William Caban Babilonia williamcaban

NOTE: This is an unofficial procedure. Do NOT use this outside a lab environment. The official procedure is described in the official OCP documentation -- https://docs.openshift.com/container-platform/4.3/machine_management/adding-rhel-compute.html

copy kubeconfig to /root/.kube/config 
copy pull secret to /tmp/pull.json

export MC_NAME=`oc get machineconfigpool worker --output=jsonpath='{.status.configuration.name}'`

oc get machineconfig $MC_NAME --output=json &gt; /tmp/worker.json

Setting up a dual-stack (ipv4 & ipv6) dnsmasq instance for OCP clusters

Allow the following ports and servcices in the bastion node

firewall-cmd --zone=public   --permanent --add-port=6443/tcp 
firewall-cmd --zone=public   --permanent --add-port=22623/tcp 
firewall-cmd --zone=public   --permanent --add-port=8080/tcp 
firewall-cmd --zone=public   --permanent --add-service=ssh
firewall-cmd --zone=public --permanent --add-service=cockpit

Export RHV/Ovirt VM to qcow2 format

Configure export domain in RHV or Ovirt
Export the VM to the export domain. A new directory with the vdisk uuid will be created and the VM will be exported to it.
- A sample export /exportfs/export_domain/<vdisk_uuid>/images/<disk_id>
Mount the export domain ito a Linux mcahine and go into the <vdisk_uuid>/images
In the folder there iwll be a file with a uuid representing the <disk_id> and a meta file
Use qemu-img convert to convert to qcow2 format

Combine the pull secrents from Quay and the one from the local registry

jq -s '.[0] * .[1]' pull-secret.json local-auth.json  > pull-secret-2.json

Mirror relrease

export AIRGAP_SECRET_JSON='pull-secret-2.json'

Disable DHCP Client on connected NICs

NOTE: The following procedure needs to be done modifying the Ignition files for the corresponding node type

To turn off the default of DHCP on connected interfaces if using static addressing:

/etc/NetworkManager.conf.d/disabledhcp.conf
[main]
no-auto-default=*

To validate API server is operational:

# If API server is operational you should be able to retrieve API version 
curl -k $(oc whoami --show-server)/version

# To catch the return code equals to 200
curl -o /dev/null -s -w "%{http_code}\n" -k $(oc whoami --show-server)/version

To validate the MachineConfigServer is operational:

# To apply as additional role to the node
oc label node <your-node-name> machineconfiguration.openshift.io/role=my-role

# To replace the role of the node
oc label node <your-node-name> machineconfiguration.openshift.io/role=my-role --override

In some baremetal and private Cloud deployments we need to force masters nodes to sync clocks. This is required by etcd and for the validity of the installation certs.

Force time sync

sudo chronyc -a makestep

To force clock update (without stepped updates) /etc/chrony.conf

	---
	apiVersion: v1
	kind: Namespace
	metadata:
	name: beyond-kvc
	---
	apiVersion: v1
	kind: ServiceAccount
	metadata:
	name: beyond-kvc-daemon

	#!/bin/sh

	IMAGES=`oc get is -o go-template --template="{{range .items}}{{.metadata.name}} {{end}}" -n openshift`

	for i in ${IMAGES}; do
	echo "Pulling: $i"
	./oc import-image $i --all -n openshift
	done