Skip to content

Commit 3353285

Browse files
jeana-redhatjeana-redhat
authored
Merge pull request #32558 from xJustin/air-gapped-new
CCXDEV-4071 CCXDEV-4434 new chapter for restricted networks
2 parents d57c801 + f2de7ef commit 3353285

File tree

5 files changed

+219
-0
lines changed

5 files changed

+219
-0
lines changed

‎_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -429,6 +429,8 @@ Topics:
429429
File: opting-out-of-remote-health-reporting
430430
- Name: Using Insights to identify issues with your cluster
431431
File: using-insights-to-identify-issues-with-your-cluster
432+
- Name: Using remote health reporting in a restricted network
433+
File: remote-health-reporting-from-restricted-network
432434
- Name: Gathering data about your cluster
433435
File: gathering-cluster-data
434436
Distros: openshift-enterprise,openshift-origin

‎modules/insights-operator-enable-obfuscation.adoc

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * support/remote_health_monitoring/remote-health-reporting-from-restricted-network.adoc
4+
5+
6+
7+
[id="insights-operator-enable-obfuscation_{context}"]
8+
= Enabling Insights Operator data obfuscation
9+
10+
You can enable obfuscation to mask sensitive and identifiable IPv4 addresses and cluster base domains that the Insights Operator sends to link:https://cloud.redhat.com[cloud.redhat.com].
11+
12+
[WARNING]
13+
====
14+
Although this feature is available, Red Hat recommends keeping obfuscation disabled for a more effective support experience.
15+
====
16+
17+
Obfuscation assigns non-identifying values to cluster IPv4 addresses, and uses a translation table that is retained in memory to change IP addresses to their obfuscated versions throughout the Insights Operator archive before uploading the data to link:https://cloud.redhat.com[cloud.redhat.com].
18+
19+
For cluster base domains, obfuscation changes the base domain to a hardcoded substring. For example, `cluster-api.openshift.example.com` becomes `cluster-api.<CLUSTER_BASE_DOMAIN>`.
20+
21+
.Prerequisites
22+
23+
* You are logged in to the {product-title} web console as `cluster-admin`.
24+
25+
.Procedure
26+
27+
. Navigate to *Workloads* -> *Secrets*.
28+
. Search for the *support* secret using the *Search by name* field. If it does not exist, click *Create* -> *Key/value secret* to create it.
29+
. Click the *Options* menu {kebab}, and then click *Edit Secret*.
30+
. Click *Add Key/Value*.
31+
. Create a key named `enableGlobalObfuscation` with a value of `true`, and click *Save*.
32+
. Navigate to *Workloads* -> *Pods*
33+
. Select the `openshift-insights` project.
34+
. Find the `insights-operator` pod.
35+
. To restart the `insights-operator` pod, click the *Options* menu {kebab}, and then click *Delete Pod*.

‎modules/insights-operator-manual-upload.adoc

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * support/remote_health_monitoring/remote-health-reporting-from-restricted-network.adoc
4+
5+
6+
7+
[id="insights-operator-manual-upload_{context}"]
8+
= Uploading an Insights Operator archive
9+
10+
You can manually upload an Insights Operator archive to link:https://cloud.redhat.com[cloud.redhat.com] to diagnose potential issues.
11+
12+
.Prerequisites
13+
14+
* You are logged in to {product-title} as `cluster-admin`.
15+
* You have a workstation with unrestricted internet access.
16+
* You have created a copy of the Insights Operator archive.
17+
18+
.Procedure
19+
20+
. Download the `dockerconfig.json` file:
21+
+
22+
[source,terminal]
23+
----
24+
$ oc extract secret/pull-secret -n openshift-config --to=.
25+
----
26+
. Copy your `"cloud.openshift.com"` `"auth"` token from the `dockerconfig.json` file:
27+
+
28+
[source,json,subs="+quotes"]
29+
----
30+
{
31+
"auths": {
32+
"cloud.openshift.com": {
33+
"auth": "_<your_token>_",
34+
"email": "[email protected]"
35+
}
36+
}
37+
----
38+
39+
40+
. Upload the archive to link:https://cloud.redhat.com[cloud.redhat.com]:
41+
+
42+
[source,terminal,subs="+quotes"]
43+
----
44+
$ curl -v -H "User-Agent: insights-operator/one10time200gather184a34f6a168926d93c330 cluster/_<cluster_id>_" -H "Authorization: Bearer _<your_token>_" -F "upload=@_<path_to_archive>_; type=application/vnd.redhat.openshift.periodic+tar" https://cloud.redhat.com/api/ingress/v1/upload
45+
----
46+
where `_<cluster_id>_` is your cluster ID, `_<your_token>_` is the token from your pull secret, and `_<path_to_archive>_` is the path to the Insights Operator archive.
47+
+
48+
If the operation is successful, the command returns a `"request_id"` and `"account_number"`:
49+
+
50+
.Example output
51+
+
52+
[source,terminal]
53+
----
54+
* Connection #0 to host cloud.redhat.com left intact
55+
{"request_id":"393a7cf1093e434ea8dd4ab3eb28884c","upload":{"account_number":"6274079"}}%
56+
----
57+
58+
.Verification steps
59+
60+
. Log in to link:https://cloud.redhat.com/openshift[].
61+
62+
. Click the *Clusters* menu in the left pane.
63+
64+
. To display the details of the cluster, click the cluster name.
65+
66+
. Open the *Insights Advisor* tab of the cluster.
67+
+
68+
If the upload was successful, the tab displays one of the following:
69+
+
70+
* *Your cluster passed all recommendations*, if Insights Advisor did not identify any issues.
71+
72+
* A list of issues that Insights Advisor has detected, prioritized by risk (low, moderate, important, and critical).

‎modules/insights-operator-one-time-gather.adoc

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * support/remote_health_monitoring/remote-health-reporting-from-restricted-network.adoc
4+
5+
6+
7+
[id="insights-operator-one-time-gather_{context}"]
8+
= Running an Insights Operator gather operation
9+
10+
You must run a gather operation to create an Insights Operator archive.
11+
12+
.Prerequisites
13+
14+
* You are logged in to {product-title} as `cluster-admin`.
15+
16+
.Procedure
17+
18+
. Create a file named `gather-job.yaml` using this template:
19+
+
20+
[source,yaml]
21+
----
22+
include::https://raw.githubusercontent.com/openshift/insights-operator/release-4.8/docs/gather-job.yaml[]
23+
----
24+
. Copy your `insights-operator` image version:
25+
+
26+
[source,terminal]
27+
----
28+
$ oc get -n openshift-insights deployment insights-operator -o yaml
29+
----
30+
. Paste your image version in `gather-job.yaml`:
31+
+
32+
[source,yaml,subs="+quotes"]
33+
----
34+
initContainers:
35+
- name: insights-operator
36+
image: _<your_insights_operator_image_version>_
37+
terminationMessagePolicy: FallbackToLogsOnError
38+
volumeMounts:
39+
----
40+
. Create the gather job:
41+
+
42+
[source,terminal]
43+
----
44+
$ oc apply -n openshift-insights -f gather-job.yaml
45+
----
46+
. Find the name of the job pod:
47+
+
48+
[source,terminal]
49+
----
50+
$ oc describe -n openshift-insights job/insights-operator-job
51+
----
52+
+
53+
.Example output
54+
[source,terminal,subs="+quotes"]
55+
----
56+
Events:
57+
Type Reason Age From Message
58+
---- ------ ---- ---- -------
59+
Normal SuccessfulCreate 7m18s job-controller Created pod: insights-operator-job-_<your_job>_
60+
----
61+
where `insights-operator-job-_<your_job>_` is the name of the pod.
62+
63+
. Verify that the operation has finished:
64+
+
65+
[source,terminal,subs="+quotes"]
66+
----
67+
$ oc logs -n openshift-insights insights-operator-job-_<your_job>_ insights-operator
68+
----
69+
+
70+
.Example output
71+
[source,terminal]
72+
----
73+
I0407 11:55:38.192084 1 diskrecorder.go:34] Wrote 108 records to disk in 33ms
74+
----
75+
. Save the created archive:
76+
+
77+
[source,terminal,subs="+quotes"]
78+
----
79+
$ oc cp openshift-insights/insights-operator-job-_<your_job>_:/var/lib/insights-operator ./insights-data
80+
----
81+
. Clean up the job:
82+
+
83+
[source,terminal]
84+
----
85+
$ oc delete -n openshift-insights job insights-operator-job
86+
----
87+

‎support/remote_health_monitoring/remote-health-reporting-from-restricted-network.adoc

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
[id="remote-health-reporting-from-restricted-network"]
2+
= Using remote health reporting in a restricted network
3+
include::modules/common-attributes.adoc[]
4+
:context: remote-health-reporting-from-restricted-network
5+
6+
toc::[]
7+
8+
You can manually gather and upload Insights Operator archives to diagnose issues from a restricted network.
9+
10+
To use the Insights Operator in a restricted network, you must:
11+
12+
* Create a copy of your Insights Operator archive.
13+
* Upload the Insights Operator archive to link:https://cloud.redhat.com[cloud.redhat.com].
14+
15+
Additionally, you can choose to xref:../../support/remote_health_monitoring/remote-health-reporting-from-restricted-network.adoc#insights-operator-enable-obfuscation_remote-health-reporting-from-restricted-network[obfuscate] the Insights Operator data before upload.
16+
17+
18+
include::modules/insights-operator-one-time-gather.adoc[leveloffset=+1]
19+
20+
include::modules/insights-operator-manual-upload.adoc[leveloffset=+1]
21+
22+
include::modules/insights-operator-enable-obfuscation.adoc[leveloffset=+1]
23+

0 commit comments

Comments
 (0)