You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: machine_management/creating_machinesets/creating-machineset-aws.adoc
+17-3Lines changed: 17 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,18 +8,32 @@ toc::[]
8
8
9
9
You can create a different machine set to serve a specific purpose in your {product-title} cluster on Amazon Web Services (AWS). For example, you might create infrastructure machine sets and related machines so that you can move supporting workloads to the new machines.
<6> To configure faster storage for etcd, especially for larger clusters, set the
305
310
storage type as `io1` and set `iops` to `2000`.
311
+
<7> Whether to require the link:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html[Amazon EC2 Instance Metadata Service v2] (IMDSv2). To require IMDSv2, set the parameter value to `Required`. To allow the use of both IMDSv1 and IMDSv2, set the parameter value to `Optional`. If no value is specified, both IMDSv1 and IMDSv2 are allowed.
312
+
+
313
+
[NOTE]
314
+
====
315
+
The IMDS configuration for control plane machines that is set during cluster installation can only be changed by using the AWS CLI. The IMDS configuration for compute machines can be changed by using machine sets.
316
+
====
306
317
ifdef::vpc,restricted[]
307
-
<7> If you provide your own VPC, specify subnets for each availability zone that your cluster uses.
308
-
<8> The ID of the AMI used to boot machines for the cluster. If set, the AMI
318
+
<8> If you provide your own VPC, specify subnets for each availability zone that your cluster uses.
319
+
<9> The ID of the AMI used to boot machines for the cluster. If set, the AMI
309
320
must belong to the same region as the cluster.
310
-
<9> The AWS service endpoints. Custom endpoints are required when installing to
321
+
<10> The AWS service endpoints. Custom endpoints are required when installing to
311
322
an unknown AWS region. The endpoint URL must use the `https` protocol and the
312
323
host must trust the certificate.
313
-
<10> The ID of your existing Route 53 private hosted zone. Providing an existing hosted zone requires that you supply your own VPC and the hosted zone is already associated with the VPC prior to installing your cluster. If undefined, the installation program creates a new hosted zone.
324
+
<11> The ID of your existing Route 53 private hosted zone. Providing an existing hosted zone requires that you supply your own VPC and the hosted zone is already associated with the VPC prior to installing your cluster. If undefined, the installation program creates a new hosted zone.
314
325
ifndef::openshift-origin[]
315
-
<11> Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
326
+
<12> Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
316
327
+
317
328
[IMPORTANT]
318
329
====
319
330
The use of FIPS Validated / Modules in Process cryptographic libraries is only supported on {product-title} deployments on the `x86_64` architecture.
320
331
====
321
-
<12> You can optionally provide the `sshKey` value that you use to access the
332
+
<13> You can optionally provide the `sshKey` value that you use to access the
322
333
machines in your cluster.
323
334
endif::openshift-origin[]
324
335
ifdef::openshift-origin[]
325
-
<11> You can optionally provide the `sshKey` value that you use to access the
336
+
<12> You can optionally provide the `sshKey` value that you use to access the
326
337
machines in your cluster.
327
338
endif::openshift-origin[]
328
339
endif::vpc,restricted[]
329
340
ifndef::vpc,restricted[]
330
-
<7> The ID of the AMI used to boot machines for the cluster. If set, the AMI
341
+
<8> The ID of the AMI used to boot machines for the cluster. If set, the AMI
331
342
must belong to the same region as the cluster.
332
-
<8> The AWS service endpoints. Custom endpoints are required when installing to
343
+
<9> The AWS service endpoints. Custom endpoints are required when installing to
333
344
an unknown AWS region. The endpoint URL must use the `https` protocol and the
334
345
host must trust the certificate.
335
346
ifndef::openshift-origin[]
336
-
<9> Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
347
+
<10> Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
337
348
+
338
349
[IMPORTANT]
339
350
====
340
351
The use of FIPS Validated / Modules in Process cryptographic libraries is only supported on {product-title} deployments on the `x86_64` architecture.
341
352
====
342
-
<10> You can optionally provide the `sshKey` value that you use to access the
353
+
<11> You can optionally provide the `sshKey` value that you use to access the
343
354
machines in your cluster.
344
355
endif::openshift-origin[]
345
356
ifdef::openshift-origin[]
346
-
<9> You can optionally provide the `sshKey` value that you use to access the
357
+
<10> You can optionally provide the `sshKey` value that you use to access the
347
358
machines in your cluster.
348
359
endif::openshift-origin[]
349
360
endif::vpc,restricted[]
@@ -354,36 +365,36 @@ For production {product-title} clusters on which you want to perform installatio
354
365
====
355
366
ifdef::private[]
356
367
ifndef::openshift-origin[]
357
-
<13> How to publish the user-facing endpoints of your cluster. Set `publish` to `Internal` to deploy a private cluster, which cannot be accessed from the internet. The default value is `External`.
368
+
<14> How to publish the user-facing endpoints of your cluster. Set `publish` to `Internal` to deploy a private cluster, which cannot be accessed from the internet. The default value is `External`.
358
369
endif::openshift-origin[]
359
370
ifdef::openshift-origin[]
360
-
<12> How to publish the user-facing endpoints of your cluster. Set `publish` to `Internal` to deploy a private cluster, which cannot be accessed from the internet. The default value is `External`.
371
+
<13> How to publish the user-facing endpoints of your cluster. Set `publish` to `Internal` to deploy a private cluster, which cannot be accessed from the internet. The default value is `External`.
361
372
endif::openshift-origin[]
362
373
endif::private[]
363
374
ifdef::secret[]
364
375
ifndef::openshift-origin[]
365
-
<14> The custom CA certificate. This is required when deploying to the AWS C2S Top Secret Region because the AWS API requires a custom CA trust bundle.
376
+
<15> The custom CA certificate. This is required when deploying to the AWS C2S Top Secret Region because the AWS API requires a custom CA trust bundle.
366
377
endif::openshift-origin[]
367
378
ifdef::openshift-origin[]
368
-
<13> The custom CA certificate. This is required when deploying to the AWS C2S Top Secret Region because the AWS API requires a custom CA trust bundle.
379
+
<14> The custom CA certificate. This is required when deploying to the AWS C2S Top Secret Region because the AWS API requires a custom CA trust bundle.
369
380
endif::openshift-origin[]
370
381
endif::secret[]
371
382
ifdef::restricted[]
372
383
ifndef::openshift-origin[]
373
-
<13> For `<local_registry>`, specify the registry domain name, and optionally the
384
+
<14> For `<local_registry>`, specify the registry domain name, and optionally the
374
385
port, that your mirror registry uses to serve content. For example
375
386
`registry.example.com` or `registry.example.com:5000`. For `<credentials>`,
376
387
specify the base64-encoded user name and password for your mirror registry.
377
-
<14> Provide the contents of the certificate file that you used for your mirror registry.
378
-
<15> Provide the `imageContentSources` section from the output of the command to mirror the repository.
388
+
<15> Provide the contents of the certificate file that you used for your mirror registry.
389
+
<16> Provide the `imageContentSources` section from the output of the command to mirror the repository.
379
390
endif::openshift-origin[]
380
391
ifdef::openshift-origin[]
381
-
<12> For `<local_registry>`, specify the registry domain name, and optionally the
392
+
<13> For `<local_registry>`, specify the registry domain name, and optionally the
382
393
port, that your mirror registry uses to serve content. For example
383
394
`registry.example.com` or `registry.example.com:5000`. For `<credentials>`,
384
395
specify the base64-encoded user name and password for your mirror registry.
385
-
<13> Provide the contents of the certificate file that you used for your mirror registry.
386
-
<14> Provide the `imageContentSources` section from the output of the command to mirror the repository.
396
+
<14> Provide the contents of the certificate file that you used for your mirror registry.
397
+
<15> Provide the `imageContentSources` section from the output of the command to mirror the repository.
You can specify whether to require the use of IMDSv2 by adding or editing the value of `metadataServiceOptions.authentication` in the machine set YAML file for your compute machines.
10
+
11
+
.Procedure
12
+
* Add or edit the following lines under the `providerSpec` field:
13
+
+
14
+
[source,yaml]
15
+
----
16
+
providerSpec:
17
+
value:
18
+
metadataServiceOptions:
19
+
authentication: Required <1>
20
+
----
21
+
<1> To require IMDSv2, set the parameter value to `Required`. To allow the use of both IMDSv1 and IMDSv2, set the parameter value to `Optional`. If no value is specified, both IMDSv1 and IMDSv2 are allowed.
= Machine set options for the Amazon EC2 Instance Metadata Service
8
+
9
+
You can use machine sets to create compute machines that use a specific version of the Amazon EC2 Instance Metadata Service (IMDS). Machine sets can create compute machines that allow the use of both IMDSv1 and link:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html[IMDSv2] or compute machines that require the use of IMDSv2.
10
+
11
+
To change the IMDS configuration for existing compute machines, edit the machine set YAML file that manages those machines. To deploy new compute machines with your preferred IMDS configuration, create a machine set YAML file with the appropriate values.
12
+
13
+
The IMDS configuration for control plane machines is set during cluster installation. To change the control plane machine IMDS configuration, you must use the AWS CLI. For more information, see the AWS documentation about how to link:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html#configuring-IMDS-existing-instances[Modify instance metadata options for existing instances].
14
+
15
+
[IMPORTANT]
16
+
====
17
+
Before configuring a machine set to create compute machines that require IMDSv2, ensure that any workloads that interact with the AWS metadata service support IMDSv2.
0 commit comments