Accessing hosts

Learn how to create a bastion host to access OKD instances and access the control plane nodes with secure shell (SSH) access.

Accessing hosts on Amazon Web Services in an installer-provisioned infrastructure cluster

The OKD installer does not create any public IP addresses for any of the Amazon Elastic Compute Cloud (Amazon EC2) instances that it provisions for your OKD cluster. To be able to SSH to your OKD hosts, you must follow this procedure.

Procedure

  1. Create a security group that allows SSH access into the virtual private cloud (VPC) created by the openshift-install command.

  2. Create an Amazon EC2 instance on one of the public subnets the installer created.

  3. Associate a public IP address with the Amazon EC2 instance that you created.

    Unlike with the OKD installation, you should associate the Amazon EC2 instance you created with an SSH keypair. It does not matter what operating system you choose for this instance, as it will simply serve as an SSH bastion to bridge the internet into your OKD cluster’s VPC. The Amazon Machine Image (AMI) you use does matter. With Fedora CoreOS (FCOS), for example, you can provide keys via Ignition, like the installer does.

  4. After you provisioned your Amazon EC2 instance and can SSH into it, you must add the SSH key that you associated with your OKD installation. This key can be different from the key for the bastion instance, but does not have to be.

    Direct SSH access is only recommended for disaster recovery. When the Kubernetes API is responsive, run privileged pods instead.

  5. Run oc get nodes, inspect the output, and choose one of the nodes that is a master. The hostname looks similar to ip-10-0-1-163.ec2.internal.

  6. From the bastion SSH host you manually deployed into Amazon EC2, SSH into that control plane host. Ensure that you use the same SSH key you specified during the installation:

    1. $ ssh -i <ssh-key-path> core@<master-hostname>