You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: installing/install_config/customizations.adoc
+34-34Lines changed: 34 additions & 34 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -37,63 +37,63 @@ to @api-approvers (github) or #forum-api-review (slack).
37
37
|Resource name
38
38
|Description
39
39
40
-
|apiserver.config.openshift.io
41
-
|Provides api-server configuration such as xref:../../security/certificates/api-server.adoc#api-server-certificates[certificates and certificate authorities].
40
+
|`apiserver.config.openshift.io`
41
+
|Provides API server configuration such as xref:../../security/certificates/api-server.adoc#api-server-certificates[certificates and certificate authorities].
42
42
43
-
|authentication.config.openshift.io
44
-
|Controls the xref:../../authentication/understanding-identity-provider.adoc#understanding-identity-provider[identity provider]and authentication configuration for the cluster.
43
+
|`authentication.config.openshift.io`
44
+
|Controls the xref:../../authentication/understanding-identity-provider.adoc#understanding-identity-provider[identity provider]and authentication configuration for the cluster.
45
45
46
-
|build.config.openshift.io
46
+
|`build.config.openshift.io`
47
47
|Controls default and enforced xref:../../builds/build-configuration.adoc#build-configuration[configuration] for all builds on the cluster.
48
48
49
-
|console.config.openshift.io
49
+
|`console.config.openshift.io`
50
50
|Configures the behavior of the web console interface, including the xref:../../web_console/configuring-web-console.adoc#configuring-web-console[logout behavior].
|Configures how specific xref:../../openshift_images/image-configuration.adoc#image-configuration[image registries] should be treated (allowed, disallowed, insecure, CA details).
58
58
59
-
|ingress.config.openshift.io
59
+
|`ingress.config.openshift.io`
60
60
|Configuration details related to xref:../../networking/ingress-operator.adoc#nw-installation-ingress-config-asset_configuring-ingress[routing] such as the default domain for routes.
61
61
62
-
|oauth.config.openshift.io
62
+
|`oauth.config.openshift.io`
63
63
|Configures identity providers and other behavior related to xref:../../authentication/configuring-internal-oauth.adoc#configuring-internal-oauth[internal OAuth server] flows.
64
64
65
-
|project.config.openshift.io
65
+
|`project.config.openshift.io`
66
66
|Configures xref:../../applications/projects/configuring-project-creation.adoc#configuring-project-creation[how projects are created] including the project template.
67
67
68
-
|proxy.config.openshift.io
68
+
|`proxy.config.openshift.io`
69
69
|Defines proxies to be used by components needing external network access. Note: not all components currently consume this value.
70
70
71
-
|scheduler.config.openshift.io
72
-
|Configures xref:../../nodes/scheduling/nodes-scheduler-default.adoc#nodes-scheduler-default[scheduler] behavior such as policies and default nodeselectors.
71
+
|`scheduler.config.openshift.io`
72
+
|Configures xref:../../nodes/scheduling/nodes-scheduler-default.adoc#nodes-scheduler-default[scheduler] behavior such as policies and default node selectors.
73
73
74
74
|===
75
75
76
76
[id="operator-configuration-resources_{context}"]
77
77
== Operator configuration resources
78
78
79
79
These configuration resources are cluster-scoped instances, named `cluster`, which control the behavior of a specific component as
80
-
owned by a particular operator.
80
+
owned by a particular Operator.
81
81
82
82
[cols="2a,8a",options="header"]
83
83
|===
84
84
|Resource name
85
85
|Description
86
86
87
-
|console.operator.openshift.io
87
+
|`console.operator.openshift.io`
88
88
|Controls console appearance such as branding customizations
89
89
90
-
|config.imageregistry.operator.openshift.io
90
+
|`config.imageregistry.operator.openshift.io`
91
91
|Configures xref:../../registry/configuring-registry-operator.adoc#registry-operator-configuration-resource-overview_configuring-registry-operator[internal image registry settings] such as public routing, log levels, proxy settings, resource constraints, replica counts, and storage type.
to control which example imagestreams and templates are installed on the cluster.
96
+
to control which example image streams and templates are installed on the cluster.
97
97
98
98
|===
99
99
@@ -113,14 +113,14 @@ documentation for details on how and when you can create additional resource ins
113
113
|Namespace
114
114
|Description
115
115
116
-
|alertmanager.monitoring.coreos.com
117
-
|main
118
-
|openshift-monitoring
116
+
|`alertmanager.monitoring.coreos.com`
117
+
|`main`
118
+
|`openshift-monitoring`
119
119
|Controls the xref:../../monitoring/managing-alerts.adoc#managing-alerts[Alertmanager] deployment parameters.
120
120
121
-
|ingresscontroller.operator.openshift.io
122
-
|default
123
-
|openshift-ingress-operator
121
+
|`ingresscontroller.operator.openshift.io`
122
+
|`default`
123
+
|`openshift-ingress-operator`
124
124
|Configures xref:../../networking/ingress-operator.adoc#configuring-ingress[Ingress Operator] behavior such as domain, number of replicas, certificates, and controller placement.
125
125
126
126
|===
@@ -135,23 +135,23 @@ You use these resources to retrieve information about the cluster. Do not edit t
135
135
|===
136
136
|Resource name|Instance name|Description
137
137
138
-
|clusterversion.config.openshift.io
139
-
|version
140
-
|In {product-title} {product-version}, you must not customize the ClusterVersion
138
+
|`clusterversion.config.openshift.io`
139
+
|`version`
140
+
|In {product-title} {product-version}, you must not customize the `ClusterVersion`
141
141
resource for production clusters. Instead, follow the process to
142
142
xref:../../updating/updating-cluster.adoc#updating-cluster[update a cluster].
143
143
144
-
|dns.config.openshift.io
145
-
|cluster
144
+
|`dns.config.openshift.io`
145
+
|`cluster`
146
146
|You cannot modify the DNS settings for your cluster. You can
147
147
xref:../../networking/dns-operator.adoc#dns-operator[view the DNS Operator status].
148
148
149
-
|infrastructure.config.openshift.io
150
-
|cluster
149
+
|`infrastructure.config.openshift.io`
150
+
|`cluster`
151
151
|Configuration details allowing the cluster to interact with its cloud provider.
152
152
153
-
|network.config.openshift.io
154
-
|cluster
153
+
|`network.config.openshift.io`
154
+
|`cluster`
155
155
|You cannot modify your cluster networking after installation. To customize your network, follow the process to
156
156
xref:../../installing/installing_aws/installing-aws-network-customizations.adoc#installing-aws-network-customizations[customize networking during installation].
Copy file name to clipboardExpand all lines: installing/installing-fips.adoc
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,16 +7,16 @@ toc::[]
7
7
8
8
Starting with version 4.3, you can install an {product-title} cluster that uses FIPS Validated / Modules in Process cryptographic libraries.
9
9
10
-
For the {op-system-first} machines in your cluster, this change is applied when the machines are deployed based on the status of an option in the `install-config.yaml` file, which governs the cluster options that a user can change during cluster deployment. With Red Hat Enterprise Linux machines, you must enable FIPS mode when you install the operating system on the machines that you plan to use as worker machines. These configuration methods ensure that your cluster meet the requirements of a FIPS compliance audit: only FIPS Validated / Modules in Process cryptography packages are enabled before the initial system boot.
10
+
For the {op-system-first} machines in your cluster, this change is applied when the machines are deployed based on the status of an option in the `install-config.yaml` file, which governs the cluster options that a user can change during cluster deployment. With {op-system-base-full} machines, you must enable FIPS mode when you install the operating system on the machines that you plan to use as worker machines. These configuration methods ensure that your cluster meet the requirements of a FIPS compliance audit: only FIPS Validated / Modules in Process cryptography packages are enabled before the initial system boot.
11
11
12
12
Because FIPS must be enabled before the operating system that your cluster uses boots for the first time, you cannot enable FIPS after you deploy a cluster.
{product-title} uses certain FIPS Validated / Modules in Process modules within Red Hat Enterprise Linux (RHEL) and {op-system} for the operating system components that it uses. See link:https://access.redhat.com/articles/3359851[RHEL7 core crypto components]. For example, when users SSH into {product-title} clusters and containers, those connections are properly encrypted.
17
+
{product-title} uses certain FIPS Validated / Modules in Process modules within {op-system-base} and {op-system} for the operating system components that it uses. See link:https://access.redhat.com/articles/3359851[RHEL7 core crypto components]. For example, when users SSH into {product-title} clusters and containers, those connections are properly encrypted.
18
18
19
-
{product-title} components are written in Go and built with Red Hat’s golang compiler. When you enable FIPS mode for your cluster, all {product-title} components that require cryptographic signing call RHEL and {op-system} cryptographic libraries.
19
+
{product-title} components are written in Go and built with Red Hat's golang compiler. When you enable FIPS mode for your cluster, all {product-title} components that require cryptographic signing call {op-system-base} and {op-system} cryptographic libraries.
20
20
21
21
.FIPS mode attributes and limitations in {product-title} {product-version}
22
22
[cols="8a,8a",options="header"]
@@ -25,13 +25,13 @@ Because FIPS must be enabled before the operating system that your cluster uses
25
25
|Attributes
26
26
|Limitations
27
27
28
-
|FIPS support in RHEL 7 operating systems.
28
+
|FIPS support in {op-system-base} 7 operating systems.
29
29
.3+|The FIPS implementation does not offer a single function that both computes hash functions and validates the keys that are based on that hash. This limitation will continue to be evaluated and improved in future {product-title} releases.
30
30
31
31
|FIPS support in CRI-O runtimes.
32
32
|FIPS support in {product-title} services.
33
33
34
-
|FIPS Validated / Modules in Process cryptographic module and algorithms that are obtained from RHEL 7 and {op-system} binaries and images.
34
+
|FIPS Validated / Modules in Process cryptographic module and algorithms that are obtained from {op-system-base} 7 and {op-system} binaries and images.
35
35
|
36
36
37
37
|Use of FIPS compatible golang compiler.
@@ -52,14 +52,14 @@ To ensure that the secrets that are stored in etcd use FIPS Validated / Modules
For local storage, use RHEL-provided disk encryption or Container Native Storage that uses RHEL-provided disk encryption. By storing all data in volumes that use RHEL-provided disk encryption and enabling FIPS mode for your cluster, both data at rest and data in motion, or network data, are protected by FIPS Validated / Modules in Process encryption.
55
+
For local storage, use {op-system-base}-provided disk encryption or Container Native Storage that uses {op-system-base}-provided disk encryption. By storing all data in volumes that use {op-system-base}-provided disk encryption and enabling FIPS mode for your cluster, both data at rest and data in motion, or network data, are protected by FIPS Validated / Modules in Process encryption.
56
56
You can configure your cluster to encrypt the root filesystem of each node, as described
57
57
in xref:../installing/install_config/installing-customizing.adoc#installing-customizing[Customizing nodes].
To ensure that containers know that they are running on a host that is using FIPS Validated / Modules in Process cryptography modules, use CRI-O to manage your runtimes. CRI-O supports FIPS-Mode, in that it configures the containers to know that they are running in FIPS mode.
62
+
To ensure that containers know that they are running on a host that is using FIPS Validated / Modules in Process cryptography modules, use CRI-O to manage your runtimes. CRI-O supports FIPS mode, in that it configures the containers to know that they are running in FIPS mode.
63
63
64
64
[id="installing-fips-mode_{context}"]
65
65
== Installing a cluster in FIPS mode
@@ -75,4 +75,4 @@ To install a cluster in FIPS mode, follow the instructions to install a customiz
75
75
76
76
To apply `AES CBC` encryption to your etcd data store, follow the xref:../security/encrypting-etcd.adoc#encrypting-etcd[Encrypting etcd data] process after you install your cluster.
77
77
78
-
If you add RHEL nodes to your cluster, ensure that you enable FIPS mode on the machines before their initial boot. See xref:../machine_management/user_infra/adding-rhel-compute.adoc#adding-rhel-compute[Adding RHEL compute machines to an {product-title} cluster] and link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-federal_standards_and_regulations#sec-Enabling-FIPS-Mode[Enabling FIPS Mode] in the RHEL 7 documentation.
78
+
If you add {op-system-base} nodes to your cluster, ensure that you enable FIPS mode on the machines before their initial boot. See xref:../machine_management/user_infra/adding-rhel-compute.adoc#adding-rhel-compute[Adding RHEL compute machines to an {product-title} cluster] and link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-federal_standards_and_regulations#sec-Enabling-FIPS-Mode[Enabling FIPS Mode] in the {op-system-base} 7 documentation.
For more information on using a Network Load Balancer(NLB) on AWS, see xref:../../networking/configuring_ingress_cluster_traffic/configuring-ingress-cluster-traffic-aws-network-load-balancer.adoc#configuring-ingress-cluster-traffic-aws-network-load-balancer[Configuring Ingress cluster traffic on AWS using a Network Load Balancer].
69
+
For more information on using a Network Load Balancer(NLB) on AWS, see xref:../../networking/configuring_ingress_cluster_traffic/configuring-ingress-cluster-traffic-aws-network-load-balancer.adoc#configuring-ingress-cluster-traffic-aws-network-load-balancer[Configuring Ingress cluster traffic on AWS using a Network Load Balancer].
Prior to troubleshooting the installation environment, it is critical to understand the overall flow of the installer-provisioned installation on bare metal. The diagrams below provide a troubleshooting flow with a step-by-step breakdown for the environment.
0 commit comments