a “filesystem bundle” that is unpacked on disk ● Version 1.0 of each released July 19th 2017 ● Distribution spec started in April, 2018.
  • 14. 14 { "ignition": { "config": {}, "timeouts": {}, "version": "2.1.0" }, "passwd": { "users": [ { "name": "core", "passwordHash": "$6$43y3tkl...", "sshAuthorizedKeys": [ "key1" ] } ] }, "storage": {}, "systemd": {} } Ignition applies a declarative node configuration early in the boot process. Unifies kickstart and cloud-init. ● Generated via openshift-install & MCO ● Configures storage, systemd units, users, & remote configs ● Executed in the initramfs One Touch provisioning via Ignition Machine generated; machine validated
  • 15. 15 ● RHCSA Step 1 ○ Boot into “early userspace” and change a file (/etc/shadow) ● Ignition works the same way ○ Boots into “early userspace” ○ Change disks, files based on JSON ○ Starts the machine ● Based on standard Linux startup process How Ignition works
  • 16. Network configuration label linux menu label ^Install RHEL CoreOS kernel /images/vmlinuz append initrd=/images/initramfs.img nomodeset rd.neednet=1 coreos.inst=yes ip=192.168.122.9::192.168.122.1:255.255.255.0:core2.example.com:enp1s0:none nameserver=192.168.122.1 coreos.inst.install_dev=sda coreos.inst.image_url=http://192.168.122.1/rhcos.raw.gz coreos.inst.ignition_url=http://192.168.122.1/static.ign 16 ● Default: DHCP! ● Static IP via Kernel Arguments:
  • 17. 17 ● First-boot only ○ Provisioning tool not a CM tool ○ Pass .ign ■ to the firmware via HTTP! ■ or cloud metadata svc (i.e. AWS user-data) ● There’s a great deep dive on Ignition here Ignition Essentials If the first-boot cfg needs tweaks, re-provision the node from scratch!
  • 18. CONFIDENTIAL designator Updating - Patching 18 Q: How to perform updating, patching? A: Red Hat Enterprise Linux CoreOS, or RHCOS, is intended to be consumed as an embedded version of RHEL that is purpose built-to run OpenShift v4. RHCOS isn't managed or updated outside of OpenShift. Updates are pushed to the platform and pick up OS security errata. If a customer is staying on top of OCP updates, then RHCOS will always be current. The management, and the fact that updates are not independent from the platform make RHCOS behave much closer to an appliance than a traditional OS.
  • 19. CONFIDENTIAL designator Satellite 19 Q: Can we integrate with Satellite? A: RHEL CoreOS does not include subscription-manager and cannot be registered to Satellite like RHEL. Satellite can provide value in two major ways for RHEL CoreOS: ▸ Provisioning - Satellite is able to serve ignition configurations as well as serve the bits needed for a PXE install. ▸ Mirroring updates - Satellite’s registry can be used to serve the containerized content in disconnected environments.
  • 20. Installation Experiences OPENSHIFT PLATFORM Full Stack Automated Simplified opinionated “Best Practices” for cluster provisioning Fully automated installation and updates including host container OS. Pre-existing Infrastructure Customer managed resources & infrastructure provisioning Plug into existing DNS and security boundaries OPENSHIFT CONTAINER PLATFORM Generally Available Product Manager: Katherine Dubé HOSTED OPENSHIFT Azure Red Hat OpenShift Deploy directly from the Azure console. Jointly managed by Red Hat and Microsoft Azure engineers. OpenShift Dedicated Get a powerful cluster, fully Managed by Red Hat engineers and support.
  • 21. What's new in OpenShift 4.3 4.3 Supported Providers Generally Available Full Stack Automation (IPI) Pre-existing Infrastructure (UPI) PMs: Katherine Dubé (AWS, Azure, GCP), Maria Bracho (BM UPI, VMware, Upgrades), Peter Lauterbach (RHV), Ramon Acedo Rodriguez (OSP, BM IPI), Mike Barrett (IBM Z & Power) * * Support planned for an upcoming 4.3 z-stream release OPENSHIFT PLATFORM *
  • 22. What means OPENSHIFT PLATFORM ● Installation on physical hardware ;-) ● Installation on Virtual Machines WITHOUT any guest tool / cloud integration! Deploying OpenShift 4.x on non-tested platforms using the bare metal install method For example Hyper-V: Red Hat Enterprise Linux 8 Ecosystem
  • 23. Full Stack Automated Deployments OPENSHIFT PLATFORM Generally Available Product Manager: Katherine Dubé Day 1: openshift-install - Day 2: Operators openshift-install deployed Control Plane Worker Nodes User managed Operator managed Cloud Resources RH CoreOS OCP Cluster OCP Cluster Resources RH CoreOS RHEL CoreOS Cloud Resources RH CoreOS RH CoreOS RHEL CoreOS
  • 24. Full Stack Automated Deployments OPENSHIFT PLATFORM Generally Available Product Manager: Katherine Dubé Simplified Cluster Creation Designed to easily provision a “best practices” OpenShift cluster ● New CLI-based installer with interactive guided workflow that allows for customization at each step ● Installer takes care of provisioning the underlying Infrastructure significantly reducing deployment complexity ● Leverages RHEL CoreOS for all node types enabling full stack automation of installation and updates of both platform and host OS content Faster Install The installer typically finishes within 30 minutes ● Only minimal user input needed with all non-essential install config options now handled by component operator CRD’s ● 4.x provides support for AWS deployments with additional provider support planned in future releases ● See the OpenShift documentation for more details $ ./openshift-install --dir ./demo create cluster ? SSH Public Key /Users/demo/.ssh/id_rsa.pub ? Platform aws ? Region us-west-2 ? Base Domain example.com ? Cluster Name demo ? Pull Secret [? for help] ************************************************************* INFO Creating cluster... INFO Waiting up to 30m0s for the Kubernetes API... INFO API v1.11.0+c69f926354 up INFO Waiting up to 30m0s for the bootstrap-complete event... INFO Destroying the bootstrap resources... INFO Waiting up to 10m0s for the openshift-console route to be created... INFO Install complete! INFO Run 'export KUBECONFIG=<your working directory>/auth/kubeconfig' to manage the cluster with 'oc', the OpenShift CLI. INFO The cluster is ready when 'oc login -u kubeadmin -p <provided>' succeeds (wait a few minutes). INFO Access the OpenShift web-console here: https://console-openshift-console.apps.demo.example.com INFO Login to the console with user: kubeadmin, password: <provided>
  • 25. Deploying to Pre-existing Infrastructure OPENSHIFT PLATFORM Generally Available Product Manager: Katherine Dubé Day 1: openshift-install - Day 2: Operators + Customer Managed Infra & Workers openshift-install deployed Cloud Resources RH CoreOS OCP Cluster OCP Cluster Resources Control Plane Cloud Resources Worker Nodes Customer deployed User managed Operator managed Note: Control plane nodes must run RHEL CoreOS! RH CoreOS RHEL CoreOS RHEL 7 RHEL CoreOS
  • 26. Comparison between deployments methods OPENSHIFT PLATFORM Generally Available Product Manager: Katherine Dubé Full Stack Automation Pre-existing Infrastructure Build Network Installer User Setup Load Balancers Installer User Configure DNS Installer User Hardware/VM Provisioning Installer User OS Installation Installer User Generate Ignition Configs Installer Installer OS Support Installer: RHEL CoreOS User: RHEL CoreOS + RHEL 7 Node Provisioning / Autoscaling Yes Only for providers with OpenShift Machine API support Customization & Provider Support Best Practices: AWS Yes: AWS, Bare Metal, & VMware
  • 27. Provider Ignition stored in? Load balancer? Registry Storage? IPI AWS, GCP, Azure S3 Cloud Provider S3 IPI OpenStack Swift KeepaliveD Swift UPI Bare Metal Own Web Server Own Nothing! NFS?* UPI VMware Own Web Server Own Nothing! NFS?* Some dirty details:
  • 28. DNS Nodes ● A records ● PTR records - at every reboot RH Core OS determination hostname via PTR record! Cluster / Load Balancer ● *.apps.<CN>.<BD>. 86400 IN A <IP of load balancer> ● api.<CN>.<BD>. 86400 IN A <IP of load balancer> ● api-int.<CN>.<BD>. 86400 IN A <IP of load balancer> Etcd Cluster ● SRV Records ○ # _service._proto.name. TTL class SRV priority weight port target. ○ _etcd-server-ssl._tcp.<CN>.<BD> 86400 IN SRV 0 10 2380 etcd-0.<CN>.<BD>. ○ _etcd-server-ssl._tcp.<CN>.<BD> 86400 IN SRV 0 10 2380 etcd-1.<CN>.<BD>. ○ _etcd-server-ssl._tcp.<CN>.<BD> 86400 IN SRV 0 10 2380 etcd-2.<CN>.<BD>. ● Additional A records to the Node/Host-names ○ etcd-0.<CN>.<BD>. 86400 IN A <IP of controleplan/master node 0> ○ etcd-1.<CN>.<BD>. 86400 IN A <IP of controleplan/master node 1> ○ etcd-2.<CN>.<BD>. 86400 IN A <IP of controleplan/master node 2> Do NOT create PTR’s! <CN> = Cluster Name <BD> = Base Domain
  • 29. 29
  • 30. Load balancer & DHCP 30 Bildquelle: Timo Klostermeier / pixelio.de
  • 31. Deploy to pre-existing infrastructure for AWS, Bare Metal, GCP, & VMware! OPENSHIFT PLATFORM Generally Available Product Manager: Katherine Dubé Customized OpenShift Deployments Enables OpenShift to be deployed to user managed resources and pre-existing infrastructure. ● Customers are responsible for provisioning all infrastructure objects including networks, load balancers, DNS, hardware/VMs and performing host OS installation ● Deployments can be performed both on-premise and to the public cloud ● OpenShift installer handles generating cluster assets (such as node ignition configs and kubeconfig) and aids with cluster bring-up by monitoring for bootstrap-complete and cluster-ready events ● Example native provider templates (AWS CloudFormation and Google Deployment Manager) included to help with user provisioning tasks for creating infrastructure objects ● While RHEL CoreOS is mandatory for the control plane, either RHEL CoreOS or RHEL 7 can be used for the worker/infra nodes $ cat ./demo/install-config.yaml apiVersion: v1 baseDomain: example.com compute: - name: worker replicas: 0 controlPlane: name: master ... $ ./openshift-install --dir ./demo create ignition-config INFO Consuming "Install Config" from target directory $ ./openshift-install --dir ./demo wait-for bootstrap-complete INFO Waiting up to 30m0s for the Kubernetes API at https://api.demo.example.com:6443... INFO API v1.11.0+c69f926354 up INFO Waiting up to 30m0s for the bootstrap-complete event... $ ./openshift-install --dir ./demo wait-for cluster-ready INFO Waiting up to 30m0s for the cluster at https://api.demo.example.com:6443 to initialize... INFO Install complete! Pitfall ● Generates certificates that are only valid for 24 hours! ● To restart: delete the config dir “./demo” !!
  • 32. Booting all machines Bootstrap Master N Master N Master N Master N Master N Worker Web Server "ignition": { "config": { "append": [ { "source": "https://api-int.demo.openshift.pub:22623/config/(master|worker)", "verification": {} [...snipped...] "security": { "tls": { "certificateAuthorities": [ { "source": "data:text/plain;charset=utf-8;base64,LS0t..==", "verification": {} } [...snipped...] The Ignition is quite huge! It contains everything you need to install OpenShift 4, except the images.
  • 33. Boot the cluster Bootstrap Master N Master N Master N Master N Master N Worker Bootstrapping process step by step: 1. Bootstrap machine boots and starts hosting the remote resources required for master machines to boot. 2. Master machines fetch the remote resources from the bootstrap machine and finish booting. 3. Master machines use the bootstrap node to form an etcd cluster. 4. Bootstrap node starts a temporary Kubernetes control plane using the newly-created etcd cluster. 5. Temporary control plane schedules the production control plane to the master machines. 6. Temporary control plane shuts down, yielding to the production control plane. 7. Bootstrap node injects OpenShift-specific components into the newly formed control plane. 8. Installer then tears down the bootstrap node or if user-provisioned, this needs to be performed by the administrator.
  • 34. label linux menu label ^Install RHEL CoreOS kernel /images/vmlinuz append initrd=/images/initramfs.img nomodeset rd.neednet=1 coreos.inst=yes ip=192.168.122.9::192.168.122.1:255.255.255.0:core2.example.com:enp1s0:none nameserver=192.168.122.1 coreos.inst.install_dev=sda coreos.inst.image_url=http://192.168.122.1/rhcos.raw.gz coreos.inst.ignition_url=http://192.168.122.1/static.ign Add a node BareMetal Machine Set
  • 35. 1. Boot a node with minimal ignition config: a. certificateAuthorities b. Point to MCO: https://api-int.demo.openshift.pub:22623/config/(master|worker) 2. Node create a CSR (oc get csr) 3. Someone approved CSR a. UPI: administrator 👨🏻‍💻 - during installation auto-approve! b. IPI: Machine Operator 4. Node join the cluster 5. Node starts all pods they need to be a perfect member! (sdn, registry ca,....) Add a node
  • 36. 36 subscription-manager register --username=<user_name> --password=<password> subscription-manager repos --enable="rhel-7-server-rpms" --enable="rhel-7-server-extras-rpms" --enable="rhel-7-server-ose-4.2-rpms" # vi inventory/hosts ---- [all:vars] ansible_user=root #ansible_become=True openshift_kubeconfig_path="~/.kube/config" [new_workers] mycluster-worker-0.example.com mycluster-worker-1.example.com ---- ansible-playbook -i /<path>/inventory/hosts playbooks/scaleup.yml Add a node RHEL Node WIHTOUT Over the Air (OTA) Updates!
  • 37. ● OpenShift retrieves the list of available updates ● Admin selects the target version ● OpenShift is updated over the air ● Auto-update support Over the Air (OTA) Updates Only with Red Hat CoreOS - it doesn’t matter how (IPI vs UPI) you install the cluster!
  • 38. OPENSHIFT PLATFORM Disconnected “Air-gapped” Installation & Upgrading Generally Available Product Manager: Katherine Dubé Installation Procedure ● Mirror OpenShift content to local container registry in the disconnected environment ● Generate install-config.yaml: $ ./openshift-install create install-config --dir <dir> ○ Edit and add pull secret (PullSecret), CA certificate (additionalTrustBundle), and image content sources (ImageContentSources) to install-config.yaml ● Set the OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE environment variable during the creation of the ignition configs ● Generate the ignition configuration: $ ./openshift-install create ignition-configs --dir <dir> ● Use the resulting ignition files to bootstrap the cluster deployment Overview ● 4.2 introduces support for installing and updating OpenShift clusters in disconnected environments ● Requires local Docker 2.2 spec compliant container registry to host OpenShift content ● Designed to work with the user provisioned infrastructure deployment method ○ Note: Will not work with Installer provisioned infrastructure deployments Admin Local Container Registry Quay.io Container Registry # mirror update image: $ oc adm -a <secret_json> release mirror --from=quay.io/<repo>/<release:version> --to=<local registry>/<repo> --to-release-image=<local registry>/<repo:version> # provide cluster with update image to update to: $ oc adm upgrade --to-mirror=<local repo:version> Local Copy of Update Image Disconnected OpenShift Cluster Red Hat sourced Update Image Mirrored to local registry Cluster updated locally Customer Cluster
  • 39. OPENSHIFT PLATFORM Cluster-wide Egress Proxy Generally Available Product Manager: Marc Curry & Katherine Dubé Overview ● 4.2 introduces support for installing and updating OpenShift clusters through a corporate proxy server ● Leverages new proxy controller within the cluster-network-operator, which is responsible for: ○ Reconciling a proxy object and writing spec > status upon successful validation. ○ Reconciling user-provided trust bundles referenced by trustedCA, validating the trust bundle certificates, merging the certificates with the system trust bundle and publishing the merged bundle to the openshift-config-managed/trusted-ca-bundle configmap. Installation Procedure ● Installer will use PROXY* environment variables from the shell it’s invoked from ● Generate install-config.yaml: $ ./openshift-install create install-config --dir <dir> ○ Edit proxy information (httpProxy, httpsProxy, & noProxy) and CA certificate (‘additionalTrustBundle’) to install-config.yaml ● Installer validates the provided install-config.yaml parameters, renders the necessary assets to create the cluster, and initiates the installation process based on the install method used: $ ./openshift-install create cluster --dir <dir> Corporate Proxy Server Proxy Connected OpenShift Cluster Customer Cluster Internet Quay.io Container Registry Backend Services $ oc get proxy/cluster -o yaml apiVersion: config.openshift.io/v1 kind: Proxy metadata: creationTimestamp: "2019-08-21T22:36:49Z" generation: 2 name: cluster resourceVersion: "24913" selfLink: /apis/config.openshift.io/v1/proxies/cluster uid: 2a344b01-d267-11f9-a4f3-025de4b59c38 spec: httpProxy: http://<username>:<pswd>@<ip>:<port> httpsProxy: https://<username>:<pswd>@<ip>:<port> noProxy: example.com readinessEndpoints: - http://www.google.com - https://www.google.com trustedCA: name: user-ca-bundle status: httpProxy: http://<username>:<pswd>@<ip>:<port> httpsProxy: https://<username>:<pswd>@<ip>:<port> noProxy: 10.0.0.0/16,10.128.0.0/14,127.0.0.1,169.254.169.254,172.30 .0.0/16,api-int.demo.example.com,api.demo.example.openshif t.com,etcd-0.demo.example.com,etcd-1.demo.example.com,etcd -2.demo.example.com,example.com,localhost An admin with privileges can interact with the proxy object using ‘oc’ commands (use the ‘oc edit’ command to modify the proxy information.) Here is an example proxy config: