Installing a cluster on AWS with remote workers on AWS Outposts

In OKD version 4.13, you can install a cluster on Amazon Web Services (AWS) with remote workers running in AWS Outposts. This can be achieved by customizing the default AWS installation and performing some manual steps.

For more info about AWS Outposts see AWS Outposts Documentation.

Prerequisites

• You reviewed details about the OKD installation and update processes.

• You read the documentation on selecting a cluster installation method and preparing it for users.

• You configured an AWS account to host the cluster.

• You are familiar with the instance types are supported in the AWS Outpost instance you use. This can be validated with get-outpost-instance-types AWS CLI command

• You are familiar with the AWS Outpost instance details, such as OutpostArn and AvailabilityZone. This can be validated with list-outposts AWS CLI command

  Since the cluster uses the provided AWS credentials to create AWS resources for its entire life cycle, the credentials must be key-based and long-lived. So, If you have an AWS profile stored on your computer, it must not use a temporary session token, generated while using a multi-factor authentication device. For more information about generating the appropriate keys, see Managing Access Keys for IAM Users in the AWS documentation. You may supply the keys when you run the installation program.

• You have access to an existing Amazon Virtual Private Cloud (VPC) in Amazon Web Services (AWS). See the section “About using a custom VPC” for more information.

• If a firewall is used, it was configured to allow the sites that your cluster requires access to.

• If the cloud identity and access management (IAM) APIs are not accessible in your environment, or if you do not want to store an administrator-level credential secret in the kube-system namespace, you can manually create and maintain IAM credentials.

About using a custom VPC

OKD 4.13 installer cannot automatically deploy AWS Subnets on AWS Outposts, so you will need to manually configure the VPC. Therefore, you have to deploy the cluster into existing subnets in an existing Amazon Virtual Private Cloud (VPC) in Amazon Web Services (AWS). In addition, by deploying OKD into an existing AWS VPC, you might be able to avoid limit constraints in new accounts or more easily abide by the operational constraints that your company’s guidelines set.

Because the installation program cannot know what other components are also in your existing subnets, it cannot choose subnet CIDRs and so forth on your behalf. You must configure networking for the subnets that you install your cluster to yourself.

Requirements for using your VPC

The installation program no longer creates the following components:

• Internet gateways

• NAT gateways

• Subnets

• Route tables

• VPCs

• VPC DHCP options

• VPC endpoints

If you use a custom VPC, you must correctly configure it and its subnets for the installation program and the cluster to use. See Amazon VPC console wizard configurations and Work with VPCs and subnets in the AWS documentation for more information on creating and managing an AWS VPC.

The installation program cannot:

• Subdivide network ranges for the cluster to use.

• Set route tables for the subnets.

• Set VPC options like DHCP.

You must complete these tasks before you install the cluster. See VPC networking components and Route tables for your VPC for more information on configuring networking in an AWS VPC.

Your VPC must meet the following characteristics:

• Create a public and private subnet in the AWS Region for each availability zone that your control plane uses. Each availability zone can contain no more than one public and one private subnet in the AWS region. For an example of this type of configuration, see VPC with public and private subnets (NAT) in the AWS documentation.

  To create a private subnet in the AWS Outposts, you need to first ensure that the Outpost instance is located in the desired availability zone. Then, you can create the private subnet within that availability zone within the Outpost instance, by adding the Outpost ARN. Make sure there is another public subnet in the AWS Region created in the same availability zone.

  Record each subnet ID. Completing the installation requires that you enter all the subnets IDs, created in the AWS Region, in the platform section of the install-config.yaml file and changing the workers machineset to use the private subnet ID created in the Outpost. See Finding a subnet ID in the AWS documentation.

  In case you need to create a public subnet in the AWS Outposts, verify that this subnet is not used for the Network or Classic LoadBalancer, otherwise the LoadBalancer creation fails. To achieve that, the kubernetes.io/cluster/.*-outposts: owned special tag must be included in the subnet.

• The VPC’s CIDR block must contain the Networking.MachineCIDR range, which is the IP address pool for cluster machines. The subnet CIDR blocks must belong to the machine CIDR that you specify.

• The VPC must have a public internet gateway attached to it. For each availability zone:

  • The public subnet requires a route to the internet gateway.

  • The public subnet requires a NAT gateway with an EIP address.

  • The private subnet requires a route to the NAT gateway in public subnet.

  To access your local cluster over your local network, the VPC must be associated with your Outpost’s local gateway route table. For more information, see VPC associations in the AWS Outposts User Guide.

• The VPC must not use the kubernetes.io/cluster/.*: owned, Name, and openshift.io/cluster tags.

  The installation program modifies your subnets to add the kubernetes.io/cluster/.*: shared tag, so your subnets must have at least one free tag slot available for it. See Tag Restrictions in the AWS documentation to confirm that the installation program can add a tag to each subnet that you specify. You cannot use a Name tag, because it overlaps with the EC2 Name field and the installation fails.

• You must enable the enableDnsSupport and enableDnsHostnames attributes in your VPC, so that the cluster can use the Route 53 zones that are attached to the VPC to resolve cluster’s internal DNS records. See DNS Support in Your VPC in the AWS documentation.

  If you prefer to use your own Route 53 hosted private zone, you must associate the existing hosted zone with your VPC prior to installing a cluster. You can define your hosted zone using the platform.aws.hostedZone field in the install-config.yaml file.

Option 1: Create VPC endpoints

Create a VPC endpoint and attach it to the subnets that the clusters are using. Name the endpoints as follows:

• ec2.<aws_region>.amazonaws.com

• elasticloadbalancing.<aws_region>.amazonaws.com

• s3.<aws_region>.amazonaws.com

With this option, network traffic remains private between your VPC and the required AWS services.

Option 2: Create a proxy without VPC endpoints

As part of the installation process, you can configure an HTTP or HTTPS proxy. With this option, internet traffic goes through the proxy to reach the required AWS services.

Option 3: Create a proxy with VPC endpoints

As part of the installation process, you can configure an HTTP or HTTPS proxy with VPC endpoints. Create a VPC endpoint and attach it to the subnets that the clusters are using. Name the endpoints as follows:

• ec2.<aws_region>.amazonaws.com

• elasticloadbalancing.<aws_region>.amazonaws.com

• s3.<aws_region>.amazonaws.com

When configuring the proxy in the install-config.yaml file, add these endpoints to the noProxy field. With this option, the proxy prevents the cluster from accessing the internet directly. However, network traffic remains private between your VPC and the required AWS services.

Required VPC components

You must provide a suitable VPC and subnets that allow communication to your machines.

VPC validation

To ensure that the subnets that you provide are suitable, the installation program confirms the following data:

• All the subnets that you specify exist.

• You provide private subnets.

• The subnet CIDRs belong to the machine CIDR that you specified.

• You provide subnets for each availability zone. Each availability zone contains exactly one public and one private subnet in the AWS region (not created in the Outpost instance). The availability zone in which the Outpost instance is installed should include one aditional private subnet in the Outpost instance.

• You provide a public subnet for each private subnet availability zone. Machines are not provisioned in availability zones that you do not provide private subnets for.

If you destroy a cluster that uses an existing VPC, the VPC is not deleted. When you remove the OKD cluster from a VPC, the kubernetes.io/cluster/.*: shared tag is removed from the subnets that it used.

Division of permissions

Starting with OKD 4.3, you do not need all of the permissions that are required for an installation program-provisioned infrastructure cluster to deploy a cluster. This change mimics the division of permissions that you might have at your company: some individuals can create different resource in your clouds than others. For example, you might be able to create application-specific items, like instances, buckets, and load balancers, but not networking-related components such as VPCs, subnets, or ingress rules.

The AWS credentials that you use when you create your cluster do not need the networking permissions that are required to make VPCs and core networking components within the VPC, such as subnets, routing tables, internet gateways, NAT, and VPN. You still need permission to make the application resources that the machines within the cluster require, such as ELBs, security groups, S3 buckets, and nodes.

Isolation between clusters

If you deploy OKD to an existing network, the isolation of cluster services is reduced in the following ways:

• You can install multiple OKD clusters in the same VPC.

• ICMP ingress is allowed from the entire network.

• TCP 22 ingress (SSH) is allowed to the entire network.

• Control plane TCP 6443 ingress (Kubernetes API) is allowed to the entire network.

• Control plane TCP 22623 ingress (MCS) is allowed to the entire network.

Generating a key pair for cluster node SSH access

During an OKD installation, you can provide an SSH public key to the installation program. The key is passed to the Fedora CoreOS (FCOS) nodes through their Ignition config files and is used to authenticate SSH access to the nodes. The key is added to the ~/.ssh/authorized_keys list for the core user on each node, which enables password-less authentication.

After the key is passed to the nodes, you can use the key pair to SSH in to the FCOS nodes as the user core. To access the nodes through SSH, the private key identity must be managed by SSH for your local user.

If you want to SSH in to your cluster nodes to perform installation debugging or disaster recovery, you must provide the SSH public key during the installation process. The ./openshift-install gather command also requires the SSH public key to be in place on the cluster nodes.

Procedure

1. If you do not have an existing SSH key pair on your local machine to use for authentication onto your cluster nodes, create one. For example, on a computer that uses a Linux operating system, run the following command:

   $ ssh-keygen -t ed25519 -N '' -f <path>/<file_name> (1)

   1	Specify the path and file name, such as ~/.ssh/id_ed25519, of the new SSH key. If you have an existing key pair, ensure your public key is in the your ~/.ssh directory.

   If you plan to install an OKD cluster that uses FIPS Validated / Modules in Process cryptographic libraries on the x86_64 architecture, do not create a key that uses the ed25519 algorithm. Instead, create a key that uses the rsa or ecdsa algorithm.

2. View the public SSH key:

   $ cat <path>/<file_name>.pub

   For example, run the following to view the ~/.ssh/id_ed25519.pub public key:

   $ cat ~/.ssh/id_ed25519.pub

3. Add the SSH private key identity to the SSH agent for your local user, if it has not already been added. SSH agent management of the key is required for password-less SSH authentication onto your cluster nodes, or if you want to use the ./openshift-install gather command.

   On some distributions, default SSH private key identities such as ~/.ssh/id_rsa and ~/.ssh/id_dsa are managed automatically.

   1. If the ssh-agent process is not already running for your local user, start it as a background task:

      $ eval "$(ssh-agent -s)"

      Example output

      Agent pid 31874

      If your cluster is in FIPS mode, only use FIPS-compliant algorithms to generate the SSH key. The key must be either RSA or ECDSA.

4. Add your SSH private key to the ssh-agent:

   $ ssh-add <path>/<file_name> (1)

   1	Specify the path and file name for your SSH private key, such as ~/.ssh/id_ed25519

   Example output

   Identity added: /home/<you>/<path>/<file_name> (<computer_name>)

Next steps

• When you install OKD, provide the SSH public key to the installation program.

Obtaining the installation program

Before you install OKD, download the installation file on the host you are using for installation.

Prerequisites

• You have a computer that runs Linux or macOS, with 500 MB of local disk space.

Procedure

1. Download installer from https://github.com/openshift/okd/releases

   The installation program creates several files on the computer that you use to install your cluster. You must keep the installation program and the files that the installation program creates after you finish installing the cluster. Both files are required to delete the cluster.

   Deleting the files created by the installation program does not remove your cluster, even if the cluster failed during installation. To remove your cluster, complete the OKD uninstallation procedures for your specific cloud provider.

2. Extract the installation program. For example, on a computer that uses a Linux operating system, run the following command:

   $ tar -xvf openshift-install-linux.tar.gz

3. Download your installation pull secret from the Red Hat OpenShift Cluster Manager. This pull secret allows you to authenticate with the services that are provided by the included authorities, including Quay.io, which serves the container images for OKD components.

   Using a pull secret from the Red Hat OpenShift Cluster Manager is not required. You can use a pull secret for another private registry. Or, if you do not need the cluster to pull images from a private registry, you can use {"auths":{"fake":{"auth":"aWQ6cGFzcwo="}}} as the pull secret when prompted during the installation.

   If you do not use the pull secret from the Red Hat OpenShift Cluster Manager:

   • Red Hat Operators are not available.

   • The Telemetry and Insights operators do not send data to Red Hat.

   • Content from the Red Hat Container Catalog registry, such as image streams and Operators, are not available.

Minimum resource requirements for cluster installation

Each cluster machine must meet the following minimum requirements:

1. One vCPU is equivalent to one physical core when simultaneous multithreading (SMT), or hyperthreading, is not enabled. When enabled, use the following formula to calculate the corresponding ratio: (threads per core × cores) × sockets = vCPUs.

2. OKD and Kubernetes are sensitive to disk performance, and faster storage is recommended, particularly for etcd on the control plane nodes which require a 10 ms p99 fsync duration. Note that on many cloud platforms, storage size and IOPS scale together, so you might need to over-allocate storage volume to obtain sufficient performance.

3. As with all user-provisioned installations, if you choose to use Fedora compute machines in your cluster, you take responsibility for all operating system life cycle management and maintenance, including performing system updates, applying patches, and completing all other required tasks. Use of Fedora 7 compute machines is deprecated and has been removed in OKD 4.10 and later.

If an instance type for your platform meets the minimum requirements for cluster machines, it is supported to use in OKD.

Identifying your AWS Outposts instance types

AWS Outposts rack catalog includes options supporting the latest generation Intel powered EC2 instance types with or without local instance storage. Identify which instance types are configured in your AWS Outpost instance. As part of the installation process, you must update the install-config.yaml file with the instance type that the installation program will use to deploy worker nodes.

Procedure

Use the AWS CLI to get the list of supported instance types by running the following command:

$ aws outposts get-outpost-instance-types --outpost-id <outpost_id> (1)

Supported instance types in AWS Outposts might be changed. For more information, you can check the Compute and Storage page in AWS Outposts documents.

Creating the installation configuration file

You can customize the OKD cluster you install on Amazon Web Services (AWS).

Prerequisites

• Obtain the OKD installation program and the pull secret for your cluster.

• Obtain service principal permissions at the subscription level.

Procedure

1. Create the install-config.yaml file.

   1. Change to the directory that contains the installation program and run the following command:

      $ ./openshift-install create install-config --dir <installation_directory> (1)

      1	For <installation_directory>, specify the directory name to store the files that the installation program creates.

      When specifying the directory:

      • Verify that the directory has the execute permission. This permission is required to run Terraform binaries under the installation directory.

      • Use an empty directory. Some installation assets, such as bootstrap X.509 certificates, have short expiration intervals, therefore you must not reuse an installation directory. If you want to reuse individual files from another cluster installation, you can copy them into your directory. However, the file names for the installation assets might change between releases. Use caution when copying installation files from an earlier OKD version.

   2. At the prompts, provide the configuration details for your cloud:

      1. Optional: Select an SSH key to use to access your cluster machines.

         For production OKD clusters on which you want to perform installation debugging or disaster recovery, specify an SSH key that your ssh-agent process uses.

      2. Select AWS as the platform to target.

      3. If you do not have an Amazon Web Services (AWS) profile stored on your computer, enter the AWS access key ID and secret access key for the user that you configured to run the installation program.

      4. Select the AWS region to deploy the cluster to.

      5. Select the base domain for the Route 53 service that you configured for your cluster.

      6. Enter a descriptive name for your cluster.

      7. Paste the pull secret from the Red Hat OpenShift Cluster Manager. This field is optional.

1. Modify the install-config.yaml file. The AWS Outposts installation has the following limitations which require manual modification of the install-config.yaml file:

   • Unlike AWS Regions, which offer near-infinite scale, AWS Outposts are limited by their provisioned capacity, EC2 family and generations, configured instance sizes, and availability of compute capacity that is not already consumed by other workloads. Therefore, when creating new OKD cluster, you need to provide the supported instance type in the compute.platform.aws.type section in the configuration file.

   • When deploying OKD cluster with remote workers running in AWS Outposts, only one Availability Zone can be used for the compute instances - the Availability Zone in which the Outpost instance was created in. Therefore, when creating new OKD cluster, it recommended to provide the relevant Availability Zone in the compute.platform.aws.zones section in the configuration file, in order to limit the compute instances to this Availability Zone.

   • Amazon Elastic Block Store (EBS) gp3 volumes aren’t supported by the AWS Outposts service. This volume type is the default type used by the OKD cluster. Therefore, when creating new OKD cluster, you must change the volume type in the compute.platform.aws.rootVolume.type section to gp2. You will find more information about how to change these values below.

2. Back up the install-config.yaml file so that you can use it to install multiple clusters.

   The install-config.yaml file is consumed during the installation process. If you want to reuse the file, you must back it up now.

Installation configuration parameters

Before you deploy an OKD cluster, you provide parameter values to describe your account on the cloud platform that hosts your cluster and optionally customize your cluster’s platform. When you create the install-config.yaml installation configuration file, you provide values for the required parameters through the command line. If you customize your cluster, you can modify the install-config.yaml file to provide more details about the platform.

Required configuration parameters

Required installation configuration parameters are described in the following table:

Network configuration parameters

You can customize your installation configuration based on the requirements of your existing network infrastructure. For example, you can expand the IP address block for the cluster network or provide different IP address blocks than the defaults.

Only IPv4 addresses are supported.

networking:
  clusterNetwork:
  - cidr: 10.128.0.0/14
    hostPrefix: 23

networking:
  serviceNetwork:
   - 172.30.0.0/16

networking:
  machineNetwork:
  - cidr: 10.0.0.0/16

Optional configuration parameters

Optional installation configuration parameters are described in the following table:

sshKey:
  <key1>
  <key2>
  <key3>

Optional AWS configuration parameters

Optional AWS configuration parameters are described in the following table:

aws ec2 describe-instance-type-offerings —filters Name=instance-type,Values=c7g.xlarge

Sample customized install-config.yaml file for AWS

You can customize the installation configuration file (install-config.yaml) to specify more details about your OKD cluster’s platform or modify the values of the required parameters.

apiVersion: v1
baseDomain: example.com (1)
credentialsMode: Mint (2)
controlPlane:  (3) (4)
  hyperthreading: Enabled (5)
  name: master
  platform: {}
  replicas: 3
compute: (3)
- hyperthreading: Enabled (5)
  name: worker
  platform:
    aws:
      type: m5.large (6)
      zones:
        - us-east-1a (7)
      rootVolume:
        type: gp2 (8)
        size: 120
  replicas: 3
metadata:
  name: test-cluster (1)
networking:
  clusterNetwork:
  - cidr: 10.128.0.0/14
    hostPrefix: 23
  machineNetwork:
  - cidr: 10.0.0.0/16
  networkType: OVNKubernetes (9)
  serviceNetwork:
  - 172.30.0.0/16
platform:
  aws:
    region: us-west-2 (1)
    propagateUserTags: true (3)
    userTags:
      adminContact: jdoe
      costCenter: 7536
  subnets: (10)
  - subnet-1
  - subnet-2
  - subnet-3
sshKey: ssh-ed25519 AAAA... (11)
pullSecret: '{"auths": ...}' (1)

Generating manifest files

Use the installation program to generate a set of manifest files in the assets directory. Manifest files are required to specify the AWS Outposts subnets to use for worker machines, and to specify settings required by the network provider.

If you plan to reuse the install-config.yaml file, create a backup file before you generate the manifest files.

Procedure

1. Optional: Create a backup copy of the install-config.yaml file:

   $ cp install-config.yaml install-config.yaml.backup

2. Generate a set of manifests in your assets directory:

   $ openshift-install create manifests --dir <installation_-_directory>

   This command displays the following messages.

   Example output

   INFO Consuming Install Config from target directory
   INFO Manifests created in: <installation_directory>/manifests and <installation_directory>/openshift

   The command generates the following manifest files:

   Example output

   $ tree
   .
   ├── manifests
   │   ├── cluster-config.yaml
   │   ├── cluster-dns-02-config.yml
   │   ├── cluster-infrastructure-02-config.yml
   │   ├── cluster-ingress-02-config.yml
   │   ├── cluster-network-01-crd.yml
   │   ├── cluster-network-02-config.yml
   │   ├── cluster-proxy-01-config.yaml
   │   ├── cluster-scheduler-02-config.yml
   │   ├── cvo-overrides.yaml
   │   ├── kube-cloud-config.yaml
   │   ├── kube-system-configmap-root-ca.yaml
   │   ├── machine-config-server-tls-secret.yaml
   │   └── openshift-config-secret-pull-secret.yaml
   └── openshift
       ├── 99_cloud-creds-secret.yaml
       ├── 99_kubeadmin-password-secret.yaml
       ├── 99_openshift-cluster-api_master-machines-0.yaml
       ├── 99_openshift-cluster-api_master-machines-1.yaml
       ├── 99_openshift-cluster-api_master-machines-2.yaml
       ├── 99_openshift-cluster-api_master-user-data-secret.yaml
       ├── 99_openshift-cluster-api_worker-machineset-0.yaml
       ├── 99_openshift-cluster-api_worker-user-data-secret.yaml
       ├── 99_openshift-machineconfig_99-master-ssh.yaml
       ├── 99_openshift-machineconfig_99-worker-ssh.yaml
       ├── 99_role-cloud-creds-secret-reader.yaml
       └── openshift-install-manifests.yaml

Modifying manifest files

• Use Outpost Subnet for workers machineset

  Modify the following file: <installation_directory>/openshift/99_openshift-cluster-api_worker-machineset-0.yaml Find the subnet ID and replace it with the ID of the private subnet created in the Outpost. As a result, all the worker machines will be created in the Outpost.

• Specify MTU value for the Network Provider

  Outpost service links support a maximum packet size of 1300 bytes. It’s required to modify the MTU of the Network Provider to follow this requirement. Create a new file under manifests directory, named cluster-network-03-config.yml

  If OpenShift SDN network provider is used, set the MTU value to 1250

  apiVersion: operator.openshift.io/v1
  kind: Network
  metadata:
    name: cluster
  spec:
    defaultNetwork:
      openshiftSDNConfig:
        mtu: 1250

  If OVN-Kubernetes network provider is used, set the MTU value to 1200

  apiVersion: operator.openshift.io/v1
  kind: Network
  metadata:
    name: cluster
  spec:
    defaultNetwork:
      ovnKubernetesConfig:
        mtu: 1200

Deploying the cluster

You can install OKD on a compatible cloud platform.

Prerequisites

• Configure an account with the cloud platform that hosts your cluster.

• Obtain the OKD installation program and the pull secret for your cluster.

• Verify the cloud provider account on your host has the correct permissions to deploy the cluster. An account with incorrect permissions causes the installation process to fail with an error message that displays the missing permissions.

Procedure

1. Change to the directory that contains the installation program and initialize the cluster deployment:

   $ ./openshift-install create cluster --dir <installation_directory> \ (1)
       --log-level=info (2)

   1	For <installation_directory>, specify the location of your customized ./install-config.yaml file.
   2	To view different installation details, specify warn, debug, or error instead of info.

2. Optional: Remove or disable the AdministratorAccess policy from the IAM account that you used to install the cluster.

   The elevated permissions provided by the AdministratorAccess policy are required only during installation.

Verification

When the cluster deployment completes successfully:

• The terminal displays directions for accessing your cluster, including a link to the web console and credentials for the kubeadmin user.

• Credential information also outputs to <installation_directory>/.openshift_install.log.

Example output

...
INFO Install complete!
INFO To access the cluster as the system:admin user when using 'oc', run 'export KUBECONFIG=/home/myuser/install_dir/auth/kubeconfig'
INFO Access the OpenShift web-console here: https://console-openshift-console.apps.mycluster.example.com
INFO Login to the console with user: "kubeadmin", and password: "4vYBz-Ee6gm-ymBZj-Wt5AL"
INFO Time elapsed: 36m22s

Installing the OpenShift CLI by downloading the binary

You can install the OpenShift CLI (oc) to interact with OKD from a command-line interface. You can install oc on Linux, Windows, or macOS.

Installing the OpenShift CLI on Linux

You can install the OpenShift CLI (oc) binary on Linux by using the following procedure.

Procedure

1. Navigate to https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/ and choose the folder for your operating system and architecture.

2. Download oc.tar.gz.

3. Unpack the archive:

   $ tar xvf <file>

4. Place the oc binary in a directory that is on your PATH.

   To check your PATH, execute the following command:

   $ echo $PATH

After you install the OpenShift CLI, it is available using the oc command:

$ oc <command>

Installing the OpenShift CLI on Windows

You can install the OpenShift CLI (oc) binary on Windows by using the following procedure.

Procedure

1. Navigate to https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/ and choose the folder for your operating system and architecture.

2. Download oc.zip.

3. Unzip the archive with a ZIP program.

4. Move the oc binary to a directory that is on your PATH.

   To check your PATH, open the command prompt and execute the following command:

   C:\> path

After you install the OpenShift CLI, it is available using the oc command:

C:\> oc <command>

Installing the OpenShift CLI on macOS

You can install the OpenShift CLI (oc) binary on macOS by using the following procedure.

Procedure

1. Navigate to https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/ and choose the folder for your operating system and architecture.

2. Download oc.tar.gz.

3. Unpack and unzip the archive.

4. Move the oc binary to a directory on your PATH.

   To check your PATH, open a terminal and execute the following command:

   $ echo $PATH

After you install the OpenShift CLI, it is available using the oc command:

$ oc <command>

Logging in to the cluster by using the CLI

You can log in to your cluster as a default system user by exporting the cluster kubeconfig file. The kubeconfig file contains information about the cluster that is used by the CLI to connect a client to the correct cluster and API server. The file is specific to a cluster and is created during OKD installation.

Prerequisites

• You deployed an OKD cluster.

• You installed the oc CLI.

Procedure

1. Export the kubeadmin credentials:

   $ export KUBECONFIG=<installation_directory>/auth/kubeconfig (1)

   1	For <installation_directory>, specify the path to the directory that you stored the installation files in.

2. Verify you can run oc commands successfully using the exported configuration:

   $ oc whoami

   Example output

   system:admin

Logging in to the cluster by using the web console

The kubeadmin user exists by default after an OKD installation. You can log in to your cluster as the kubeadmin user by using the OKD web console.

Prerequisites

• You have access to the installation host.

• You completed a cluster installation and all cluster Operators are available.

Procedure

1. Obtain the password for the kubeadmin user from the kubeadmin-password file on the installation host:

   $ cat <installation_directory>/auth/kubeadmin-password

   Alternatively, you can obtain the kubeadmin password from the <installation_directory>/.openshift_install.log log file on the installation host.

2. List the OKD web console route:

   $ oc get routes -n openshift-console | grep 'console-openshift'

   Alternatively, you can obtain the OKD route from the <installation_directory>/.openshift_install.log log file on the installation host.

   Example output

   console     console-openshift-console.apps.<cluster_name>.<base_domain>            console     https   reencrypt/Redirect   None

3. Navigate to the route detailed in the output of the preceding command in a web browser and log in as the kubeadmin user.

Additional resources

• See Accessing the web console for more details about accessing and understanding the OKD web console.

• See About remote health monitoring for more information about the Telemetry service.

Cluster Limitations

Next steps

• Validating an installation.

• Customize your cluster.

• If necessary, you can opt out of remote health reporting.

• If necessary, you can remove cloud provider credentials.