openshift-docs/installing/installing_ibm_z/installing-restricted-networks-ibm-z-kvm.adoc

:_mod-docs-content-type: ASSEMBLY
include::_attributes/common-attributes.adoc[]
[id="installing-restricted-networks-ibm-z-kvm"]
= Installing a cluster with {op-system-base} KVM on {ibm-z-title} and {ibm-linuxone-title} in a restricted network
:context: installing-restricted-networks-ibm-z-kvm

toc::[]

[role="_abstract"]
In {product-title} version {product-version}, you can install a cluster on
{ibm-z-name} or {ibm-linuxone-name} infrastructure that you provision in a restricted network.

[NOTE]
====
While this document refers to only {ibm-z-name}, all information in it also applies to {ibm-linuxone-name}.
====

[IMPORTANT]
====
Additional considerations exist for non-bare metal platforms. Review the information in the
link:https://access.redhat.com/articles/4207611[guidelines for deploying {product-title} on non-tested platforms] before you install an {product-title} cluster.
====

== Prerequisites

* You reviewed details about the xref:../../architecture/architecture-installation.adoc#architecture-installation[{product-title} installation and update] processes.
* You read the documentation on xref:../../installing/overview/installing-preparing.adoc#installing-preparing[selecting a cluster installation method and preparing it for users].
* You xref:../../disconnected/mirroring/installing-mirroring-installation-images.adoc#installing-mirroring-installation-images[created a registry on your mirror host] and obtained the `imageContentSources` data for your version of {product-title}.
* You must move or remove any existing installation files, before you begin the installation process. This ensures that the required installation files are created and updated during the installation process.
+
[IMPORTANT]
====
Ensure that installation steps are done from a machine with access to the installation media.
====
* You provisioned xref:../../storage/persistent_storage/persistent-storage-ocs.adoc#persistent-storage-ocs[persistent storage using {rh-storage}] or other supported storage protocols for your cluster. To deploy a private image registry, you must set up persistent storage with `ReadWriteMany` access.
* If you use a firewall, you xref:../../installing/install_config/configuring-firewall.adoc#configuring-firewall[configured it to allow the sites] that your cluster requires access to.
+
[NOTE]
====
Be sure to also review this site list if you are configuring a proxy.
====
* You provisioned a {op-system-base} Kernel Virtual Machine (KVM) system that is hosted on the logical partition (LPAR) and based on {op-system-base} 8.6 or later. See link:https://access.redhat.com/support/policy/updates/errata#RHEL8_and_9_Life_Cycle[Red Hat Enterprise Linux 8 and 9 Life Cycle].

include::modules/installation-about-restricted-network.adoc[leveloffset=+1]

include::modules/cluster-entitlements.adoc[leveloffset=+1]

include::modules/installation-requirements-user-infra-ibm-z-kvm.adoc[leveloffset=+1]
include::modules/csr-management.adoc[leveloffset=+2]

[role="_additional-resources"]
[id="additional-resources_ibmz-kvm-restricted-recommended-host-practices"]
.Additional resources

* xref:../../scalability_and_performance/ibm-z-recommended-host-practices.adoc#ibm-z-recommended-host-practices[Recommended host practices for {ibm-z-name} & {ibm-linuxone-name} environments]

include::modules/installation-network-user-infra.adoc[leveloffset=+2]

[role="_additional-resources"]
[id="additional-resources_ibmz-network-user-infra"]
.Additional resources

* xref:../../installing/install_config/installing-customizing.adoc#installation-special-config-chrony_installing-customizing[Configuring chrony time service]

include::modules/installation-dns-user-infra.adoc[leveloffset=+2]

include::modules/installation-load-balancing-user-infra.adoc[leveloffset=+2]

include::modules/installation-infrastructure-user-infra.adoc[leveloffset=+1]

include::modules/installation-user-provisioned-validating-dns.adoc[leveloffset=+1]

include::modules/ssh-agent-using.adoc[leveloffset=+1]

//You extract the installation program from the mirrored content.

//You install the CLI on the mirror host.

include::modules/installation-initializing-manual.adoc[leveloffset=+1]

[role="_additional-resources"]
.Additional resources
* xref:../../installing/installing_ibm_z/installation-config-parameters-ibm-z.adoc#installation-config-parameters-ibm-z[Installation configuration parameters for {ibm-z-name}]

include::modules/installation-bare-metal-config-yaml.adoc[leveloffset=+2]

include::modules/installation-configure-proxy.adoc[leveloffset=+2]

include::modules/installation-three-node-cluster.adoc[leveloffset=+2]

include::modules/nw-operator-cr.adoc[leveloffset=+1]

include::modules/installation-user-infra-generate-k8s-manifest-ignition.adoc[leveloffset=+1]

include::modules/installation-ibm-z-kvm-user-infra-installing-rhcos.adoc[leveloffset=+1]

include::modules/ibm-z-secure-execution.adoc[leveloffset=+2]

[role="_additional-resources"]
[id="additional-resources_Linux-as-an-IBM-Secure-Execution-host-or-guest-restricted"]
.Additional resources

* link:https://www.ibm.com/docs/en/linux-on-systems?topic=virtualization-secure-execution[Introducing {ibm-name} Secure Execution for Linux]

* link:https://www.ibm.com/docs/en/linux-on-systems?topic=ibmz-secure-execution[Linux as an {ibm-name} Secure Execution host or guest]

* link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/configuring_and_managing_virtualization/securing-virtual-machines-in-rhel_configuring-and-managing-virtualization#setting-up-secure-execution-on-ibm-z_securing-virtual-machines-in-rhel[Setting up {ibm-name} Secure Execution on {ibm-z-title}]

include::modules/ibmz-configure-nbde-with-static-ip.adoc[leveloffset=+2]

[role="_additional-resources"]
[id="additional-resources_configure-nbde-ibm-z-kvm-restricted"]
.Additional resources

* xref:../../installing/install_config/installing-customizing.adoc#installation-special-config-butane_installing-customizing[Creating machine configs with Butane]

include::modules/installation-ibm-z-kvm-user-infra-machines-iso.adoc[leveloffset=+2]

include::modules/installation-full-ibm-z-kvm-user-infra-machines-iso.adoc[leveloffset=+2]

include::modules/installation-user-infra-machines-static-network.adoc[leveloffset=+2]

include::modules/installation-installing-bare-metal.adoc[leveloffset=+1]

include::modules/cli-logging-in-kubeadmin.adoc[leveloffset=+1]

include::modules/installation-approve-csrs.adoc[leveloffset=+1]

include::modules/installation-operators-config.adoc[leveloffset=+1]

include::modules/olm-restricted-networks-configuring-operatorhub.adoc[leveloffset=+2]

include::modules/installation-registry-storage-config.adoc[leveloffset=+2]

include::modules/registry-configuring-storage-baremetal.adoc[leveloffset=+3]

include::modules/installation-registry-storage-non-production.adoc[leveloffset=+3]

include::modules/installation-complete-user-infra.adoc[leveloffset=+1]

[role="_additional-resources"]
[id="additional-resources_ibmz-kvm-restricted-sosreport"]
.Additional resources

* link:https://access.redhat.com/solutions/4387261[How to generate SOSREPORT within {product-title} version 4 nodes without SSH].

[id="next-steps_ibmz-kvm-restricted"]
== Next steps

* xref:../../post_installation_configuration/cluster-tasks.adoc#available_cluster_customizations[Customize your cluster].
* If the mirror registry that you used to install your cluster has a trusted CA, add it to the cluster by xref:../../openshift_images/image-configuration.adoc#images-configuration-cas_image-configuration[configuring additional trust stores].
* If necessary, you can xref:../../support/remote_health_monitoring/opting-out-of-remote-health-reporting.adoc#opting-out-remote-health-reporting_opting-out-remote-health-reporting[opt out of remote health reporting].
* If necessary, see xref:../../support/remote_health_monitoring/opting-out-of-remote-health-reporting.adoc#insights-operator-register-disconnected-cluster_opting-out-remote-health-reporting[Registering your disconnected cluster]