OCI Resources for the Agent-based Installer for Manual Installation

Compartments enable you to organize and isolate cloud resources. We recommend creating a new compartment for the OpenShift cluster. For more information, see Creating a Compartment.

OpenShift compute nodes, load balancers, and other resources use an OCI Virtual Cloud Network (VCN) to connect. See Creating a VCN for instructions on creating a VCN.

You need IAM permissions to manage VCNs and the related Networking resources in the virtual-network-family Aggregate Resource-Type. See Managing Access to Resources for details. Note that Networking permissions are discussed in the Core Services section.

Optionally, you can use network security groups (NSGs) in your VCN to control access. See Network Security Groups for details on using NSGs to control network traffic and access. Note that the NSG must be in the same compartment as the other OpenShfit infrastructure resources.

See the Terraform Defined Resources for OpenShift on OCI page on GitHub for VCN and subnet configuration details. For specific resource definitions, access the relevant folders in the shared_modules directory and search for the following resources: oci_core_vcn, oci_core_internet_gateway, oci_core_nat_gateway, oci_core_route_table, oci_core_subnet, and oci_core_network_security_group.

The Red Hat OpenShift cluster requires two load balancers, one for internal network traffic, and one for external traffic. See Creating a Load Balancer for instructions. For high-level details on load balancer configurations, refer to the Terraform Defined Resources for OpenShift on OCI page on GitHub. For specific resource definitions, access the relevant folder in the shared_modules directory and search for the following resources: oci_load_balancer_load_balancer, oci_load_balancer_backend_set, and oci_load_balancer_listener.

Create DNS records for routing internal and external OpenShift network traffic. Depending on your networking and security requirements, create either a public DNS zone, a private DNS zone, or both. A private DNS zone is only resolvable within Oracle networks (such as your VCN). A public DNS zone enables external access.

Each DNS record must reference the same public and private load balancer IDs.

See Zones for instructions on creating and managing DNS zones.

For high-level DNS configuration details, see the Terraform Defined Resources for OpenShift on OCI page on GitHub. For specific resource definitions, access the relevant folder in the shared_modules directory and search for the following resources: oci_dns_zone and oci_dns_rrset.

Defined tags are required to group and identify all control plane and compute nodes.

Using the Tagging service, create two tag namespaces and define the required tags in the compartment you're using to create the OpenShift cluster:

• Tag namespace: openshift-tags and openshift-{cluster_name}
• Defined tag names and values:
• • For openshift-tags: openshift-resource
  • For openshift-{cluster_name}:
    • instance-role: control_plane or compute (depending on the node type)
    • boot-volume-type: PARAVIRTUALIZED or ISCSI

These tags must be applied to all relevant resources during provisioning. For more information, see Resource Attribution Tags.

For more information, see Tags and Tag Namespace Concepts.

For high-level instructions specficic to OpenShift on OCI, see Terraform Defined Resources for OpenShift on OCI page on GitHub. For specific resource definitions, access the relevant folder in the shared_modules directory and search for the following resources: oci_identity_tag_namespace and oci_identity_tag.

Dynamic groups enable you to group Oracle Cloud Infrastructure (OCI) compute instances as "principal" actors (similar to user groups) for granting access through IAM policies.

You can create IAM policies (discussed in the following section) that reference these dynamic groups to control access to OCI resources. See Managing Dynamic Groups for instructions. For high-level details on dynamic group configuration, see the Terraform Defined Resources for OpenShift on OCI page on GitHub . For specific resource definitions, access the relevant folder in the shared_modules directory and search for the following resource: oci_identity_dynamic_group.

Three IAM policies are required for the OpenShift control plane dynamic group to access and manage OCI resources during cluster creation. These IAM policies are required for the master dynamic group. See Managing Dynamic Groups and IAM Policies Overview for instructions. For high-level details on dynamic group policy configurations, see the Terraform Defined Resources for OpenShift on OCI page on GitHub. For specific resource definitions, access the relevant folder in the shared_modules directory and search for the following resource: oci_identity_policy.

• Control Plane Resource Access Policy: This policy allows the control plane noes to manage core infrastructure resources. The dynamic group for control plane nodes is named ${var.cluster_name}_control_plane_nodes
  • Policy Name:${var.cluster_name}_control_plane_nodes
  • Compartment: Cluster compartment
  • Policy Statements:

    
    Allow dynamic-group ${oci_identity_dynamic_group.openshift_control_plane_nodes.name} to manage volume-family in compartment id ${var.compartment_ocid}
    
    Allow dynamic-group ${oci_identity_dynamic_group.openshift_control_plane_nodes.name} to manage instance-family in compartment id ${var.compartment_ocid}
    
    Allow dynamic-group ${oci_identity_dynamic_group.openshift_control_plane_nodes.name} to manage security-lists in compartment id ${var.compartment_ocid}
    
    Allow dynamic-group ${oci_identity_dynamic_group.openshift_control_plane_nodes.name} to use virtual-network-family in compartment id ${var.compartment_ocid}
    
    Allow dynamic-group ${oci_identity_dynamic_group.openshift_control_plane_nodes.name} to manage load-balancers in compartment id ${var.compartment_ocid}
    
    Allow dynamic-group ${oci_identity_dynamic_group.openshift_control_plane_nodes.name} to manage objects in compartment id ${var.compartment_ocid}

• Cluster Resource Tagging Access Policy: This policy grants access to the control plane nodes to use the openshift-tags namespace to tag cluster resources.
  • Policy Name: ${var.cluster_name}_control_plane_nodes_tags
  • Compartment: Root compartment
  • Policy Statement:

    Allow dynamic-group ${oci_identity_dynamic_group.openshift_control_plane_nodes.name} to use tag-namespaces in tenancy

• (Optional) Networking Access Policy: This policy is required only if networking components are in a different compartment than the cluster instances.

  • Policy Name: ${var.cluster_name}_control_plane_nodes_networking_access_policy

  • Compartment: Networking compartment
  • Policy Statements:

    
    Allow dynamic-group ${oci_identity_dynamic_group.openshift_control_plane_nodes.name} to manage security-lists in compartment id ${var.networking_compartment_ocid}
    
    Allow dynamic-group ${oci_identity_dynamic_group.openshift_control_plane_nodes.name} to manage virtual-network-family in compartment id ${var.networking_compartment_ocid}  

To create cluster nodes for OpenShift Container Platform using the Agent-based Installer, you need a Compute service custom image that contains the Red Hat software needed to run the cluster nodes. To create this image, you need to do the following:

1. Create a discovery ISO image locally, using the openshift-install binary, available from Red Hat Hybrid Cloud Console. See Creating configuration files for installing a cluster on OCI (Red Hat documentation) (Red Hat documentation) for instructions.
2. Upload your discovery ISO image to OCI Object Storage. See Creating an Object Storage Bucket and Uploading an Object Storage Object to a Bucket for instructions.
3. Create custom image in the a Compute service based on the discovery ISO. See Managing Custom Images for instructions.

The Agent-based Installer requires two configuration files that must be edited so that you can use the Agent-based Installer to generate the discovery ISO image. These are the agent-config.yaml and install-config.yaml files. See Creating configuration files for installing a cluster on OCI (Red Hat documentation) for details.

After creating the agent-config.yaml and install-config.yaml files, save them locally. Your local directory structure must be as follows:

.
└── local_machine_work_directory/
    ├── agent-config.yaml
    ├── install-config.yaml
    └── openshift /
        ├── manifest.yml

Ensure that your firewall is configured to grant access to the sites that OpenShift Container Platform requires. See Configuring your firewall for OpenShift Container Platform (Red Hat documentation)for details on setting up your firewall's allowlist for OpenShift Container Platform.