github.com/openshift/installer@v1.4.17/docs/user/ovirt/install_ipi.md (about) 1  2 3 **Table of Contents** 4 5 - [Install using oVirt platform provider](#install-using-ovirt-platform-provider) 6 * [Overview](#overview) 7 * [Prerequisite](#prerequisite) 8 * [Minimum resources](#minimum-resources) 9 * [Install](#install) 10 + [Minimum permission for installation](#minimum-permission-for-installation) 11 + [ovirt-config.yaml](#ovirt-configyaml) 12 + [ovirt-credentials](#ovirt-credentials) 13 + [Bootstrap VM](#bootstrap-vm) 14 + [Install using the wizard](#install-using-the-wizard) 15 + [Install in stages when customization is needed](#install-in-stages-when-customization-is-needed) 16 17 # Install using oVirt platform provider 18 19 ## Overview 20 21 This provider enables the OpenShift Installer to provision VM resources in an 22 oVirt data center, that will be used as worker and masters of the clusters. It 23 will also create the bootstrap machine, and the configuration needed to get 24 the initial cluster running by supplying DNS a service and load balancing, all 25 using static pods. 26 This work is related to the Bare-Metal provider because oVirt does not supply 27 DNS and LB services but is a platform provider. See also [Bare Metal IPI Networking Infrastructure] 28 29 30 ## Prerequisite 31 32 1. oVirt/RHV version 4.3.9.4 or later. 33 2. Allocate 2 IP on the VM network: 34 - IP for the internal kubernetes api, that all components will interact with 35 - IP for the Ingress, the load balancer in front of the cluster apps 36 To work with this provider one must supply 2 IPs excluded from the MAC range 37 in the virtualization env, where the cluster will run. Those IPs will be active 38 by keepalived, on, initially the bootstrap machine, and then the masters, after 39 a fail-over, when the bootstrap is killed. 40 Locate those IP's in the target network. If you want the network details, go to 41 oVirt's webadmin and look for the designated cluster details and its networks. 42 One way to check if an IP is in use is to check if it has ARP associated with it 43 perform this check while on one of the hosts that would run the VMs: 44 ```console 45 $ arp 10.35.1.19 46 10.35.1.1 (10.35.1.1) -- no entry 47 ``` 48 3. Name resolution of `api_vip` from your installing machine 49 The installer must resolve the `api_vip` during the installation, as it will 50 interact with the API to follow the cluster version progress. 51 52 53 ## Minimum resources 54 55 The default master/worker: 56 - 4 CPUs 57 - 16 RAM 58 - 120 GB disk 59 60 For 3 masters/3 workers, the target Cluster **must have at least**: 61 - 96RAM 62 - 24vCPUs 63 - 720GiB storage 64 - Storage that is fast enough for etcd, [using-fio-to-tell-whether-your-storage-is-fast-enough-for-etcd](https://www.ibm.com/cloud/blog/using-fio-to-tell-whether-your-storage-is-fast-enough-for-etcd) 65 66 > Worker count can be reduced to 2 in `install-config.yaml` in case needed. 67 68 The cluster will create by default 1 bootstrap, 3 master, and 3 workers machines. 69 By the time the first worker is up the bootstrap VM should be destroyed, and this 70 is included in the minimum resources calculation. 71 72 73 ## Install 74 75 ### Minimum permission for installation 76 77 It's **not recommended** to users use admin@internal during the installation. Instead, create an exclusive user to install and manage OCP on oVirt. 78 79 The minimum permissions are: 80 - DiskOperator 81 - DiskCreator 82 - UserTemplateBasedVm 83 - TemplateOwner 84 - TemplateCreator 85 - ClusterAdmin (on the specific cluster targeted for OCP deployment) 86 87 There is an [ansible playbook available](https://github.com/oVirt/ocp-on-ovirt/tree/master/installer-tools/ocpadmin) which helps to setup an internal user and group with the minimum privileges to run the openshift-install on oVirt. 88 89 ### ovirt-config.yaml 90 91 The ovirt-config.yaml is created under ${HOME}/.ovirt directory by the installer. 92 It contains all information how the installer connects to oVirt and can be re-used 93 if required to re-trigger a new installation. 94 95 Below the description of all config options in ovirt-config.yaml. 96 97 | Name | Value | Type | Example | 98 | ---------------|:------------------------------:|:--------:|:------------------------------------------------------------------------------------------------------:| 99 | ovirt_url | URL for Engine API | string | https://engine.fqdn.home/ovirt-engine/api | 100 | ovirt_fqdn | Engine FQDN | string | engine.fqdn.home | 101 | ovirt_username | User to connect with Engine | string | admin@internal | 102 | ovirt_password | Password for the user provided | string | superpass | 103 | ovirt_insecure | TLS verification disabled | boolean | false | 104 | ovirt_ca_bundle| CA Bundle | string | -----BEGIN CERTIFICATE----- MIIDvTCCAqWgAwIBAgICEAA.... ----- END CERTIFICATE ----- | 105 | ovirt_cafile | path to a file containing the | string | /path/to/ca.pm | 106 | | engine cert | | | 107 | ovirt_pem_url | PEM URL | string | https://engine.fqdn.home/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA | 108 109 ### ovirt-credentials 110 During installation ${HOME}/.ovirt/ovirt-config.yaml is converted to a **secret** named as **ovirt-credentials** 111 and every openshift component with permission can use it. 112 113 $ oc get secrets --all-namespaces | grep ovirt-credentials 114 ``` 115 kube-system ovirt-credentials 116 openshift-machine-api ovirt-credentials 117 ``` 118 119 $ oc get secret ovirt-credentials -n kube-system -o yaml 120 $ oc get secret ovirt-credentials -n openshift-machine-api -o yaml 121 ``` 122 apiVersion: v1 123 data: 124 ovirt_ca_bundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUR2VENDFTE1Ba0dBMVV... 125 ovirt_cafile: "" 126 ovirt_insecure: Zm2U= 127 ovirt_password: cmGF0 128 ovirt_url: aHR0cHM3Z5lL2FwaQ== 129 ovirt_username: YWRtaJuYWw= 130 kind: Secret 131 metadata: 132 creationTimestamp: "2020-07-30T15:03:06Z" 133 managedFields: 134 - apiVersion: v1 135 fieldsType: FieldsV1 136 fieldsV1: 137 f:data: 138 .: {} 139 f:ovirt_ca_bundle: {} 140 f:ovirt_cafile: {} 141 f:ovirt_insecure: {} 142 f:ovirt_password: {} 143 f:ovirt_url: {} 144 f:ovirt_username: {} 145 f:type: {} 146 manager: cluster-bootstrap 147 operation: Update 148 time: "2020-07-30T15:03:06Z" 149 name: ovirt-credentials 150 namespace: kube-system 151 resourceVersion: "94" 152 selfLink: /api/v1/namespaces/kube-system/secrets/ovirt-credentials 153 uid: 642dbc91-12eb-4111-baa7-d79cbc9b79e4 154 type: Opaque 155 ``` 156 157 ### Bootstrap VM 158 159 The bootstrap will perform ignition fully and will advertise the IP in the 160 pre-login msg. Go to Engine webadmin UI, and open the console of the bootstrap 161 VM to get it. 162 163 164 ### Install using the wizard 165 166 At this stage the installer can create a cluster by gathering all the information 167 using a wizard: 168 ```console 169 $ openshift-install create cluster --dir=install_dir 170 ? SSH Public Key /home/user/.ssh/id_dsa.pub 171 ? Platform ovirt 172 ? Engine FQDN[:PORT] [? for help] ovirt-engine-fqdn 173 ? Enter ovirt-engine username admin@internal 174 ? Enter password *** 175 ? oVirt cluster xxxx 176 ? oVirt storage xxxx 177 ? oVirt network xxxx 178 ? Internal API virtual IP 10.0.0.1 179 ? Ingress virtual IP 10.0.0.3 180 ? Base Domain example.org 181 ? Cluster Name test 182 ? Pull Secret [? for help] 183 INFO Consuming Install Config from target directory 184 INFO Creating infrastructure resources... 185 INFO Waiting up to 20m0s for the Kubernetes API at https://api.test.example.org:6443... 186 INFO API v1.17.1 up 187 INFO Waiting up to 40m0s for bootstrapping to complete... 188 INFO Destroying the bootstrap resources... 189 INFO Waiting up to 30m0s for the cluster at https://api.test.example.org:6443 to initialize... 190 INFO Waiting up to 10m0s for the openshift-console route to be created... 191 INFO Install complete! 192 INFO To access the cluster as the system:admin user when using 'oc', run 193 export KUBECONFIG=/home/user/install_dir/auth/kubeconfig 194 INFO Access the OpenShift web-console here: https://console-openshift-console.apps.test.example.org 195 INFO Login to the console with user: kubeadmin, password: xxxxxxxxx 196 ``` 197 198 199 ### Install in stages when customization is needed 200 201 Start the installation by creating an `install-config` interactively, using a work-dir: 202 203 ```console 204 $ openshift-install create install-config --dir=install_dir 205 ``` 206 207 The resulting `install_dir/install-config.yaml` can be further customized if needed. 208 For general customization please see [docs/user/customization.md](../customization.md#platform-customization) 209 For ovirt-specific see [customization.md](./customization.md) 210 Continue the installation using the install-config in the new folder `install_dir` 211 212 ```console 213 $ openshift-install create cluster --dir=install_dir 214 ``` 215 216 When the all prompts are done the installer will create ${HOME}/.ovirt/ovirt-config.yaml 217 containing all required information about the connection with Engine. 218 The installation process will create a temporary VM which will trigger bootstrap VM 219 for later create three masters nodes. The masters nodes will create all services and 220 checks required. Finally, the cluster will create the three workers node. 221 222 In the end the installer finishes and the cluster should be up. 223 224 To access the cluster as the system:admin user: 225 226 ```console 227 $ export KUBECONFIG=$PWD/install_dir/auth/kubeconfig 228 $ oc get nodes 229 ``` 230 231 [Bare Metal IPI Networking Infrastructure]: https://github.com/openshift/installer/blob/master/docs/design/baremetal/networking-infrastructure.md 232 233 #### Installing OpenShift on RHV/oVirt in *insecure* mode 234 235 <!-- Do not change this title as it is used in the code to point users to the right place --> 236 237 Starting OpenShift 4.7 we are sunsetting the “insecure” option from the OpenShift Installer. Starting with this version, the installer only supports installation methods from the user interface that lead to using verified certificates. 238 239 This change also means that setting up the CA certificate for RHV is no longer required before running the installer. The installer will ask you for confirmation about the certificate and store the CA certificate for use during the installation. 240 241 Should you, nevertheless, require an installation without certificate verification you can create a file named ovirt-config.yaml in the .ovirt directory in your home directory (~/.ovirt/ovirt-config.yaml) before running the installer with the following content: 242 243 ```yaml 244 ovirt_url: https://ovirt.example.com/ovirt-engine/api 245 ovirt_fqdn: ovirt.example.com 246 ovirt_pem_url: "" 247 ovirt_username: admin@internal 248 ovirt_password: super-secret-password 249 ovirt_insecure: true 250 ``` 251 252 Please note that this option is **not recommended** as it will allow a potential attacker to perform a Man-in-the-Middle attack and capture sensitive credentials on the network.