Installing a cluster on AWS into a government region

In OKD version 4.6, you can install a cluster on Amazon Web Services (AWS) into a government region. To configure the government region, modify parameters in the install-config.yaml file before you install the cluster.

Prerequisites

• Review details about the OKD installation and update processes.

• Configure an AWS account to host the cluster.

  If you have an AWS profile stored on your computer, it must not use a temporary session token that you generated while using a multi-factor authentication device. The cluster continues to use your current AWS credentials to create AWS resources for the entire life of the cluster, so you must use long-lived credentials. To generate appropriate keys, see Managing Access Keys for IAM Users in the AWS documentation. You can supply the keys when you run the installation program.

• If you use a firewall, you must configure it to allow the sites that your cluster requires access to.

• If you do not allow the system to manage identity and access management (IAM), then a cluster administrator can manually create and maintain IAM credentials. Manual mode can also be used in environments where the cloud IAM APIs are not reachable.

AWS government regions

OKD supports deploying a cluster to AWS GovCloud (US) regions. AWS GovCloud is specifically designed for US government agencies at the federal, state, and local level, as well as contractors, educational institutions, and other US customers that must run sensitive workloads in the cloud.

These regions do not have published Fedora CoreOS (FCOS) Amazon Machine Images (AMI) to select, so you must upload a custom AMI that belongs to that region.

The following AWS GovCloud partitions are supported:

• us-gov-west-1

• us-gov-east-1

The AWS GovCloud region and custom AMI must be manually configured in the install-config.yaml file since FCOS AMIs are not provided by Red Hat for those regions.

Private clusters

You can deploy a private OKD cluster that does not expose external endpoints. Private clusters are accessible from only an internal network and are not visible to the Internet.

By default, OKD is provisioned to use publicly-accessible DNS and endpoints. A private cluster sets the DNS, Ingress Controller, and API server to private when you deploy your cluster. This means that the cluster resources are only accessible from your internal network and are not visible to the internet.

To deploy a private cluster, you must use existing networking that meets your requirements. Your cluster resources might be shared between other clusters on the network.

Additionally, you must deploy a private cluster from a machine that has access the API services for the cloud you provision to, the hosts on the network that you provision, and to the internet to obtain installation media. You can use any machine that meets these access requirements and follows your company’s guidelines. For example, this machine can be a bastion host on your cloud network or a machine that has access to the network through a VPN.

Private clusters in AWS

To create a private cluster on Amazon Web Services (AWS), you must provide an existing private VPC and subnets to host the cluster. The installation program must also be able to resolve the DNS records that the cluster requires. The installation program configures the Ingress Operator and API server for access from only the private network.

The cluster still requires access to Internet to access the AWS APIs.

The following items are not required or created when you install a private cluster:

• Public subnets

• Public load balancers, which support public ingress

• A public Route 53 zone that matches the baseDomain for the cluster

The installation program does use the baseDomain that you specify to create a private Route 53 zone and the required records for the cluster. The cluster is configured so that the Operators do not create public records for the cluster and all cluster machines are placed in the private subnets that you specify.

Limitations

The ability to add public functionality to a private cluster is limited.

• You cannot make the Kubernetes API endpoints public after installation without taking additional actions, including creating public subnets in the VPC for each availability zone in use, creating a public load balancer, and configuring the control plane security groups to allow traffic from Internet on 6443 (Kubernetes API port).

• If you use a public Service type load balancer, you must tag a public subnet in each availability zone with kubernetes.io/cluster/<cluster-infra-id>: shared so that AWS can use them to create public load balancers.

About using a custom VPC

In OKD 4.6, you can deploy a cluster into existing subnets in an existing Amazon Virtual Private Cloud (VPC) in Amazon Web Services (AWS). By deploying OKD into an existing AWS VPC, you might be able to avoid limit constraints in new accounts or more easily abide by the operational constraints that your company’s guidelines set. If you cannot obtain the infrastructure creation permissions that are required to create the VPC yourself, use this installation option.

Because the installation program cannot know what other components are also in your existing subnets, it cannot choose subnet CIDRs and so forth on your behalf. You must configure networking for the subnets that you install your cluster to yourself.

Requirements for using your VPC

The installation program no longer creates the following components:

• Internet gateways

• NAT gateways

• Subnets

• Route tables

• VPCs

• VPC DHCP options

• VPC endpoints

If you use a custom VPC, you must correctly configure it and its subnets for the installation program and the cluster to use. The installation program cannot subdivide network ranges for the cluster to use, set route tables for the subnets, or set VPC options like DHCP, so you must do so before you install the cluster.

Your VPC must meet the following characteristics:

• The VPC’s CIDR block must contain the Networking.MachineCIDR range, which is the IP address pool for cluster machines.

• The VPC must not use the kubernetes.io/cluster/.*: owned tag.

• You must enable the enableDnsSupport and enableDnsHostnames attributes in your VPC so that the cluster can use the Route 53 zones that are attached to the VPC to resolve cluster’s internal DNS records. See DNS Support in Your VPC in the AWS documentation.

If you use a cluster with public access, you must create a public and a private subnet for each availability zone that your cluster uses.

The installation program modifies your subnets to add the kubernetes.io/cluster/.*: shared tag, so your subnets must have at least one free tag slot available for it. Review the current Tag Restrictions in the AWS documentation to ensure that the installation program can add a tag to each subnet that you specify.

If you are working in a disconnected environment, you are unable to reach the public IP addresses for EC2 and ELB endpoints. To resolve this, you must create a VPC endpoint and attach it to the subnet that the clusters are using. The endpoints should be named as follows:

• ec2.<region>.amazonaws.com

• elasticloadbalancing.<region>.amazonaws.com

• s3.<region>.amazonaws.com

Required VPC components

You must provide a suitable VPC and subnets that allow communication to your machines.

VPC validation

To ensure that the subnets that you provide are suitable, the installation program confirms the following data:

• All the subnets that you specify exist.

• You provide private subnets.

• The subnet CIDRs belong to the machine CIDR that you specified.

• You provide subnets for each availability zone. Each availability zone contains no more than one public and one private subnet. If you use a private cluster, provide only a private subnet for each availability zone. Otherwise, provide exactly one public and private subnet for each availability zone.

• You provide a public subnet for each private subnet availability zone. Machines are not provisioned in availability zones that you do not provide private subnets for.

If you destroy a cluster that uses an existing VPC, the VPC is not deleted. When you remove the OKD cluster from a VPC, the kubernetes.io/cluster/.*: shared tag is removed from the subnets that it used.

Division of permissions

Starting with OKD 4.3, you do not need all of the permissions that are required for an installation program-provisioned infrastructure cluster to deploy a cluster. This change mimics the division of permissions that you might have at your company: some individuals can create different resource in your clouds than others. For example, you might be able to create application-specific items, like instances, buckets, and load balancers, but not networking-related components such as VPCs, subnets, or ingress rules.

The AWS credentials that you use when you create your cluster do not need the networking permissions that are required to make VPCs and core networking components within the VPC, such as subnets, routing tables, Internet gateways, NAT, and VPN. You still need permission to make the application resources that the machines within the cluster require, such as ELBs, security groups, S3 buckets, and nodes.

Isolation between clusters

If you deploy OKD to an existing network, the isolation of cluster services is reduced in the following ways:

• You can install multiple OKD clusters in the same VPC.

• ICMP ingress is allowed from the entire network.

• TCP 22 ingress (SSH) is allowed to the entire network.

• Control plane TCP 6443 ingress (Kubernetes API) is allowed to the entire network.

• Control plane TCP 22623 ingress (MCS) is allowed to the entire network.

Generating an SSH private key and adding it to the agent

If you want to perform installation debugging or disaster recovery on your cluster, you must provide an SSH key to both your ssh-agent and the installation program. You can use this key to access the bootstrap machine in a public cluster to troubleshoot installation issues.

You can use this key to SSH into the master nodes as the user core. When you deploy the cluster, the key is added to the core user’s ~/.ssh/authorized_keys list.

Procedure

1. If you do not have an SSH key that is configured for password-less authentication on your computer, create one. For example, on a computer that uses a Linux operating system, run the following command:

   $ ssh-keygen -t ed25519 -N '' \
       -f <path>/<file_name> (1)

   1	Specify the path and file name, such as ~/.ssh/id_rsa, of the new SSH key. If you have an existing key pair, ensure your public key is in the your ~/.ssh directory.

   Running this command generates an SSH key that does not require a password in the location that you specified.

   If you plan to install an OKD cluster that uses FIPS Validated / Modules in Process cryptographic libraries on the x86_64 architecture, do not create a key that uses the ed25519 algorithm. Instead, create a key that uses the rsa or ecdsa algorithm.

2. Start the ssh-agent process as a background task:

   $ eval "$(ssh-agent -s)"

   Example output

   Agent pid 31874

   If your cluster is in FIPS mode, only use FIPS-compliant algorithms to generate the SSH key. The key must be either RSA or ECDSA.

3. Add your SSH private key to the ssh-agent:

   $ ssh-add <path>/<file_name> (1)

   Example output

   Identity added: /home/<you>/<path>/<file_name> (<computer_name>)

   1	Specify the path and file name for your SSH private key, such as ~/.ssh/id_rsa

Next steps

• When you install OKD, provide the SSH public key to the installation program.

Obtaining the installation program

Before you install OKD, download the installation file on a local computer.

Prerequisites

• You have a computer that runs Linux or macOS, with 500 MB of local disk space

Procedure

1. Download installer from https://github.com/openshift/okd/releases

   The installation program creates several files on the computer that you use to install your cluster. You must keep the installation program and the files that the installation program creates after you finish installing the cluster. Both files are required to delete the cluster.

   Deleting the files created by the installation program does not remove your cluster, even if the cluster failed during installation. To remove your cluster, complete the OKD uninstallation procedures for your specific cloud provider.

2. Extract the installation program. For example, on a computer that uses a Linux operating system, run the following command:

   $ tar xvf openshift-install-linux.tar.gz

3. From the Pull Secret page on the Red Hat OpenShift Cluster Manager site, download your installation pull secret as a .txt file. This pull secret allows you to authenticate with the services that are provided by the included authorities, including Quay.io, which serves the container images for OKD components.

   Using a pull secret from the Red Hat OpenShift Cluster Manager site is not required. You can use a pull secret for another private registry. Or, if you do not need the cluster to pull images from a private registry, you can use {"auths":{"fake":{"auth":"aWQ6cGFzcwo="}}} as the pull secret when prompted during the installation.

   If you do not use the pull secret from the Red Hat OpenShift Cluster Manager site:

   • Red Hat Operators are not available.

   • The Telemetry and Insights operators do not send data to Red Hat.

   • Content from the Red Hat Container Catalog registry, such as image streams and Operators, are not available.

Manually creating the installation configuration file

When installing OKD on Amazon Web Services (AWS) into a region requiring a custom Fedora CoreOS (FCOS) AMI, you must manually generate your installation configuration file.

Prerequisites

• Obtain the OKD installation program and the access token for your cluster.

Procedure

1. Create an installation directory to store your required installation assets in:

   $ mkdir <installation_directory>

   You must create a directory. Some installation assets, like bootstrap X.509 certificates have short expiration intervals, so you must not reuse an installation directory. If you want to reuse individual files from another cluster installation, you can copy them into your directory. However, the file names for the installation assets might change between releases. Use caution when copying installation files from an earlier OKD version.

2. Customize the following install-config.yaml file template and save it in the <installation_directory>.

   You must name this configuration file install-config.yaml.

3. Back up the install-config.yaml file so that you can use it to install multiple clusters.

   The install-config.yaml file is consumed during the next step of the installation process. You must back it up now.

Installation configuration parameters

Before you deploy an OKD cluster, you provide parameter values to describe your account on the cloud platform that hosts your cluster and optionally customize your cluster’s platform. When you create the install-config.yaml installation configuration file, you provide values for the required parameters through the command line. If you customize your cluster, you can modify the install-config.yaml file to provide more details about the platform.

Required configuration parameters

Required installation configuration parameters are described in the following table:

Network configuration parameters

You can customize your installation configuration based on the requirements of your existing network infrastructure. For example, you can expand the IP address block for the cluster network or provide different IP address blocks than the defaults.

Only IPv4 addresses are supported.

networking:
  clusterNetwork:
  - cidr: 10.128.0.0/14
    hostPrefix: 23

networking:
  serviceNetwork:
   - 172.30.0.0/16

networking:
  machineNetwork:
  - cidr: 10.0.0.0/16

Optional configuration parameters

Optional installation configuration parameters are described in the following table:

sshKey:
  <key1>
  <key2>
  <key3>

Optional AWS configuration parameters

Optional AWS configuration parameters are described in the following table:

Sample customized install-config.yaml file for AWS

You can customize the install-config.yaml file to specify more details about your OKD cluster’s platform or modify the values of the required parameters.

apiVersion: v1
baseDomain: example.com (1)
credentialsMode: Mint (2)
controlPlane:  (3) (4)
  hyperthreading: Enabled (5)
  name: master
  platform:
    aws:
      zones:
      - us-gov-west-1a
      - us-gov-west-1b
      rootVolume:
        iops: 4000
        size: 500
        type: io1 (6)
      type: m5.xlarge
  replicas: 3
compute: (3)
- hyperthreading: Enabled (5)
  name: worker
  platform:
    aws:
      rootVolume:
        iops: 2000
        size: 500
        type: io1 (6)
      type: c5.4xlarge
      zones:
      - us-gov-west-1c
  replicas: 3
metadata:
  name: test-cluster (1)
networking:
  clusterNetwork:
  - cidr: 10.128.0.0/14
    hostPrefix: 23
  machineNetwork:
  - cidr: 10.0.0.0/16
  networkType: OVNKubernetes
  serviceNetwork:
  - 172.30.0.0/16
platform:
  aws:
    region: us-gov-west-1
    userTags:
      adminContact: jdoe
      costCenter: 7536
    subnets: (7)
    - subnet-1
    - subnet-2
    - subnet-3
    amiID: ami-96c6f8f7 (8)
    serviceEndpoints: (9)
      - name: ec2
        url: https://vpce-id.ec2.us-west-2.vpce.amazonaws.com
    hostedZone: Z3URY6TWQ91KVV (10)
sshKey: ssh-ed25519 AAAA... (11)
pullSecret: '{"auths": ...}' (1)
publish: Internal (12)
additionalTrustBundle: | (13)
    -----BEGIN CERTIFICATE-----
    <MY_TRUSTED_CA_CERT>
    -----END CERTIFICATE-----

AWS regions without a published FCOS AMI

You can deploy an OKD cluster to Amazon Web Services (AWS) regions without native support for a Fedora CoreOS (FCOS) Amazon Machine Image (AMI) or the AWS software development kit (SDK). If a published AMI is not available for an AWS region, you can upload a custom AMI prior to installing the cluster. This is required if you are deploying your cluster to an AWS government region.

If you are deploying to a non-government region that does not have a published FCOS AMI, and you do not specify a custom AMI, the installation program copies the us-east-1 AMI to the user account automatically. Then the installation program creates the control plane machines with encrypted EBS volumes using the default or user-specified Key Management Service (KMS) key. This allows the AMI to follow the same process workflow as published FCOS AMIs.

A region without native support for an FCOS AMI is not available to select from the terminal during cluster creation because it is not published. However, you can install to this region by configuring the custom AMI in the install-config.yaml file.

Uploading a custom FCOS AMI in AWS

If you are deploying to a custom Amazon Web Services (AWS) region, you must upload a custom Fedora CoreOS (FCOS) Amazon Machine Image (AMI) that belongs to that region.

Prerequisites

• You configured an AWS account.

• You created an Amazon S3 bucket with the required IAM service role.

• You uploaded your FCOS VMDK file to Amazon S3.

• You downloaded the AWS CLI and installed it on your computer. See Install the AWS CLI Using the Bundled Installer.

Procedure

1. Export your AWS profile as an environment variable:

   $ export AWS_PROFILE=<aws_profile> (1)

   1	The AWS profile name that holds your AWS credentials, like govcloud.

2. Export the region to associate with your custom AMI as an environment variable:

   $ export AWS_DEFAULT_REGION=<aws_region> (1)

   1	The AWS region, like us-gov-east-1.

3. Export the version of FCOS you uploaded to Amazon S3 as an environment variable:

   $ export RHCOS_VERSION=<version> (1)

   1	The FCOS VMDK version, like 4.6.0.

4. Export the Amazon S3 bucket name as an environment variable:

   $ export VMIMPORT_BUCKET_NAME=<s3_bucket_name>

5. Create the containers.json file and define your FCOS VMDK file:

   $ cat <<EOF > containers.json
   {
      "Description": "rhcos-${RHCOS_VERSION}-x86_64-aws.x86_64",
      "Format": "vmdk",
      "UserBucket": {
         "S3Bucket": "${VMIMPORT_BUCKET_NAME}",
         "S3Key": "rhcos-${RHCOS_VERSION}-x86_64-aws.x86_64.vmdk"
      }
   }
   EOF

6. Import the FCOS disk as an Amazon EBS snapshot:

   $ aws ec2 import-snapshot --region ${AWS_DEFAULT_REGION} \
        --description "<description>" \ (1)
        --disk-container "file://<file_path>/containers.json" (2)

   1	The description of your FCOS disk being imported, like rhcos-${RHCOS_VERSION}-x86_64-aws.x86_64.
   2	The file path to the JSON file describing your FCOS disk. The JSON file should contain your Amazon S3 bucket name and key.

7. Check the status of the image import:

   $ watch -n 5 aws ec2 describe-import-snapshot-tasks --region ${AWS_DEFAULT_REGION}

   Example output

   {
       "ImportSnapshotTasks": [
           {
               "Description": "rhcos-4.6.0-x86_64-aws.x86_64",
               "ImportTaskId": "import-snap-fh6i8uil",
               "SnapshotTaskDetail": {
                   "Description": "rhcos-4.6.0-x86_64-aws.x86_64",
                   "DiskImageSize": 819056640.0,
                   "Format": "VMDK",
                   "SnapshotId": "snap-06331325870076318",
                   "Status": "completed",
                   "UserBucket": {
                       "S3Bucket": "external-images",
                       "S3Key": "rhcos-4.6.0-x86_64-aws.x86_64.vmdk"
                   }
               }
           }
       ]
   }

   Copy the SnapshotId to register the image.

8. Create a custom FCOS AMI from the FCOS snapshot:

   $ aws ec2 register-image \
      --region ${AWS_DEFAULT_REGION} \
      --architecture x86_64 \ (1)
      --description "rhcos-${RHCOS_VERSION}-x86_64-aws.x86_64" \ (2)
      --ena-support \
      --name "rhcos-${RHCOS_VERSION}-x86_64-aws.x86_64" \ (3)
      --virtualization-type hvm \
      --root-device-name '/dev/xvda' \
      --block-device-mappings 'DeviceName=/dev/xvda,Ebs={DeleteOnTermination=true,SnapshotId=<snapshot_ID>}' (4)

   1	The FCOS VMDK architecture type, like x86_64, s390x, or ppc64le.
   2	The Description from the imported snapshot.
   3	The name of the FCOS AMI.
   4	The SnapshotID from the imported snapshot.

To learn more about these APIs, see the AWS documentation for importing snapshots and creating EBS-backed AMIs.

Configuring the cluster-wide proxy during installation

Production environments can deny direct access to the Internet and instead have an HTTP or HTTPS proxy available. You can configure a new OKD cluster to use a proxy by configuring the proxy settings in the install-config.yaml file.

Prerequisites

• You have an existing install-config.yaml file.

• You reviewed the sites that your cluster requires access to and determined whether any of them need to bypass the proxy. By default, all cluster egress traffic is proxied, including calls to hosting cloud provider APIs. You added sites to the Proxy object’s spec.noProxy field to bypass the proxy if necessary.

  The Proxy object status.noProxy field is populated with the values of the networking.machineNetwork[].cidr, networking.clusterNetwork[].cidr, and networking.serviceNetwork[] fields from your installation configuration. For installations on Amazon Web Services (AWS), Google Cloud Platform (GCP), Microsoft Azure, and Red Hat OpenStack Platform (RHOSP), the Proxy object status.noProxy field is also populated with the instance metadata endpoint (169.254.169.254).

• If your cluster is on AWS, you added the ec2.<region>.amazonaws.com, elasticloadbalancing.<region>.amazonaws.com, and s3.<region>.amazonaws.com endpoints to your VPC endpoint. These endpoints are required to complete requests from the nodes to the AWS EC2 API. Because the proxy works on the container level, not the node level, you must route these requests to the AWS EC2 API through the AWS private network. Adding the public IP address of the EC2 API to your allowlist in your proxy server is not sufficient.

Procedure

1. Edit your install-config.yaml file and add the proxy settings. For example:

   apiVersion: v1
   baseDomain: my.domain.com
   proxy:
     httpProxy: http://<username>:<pswd>@<ip>:<port> (1)
     httpsProxy: https://<username>:<pswd>@<ip>:<port> (2)
     noProxy: example.com (3)
   additionalTrustBundle: | (4)
       -----BEGIN CERTIFICATE-----
       <MY_TRUSTED_CA_CERT>
       -----END CERTIFICATE-----
   ...

   1	A proxy URL to use for creating HTTP connections outside the cluster. The URL scheme must be http. If you use an MITM transparent proxy network that does not require additional proxy configuration but requires additional CAs, you must not specify an httpProxy value.
   2	A proxy URL to use for creating HTTPS connections outside the cluster. If you use an MITM transparent proxy network that does not require additional proxy configuration but requires additional CAs, you must not specify an httpsProxy value.
   3	A comma-separated list of destination domain names, domains, IP addresses, or other network CIDRs to exclude proxying. Preface a domain with . to match subdomains only. For example, .y.com matches x.y.com, but not y.com. Use * to bypass proxy for all destinations.
   4	If provided, the installation program generates a config map that is named user-ca-bundle in the openshift-config namespace that contains one or more additional CA certificates that are required for proxying HTTPS connections. The Cluster Network Operator then creates a trusted-ca-bundle config map that merges these contents with the Fedora CoreOS (FCOS) trust bundle, and this config map is referenced in the Proxy object’s trustedCA field. The additionalTrustBundle field is required unless the proxy’s identity certificate is signed by an authority from the FCOS trust bundle. If you use an MITM transparent proxy network that does not require additional proxy configuration but requires additional CAs, you must provide the MITM CA certificate.

   The installation program does not support the proxy readinessEndpoints field.

2. Save the file and reference it when installing OKD.

The installation program creates a cluster-wide proxy that is named cluster that uses the proxy settings in the provided install-config.yaml file. If no proxy settings are provided, a cluster Proxy object is still created, but it will have a nil spec.

Deploying the cluster

You can install OKD on a compatible cloud platform.

Prerequisites

• Configure an account with the cloud platform that hosts your cluster.

• Obtain the OKD installation program and the pull secret for your cluster.

Procedure

1. Change to the directory that contains the installation program and initialize the cluster deployment:

   $ ./openshift-install create cluster --dir=<installation_directory> \ (1)
       --log-level=info (2)

   1	For <installation_directory>, specify the location of your customized ./install-config.yaml file.
   2	To view different installation details, specify warn, debug, or error instead of info.

   If the cloud provider account that you configured on your host does not have sufficient permissions to deploy the cluster, the installation process stops, and the missing permissions are displayed.

   When the cluster deployment completes, directions for accessing your cluster, including a link to its web console and credentials for the kubeadmin user, display in your terminal.

   Example output

   ...
   INFO Install complete!
   INFO To access the cluster as the system:admin user when using 'oc', run 'export KUBECONFIG=/home/myuser/install_dir/auth/kubeconfig'
   INFO Access the OpenShift web-console here: https://console-openshift-console.apps.mycluster.example.com
   INFO Login to the console with user: "kubeadmin", and password: "4vYBz-Ee6gm-ymBZj-Wt5AL"
   INFO Time elapsed: 36m22s

   The cluster access and credential information also outputs to <installation_directory>/.openshift_install.log when an installation succeeds.

   The Ignition config files that the installation program generates contain certificates that expire after 24 hours, which are then renewed at that time. If the cluster is shut down before renewing the certificates and the cluster is later restarted after the 24 hours have elapsed, the cluster automatically recovers the expired certificates. The exception is that you must manually approve the pending node-bootstrapper certificate signing requests (CSRs) to recover kubelet certificates. See the documentation for Recovering from expired control plane certificates for more information.

   You must not delete the installation program or the files that the installation program creates. Both are required to delete the cluster.

2. Optional: Remove or disable the AdministratorAccess policy from the IAM account that you used to install the cluster.

   The elevated permissions provided by the AdministratorAccess policy are required only during installation.

Installing the OpenShift CLI by downloading the binary

You can install the OpenShift CLI (oc) in order to interact with OKD from a command-line interface. You can install oc on Linux, Windows, or macOS.

Installing the OpenShift CLI on Linux

You can install the OpenShift CLI (oc) binary on Linux by using the following procedure.

Procedure

1. Navigate to https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/ and choose the folder for your operating system and architecture.

2. Download oc.tar.gz.

3. Unpack the archive:

   $ tar xvzf <file>

4. Place the oc binary in a directory that is on your PATH.

   To check your PATH, execute the following command:

   $ echo $PATH

After you install the OpenShift CLI, it is available using the oc command:

$ oc <command>

Installing the OpenShift CLI on Windows

You can install the OpenShift CLI (oc) binary on Windows by using the following procedure.

Procedure

1. Navigate to https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/ and choose the folder for your operating system and architecture.

2. Download oc.zip.

3. Unzip the archive with a ZIP program.

4. Move the oc binary to a directory that is on your PATH.

   To check your PATH, open the command prompt and execute the following command:

   C:\> path

After you install the OpenShift CLI, it is available using the oc command:

C:\> oc <command>

Installing the OpenShift CLI on macOS

You can install the OpenShift CLI (oc) binary on macOS by using the following procedure.

Procedure

1. Navigate to https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/ and choose the folder for your operating system and architecture.

2. Download oc.tar.gz.

3. Unpack and unzip the archive.

4. Move the oc binary to a directory on your PATH.

   To check your PATH, open a terminal and execute the following command:

   $ echo $PATH

After you install the OpenShift CLI, it is available using the oc command:

$ oc <command>

Logging in to the cluster by using the CLI

You can log in to your cluster as a default system user by exporting the cluster kubeconfig file. The kubeconfig file contains information about the cluster that is used by the CLI to connect a client to the correct cluster and API server. The file is specific to a cluster and is created during OKD installation.

Prerequisites

• You deployed an OKD cluster.

• You installed the oc CLI.

Procedure

1. Export the kubeadmin credentials:

   $ export KUBECONFIG=<installation_directory>/auth/kubeconfig (1)

   1	For <installation_directory>, specify the path to the directory that you stored the installation files in.

2. Verify you can run oc commands successfully using the exported configuration:

   $ oc whoami

   Example output

   system:admin

Logging in to the cluster by using the web console

The kubeadmin user exists by default after an OKD installation. You can log into your cluster as the kubeadmin user by using the OKD web console.

Prerequisites

• You have access to the installation host.

• You completed a cluster installation and all cluster Operators are available.

Procedure

1. Obtain the password for the kubeadmin user from the kubeadmin-password file on the installation host:

   $ cat <installation_directory>/auth/kubeadmin-password

   Alternatively, you can obtain the kubeadmin password from the <installation_directory>/.openshift_install.log log file on the installation host.

2. List the OKD web console route:

   $ oc get routes -n openshift-console | grep 'console-openshift'

   Alternatively, you can obtain the OKD route from the <installation_directory>/.openshift_install.log log file on the installation host.

   Example output

   console     console-openshift-console.apps.<cluster_name>.<base_domain>            console     https   reencrypt/Redirect   None

3. Navigate to the route detailed in the output of the preceding command in a web browser and log in as the kubeadmin user.

Additional resources

• See Accessing the web console for more details about accessing and understanding the OKD web console.

Additional resources

• See About remote health monitoring for more information about the Telemetry service.

Next steps

• Validating an installation.

• Customize your cluster.

• If necessary, you can opt out of remote health reporting.

• If necessary, you can remove cloud provider credentials.