openshift/openshift-docs
1
0
Fork 0
mirror of https://github.com/openshift/openshift-docs.git synced 2026-02-05 12:46:18 +01:00
Code Issues Releases Activity
Files
enterprise-4.21
openshift-docs/modules/installation-ibm-cloud-config-yaml.adoc
Brendan Daly e7e4e3cbbc OSDOCS-16899:combining assemblies
2025-11-14 12:55:20 +00:00

447 lines
22 KiB
Plaintext
Raw Permalink Blame History

// Module included in the following assemblies:
//
// * installing/installing_ibm_cloud/installing-ibm-cloud-customizations.adoc
// * installing/installing_ibm_cloud/installing-ibm-cloud-network-customizations.adoc
// * installing/installing_ibm_cloud/installing-ibm-cloud-vpc.adoc
// * installing/installing_ibm_cloud/installing-ibm-cloud-private.adoc
// * installing/installing_ibm_cloud/installing-ibm-cloud-restricted.adoc
ifeval::["{context}" == "installing-ibm-cloud-customizations"]
:with-networking:
endif::[]
ifeval::["{context}" == "installing-ibm-cloud-customizations"]
:without-networking:
endif::[]
ifeval::["{context}" == "installing-ibm-cloud-vpc"]
:vpc:
endif::[]
ifeval::["{context}" == "installing-ibm-cloud-private"]
:private:
endif::[]
ifeval::["{context}" == "installing-ibm-cloud-restricted"]
:restricted:
endif::[]
:_mod-docs-content-type: REFERENCE
[id="installation-ibm-cloud-config-yaml_{context}"]
= Sample customized install-config.yaml file for {ibm-cloud-title}
You can customize the `install-config.yaml` file to specify more details about your {product-title} cluster's platform or modify the values of the required parameters.
[IMPORTANT]
====
This sample YAML file is provided for reference only. You must obtain your `install-config.yaml` file by using the installation program and then modify it.
====
ifdef::with-networking,without-networking[]
[source,yaml]
----
apiVersion: v1
baseDomain: example.com <1>
controlPlane: <2> <3>
hyperthreading: Enabled <4>
name: master
platform:
ibmcloud: {}
replicas: 3
compute: <2> <3>
- hyperthreading: Enabled <4>
name: worker
platform:
ibmcloud: {}
replicas: 3
metadata:
name: test-cluster <1>
ifdef::without-networking[]
networking:
endif::[]
ifdef::with-networking[]
networking: <2>
endif::[]
clusterNetwork:
- cidr: 10.128.0.0/14
hostPrefix: 23
machineNetwork:
- cidr: 10.0.0.0/16
networkType: OVNKubernetes <5>
serviceNetwork:
- 172.30.0.0/16
platform:
ibmcloud:
region: us-south <1>
credentialsMode: Manual
publish: External
pullSecret: '{"auths": ...}' <1>
ifndef::openshift-origin[]
fips: false <6>
sshKey: ssh-ed25519 AAAA... <7>
endif::openshift-origin[]
ifdef::openshift-origin[]
sshKey: ssh-ed25519 AAAA... <6>
endif::openshift-origin[]
----
<1> Required. The installation program prompts you for this value.
<2> If you do not provide these parameters and values, the installation program provides the default value.
<3> The `controlPlane` section is a single mapping, but the `compute` section is a sequence of mappings. To meet the requirements of the different data structures, the first line of the `compute` section must begin with a hyphen, `-`, and the first line of the `controlPlane` section must not. Only one control plane pool is used.
<4> Enables or disables simultaneous multithreading, also known as Hyper-Threading. By default, simultaneous multithreading is enabled to increase the performance of your machines' cores. You can disable it by setting the parameter value to `Disabled`. If you disable simultaneous multithreading in some cluster machines, you must disable it in all cluster machines.
+
[IMPORTANT]
====
If you disable simultaneous multithreading, ensure that your capacity planning accounts for the dramatically decreased machine performance. Use larger machine types, such as `n1-standard-8`, for your machines if you disable simultaneous multithreading.
====
<5> The cluster network plugin to install. The default value `OVNKubernetes` is the only supported value.
ifndef::openshift-origin[]
<6> Enables or disables FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
+
--
[IMPORTANT]
====
To enable FIPS mode for your cluster, you must run the installation program from a {op-system-base-full} computer configured to operate in FIPS mode. For more information about configuring FIPS mode on RHEL, see link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/assembly_installing-the-system-in-fips-mode_security-hardening[Installing the system in FIPS mode].
When running {op-system-base-full} or {op-system-first} booted in FIPS mode, {product-title} core components use the {op-system-base} cryptographic libraries that have been submitted to NIST for FIPS 140-2/140-3 Validation on only the x86_64, ppc64le, and s390x architectures.
====
--
<7> Optional: provide the `sshKey` value that you use to access the machines in your cluster.
endif::openshift-origin[]
ifdef::openshift-origin[]
<6> Optional: provide the `sshKey` value that you use to access the machines in your cluster.
endif::openshift-origin[]
+
[NOTE]
====
For production {product-title} clusters on which you want to perform installation debugging or disaster recovery, specify an SSH key that your `ssh-agent` process uses.
====
endif::with-networking,without-networking[]
ifdef::vpc[]
[source,yaml]
----
apiVersion: v1
baseDomain: example.com <1>
controlPlane: <2> <3>
hyperthreading: Enabled <4>
name: master
platform:
ibmcloud: {}
replicas: 3
compute: <2> <3>
- hyperthreading: Enabled <4>
name: worker
platform:
ibmcloud: {}
replicas: 3
metadata:
name: test-cluster <1>
networking:
clusterNetwork:
- cidr: 10.128.0.0/14 <5>
hostPrefix: 23
machineNetwork:
- cidr: 10.0.0.0/16
networkType: OVNKubernetes <6>
serviceNetwork:
- 172.30.0.0/16
platform:
ibmcloud:
region: eu-gb <1>
resourceGroupName: eu-gb-example-cluster-rg <7>
networkResourceGroupName: eu-gb-example-existing-network-rg <8>
vpcName: eu-gb-example-network-1 <9>
controlPlaneSubnets: <10>
- eu-gb-example-network-1-cp-eu-gb-1
- eu-gb-example-network-1-cp-eu-gb-2
- eu-gb-example-network-1-cp-eu-gb-3
computeSubnets: <11>
- eu-gb-example-network-1-compute-eu-gb-1
- eu-gb-example-network-1-compute-eu-gb-2
- eu-gb-example-network-1-compute-eu-gb-3
credentialsMode: Manual
publish: External
pullSecret: '{"auths": ...}' <1>
ifndef::openshift-origin[]
fips: false <12>
sshKey: ssh-ed25519 AAAA... <13>
endif::openshift-origin[]
ifdef::openshift-origin[]
sshKey: ssh-ed25519 AAAA... <12>
endif::openshift-origin[]
----
<1> Required. The installation program prompts you for this value.
<2> If you do not provide these parameters and values, the installation program provides the default value.
<3> The `controlPlane` section is a single mapping, but the `compute` section is a sequence of mappings. To meet the requirements of the different data structures, the first line of the `compute` section must begin with a hyphen, `-`, and the first line of the `controlPlane` section must not. Only one control plane pool is used.
<4> Enables or disables simultaneous multithreading, also known as Hyper-Threading. By default, simultaneous multithreading is enabled to increase the performance of your machines' cores. You can disable it by setting the parameter value to `Disabled`. If you disable simultaneous multithreading in some cluster machines, you must disable it in all cluster machines.
+
[IMPORTANT]
====
If you disable simultaneous multithreading, ensure that your capacity planning accounts for the dramatically decreased machine performance. Use larger machine types, such as `n1-standard-8`, for your machines if you disable simultaneous multithreading.
====
<5> The machine CIDR must contain the subnets for the compute machines and control plane machines.
<6> The cluster network plugin to install. The default value `OVNKubernetes` is the only supported value.
<7> The name of an existing resource group. All installer-provisioned cluster resources are deployed to this resource group. If undefined, a new resource group is created for the cluster.
<8> Specify the name of the resource group that contains the existing virtual private cloud (VPC). The existing VPC and subnets should be in this resource group. The cluster will be installed to this VPC.
<9> Specify the name of an existing VPC.
<10> Specify the name of the existing subnets to which to deploy the control plane machines. The subnets must belong to the VPC that you specified. Specify a subnet for each availability zone in the region.
<11> Specify the name of the existing subnets to which to deploy the compute machines. The subnets must belong to the VPC that you specified. Specify a subnet for each availability zone in the region.
ifndef::openshift-origin[]
<12> Enables or disables FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
+
[IMPORTANT]
====
When running {op-system-base-full} or {op-system-first} booted in FIPS mode, {product-title} core components use the {op-system-base} cryptographic libraries that have been submitted to NIST for FIPS 140-2/140-3 Validation on only the x86_64, ppc64le, and s390x architectures.
====
<13> Optional: provide the `sshKey` value that you use to access the machines in your cluster.
endif::openshift-origin[]
ifdef::openshift-origin[]
<12> Optional: provide the `sshKey` value that you use to access the machines in your cluster.
endif::openshift-origin[]
+
[NOTE]
====
For production {product-title} clusters on which you want to perform installation debugging or disaster recovery, specify an SSH key that your `ssh-agent` process uses.
====
endif::vpc[]
ifdef::private[]
[source,yaml]
----
apiVersion: v1
baseDomain: example.com <1>
controlPlane: <2> <3>
hyperthreading: Enabled <4>
name: master
platform:
ibmcloud: {}
replicas: 3
compute: <2> <3>
- hyperthreading: Enabled <4>
name: worker
platform:
ibmcloud: {}
replicas: 3
metadata:
name: test-cluster <1>
networking:
clusterNetwork:
- cidr: 10.128.0.0/14 <5>
hostPrefix: 23
machineNetwork:
- cidr: 10.0.0.0/16 <6>
networkType: OVNKubernetes <7>
serviceNetwork:
- 172.30.0.0/16
platform:
ibmcloud:
region: eu-gb <1>
resourceGroupName: eu-gb-example-cluster-rg <8>
networkResourceGroupName: eu-gb-example-existing-network-rg <9>
vpcName: eu-gb-example-network-1 <10>
controlPlaneSubnets: <11>
- eu-gb-example-network-1-cp-eu-gb-1
- eu-gb-example-network-1-cp-eu-gb-2
- eu-gb-example-network-1-cp-eu-gb-3
computeSubnets: <12>
- eu-gb-example-network-1-compute-eu-gb-1
- eu-gb-example-network-1-compute-eu-gb-2
- eu-gb-example-network-1-compute-eu-gb-3
credentialsMode: Manual
publish: Internal <13>
pullSecret: '{"auths": ...}' <1>
ifndef::openshift-origin[]
fips: false <14>
sshKey: ssh-ed25519 AAAA... <15>
endif::openshift-origin[]
ifdef::openshift-origin[]
sshKey: ssh-ed25519 AAAA... <14>
endif::openshift-origin[]
----
<1> Required.
<2> If you do not provide these parameters and values, the installation program provides the default value.
<3> The `controlPlane` section is a single mapping, but the `compute` section is a sequence of mappings. To meet the requirements of the different data structures, the first line of the `compute` section must begin with a hyphen, `-`, and the first line of the `controlPlane` section must not. Only one control plane pool is used.
<4> Enables or disables simultaneous multithreading, also known as Hyper-Threading. By default, simultaneous multithreading is enabled to increase the performance of your machines' cores. You can disable it by setting the parameter value to `Disabled`. If you disable simultaneous multithreading in some cluster machines, you must disable it in all cluster machines.
+
[IMPORTANT]
====
If you disable simultaneous multithreading, ensure that your capacity planning accounts for the dramatically decreased machine performance. Use larger machine types, such as `n1-standard-8`, for your machines if you disable simultaneous multithreading.
====
<5> The machine CIDR must contain the subnets for the compute machines and control plane machines.
<6> The CIDR must contain the subnets defined in `platform.ibmcloud.controlPlaneSubnets` and `platform.ibmcloud.computeSubnets`.
<7> The cluster network plugin to install. The default value `OVNKubernetes` is the only supported value.
<8> The name of an existing resource group. All installer-provisioned cluster resources are deployed to this resource group. If undefined, a new resource group is created for the cluster.
<9> Specify the name of the resource group that contains the existing virtual private cloud (VPC). The existing VPC and subnets should be in this resource group. The cluster will be installed to this VPC.
<10> Specify the name of an existing VPC.
<11> Specify the name of the existing subnets to which to deploy the control plane machines. The subnets must belong to the VPC that you specified. Specify a subnet for each availability zone in the region.
<12> Specify the name of the existing subnets to which to deploy the compute machines. The subnets must belong to the VPC that you specified. Specify a subnet for each availability zone in the region.
<13> How to publish the user-facing endpoints of your cluster. Set `publish` to `Internal` to deploy a private cluster. The default value is `External`.
ifndef::openshift-origin[]
<14> Enables or disables FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
+
[IMPORTANT]
====
When running {op-system-base-full} or {op-system-first} booted in FIPS mode, {product-title} core components use the {op-system-base} cryptographic libraries that have been submitted to NIST for FIPS 140-2/140-3 Validation on only the x86_64, ppc64le, and s390x architectures.
====
<15> Optional: provide the `sshKey` value that you use to access the machines in your cluster.
endif::openshift-origin[]
ifdef::openshift-origin[]
<14> You can optionally provide the `sshKey` value that you use to access the machines in your cluster.
endif::openshift-origin[]
+
[NOTE]
====
For production {product-title} clusters on which you want to perform installation debugging or disaster recovery, specify an SSH key that your `ssh-agent` process uses.
====
endif::private[]
ifdef::restricted[]
[source,yaml]
----
apiVersion: v1
baseDomain: example.com <1>
controlPlane: <2> <3>
hyperthreading: Enabled <4>
name: master
platform:
ibm-cloud: {}
replicas: 3
compute: <2> <3>
- hyperthreading: Enabled <4>
name: worker
platform:
ibmcloud: {}
replicas: 3
metadata:
name: test-cluster <1>
networking:
clusterNetwork:
- cidr: 10.128.0.0/14 <5>
hostPrefix: 23
machineNetwork:
- cidr: 10.0.0.0/16 <6>
networkType: OVNKubernetes <7>
serviceNetwork:
- 172.30.0.0/16
platform:
ibmcloud:
region: us-east <1>
resourceGroupName: us-east-example-cluster-rg <8>
serviceEndpoints: <9>
- name: IAM
url: https://private.us-east.iam.cloud.ibm.com
- name: VPC
url: https://us-east.private.iaas.cloud.ibm.com/v1
- name: ResourceController
url: https://private.us-east.resource-controller.cloud.ibm.com
- name: ResourceManager
url: https://private.us-east.resource-controller.cloud.ibm.com
- name: DNSServices
url: https://api.private.dns-svcs.cloud.ibm.com/v1
- name: COS
url: https://s3.direct.us-east.cloud-object-storage.appdomain.cloud
- name: GlobalSearch
url: https://api.private.global-search-tagging.cloud.ibm.com
- name: GlobalTagging
url: https://tags.private.global-search-tagging.cloud.ibm.com
networkResourceGroupName: us-east-example-existing-network-rg <10>
vpcName: us-east-example-network-1 <11>
controlPlaneSubnets: <12>
- us-east-example-network-1-cp-us-east-1
- us-east-example-network-1-cp-us-east-2
- us-east-example-network-1-cp-us-east-3
computeSubnets: <13>
- us-east-example-network-1-compute-us-east-1
- us-east-example-network-1-compute-us-east-2
- us-east-example-network-1-compute-us-east-3
credentialsMode: Manual
pullSecret: '{"auths":{"<local_registry>": {"auth": "<credentials>","email": "you@example.com"}}}' <14>
ifndef::openshift-origin[]
fips: false <15>
sshKey: ssh-ed25519 AAAA... <16>
endif::openshift-origin[]
ifdef::openshift-origin[]
sshKey: ssh-ed25519 AAAA... <15>
endif::openshift-origin[]
ifndef::openshift-origin[]
additionalTrustBundle: | <17>
-----BEGIN CERTIFICATE-----
<MY_TRUSTED_CA_CERT>
-----END CERTIFICATE-----
imageContentSources: <18>
- mirrors:
- <local_registry>/<local_repository_name>/release
source: quay.io/openshift-release-dev/ocp-release
- mirrors:
- <local_registry>/<local_repository_name>/release
source: quay.io/openshift-release-dev/ocp-v4.0-art-dev
endif::openshift-origin[]
ifdef::openshift-origin[]
additionalTrustBundle: | <16>
-----BEGIN CERTIFICATE-----
<MY_TRUSTED_CA_CERT>
-----END CERTIFICATE-----
imageContentSources: <17>
- mirrors:
- <local_registry>/<local_repository_name>/release
source: quay.io/openshift-release-dev/ocp-release
- mirrors:
- <local_registry>/<local_repository_name>/release
source: quay.io/openshift-release-dev/ocp-v4.0-art-dev
endif::openshift-origin[]
----
<1> Required.
<2> If you do not provide these parameters and values, the installation program provides the default value.
<3> The `controlPlane` section is a single mapping, but the `compute` section is a sequence of mappings. To meet the requirements of the different data structures, the first line of the `compute` section must begin with a hyphen, `-`, and the first line of the `controlPlane` section must not. Only one control plane pool is used.
<4> Enables or disables simultaneous multithreading, also known as Hyper-Threading. By default, simultaneous multithreading is enabled to increase the performance of your machines' cores. You can disable it by setting the parameter value to `Disabled`. If you disable simultaneous multithreading in some cluster machines, you must disable it in all cluster machines.
+
[IMPORTANT]
====
If you disable simultaneous multithreading, ensure that your capacity planning accounts for the dramatically decreased machine performance. Use larger machine types, such as `n1-standard-8`, for your machines if you disable simultaneous multithreading.
====
<5> The machine CIDR must contain the subnets for the compute machines and control plane machines.
<6> The CIDR must contain the subnets defined in `platform.ibmcloud.controlPlaneSubnets` and `platform.ibmcloud.computeSubnets`.
<7> The cluster network plugin to install. The default value `OVNKubernetes` is the only supported value.
<8> The name of an existing resource group. All installer-provisioned cluster resources are deployed to this resource group. If undefined, a new resource group is created for the cluster.
<9> Based on the network restrictions of the VPC, specify alternate service endpoints as needed. This overrides the default public endpoint for the service.
<10> Specify the name of the resource group that contains the existing virtual private cloud (VPC). The existing VPC and subnets should be in this resource group. The cluster will be installed to this VPC.
<11> Specify the name of an existing VPC.
<12> Specify the name of the existing subnets to which to deploy the control plane machines. The subnets must belong to the VPC that you specified. Specify a subnet for each availability zone in the region.
<13> Specify the name of the existing subnets to which to deploy the compute machines. The subnets must belong to the VPC that you specified. Specify a subnet for each availability zone in the region.
<14> For `<local_registry>`, specify the registry domain name, and optionally the port, that your mirror registry uses to serve content. For example, registry.example.com or registry.example.com:5000. For `<credentials>`, specify the base64-encoded user name and password for your mirror registry.
ifndef::openshift-origin[]
<15> Enables or disables FIPS mode. By default, FIPS mode is not enabled. If FIPS mode is enabled, the {op-system-first} machines that {product-title} runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that are provided with {op-system} instead.
+
[IMPORTANT]
====
The use of FIPS Validated or Modules in Process cryptographic libraries is only supported on {product-title} deployments on the `x86_64` architecture.
====
<16> Optional: provide the `sshKey` value that you use to access the machines in your cluster.
<17> Provide the contents of the certificate file that you used for your mirror registry.
<18> Provide these values from the `metadata.name: release-0` section of the `imageContentSourcePolicy.yaml` file that was created when you mirrored the registry.
endif::openshift-origin[]
ifdef::openshift-origin[]
<15> You can optionally provide the `sshKey` value that you use to access the machines in your cluster.
<16> Provide the contents of the certificate file that you used for your mirror registry.
<17> Provide these values from the `metadata.name: release-0` section of the `imageContentSourcePolicy.yaml` file that was created when you mirrored the registry.
endif::openshift-origin[]
+
[NOTE]
====
For production {product-title} clusters on which you want to perform installation debugging or disaster recovery, specify an SSH key that your `ssh-agent` process uses.
====
endif::restricted[]
ifeval::["{context}" == "installing-ibm-cloud-customizations"]
:!with-networking:
endif::[]
ifeval::["{context}" == "installing-ibm-cloud-customizations"]
:!without-networking:
endif::[]
ifeval::["{context}" == "installing-ibm-cloud-vpc"]
:!vpc:
endif::[]
ifeval::["{context}" == "installing-ibm-cloud-private"]
:!private:
endif::[]
ifeval::["{context}" == "installing-ibm-cloud-restricted"]
:!restricted:
endif::[]
View Git Blame Copy Permalink