|
| 1 | +[id="installing-restricted-networks-gcp-installer-provisioned"] |
| 2 | += Installing a cluster on GCP in a restricted network |
| 3 | +include::modules/common-attributes.adoc[] |
| 4 | +:context: installing-restricted-networks-gcp-installer-provisioned |
| 5 | + |
| 6 | +toc::[] |
| 7 | + |
| 8 | +In {product-title} {product-version}, you can install a cluster on Google Cloud Platform (GCP) in a restricted network by creating an internal mirror of the installation release content on an existing Google Virtual Private Cloud (VPC). |
| 9 | + |
| 10 | +[IMPORTANT] |
| 11 | +==== |
| 12 | +You can install an {product-title} cluster by using mirrored installation release content, but your cluster will require internet access to use the GCP APIs. |
| 13 | +==== |
| 14 | + |
| 15 | +[id="prerequisites_installing-restricted-networks-gcp-installer-provisioned"] |
| 16 | +== Prerequisites |
| 17 | + |
| 18 | +* You xref:../../installing/install_config/installing-restricted-networks-preparations.adoc#installing-restricted-networks-preparations[created a mirror registry on your bastion host] and obtained the `imageContentSources` data for your version of {product-title}. |
| 19 | ++ |
| 20 | +[IMPORTANT] |
| 21 | +==== |
| 22 | +Because the installation media is on the bastion host, use that computer to complete all installation steps. |
| 23 | +==== |
| 24 | +* You have an existing VPC in GCP. While installing a cluster in a restricted network that uses installer-provisioned infrastructure, you cannot use the installer-provisioned VPC. You must use a user-provisioned VPC that satisfies one of the following requirements: |
| 25 | +** Contains the mirror registry |
| 26 | +** Has firewall rules or a peering connection to access the mirror registry hosted elsewhere |
| 27 | +* You reviewed details about the xref:../../architecture/architecture-installation.adoc#architecture-installation[{product-title} installation and update] processes. |
| 28 | +* If you use a firewall, you must xref:../../installing/install_config/configuring-firewall.adoc#configuring-firewall[configure it to allow the sites] that your cluster requires access to. While you might need to grant access to more sites, you must grant access to `*.googleapis.com` and `accounts.google.com`. |
| 29 | +* If you do not allow the system to manage identity and access management (IAM), then a cluster administrator can xref:../../installing/installing_gcp/manually-creating-iam-gcp.adoc#manually-creating-iam-gcp[manually create and maintain IAM credentials]. Manual mode can also be used in environments where the cloud IAM APIs are not reachable. |
| 30 | + |
| 31 | +include::modules/installation-about-restricted-network.adoc[leveloffset=+1] |
| 32 | + |
| 33 | +include::modules/cluster-entitlements.adoc[leveloffset=+1] |
| 34 | + |
| 35 | +.Additional resources |
| 36 | + |
| 37 | +* See xref:../../support/remote_health_monitoring/about-remote-health-monitoring.adoc#about-remote-health-monitoring[About remote health monitoring] for more information about the Telemetry service |
| 38 | + |
| 39 | +include::modules/ssh-agent-using.adoc[leveloffset=+1] |
| 40 | + |
| 41 | +include::modules/installation-initializing.adoc[leveloffset=+1] |
| 42 | + |
| 43 | +include::modules/installation-configuration-parameters.adoc[leveloffset=+2] |
| 44 | + |
| 45 | +include::modules/installation-gcp-config-yaml.adoc[leveloffset=+2] |
| 46 | + |
| 47 | +include::modules/installation-configure-proxy.adoc[leveloffset=+2] |
| 48 | + |
| 49 | +include::modules/installation-launching-installer.adoc[leveloffset=+1] |
| 50 | + |
| 51 | +include::modules/cli-installing-cli.adoc[leveloffset=+1] |
| 52 | + |
| 53 | +include::modules/cli-logging-in-kubeadmin.adoc[leveloffset=+1] |
| 54 | + |
| 55 | +[id="next-steps_installing-restricted-networks-gcp-installer-provisioned"] |
| 56 | +== Next steps |
| 57 | + |
| 58 | +* xref:../../installing/validating-an-installation.adoc#validating-an-installation[Validate an installation]. |
| 59 | +* xref:../../post_installation_configuration/cluster-tasks.adoc#available_cluster_customizations[Customize your cluster]. |
| 60 | +* Learn how to xref:../../operators/admin/olm-restricted-networks.adoc#olm-understanding-operator-catalog-images_olm-restricted-networks[use Operator Lifecycle Manager (OLM) on restricted networks]. |
| 61 | +* If the mirror registry that you used to install your cluster has a trusted CA, add it to the cluster by xref:../../openshift_images/image-configuration.adoc#images-configuration-cas_image-configuration[configuring additional trust stores]. |
| 62 | +* If necessary, you can xref:../../support/remote_health_monitoring/opting-out-of-remote-health-reporting.adoc#opting-out-remote-health-reporting_opting-out-remote-health-reporting[opt out of remote health reporting]. |
0 commit comments