Installing a cluster on Alibaba Cloud into an existing VPC

In OKD version 4.14, you can install a cluster into an existing Alibaba Virtual Private Cloud (VPC) on Alibaba Cloud Services. The installation program provisions the required infrastructure, which can then be customized. To customize the VPC installation, modify the parameters in the ‘install-config.yaml’ file before you install the cluster.

Prerequisites

• You reviewed details about the OKD installation and update processes.

• You read the documentation on selecting a cluster installation method and preparing it for users.

• You registered your domain.

• If you use a firewall, you configured it to allow the sites that your cluster requires access to.

• If the cloud Resource Access Management (RAM) APIs are not accessible in your environment, or if you do not want to store an administrator-level credential secret in the kube-system namespace, you can manually create and maintain Resource Access Management (RAM) credentials.

Using a custom VPC

In OKD 4.14, you can deploy a cluster into existing subnets in an existing Virtual Private Cloud (VPC) in the Alibaba Cloud Platform. By deploying OKD into an existing Alibaba VPC, you can avoid limit constraints in new accounts and more easily adhere to your organization’s operational constraints. If you cannot obtain the infrastructure creation permissions that are required to create the VPC yourself, use this installation option. You must configure networking using vSwitches.

Requirements for using your VPC

The union of the VPC CIDR block and the machine network CIDR must be non-empty. The vSwitches must be within the machine network.

The installation program does not create the following components:

• VPC

• vSwitches

• Route table

• NAT gateway

VPC validation

To ensure that the vSwitches you provide are suitable, the installation program confirms the following data:

• All the vSwitches that you specify must exist.

• You have provided one or more vSwitches for control plane machines and compute machines.

• The vSwitches’ CIDRs belong to the machine CIDR that you specified.

Division of permissions

Some individuals can create different resources in your cloud than others. For example, you might be able to create application-specific items, like instances, buckets, and load balancers, but not networking-related components, such as VPCs or vSwitches.

Isolation between clusters

If you deploy OKD into an existing network, the isolation of cluster services is reduced in the following ways:

• You can install multiple OKD clusters in the same VPC.

• ICMP ingress is allowed to the entire network.

• TCP 22 ingress (SSH) is allowed to the entire network.

• Control plane TCP 6443 ingress (Kubernetes API) is allowed to the entire network.

• Control plane TCP 22623 ingress (MCS) is allowed to the entire network.

Generating a key pair for cluster node SSH access

During an OKD installation, you can provide an SSH public key to the installation program. The key is passed to the Fedora CoreOS (FCOS) nodes through their Ignition config files and is used to authenticate SSH access to the nodes. The key is added to the ~/.ssh/authorized_keys list for the core user on each node, which enables password-less authentication.

After the key is passed to the nodes, you can use the key pair to SSH in to the FCOS nodes as the user core. To access the nodes through SSH, the private key identity must be managed by SSH for your local user.

If you want to SSH in to your cluster nodes to perform installation debugging or disaster recovery, you must provide the SSH public key during the installation process. The ./openshift-install gather command also requires the SSH public key to be in place on the cluster nodes.

Procedure

1. If you do not have an existing SSH key pair on your local machine to use for authentication onto your cluster nodes, create one. For example, on a computer that uses a Linux operating system, run the following command:

   $ ssh-keygen -t ed25519 -N '' -f <path>/<file_name> (1)

   1	Specify the path and file name, such as ~/.ssh/id_ed25519, of the new SSH key. If you have an existing key pair, ensure your public key is in the your ~/.ssh directory.

   If you plan to install an OKD cluster that uses the Fedora cryptographic libraries that have been submitted to NIST for FIPS 140-2/140-3 Validation on only the x86_64, ppc64le, and s390x architectures, do not create a key that uses the ed25519 algorithm. Instead, create a key that uses the rsa or ecdsa algorithm.

2. View the public SSH key:

   $ cat <path>/<file_name>.pub

   For example, run the following to view the ~/.ssh/id_ed25519.pub public key:

   $ cat ~/.ssh/id_ed25519.pub

3. Add the SSH private key identity to the SSH agent for your local user, if it has not already been added. SSH agent management of the key is required for password-less SSH authentication onto your cluster nodes, or if you want to use the ./openshift-install gather command.

   On some distributions, default SSH private key identities such as ~/.ssh/id_rsa and ~/.ssh/id_dsa are managed automatically.

   1. If the ssh-agent process is not already running for your local user, start it as a background task:

      $ eval "$(ssh-agent -s)"

      Example output

      Agent pid 31874

      If your cluster is in FIPS mode, only use FIPS-compliant algorithms to generate the SSH key. The key must be either RSA or ECDSA.

4. Add your SSH private key to the ssh-agent:

   $ ssh-add <path>/<file_name> (1)

   1	Specify the path and file name for your SSH private key, such as ~/.ssh/id_ed25519

   Example output

   Identity added: /home/<you>/<path>/<file_name> (<computer_name>)

Next steps

• When you install OKD, provide the SSH public key to the installation program.

Obtaining the installation program

Before you install OKD, download the installation file on the host you are using for installation.

Prerequisites

• You have a computer that runs Linux or macOS, with 500 MB of local disk space.

Procedure

1. Download installer from https://github.com/openshift/okd/releases

   The installation program creates several files on the computer that you use to install your cluster. You must keep the installation program and the files that the installation program creates after you finish installing the cluster. Both files are required to delete the cluster.

   Deleting the files created by the installation program does not remove your cluster, even if the cluster failed during installation. To remove your cluster, complete the OKD uninstallation procedures for your specific cloud provider.

2. Extract the installation program. For example, on a computer that uses a Linux operating system, run the following command:

   $ tar -xvf openshift-install-linux.tar.gz

3. Download your installation pull secret from the Red Hat OpenShift Cluster Manager. This pull secret allows you to authenticate with the services that are provided by the included authorities, including Quay.io, which serves the container images for OKD components.

   Using a pull secret from the Red Hat OpenShift Cluster Manager is not required. You can use a pull secret for another private registry. Or, if you do not need the cluster to pull images from a private registry, you can use {"auths":{"fake":{"auth":"aWQ6cGFzcwo="}}} as the pull secret when prompted during the installation.

   If you do not use the pull secret from the Red Hat OpenShift Cluster Manager:

   • Red Hat Operators are not available.

   • The Telemetry and Insights operators do not send data to Red Hat.

   • Content from the Red Hat Container Catalog registry, such as image streams and Operators, are not available.

Creating the installation configuration file

You can customize the OKD cluster you install on Alibaba Cloud.

Prerequisites

• You have the OKD installation program and the pull secret for your cluster.

Procedure

1. Create the install-config.yaml file.

   1. Change to the directory that contains the installation program and run the following command:

      $ ./openshift-install create install-config --dir <installation_directory> (1)

      1	For <installation_directory>, specify the directory name to store the files that the installation program creates.

      When specifying the directory:

      • Verify that the directory has the execute permission. This permission is required to run Terraform binaries under the installation directory.

      • Use an empty directory. Some installation assets, such as bootstrap X.509 certificates, have short expiration intervals, therefore you must not reuse an installation directory. If you want to reuse individual files from another cluster installation, you can copy them into your directory. However, the file names for the installation assets might change between releases. Use caution when copying installation files from an earlier OKD version.

        Always delete the ~/.powervs directory to avoid reusing a stale configuration. Run the following command: $ rm -rf ~/.powervs

   2. At the prompts, provide the configuration details for your cloud:

      1. Optional: Select an SSH key to use to access your cluster machines.

         For production OKD clusters on which you want to perform installation debugging or disaster recovery, specify an SSH key that your ssh-agent process uses.

      2. Select alibabacloud as the platform to target.

      3. Select the region to deploy the cluster to.

      4. Select the base domain to deploy the cluster to. The base domain corresponds to the public DNS zone that you created for your cluster.

      5. Provide a descriptive name for your cluster.

1. Installing the cluster into Alibaba Cloud requires that the Cloud Credential Operator (CCO) operate in manual mode. Modify the install-config.yaml file to set the credentialsMode parameter to Manual:

   Example install-config.yaml configuration file with credentialsMode set to Manual

   apiVersion: v1
   baseDomain: cluster1.example.com
   credentialsMode: Manual (1)
   compute:
   - architecture: amd64
     hyperthreading: Enabled
    ...

   1	Add this line to set the credentialsMode to Manual.

2. Modify the install-config.yaml file. You can find more information about the available parameters in the “Installation configuration parameters” section.

3. Back up the install-config.yaml file so that you can use it to install multiple clusters.

   The install-config.yaml file is consumed during the installation process. If you want to reuse the file, you must back it up now.

Additional resources

• Installation configuration parameters for Alibaba Cloud

Sample customized install-config.yaml file for Alibaba Cloud

You can customize the installation configuration file (install-config.yaml) to specify more details about your cluster’s platform or modify the values of the required parameters.

apiVersion: v1
baseDomain: alicloud-dev.devcluster.openshift.com
credentialsMode: Manual
compute:
- architecture: amd64
  hyperthreading: Enabled
  name: worker
  platform: {}
  replicas: 3
controlPlane:
  architecture: amd64
  hyperthreading: Enabled
  name: master
  platform: {}
  replicas: 3
metadata:
  creationTimestamp: null
  name: test-cluster (1)
 networking:
  clusterNetwork:
  - cidr: 10.128.0.0/14
    hostPrefix: 23
  machineNetwork:
  - cidr: 10.0.0.0/16
  networkType: OVNKubernetes (2)
  serviceNetwork:
  - 172.30.0.0/16
platform:
  alibabacloud:
    defaultMachinePlatform: (3)
      instanceType: ecs.g6.xlarge
      systemDiskCategory: cloud_efficiency
      systemDiskSize: 200
    region: ap-southeast-1 (4)
    resourceGroupID: rg-acfnw6j3hyai (5)
    vpcID: vpc-0xifdjerdibmaqvtjob2b (8)
    vswitchIDs: (8)
    - vsw-0xi8ycgwc8wv5rhviwdq5
    - vsw-0xiy6v3z2tedv009b4pz2
publish: External
pullSecret: '{"auths": {"cloud.openshift.com": {"auth": ... }' (6)
sshKey: |
  ssh-rsa AAAA... (7)

Generating the required installation manifests

You must generate the Kubernetes manifest and Ignition config files that the cluster needs to configure the machines.

Procedure

1. Generate the manifests by running the following command from the directory that contains the installation program:

   $ openshift-install create manifests --dir <installation_directory>

   where:

   <installation_directory>

   Specifies the directory in which the installation program creates files.

Configuring the Cloud Credential Operator utility

To create and manage cloud credentials from outside of the cluster when the Cloud Credential Operator (CCO) is operating in manual mode, extract and prepare the CCO utility (ccoctl) binary.

Prerequisites

• You have access to an OKD account with cluster administrator access.

• You have installed the OpenShift CLI (oc).

Procedure

1. Obtain the OKD release image by running the following command:

   $ RELEASE_IMAGE=$(./openshift-install version | awk '/release image/ {print $3}')

2. Obtain the CCO container image from the OKD release image by running the following command:

   $ CCO_IMAGE=$(oc adm release info --image-for='cloud-credential-operator' $RELEASE_IMAGE -a ~/.pull-secret)

   Ensure that the architecture of the $RELEASE_IMAGE matches the architecture of the environment in which you will use the ccoctl tool.

3. Extract the ccoctl binary from the CCO container image within the OKD release image by running the following command:

   $ oc image extract $CCO_IMAGE --file="/usr/bin/ccoctl" -a ~/.pull-secret

4. Change the permissions to make ccoctl executable by running the following command:

   $ chmod 775 ccoctl

Verification

• To verify that ccoctl is ready to use, display the help file by running the following command:

  $ ccoctl --help

  Output of ccoctl --help

  OpenShift credentials provisioning tool
  Usage:
    ccoctl [command]
  Available Commands:
    alibabacloud Manage credentials objects for alibaba cloud
    aws          Manage credentials objects for AWS cloud
    azure        Manage credentials objects for Azure
    gcp          Manage credentials objects for Google cloud
    help         Help about any command
    ibmcloud     Manage credentials objects for IBM Cloud
    nutanix      Manage credentials objects for Nutanix
  Flags:
    -h, --help   help for ccoctl
  Use "ccoctl [command] --help" for more information about a command.

Creating credentials for OKD components with the ccoctl tool

You can use the OKD Cloud Credential Operator (CCO) utility to automate the creation of Alibaba Cloud RAM users and policies for each in-cluster component.

Prerequisites

You must have:

• Extracted and prepared the ccoctl binary.

• Created a RAM user with sufficient permission to create the OKD cluster.

• Added the AccessKeyID (access_key_id) and AccessKeySecret (access_key_secret) of that RAM user into the ~/.alibabacloud/credentials file on your local computer.

Procedure

1. Set a $RELEASE_IMAGE variable with the release image from your installation file by running the following command:

   $ RELEASE_IMAGE=$(./openshift-install version | awk '/release image/ {print $3}')

2. Extract the list of CredentialsRequest objects from the OKD release image by running the following command:

   $ oc adm release extract \
     --from=$RELEASE_IMAGE \
     --credentials-requests \
     --included \(1)
     --install-config=<path_to_directory_with_installation_configuration>/install-config.yaml \(2)
     --to=<path_to_directory_for_credentials_requests> (3)

   1	The —included parameter includes only the manifests that your specific cluster configuration requires.
   2	Specify the location of the install-config.yaml file.
   3	Specify the path to the directory where you want to store the CredentialsRequest objects. If the specified directory does not exist, this command creates it.

   This command might take a few moments to run.

3. Use the ccoctl tool to process all CredentialsRequest objects by running the following command:

   1. Run the following command to use the tool:

      $ ccoctl alibabacloud create-ram-users \
        --name <name> \(1)
        --region=<alibaba_region> \(2)
        --credentials-requests-dir=<path_to_credentials_requests_directory> \(3)
        --output-dir=<path_to_ccoctl_output_dir> (4)

      1	Specify the name used to tag any cloud resources that are created for tracking.
      2	Specify the Alibaba Cloud region in which cloud resources will be created.
      3	Specify the directory containing the files for the component CredentialsRequest objects.
      4	Specify the directory where the generated component credentials secrets will be placed.

      If your cluster uses Technology Preview features that are enabled by the TechPreviewNoUpgrade feature set, you must include the —enable-tech-preview parameter.

      Example output

      2022/02/11 16:18:26 Created RAM User: user1-alicloud-openshift-machine-api-alibabacloud-credentials
      2022/02/11 16:18:27 Ready for creating new ram policy user1-alicloud-openshift-machine-api-alibabacloud-credentials-policy-policy
      2022/02/11 16:18:27 RAM policy user1-alicloud-openshift-machine-api-alibabacloud-credentials-policy-policy has created
      2022/02/11 16:18:28 Policy user1-alicloud-openshift-machine-api-alibabacloud-credentials-policy-policy has attached on user user1-alicloud-openshift-machine-api-alibabacloud-credentials
      2022/02/11 16:18:29 Created access keys for RAM User: user1-alicloud-openshift-machine-api-alibabacloud-credentials
      2022/02/11 16:18:29 Saved credentials configuration to: user1-alicloud/manifests/openshift-machine-api-alibabacloud-credentials-credentials.yaml
      ...

      A RAM user can have up to two AccessKeys at the same time. If you run ccoctl alibabacloud create-ram-users more than twice, the previously generated manifests secret becomes stale and you must reapply the newly generated secrets.

   2. Verify that the OKD secrets are created:

      $ ls <path_to_ccoctl_output_dir>/manifests

      Example output

      openshift-cluster-csi-drivers-alibaba-disk-credentials-credentials.yaml
      openshift-image-registry-installer-cloud-credentials-credentials.yaml
      openshift-ingress-operator-cloud-credentials-credentials.yaml
      openshift-machine-api-alibabacloud-credentials-credentials.yaml

      You can verify that the RAM users and policies are created by querying Alibaba Cloud. For more information, refer to Alibaba Cloud documentation on listing RAM users and policies.

4. Copy the generated credential files to the target manifests directory:

   $ cp ./<path_to_ccoctl_output_dir>/manifests/*credentials.yaml ./<path_to_installation>dir>/manifests/

   where:

   <path_to_ccoctl_output_dir>

   Specifies the directory created by the ccoctl alibabacloud create-ram-users command.

   <path_to_installation_dir>

   Specifies the directory in which the installation program creates files.

Deploying the cluster

You can install OKD on a compatible cloud platform.

Prerequisites

• You have configured an account with the cloud platform that hosts your cluster.

• You have the OKD installation program and the pull secret for your cluster.

• You have verified that the cloud provider account on your host has the correct permissions to deploy the cluster. An account with incorrect permissions causes the installation process to fail with an error message that displays the missing permissions.

Procedure

• Change to the directory that contains the installation program and initialize the cluster deployment:

  $ ./openshift-install create cluster --dir <installation_directory> \ (1)
      --log-level=info (2)

  1	For <installation_directory>, specify the location of your customized ./install-config.yaml file.
  2	To view different installation details, specify warn, debug, or error instead of info.

Verification

When the cluster deployment completes successfully:

• The terminal displays directions for accessing your cluster, including a link to the web console and credentials for the kubeadmin user.

• Credential information also outputs to <installation_directory>/.openshift_install.log.

Example output

...
INFO Install complete!
INFO To access the cluster as the system:admin user when using 'oc', run 'export KUBECONFIG=/home/myuser/install_dir/auth/kubeconfig'
INFO Access the OpenShift web-console here: https://console-openshift-console.apps.mycluster.example.com
INFO Login to the console with user: "kubeadmin", and password: "password"
INFO Time elapsed: 36m22s

Installing the OpenShift CLI by downloading the binary

You can install the OpenShift CLI (oc) to interact with OKD from a command-line interface. You can install oc on Linux, Windows, or macOS.

Installing the OpenShift CLI on Linux

You can install the OpenShift CLI (oc) binary on Linux by using the following procedure.

Procedure

1. Navigate to https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/ and choose the folder for your operating system and architecture.

2. Download oc.tar.gz.

3. Unpack the archive:

   $ tar xvf <file>

4. Place the oc binary in a directory that is on your PATH.

   To check your PATH, execute the following command:

   $ echo $PATH

After you install the OpenShift CLI, it is available using the oc command:

$ oc <command>

Installing the OpenShift CLI on Windows

You can install the OpenShift CLI (oc) binary on Windows by using the following procedure.

Procedure

1. Navigate to https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/ and choose the folder for your operating system and architecture.

2. Download oc.zip.

3. Unzip the archive with a ZIP program.

4. Move the oc binary to a directory that is on your PATH.

   To check your PATH, open the command prompt and execute the following command:

   C:\> path

After you install the OpenShift CLI, it is available using the oc command:

C:\> oc <command>

Installing the OpenShift CLI on macOS

You can install the OpenShift CLI (oc) binary on macOS by using the following procedure.

Procedure

1. Navigate to https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/ and choose the folder for your operating system and architecture.

2. Download oc.tar.gz.

3. Unpack and unzip the archive.

4. Move the oc binary to a directory on your PATH.

   To check your PATH, open a terminal and execute the following command:

   $ echo $PATH

After you install the OpenShift CLI, it is available using the oc command:

$ oc <command>

Logging in to the cluster by using the CLI

You can log in to your cluster as a default system user by exporting the cluster kubeconfig file. The kubeconfig file contains information about the cluster that is used by the CLI to connect a client to the correct cluster and API server. The file is specific to a cluster and is created during OKD installation.

Prerequisites

• You deployed an OKD cluster.

• You installed the oc CLI.

Procedure

1. Export the kubeadmin credentials:

   $ export KUBECONFIG=<installation_directory>/auth/kubeconfig (1)

   1	For <installation_directory>, specify the path to the directory that you stored the installation files in.

2. Verify you can run oc commands successfully using the exported configuration:

   $ oc whoami

   Example output

   system:admin

Logging in to the cluster by using the web console

The kubeadmin user exists by default after an OKD installation. You can log in to your cluster as the kubeadmin user by using the OKD web console.

Prerequisites

• You have access to the installation host.

• You completed a cluster installation and all cluster Operators are available.

Procedure

1. Obtain the password for the kubeadmin user from the kubeadmin-password file on the installation host:

   $ cat <installation_directory>/auth/kubeadmin-password

   Alternatively, you can obtain the kubeadmin password from the <installation_directory>/.openshift_install.log log file on the installation host.

2. List the OKD web console route:

   $ oc get routes -n openshift-console | grep 'console-openshift'

   Alternatively, you can obtain the OKD route from the <installation_directory>/.openshift_install.log log file on the installation host.

   Example output

   console     console-openshift-console.apps.<cluster_name>.<base_domain>            console     https   reencrypt/Redirect   None

3. Navigate to the route detailed in the output of the preceding command in a web browser and log in as the kubeadmin user.

Additional resources

• See About remote health monitoring for more information about the Telemetry service.

• See Accessing the web console for more details about accessing and understanding the OKD web console

Next steps

• Validating an installation.

• Customize your cluster.

• If necessary, you can opt out of remote health reporting.