Building the Installation Host¶

The installation host serves multiple purposes. All install work is done here. It is used to validate the environment prior to installation and provides tools for generating the ISO images.

The installation host can be a bare metal or virtualized host and only requires what is needed for a normal Red Hat Enterprise Linux install. See Infrastructure for the recommended hardware specifications. It should be on the same network as the targeted hosts for the OpenShift cluster install so it can be used to validate the firewall is open prior to installation.

Install the OS¶

Download Red Hat Enterprise Linux 9.x Binary DVD
Boot host from ISO and perform install as Server with GUI
Enable SSH for the newly created user and make them an administrator
Reboot and SSH into the installation host

Register the Host¶

sudo subscription-manager register
sudo subscription-manager repos --enable=rhel-9-for-x86_64-baseos-rpms
sudo subscription-manager repos --enable=rhel-9-for-x86_64-appstream-rpms
sudo dnf update -y
sudo reboot

Download Required Tools¶

OCP_VERSION=4.22
wget "https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/stable-${OCP_VERSION}/openshift-install-linux.tar.gz" -P /tmp
sudo tar -xvzf /tmp/openshift-install-linux.tar.gz -C /usr/local/bin
wget "https://mirror.openshift.com/pub/openshift-v4/clients/ocp/stable-${OCP_VERSION}/openshift-client-linux.tar.gz" -P /tmp
sudo tar -xvzf /tmp/openshift-client-linux.tar.gz -C /usr/local/bin
rm -f /tmp/openshift-install-linux.tar.gz /tmp/openshift-client-linux.tar.gz
sudo dnf install -y nmstate git podman wget jq skopeo nmap-ncat

Verify the tools are installed:

openshift-install version
oc version
nmstatectl version
git -v
podman --version
skopeo --version
jq --version
nc -h >/dev/null && echo "ncat: ok"

Download the Pull Secret¶

Download the pull secret from console.redhat.com. On the download page, click Download pull secret and save the JSON file:

# Paste the downloaded JSON into this file, then restrict permissions
cat > ~/pull-secret.txt
# Press Ctrl+D when finished pasting
chmod 600 ~/pull-secret.txt

Confirm it is valid JSON:

jq -e . ~/pull-secret.txt >/dev/null && echo "pull secret OK"

Create an SSH Key¶

An SSH key is required to access the OpenShift hosts for debugging and is required as part of the install.

ssh-keygen -t ed25519 -f ~/.ssh/ocp

Open Port 8080 for ISO Hosting¶

The web interfaces for BMCs can sometimes be flaky when uploading ISOs for boot. Serve the ISO from an HTTP host using Podman.

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload

Firewall Checks¶

Inter-Node Firewall Ports¶

The required ports between cluster nodes are listed on the Networking — Required Firewall Ports page.

To verify ports are not blocked between hosts, boot the target from a RHEL live ISO (the same ISO used for NIC/disk discovery) so it has a shell. Then start a temporary listener on the target and connect from the source:

# On the target host (live ISO) - start a listener on port 6443
nc -l 6443

# On the source host - test connectivity to the target
nc -zv {{ target_ip }} 6443

If the connection succeeds, no firewall is blocking that port between the two hosts. Repeat for critical ports (6443, 22623, 2379, 10250) across all node pairs.

Outbound Access¶

The cluster nodes and installation host need outbound HTTPS (port 443) access to Red Hat registries, update services, and telemetry endpoints. See the Networking — Outbound Access page for the full list of required endpoints.

Connectivity Checks¶

for domain in registry.redhat.io access.redhat.com quay.io cdn.quay.io cdn01.quay.io cdn02.quay.io cdn03.quay.io cdn04.quay.io cdn05.quay.io cdn06.quay.io sso.redhat.com api.openshift.com console.redhat.com mirror.openshift.com quayio-production-s3.s3.amazonaws.com rhcos.mirror.openshift.com cert-api.access.redhat.com api.access.redhat.com infogw.api.openshift.com; do
  nc -zv -w 2 $domain 443 2>&1 | grep -iqE "connected|succeeded|open" && echo "$domain: SUCCESS" || echo "$domain: FAILED"
done

You can also login with your Red Hat account using podman:

podman login registry.redhat.io

Details¶

Environment Validation Tools¶

Make sure you can validate connectivity:

curl -vk https://registry.redhat.io/v2/
dig registry.redhat.io +short
nslookup registry.redhat.io
podman login registry.redhat.io

Company Image Considerations¶

If using a company RHEL image, ensure any processes that may interfere with web hosting or the other install processes are turned off.