Skip to content

Commit de472b2

Browse files
authored
Merge pull request #60348 from mjpytlak/osdocs-5975
OSDOCS#5975: Custom RHCOS image for control plane and compute machines
2 parents 9d384f4 + fa8b7c3 commit de472b2

File tree

3 files changed

+99
-71
lines changed

3 files changed

+99
-71
lines changed

modules/installation-configuration-parameters.adoc

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1383,6 +1383,22 @@ Additional GCP configuration parameters are described in the following table:
13831383
|====
13841384
|Parameter|Description|Values
13851385

1386+
|`controlPlane.platform.gcp.osImage.project`
1387+
|Optional. By default, the installation program downloads and installs the {op-system-first} image that is used to boot control plane machines. You can override the default behavior by specifying the location of a custom {op-system} image that the installation program is to use for control plane machines only.
1388+
|String. The name of GCP project where the image is located.
1389+
1390+
|`controlPlane.platform.gcp.osImage.name`
1391+
|The name of the custom {op-system} image that the installation program is to use to boot control plane machines. If you use `controlPlane.platform.gcp.osImage.project`, this field is required.
1392+
|String. The name of the {op-system} image.
1393+
1394+
|`compute.platform.gcp.osImage.project`
1395+
|Optional. By default, the installation program downloads and installs the {op-system} image that is used to boot compute machines. You can override the default behavior by specifying the location of a custom {op-system} image that the installation program is to use for compute machines only.
1396+
|String. The name of GCP project where the image is located.
1397+
1398+
|`compute.platform.gcp.osImage.name`
1399+
|The name of the custom {op-system} image that the installation program is to use to boot compute machines. If you use `compute.platform.gcp.osImage.project`, this field is required.
1400+
|String. The name of the {op-system} image.
1401+
13861402
|`platform.gcp.network`
13871403
|The name of the existing Virtual Private Cloud (VPC) where you want to deploy your cluster. If you want to deploy your cluster into a shared VPC, you must set `platform.gcp.networkProjectID` with the name of the GCP project that contains the shared VPC.
13881404
|String.
@@ -1428,6 +1444,14 @@ link:https://yaml.org/spec/1.2/spec.html#sequence//[YAML sequence].
14281444
|The link:https://cloud.google.com/compute/docs/disks#disk-types[GCP disk type].
14291445
|Either the default `pd-ssd` or the `pd-standard` disk type. The control plane nodes must be the `pd-ssd` disk type. Compute nodes can be either type.
14301446

1447+
|`platform.gcp.defaultMachinePlatform.osImage.project`
1448+
|Optional. By default, the installation program downloads and installs the {op-system} image that is used to boot control plane and compute machines. You can override the default behavior by specifying the location of a custom {op-system} image that the installation program is to use for both types of machines.
1449+
|String. The name of GCP project where the image is located.
1450+
1451+
|`platform.gcp.defaultMachinePlatform.osImage.name`
1452+
|The name of the custom {op-system} image that the installation program is to use to boot control plane and compute machines. If you use `platform.gcp.defaultMachinePlatform.osImage.project`, this field is required.
1453+
|String. The name of the RHCOS image.
1454+
14311455
|`platform.gcp.defaultMachinePlatform.tags`
14321456
|Optional. Additional network tags to add to the control plane and compute machines.
14331457
|One or more strings, for example `network-tag1`.

modules/installation-gcp-config-yaml.adoc

Lines changed: 50 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,9 @@ controlPlane: <2> <3>
5858
tags: <6>
5959
- control-plane-tag1
6060
- control-plane-tag2
61+
osImage: <7>
62+
project: example-project-name
63+
name: example-image-name
6164
replicas: 3
6265
compute: <2> <3>
6366
- hyperthreading: Enabled <4>
@@ -80,6 +83,9 @@ compute: <2> <3>
8083
tags: <6>
8184
- compute-tag1
8285
- compute-tag2
86+
osImage: <7>
87+
project: example-project-name
88+
name: example-image-name
8389
replicas: 3
8490
metadata:
8591
name: test-cluster <1>
@@ -94,7 +100,7 @@ endif::[]
94100
hostPrefix: 23
95101
machineNetwork:
96102
- cidr: 10.0.0.0/16
97-
networkType: OVNKubernetes <7>
103+
networkType: OVNKubernetes <8>
98104
serviceNetwork:
99105
- 172.30.0.0/16
100106
platform:
@@ -105,59 +111,62 @@ platform:
105111
tags: <6>
106112
- global-tag1
107113
- global-tag2
114+
osImage: <7>
115+
project: example-project-name
116+
name: example-image-name
108117
ifdef::vpc,restricted[]
109-
network: existing_vpc <8>
110-
controlPlaneSubnet: control_plane_subnet <9>
111-
computeSubnet: compute_subnet <10>
118+
network: existing_vpc <9>
119+
controlPlaneSubnet: control_plane_subnet <10>
120+
computeSubnet: compute_subnet <11>
112121
endif::vpc,restricted[]
113122
ifndef::restricted[]
114123
pullSecret: '{"auths": ...}' <1>
115124
endif::restricted[]
116125
ifdef::restricted[]
117-
pullSecret: '{"auths":{"<local_registry>": {"auth": "<credentials>","email": "[email protected]"}}}' <11>
126+
pullSecret: '{"auths":{"<local_registry>": {"auth": "<credentials>","email": "[email protected]"}}}' <12>
118127
endif::restricted[]
119128
ifndef::vpc,restricted[]
120129
ifndef::openshift-origin[]
121-
fips: false <8>
122-
sshKey: ssh-ed25519 AAAA... <9>
130+
fips: false <9>
131+
sshKey: ssh-ed25519 AAAA... <10>
123132
endif::openshift-origin[]
124133
ifdef::openshift-origin[]
125-
sshKey: ssh-ed25519 AAAA... <8>
134+
sshKey: ssh-ed25519 AAAA... <9>
126135
endif::openshift-origin[]
127136
endif::vpc,restricted[]
128137
ifdef::vpc[]
129138
ifndef::openshift-origin[]
130-
fips: false <11>
131-
sshKey: ssh-ed25519 AAAA... <12>
139+
fips: false <12>
140+
sshKey: ssh-ed25519 AAAA... <13>
132141
endif::openshift-origin[]
133142
ifdef::openshift-origin[]
134-
sshKey: ssh-ed25519 AAAA... <11>
143+
sshKey: ssh-ed25519 AAAA... <12>
135144
endif::openshift-origin[]
136145
endif::vpc[]
137146
ifdef::restricted[]
138147
ifndef::openshift-origin[]
139-
fips: false <12>
140-
sshKey: ssh-ed25519 AAAA... <13>
148+
fips: false <13>
149+
sshKey: ssh-ed25519 AAAA... <14>
141150
endif::openshift-origin[]
142151
ifdef::openshift-origin[]
143-
sshKey: ssh-ed25519 AAAA... <12>
152+
sshKey: ssh-ed25519 AAAA... <13>
144153
endif::openshift-origin[]
145154
endif::restricted[]
146155
ifdef::private[]
147156
ifndef::openshift-origin[]
148-
publish: Internal <13>
157+
publish: Internal <14>
149158
endif::openshift-origin[]
150159
ifdef::openshift-origin[]
151-
publish: Internal <12>
160+
publish: Internal <13>
152161
endif::openshift-origin[]
153162
endif::private[]
154163
ifdef::restricted[]
155164
ifndef::openshift-origin[]
156-
additionalTrustBundle: | <14>
165+
additionalTrustBundle: | <15>
157166
-----BEGIN CERTIFICATE-----
158167
<MY_TRUSTED_CA_CERT>
159168
-----END CERTIFICATE-----
160-
imageContentSources: <15>
169+
imageContentSources: <16>
161170
- mirrors:
162171
- <local_registry>/<local_repository_name>/release
163172
source: quay.io/openshift-release-dev/ocp-release
@@ -166,11 +175,11 @@ imageContentSources: <15>
166175
source: quay.io/openshift-release-dev/ocp-v4.0-art-dev
167176
endif::openshift-origin[]
168177
ifdef::openshift-origin[]
169-
additionalTrustBundle: | <13>
178+
additionalTrustBundle: | <14>
170179
-----BEGIN CERTIFICATE-----
171180
<MY_TRUSTED_CA_CERT>
172181
-----END CERTIFICATE-----
173-
imageContentSources: <14>
182+
imageContentSources: <15>
174183
- mirrors:
175184
- <local_registry>/<local_repository_name>/release
176185
source: quay.io/openshift-release-dev/ocp-release
@@ -191,55 +200,56 @@ If you disable simultaneous multithreading, ensure that your capacity planning a
191200
====
192201
<5> Optional: The custom encryption key section to encrypt both virtual machines and persistent volumes. Your default compute service account must have the permissions granted to use your KMS key and have the correct IAM role assigned. The default service account name follows the `service-<project_number>@compute-system.iam.gserviceaccount.com` pattern. For more information about granting the correct permissions for your service account, see "Machine management" -> "Creating compute machine sets" -> "Creating a compute machine set on GCP".
193202
<6> Optional: A set of network tags to apply to the control plane or compute machine sets. The `platform.gcp.defaultMachinePlatform.tags` parameter will apply to both control plane and compute machines. If the `compute.platform.gcp.tags` or `controlPlane.platform.gcp.tags` parameters are set, they override the `platform.gcp.defaultMachinePlatform.tags` parameter.
194-
<7> The cluster network plugin to install. The supported values are `OVNKubernetes` and `OpenShiftSDN`. The default value is `OVNKubernetes`.
203+
<7> Optional: A custom {op-system-first} that should be used to boot control plane and compute machines. The `project` and `name` parameters under `platform.gcp.defaultMachinePlatform.osImage` apply to both control plane and compute machines. If the `project` and `name` parameters under `controlPlane.platform.gcp.osImage` or `compute.platform.gcp.osImage` are set, they override the `platform.gcp.defaultMachinePlatform.osImage` parameters.
204+
<8> The cluster network plugin to install. The supported values are `OVNKubernetes` and `OpenShiftSDN`. The default value is `OVNKubernetes`.
195205
ifdef::vpc,restricted[]
196-
<8> Specify the name of an existing VPC.
197-
<9> Specify the name of the existing subnet to deploy the control plane machines to. The subnet must belong to the VPC that you specified.
198-
<10> Specify the name of the existing subnet to deploy the compute machines to. The subnet must belong to the VPC that you specified.
206+
<9> Specify the name of an existing VPC.
207+
<10> Specify the name of the existing subnet to deploy the control plane machines to. The subnet must belong to the VPC that you specified.
208+
<11> Specify the name of the existing subnet to deploy the compute machines to. The subnet must belong to the VPC that you specified.
199209
endif::vpc,restricted[]
200210
ifdef::restricted[]
201-
<11> For `<local_registry>`, specify the registry domain name, and optionally the port, that your mirror registry uses to serve content. For example, `registry.example.com` or `registry.example.com:5000`. For `<credentials>`, specify the base64-encoded user name and password for your mirror registry.
211+
<12> For `<local_registry>`, specify the registry domain name, and optionally the port, that your mirror registry uses to serve content. For example, `registry.example.com` or `registry.example.com:5000`. For `<credentials>`, specify the base64-encoded user name and password for your mirror registry.
202212
endif::restricted[]
203213
ifdef::vpc[]
204214
ifndef::openshift-origin[]
205-
<11> Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
215+
<12> Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
206216
+
207217
[IMPORTANT]
208218
====
209219
The use of FIPS Validated / Modules in Process cryptographic libraries is only supported on {product-title} deployments on the `x86_64` architecture.
210220
====
211-
<12> You can optionally provide the `sshKey` value that you use to access the machines in your cluster.
221+
<13> You can optionally provide the `sshKey` value that you use to access the machines in your cluster.
212222
endif::openshift-origin[]
213223
ifdef::openshift-origin[]
214-
<11> You can optionally provide the `sshKey` value that you use to access the machines in your cluster.
224+
<12> You can optionally provide the `sshKey` value that you use to access the machines in your cluster.
215225
endif::openshift-origin[]
216226
endif::vpc[]
217227
ifdef::restricted[]
218228
ifndef::openshift-origin[]
219-
<12> Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
229+
<13> Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
220230
+
221231
[IMPORTANT]
222232
====
223233
The use of FIPS Validated / Modules in Process cryptographic libraries is only supported on {product-title} deployments on the `x86_64` architecture.
224234
====
225-
<13> You can optionally provide the `sshKey` value that you use to access the machines in your cluster.
235+
<14> You can optionally provide the `sshKey` value that you use to access the machines in your cluster.
226236
endif::openshift-origin[]
227237
ifdef::openshift-origin[]
228-
<12> You can optionally provide the `sshKey` value that you use to access the machines in your cluster.
238+
<13> You can optionally provide the `sshKey` value that you use to access the machines in your cluster.
229239
endif::openshift-origin[]
230240
endif::restricted[]
231241
ifndef::vpc,restricted[]
232242
ifndef::openshift-origin[]
233-
<8> Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
243+
<9> Whether to enable or disable FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
234244
+
235245
[IMPORTANT]
236246
====
237247
The use of FIPS Validated / Modules in Process cryptographic libraries is only supported on {product-title} deployments on the `x86_64` architecture.
238248
====
239-
<9> You can optionally provide the `sshKey` value that you use to access the machines in your cluster.
249+
<10> You can optionally provide the `sshKey` value that you use to access the machines in your cluster.
240250
endif::openshift-origin[]
241251
ifdef::openshift-origin[]
242-
<8> You can optionally provide the `sshKey` value that you use to access the machines in your cluster.
252+
<9> You can optionally provide the `sshKey` value that you use to access the machines in your cluster.
243253
endif::openshift-origin[]
244254
endif::vpc,restricted[]
245255
+
@@ -249,20 +259,20 @@ For production {product-title} clusters on which you want to perform installatio
249259
====
250260
ifdef::private[]
251261
ifndef::openshift-origin[]
252-
<13> How to publish the user-facing endpoints of your cluster. Set `publish` to `Internal` to deploy a private cluster, which cannot be accessed from the internet. The default value is `External`.
262+
<14> How to publish the user-facing endpoints of your cluster. Set `publish` to `Internal` to deploy a private cluster, which cannot be accessed from the internet. The default value is `External`.
253263
endif::openshift-origin[]
254264
ifdef::openshift-origin[]
255-
<12> How to publish the user-facing endpoints of your cluster. Set `publish` to `Internal` to deploy a private cluster, which cannot be accessed from the internet. The default value is `External`.
265+
<13> How to publish the user-facing endpoints of your cluster. Set `publish` to `Internal` to deploy a private cluster, which cannot be accessed from the internet. The default value is `External`.
256266
endif::openshift-origin[]
257267
endif::private[]
258268
ifdef::restricted[]
259269
ifndef::openshift-origin[]
260-
<14> Provide the contents of the certificate file that you used for your mirror registry.
261-
<15> Provide the `imageContentSources` section from the output of the command to mirror the repository.
270+
<15> Provide the contents of the certificate file that you used for your mirror registry.
271+
<16> Provide the `imageContentSources` section from the output of the command to mirror the repository.
262272
endif::openshift-origin[]
263273
ifdef::openshift-origin[]
264-
<13> Provide the contents of the certificate file that you used for your mirror registry.
265-
<14> Provide the `imageContentSources` section from the output of the command to mirror the repository.
274+
<14> Provide the contents of the certificate file that you used for your mirror registry.
275+
<15> Provide the `imageContentSources` section from the output of the command to mirror the repository.
266276
endif::openshift-origin[]
267277
endif::restricted[]
268278

modules/installation-gcp-marketplace.adoc

Lines changed: 25 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -4,45 +4,39 @@
44

55
:_content-type: PROCEDURE
66
[id="installation-gcp-marketplace_{context}"]
7-
= Using a GCP Marketplace image
8-
If you want to deploy an {product-title} cluster using a GCP Marketplace image, you must create the manifests and edit the compute machine set definitions to specify the GCP Marketplace image.
7+
= Using the GCP Marketplace offering
98

10-
.Prerequisites
11-
12-
* You have the {product-title} installation program and the pull secret for your cluster.
9+
Using the GCP Marketplace offering lets you deploy an {product-title} cluster, which is billed on pay-per-use basis (hourly, per core) through GCP, while still being supported directly by Red{nbsp}Hat.
1310

14-
.Procedure
11+
By default, the installation program downloads and installs the {op-system-first} image that is used to deploy compute machines. To deploy an {product-title} cluster using an {op-system} image from the GCP Marketplace, override the default behavior by modifying the `install-config.yaml` file to reference the location of GCP Marketplace offer.
1512

16-
. Generate the installation manifests by running the following command:
17-
+
18-
[source,terminal]
19-
----
20-
$ openshift-install create manifests --dir <installation_dir>
21-
----
13+
.Prerequisites
2214

23-
. Locate the following files:
15+
* You have an existing `install-config.yaml` file.
2416
25-
** `<installation_dir>/openshift/99_openshift-cluster-api_worker-machineset-0.yaml`
26-
** `<installation_dir>/openshift/99_openshift-cluster-api_worker-machineset-1.yaml`
27-
** `<installation_dir>/openshift/99_openshift-cluster-api_worker-machineset-2.yaml`
17+
.Procedure
2818

29-
. In each file, edit the `.spec.template.spec.providerSpec.value.disks[0].image` property to reference the offer to use:
19+
. Edit the `compute.platform.gcp.osImage` parameters to specify the location of the GCP Marketplace image:
20+
** Set the `project` parameter to `redhat-marketplace-public`
21+
** Set the `name` parameter to one of the following offers:
3022
+
31-
{product-title}:: `projects/redhat-marketplace-public/global/images/redhat-coreos-ocp-413-x86-64-202305021736`
32-
{opp}:: `projects/redhat-marketplace-public/global/images/redhat-coreos-opp-413-x86-64-202305021736`
33-
{oke}:: `projects/redhat-marketplace-public/global/images/redhat-coreos-oke-413-x86-64-202305021736`
23+
{product-title}:: `redhat-coreos-ocp-413-x86-64-202305021736`
24+
{opp}:: `redhat-coreos-opp-413-x86-64-202305021736``
25+
{oke}:: `redhat-coreos-oke-413-x86-64-202305021736`
26+
. Save the file and reference it when deploying the cluster.
3427

35-
.Example compute machine set with the GCP Marketplace image
28+
.Sample `install-config.yaml` file that specifies a GCP Marketplace image for compute machines
3629
[source,yaml]
3730
----
38-
deletionProtection: false
39-
disks:
40-
- autoDelete: true
41-
boot: true
42-
image: projects/redhat-marketplace-public/global/images/redhat-coreos-ocp-48-x86-64-202210040145
43-
labels: null
44-
sizeGb: 128
45-
type: pd-ssd
46-
kind: GCPMachineProviderSpec
47-
machineType: n2-standard-4
31+
apiVersion: v1
32+
baseDomain: example.com
33+
controlPlane:
34+
# ...
35+
compute:
36+
platform:
37+
gcp:
38+
osImage:
39+
project: redhat-marketplace-public
40+
name: redhat-coreos-ocp-413-x86-64-202305021736
41+
# ...
4842
----

0 commit comments

Comments
 (0)