openshift-docs/installing/installing_ibm_cloud_public/installing-ibm-cloud-restricted.adoc

:_content-type: ASSEMBLY
include::_attributes/common-attributes.adoc[]
[id="installing-ibm-cloud-restricted"]
= Installing a cluster on IBM Cloud in a restricted network
:context: installing-ibm-cloud-restricted

toc::[]

In {product-title} {product-version}, you can install a cluster in a restricted network by creating an internal mirror of the installation release content that is accessible to an existing Virtual Private Cloud (VPC) on {ibm-cloud-name}.

[id="prerequisites_installing-ibm-cloud-restricted"]
== Prerequisites

* You reviewed details about the xref:../../architecture/architecture-installation.adoc#architecture-installation[{product-title} installation and update] processes.
* You xref:../../installing/installing_ibm_cloud_public/installing-ibm-cloud-account.adoc#installing-ibm-cloud-account[configured an IBM Cloud account] to host the cluster.
* You have a container image registry that is accessible to the internet and your restricted network. The container image registry should mirror the contents of the {product-registry} and contain the installation media. For more information, see xref:../../disconnected/mirroring/installing-mirroring-disconnected.adoc#installing-mirroring-disconnected[Mirroring images for a disconnected installation using the oc-mirror plugin].
* You have an existing VPC on {ibm-cloud-name} that meets the following requirements:
** The VPC contains the mirror registry or has firewall rules or a peering connection to access the mirror registry that is hosted elsewhere.
** The VPC can access {ibm-cloud-name} service endpoints using a public endpoint. If network restrictions limit access to public service endpoints, evaluate those services for alternate endpoints that might be available. For more information see xref:../../installing/installing_ibm_cloud_public/installing-ibm-cloud-restricted.adoc#access-to-ibm-service-endpoints_installing-ibm-cloud-restricted[Access to IBM service endpoints].

+
You cannot use the VPC that the installation program provisions by default.
* If you plan on configuring endpoint gateways to use {ibm-cloud-name} Virtual Private Endpoints, consider the following requirements:
** Endpoint gateway support is currently limited to the `us-east` and `us-south` regions.
** The VPC must allow traffic to and from the endpoint gateways. You can use the VPC’s default security group, or a new security group, to allow traffic on port 443. For more information, see xref:../../installing/installing_ibm_cloud_public/installing-ibm-cloud-restricted.adoc#installation-ibm-cloud-configure-vpc-for-endpoint-gateways_installing-ibm-cloud-restricted[Allowing endpoint gateway traffic].
* If you use a firewall, you xref:../../installing/install_config/configuring-firewall.adoc#configuring-firewall[configured it to allow the sites] that your cluster requires access to.
* You configured the `ccoctl` utility before you installed the cluster. For more information, see xref:../../installing/installing_ibm_cloud_public/configuring-iam-ibm-cloud.adoc#configuring-iam-ibm-cloud[Configuring IAM for IBM Cloud VPC].

include::modules/installation-about-restricted-network.adoc[leveloffset=+1]

[role="_additional-resources"]
.Additional resources
* xref:../../disconnected/mirroring/installing-mirroring-disconnected.adoc#installing-mirroring-disconnected[Mirroring images for a disconnected installation using the oc-mirror plugin]
* xref:../../installing/installing_ibm_cloud_public/installation-config-parameters-ibm-cloud-vpc.adoc#installation-configuration-parameters-additional-ibm-cloud_installation-config-parameters-ibm-cloud-vpc[Additional IBM Cloud configuration parameters]

include::modules/installation-custom-ibm-cloud-vpc.adoc[leveloffset=+1]
include::modules/installation-ibm-cloud-configure-vpc-for-endpoint-gateways.adoc[leveloffset=+2]

include::modules/ssh-agent-using.adoc[leveloffset=+1]

include::modules/installation-ibm-cloud-export-variables.adoc[leveloffset=+1]

include::modules/installation-ibm-cloud-download-rhcos.adoc[leveloffset=+1]

include::modules/installation-initializing-manual.adoc[leveloffset=+1]

include::modules/installation-configure-proxy.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources
* xref:../../installing/installing_ibm_cloud_public/installation-config-parameters-ibm-cloud-vpc.adoc#installation-config-parameters-ibm-cloud-vpc[Installation configuration parameters for {ibm-cloud-name}]

include::modules/installation-minimum-resource-requirements.adoc[leveloffset=+2]

include::modules/installation-ibm-cloud-tested-machine-types.adoc[leveloffset=+2]

include::modules/installation-ibm-cloud-config-yaml.adoc[leveloffset=+2]

include::modules/cli-installing-cli.adoc[leveloffset=+1]

include::modules/manually-create-iam-ibm-cloud.adoc[leveloffset=+1]

include::modules/installation-launching-installer.adoc[leveloffset=+1]

include::modules/cli-logging-in-kubeadmin.adoc[leveloffset=+1]

[role="_additional-resources"]
[id="additional-resources_installing-ibm-cloud-restricted-console"]
.Additional resources
* xref:../../web_console/web-console.adoc#web-console[Accessing the web console]

== Post installation
Complete the following steps to complete the configuration of your cluster.

include::modules/olm-restricted-networks-configuring-operatorhub.adoc[leveloffset=+2]
include::modules/oc-mirror-updating-restricted-cluster-manifests.adoc[leveloffset=+2]

include::modules/cluster-telemetry.adoc[leveloffset=+1]

[role="_additional-resources"]
[id="additional-resources_installing-ibm-cloud-restricted-telemetry"]
.Additional resources
* xref:../../support/remote_health_monitoring/about-remote-health-monitoring.adoc#about-remote-health-monitoring[About remote health monitoring]

[id="next-steps_installing-ibm-cloud-restricted"]
== Next steps
* xref:../../post_installation_configuration/cluster-tasks.adoc#available_cluster_customizations[Customize your cluster].
* Optional: xref:../../support/remote_health_monitoring/opting-out-of-remote-health-reporting.adoc#opting-out-remote-health-reporting_opting-out-remote-health-reporting[Opt out of remote health reporting].