osdocs-627 disconnected install #16696

kalexand-rh · 2019-09-17T20:52:57Z

https://jira.coreos.com/browse/OSDOCS-627

openshift-docs-preview-bot · 2019-09-18T11:46:19Z

The preview will be available shortly at:

https://osdocs627--ocpdocs.netlify.com/

kalexand-rh · 2019-09-18T12:11:25Z

@umohnani8, will you PTAL?

umohnani8 · 2019-09-18T20:27:36Z

@wking @abhinavdahiya PTAL

wking · 2019-09-18T23:43:30Z

installing/installing_disconnected/installing-disconnected-aws.adoc

+include::modules/installation-generate-aws-user-infra.adoc[leveloffset=+1]
+
+// After the proxy change merges, I need to put it in and emphasize that you
+// must configure a proxy for the AWS mirrored content story.


You can use a proxy. I don't think you must use a proxy unless you close off enough network access that we need it to access the AWS IAM endpoints or something.

You're right, and I'm going to clarify the AWS proxy requirements and usage on https://bugzilla.redhat.com/show_bug.cgi?id=1743483

wking · 2019-09-18T23:49:27Z

installing/installing_disconnected/installing-disconnected-aws.adoc

+link:https://docs.aws.amazon.com/cli/latest/userguide/install-bundle.html[Install the AWS CLI Using the Bundled Installer (Linux, macOS, or Unix)]
+in the AWS documentation.
+* If you use a firewall, you must
+xref:../../installing/install_config/configuring-firewall.adoc#configuring-firewall[configure it to access Red Hat Insights].


What's this for? I wouldn't expect to need access to Insights. Currently the firewall docs just talk about Telemetry / updates, and neither of those are critical to install. The disabling-Telemetry docs talk about that in more detail, and I'd expect most disconnected folks to disable update downloads and Telemetry and Insights uploads. Maybe you want to talk about the pros, cons, and methods behind enabling/disabling each of those in the body of the doc, but I don't think we want to make a hard must statement here.

@wking, disabling telemetry is one of the optional next steps in the assembly. Do you have a bit more information that I can include to help the disconnected installers appreciate why they should disable telemetry?

The current disabling-telemetry docs focus on the pros of telemetry and cons of disabling it. But if you have no way to connect to telemetry, you don't have to think about it, you should just disable it. Still good to read about the cons, but no sense in having the telemeter container banging its head against the disconnected network every few minutes for the life of the cluster and alerting about those failures.

On the other hand, if you're just using mirrors for auditing/performance, and your cluster can still reach Red Hat's telemetry endpoints, you probably want to keep them enabled.

modules/installation-bare-metal-config-yaml.adoc

wking · 2019-09-18T23:54:25Z

modules/installation-initializing-manual.adoc

 it in the `<installation_directory>`.
 +
 [NOTE]
 ====
 You must name this configuration file `install-config.yaml`.
 ====
+ifdef::disconnected[]
+** You must provide the contents of the certificate for your mirror repository
+in the `additionalTrustBundle` section.


Only if your mirror certificate is not signed by a CA RHCOS trusts by default. Maybe weaken the "must"?

@wking, can you tell me a little more about how this workflow would work? I'm happy to soften that requirement, but I'd need to add some notes in other topics. (Like in the topic about setting up a mirror repo and probably elsewhere in the installation docs.)

If you're mirroring to a registry whose cert RHCOS trusts by default (e.g. from quay.io to docker.io), you don't need to add additional trust for your mirror registry.

I'm adding that exception.

wking · 2019-09-18T23:57:12Z

modules/installation-vsphere-config-yaml.adoc

 pullSecret: '{"auths": ...}' <12>
+endif::disconnected[]
+ifdef::disconnected[]
+pullSecret: '{"auths":{"<bastion_host_name>:5000": {"auth": "<credentials>","email": "you@example.com"}}}' <12>


In the earlier docs you were talking about appending the mirror creds to the cloud.openshift.com ceds, but this line here is just the mirror creds. That's fine if the cluster doesn't need to auth to any of the standard Red Hat services, but it's not going to work if there is proxy or whatever access and the cluster is supposed to be pushing Telemetry/Insights, pulling registry.redhat.io images, etc.

@wking, do we know which use case is more likely or preferred?

I dunno, but sounds like you're planning to address this with a note in a reroll.

In the "preparing" topic, I'm saying to use just the mirror creds, so I'm going to keep this reference as-is.

kalexand-rh · 2019-09-23T12:07:23Z

@openshift/team-documentation, PTAL

bobfuru

A few small comments but otherwise LGTM.

modules/installation-about-restricted-network.adoc

kalexand-rh · 2019-09-24T00:03:42Z

/cherrypick enterprise-4.2

openshift-cherrypick-robot · 2019-09-24T00:03:51Z

@kalexand-rh: new pull request created: #16822

In response to this:

/cherrypick enterprise-4.2

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

jianlinliu · 2019-09-26T07:47:55Z

installing/installing_restricted_networks/installing-restricted-networks-aws.adoc

+
+include::modules/installation-about-restricted-network.adoc[leveloffset=+1]
+
+include::modules/cluster-entitlements.adoc[leveloffset=+1]


Go through this section, seem like not suitable for disconnected install, especially for the following lines, though I am not expert for Telemetry part.
"""
Your machines must have direct internet access to install the cluster.

You must have internet access to:

Access the OpenShift Infrastructure Providers page to download the installation program Access quay.io to obtain the packages that are required to install your cluster Obtain the packages that are required to perform cluster updates Access Red Hat’s software as a service page to perform subscription management

"""

I opened a PR here to try to address this: #16985
If you have more feedback, please let me know!

jianlinliu · 2019-09-26T08:15:40Z

modules/installation-generate-aws-user-infra.adoc

+----
+
+Provide the contents of the certificate file that you used for your mirror
+registry.


Form customer perspective, I think we need make this be more clear. In this example, I think it is better to mention the certificate file is generated in step 3 of "Creating a mirror registry" section.

I'll improve the note, but I can't create a link to that step.

modules/installation-generate-aws-user-infra.adoc

jianlinliu · 2019-09-26T08:32:46Z

installing/installing_restricted_networks/installing-restricted-networks-aws.adoc

+
+include::modules/ssh-agent-using.adoc[leveloffset=+1]
+
+include::modules/installation-generate-aws-user-infra.adoc[leveloffset=+1]


In disconnected env, user probably need bring his/her own DNS, but not provisioned by ingress router, just like what is mentioned in https://bugzilla.redhat.com/show_bug.cgi?id=1743483#c20, so we need openshift/installer#2221, and mentioned that in the disconnected install doc. Once that, manifests/cluster-dns-02-config.yml also need to be removed in this step

@jianlinliu, does the whole file need to be removed? Just part of it's removed in that installer PR. I have a draft here: https://github.com/openshift/openshift-docs/pull/17190/files

Sorry, not remove the whole file, but change some line in manifests/cluster-dns-02-config.yml, will follow up in your new PR.

jianlinliu · 2019-09-26T08:50:14Z

installing/installing_restricted_networks/installing-restricted-networks-aws.adoc

+
+include::modules/installation-creating-aws-vpc.adoc[leveloffset=+1]
+
+include::modules/installation-cloudformation-vpc.adoc[leveloffset=+2]


If follow the same CF template and process to install cluster, personally I do not think it is meaningful to link a common UPI install here (except the part of consuming release image from mirror registry). From customer perspective, I will be more interested in what change should be applied once the installation is happening in restricted networks. The long document is easy to make user miss his/her focus.

The idea of the assembly is to provide all of the context that a user would need to complete the the installation. They shouldn't have to use the other assembly at all. Can you tell me more about the other improvements at the end of the process?

jianlinliu · 2019-10-09T11:03:16Z

_topic_map.yml

+#    File: installing-restricted-networks-preparations
+  - Name: Restricted network AWS installation
+    File: installing-restricted-networks-aws
+  - Name: Restricted network bare metal installation


@morenod Could you help review this part - upi install on baremetal in a restricted network (originally we call it 'disconnected')?

On "Sample install-config.yaml file for bare metal". Point 14: imageContentSources is a requirement?

What happens if quay.io connection is also not allowed from the host where installer is being executed and image have been already uploaded to the internal registry?

You still need to provide imageContentSources with the mirror mapping of quay.io and the internal registry to the install-config.yaml. This way you don't have to go in and manually change the names of the images to be internal-registry/internal-repo, it can still be quay.io/myrepo and with the mirror mapping, the installer will know to try the mirrored location (i.e the internal registry) first.

morenod · 2019-10-10T13:52:58Z

modules/installation-bare-metal-config-yaml.adoc

+- mirrors:
+  - <bastion_host_name>:5000/<repo_name>/release
+  source: quay.io/openshift-release-dev/ocp-release
+- mirrors:
+  - <bastion_host_name>:5000/<repo_name>/release
+  source: registry.svc.ci.openshift.org/ocp/release


Both examples of mirrors are the same, we need to provide different options on each mirror example or left just one

kalexand-rh added the branch/enterprise-4.2 label Sep 17, 2019

kalexand-rh added this to the Future Release milestone Sep 17, 2019

kalexand-rh self-assigned this Sep 17, 2019

openshift-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Sep 17, 2019

kalexand-rh force-pushed the osdocs627 branch 2 times, most recently from 8fb67ee to c10b0da Compare September 18, 2019 11:43

wking reviewed Sep 18, 2019

View reviewed changes

modules/installation-bare-metal-config-yaml.adoc Outdated Show resolved Hide resolved

wking reviewed Sep 18, 2019

View reviewed changes

openshift-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Sep 21, 2019

kalexand-rh added the peer-review-needed Signifies that the peer review team needs to review this PR label Sep 23, 2019

bobfuru reviewed Sep 23, 2019

View reviewed changes

modules/installation-about-restricted-network.adoc Outdated Show resolved Hide resolved

kalexand-rh force-pushed the osdocs627 branch from b8854dd to b848fc8 Compare September 23, 2019 23:56

openshift-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 23, 2019

osdocs-627 disconnected install

b7ca64c

kalexand-rh force-pushed the osdocs627 branch from b848fc8 to b7ca64c Compare September 23, 2019 23:59

openshift-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 23, 2019

kalexand-rh added peer-review-done Signifies that the peer review team has reviewed this PR and removed peer-review-needed Signifies that the peer review team needs to review this PR branch/enterprise-4.2 labels Sep 24, 2019

kalexand-rh merged commit f9b4091 into openshift:master Sep 24, 2019

kalexand-rh added the branch/enterprise-4.2 label Sep 24, 2019

kalexand-rh deleted the osdocs627 branch September 24, 2019 00:03

openshift-cherrypick-robot mentioned this pull request Sep 24, 2019

[enterprise-4.2] osdocs-627 disconnected install #16822

Merged

wking mentioned this pull request Sep 25, 2019

Add OLM disconnected config #16458

Merged

jianlinliu reviewed Sep 26, 2019

View reviewed changes

kalexand-rh mentioned this pull request Oct 4, 2019

restricted network updates #17055

Merged

jianlinliu reviewed Oct 9, 2019

View reviewed changes

morenod reviewed Oct 10, 2019

View reviewed changes

vikram-redhat modified the milestones: Future Release, OCP 4.2 GA Oct 16, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

osdocs-627 disconnected install #16696

osdocs-627 disconnected install #16696

kalexand-rh commented Sep 17, 2019

openshift-docs-preview-bot commented Sep 18, 2019

kalexand-rh commented Sep 18, 2019

umohnani8 commented Sep 18, 2019

wking Sep 18, 2019

kalexand-rh Sep 20, 2019

wking Sep 18, 2019

kalexand-rh Sep 21, 2019

wking Sep 21, 2019

wking Sep 21, 2019

wking Sep 18, 2019

kalexand-rh Sep 20, 2019

wking Sep 21, 2019

kalexand-rh Sep 21, 2019

wking Sep 18, 2019

kalexand-rh Sep 20, 2019

wking Sep 21, 2019

kalexand-rh Sep 21, 2019

kalexand-rh commented Sep 23, 2019

bobfuru left a comment

kalexand-rh commented Sep 24, 2019

openshift-cherrypick-robot commented Sep 24, 2019

jianlinliu Sep 26, 2019

kalexand-rh Oct 4, 2019

jianlinliu Sep 26, 2019

kalexand-rh Oct 4, 2019

jianlinliu Sep 26, 2019

kalexand-rh Oct 10, 2019

jianlinliu Oct 11, 2019

jianlinliu Sep 26, 2019

kalexand-rh Oct 4, 2019

jianlinliu Oct 9, 2019

morenod Oct 10, 2019

umohnani8 Oct 10, 2019

morenod Oct 10, 2019


		include::modules/installation-about-restricted-network.adoc[leveloffset=+1]

		include::modules/cluster-entitlements.adoc[leveloffset=+1]


		include::modules/ssh-agent-using.adoc[leveloffset=+1]

		include::modules/installation-generate-aws-user-infra.adoc[leveloffset=+1]


		include::modules/installation-creating-aws-vpc.adoc[leveloffset=+1]

		include::modules/installation-cloudformation-vpc.adoc[leveloffset=+2]

osdocs-627 disconnected install #16696

osdocs-627 disconnected install #16696

Conversation

kalexand-rh commented Sep 17, 2019

openshift-docs-preview-bot commented Sep 18, 2019

kalexand-rh commented Sep 18, 2019

umohnani8 commented Sep 18, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kalexand-rh commented Sep 23, 2019

bobfuru left a comment

Choose a reason for hiding this comment

kalexand-rh commented Sep 24, 2019

openshift-cherrypick-robot commented Sep 24, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment