Skip to content

openshift-snc.md

Latest commit

 

History

History
134 lines (102 loc) · 5.02 KB

openshift-snc.md

File metadata and controls

134 lines (102 loc) · 5.02 KB
Raw

Overview

This action provisions a single-node OpenShift cluster on IBM Cloud VPC, using bundles from the SNC project. The VM is created from a catalog image and assigned a floating IP for direct SSH and Kubernetes API access.

The catalog image is automatically discovered by querying the IBM Cloud Catalog Management API. When --version is omitted, the latest available version is selected by semver.

Prerequisite

A catalog image must be generated from the SNC bundle and published to an IBM Cloud private catalog. This can be done with cloud-importer:

cloud-importer openshift-local ibmcloud \
    --arch x86_64 \
    --bundle-url https://developers.redhat.com/content-gateway/file/pub/openshift-v4/clients/crc/bundles/openshift/4.22.14/crc_libvirt_4.22.14_amd64.crcbundle \
    --shasum-url https://developers.redhat.com/content-gateway/file/pub/openshift-v4/clients/crc/bundles/openshift/4.22.14/sha256sum.txt \
    --backed-url file:///Users/tester/workspace \
    --output /tmp/snc

The resulting catalog image must be named following the pattern openshift-local-<version>-<arch> (e.g. openshift-local-4-22-14-x86-64) for auto-discovery to work.

Environment variables

Variable Required Description
IBMCLOUD_API_KEY yes IBM Cloud API key
IC_REGION yes IBM Cloud region (e.g. us-south, eu-de)
IC_ZONE yes Availability zone (e.g. eu-de-2)
IBMCLOUD_COS_ACCESS_KEY_ID only with S3 --backed-url HMAC access key for IBM Cloud Object Storage
IBMCLOUD_COS_SECRET_ACCESS_KEY only with S3 --backed-url HMAC secret key for IBM Cloud Object Storage
IBMCLOUD_COS_ENDPOINT no COS S3 endpoint (defaults to s3.<region>.cloud-object-storage.appdomain.cloud)

Create

mapt ibmcloud openshift-snc create \
    --project-name my-snc \
    --backed-url file:///workspace \
    --conn-details-output /tmp/snc \
    --version 4.22.14 \
    --pull-secret-file /path/to/pull-secret

With spot instances:

mapt ibmcloud openshift-snc create \
    --spot \
    --version 4.22.14 \
    --project-name my-snc \
    --backed-url file:///workspace \
    --conn-details-output /tmp/snc \
    --pull-secret-file /path/to/pull-secret

Outputs

Files written to the path defined by --conn-details-output:

File Description
host Floating IP of the instance
username SSH username (core)
id_rsa Private key for the instance
kubeconfig Kubeconfig for the cluster (API server points to the floating IP via nip.io)

Pulumi passphrase handling

The IBM Cloud workflow uses printf %q to embed the passphrase safely in a shell command. For example, the passphrase foo&bar appears in that command as foo\&bar; after shell parsing, Pulumi receives the original foo&bar.

JSON may show the same value as foo\u0026bar. This is not a different passphrase: \u0026 is JSON's escape sequence for one &. If you copy a passphrase from JSON output, decode it first and use the decoded value, such as foo&bar. Do not copy \u0026 as part of the passphrase. Pulumi uses the exact UTF-8 bytes of the passphrase and does not normalize Unicode, so foo&bar and foo\u0026bar are different passphrases and produce different encryption keys.

Container

podman run -d --name ibmcloud-snc \
        -v ${PWD}:/workspace:z \
        -e IBMCLOUD_API_KEY=XXX \
        -e IC_REGION=eu-de \
        -e IC_ZONE=eu-de-2 \
        quay.io/redhat-developer/mapt:v1.0.0-dev mapt ibmcloud openshift-snc create \
            --project-name ibmcloud-snc \
            --backed-url file:///workspace \
            --conn-details-output /workspace \
            --version 4.22.14 \
            --pull-secret-file /workspace/pull-secret

SSH access

OUTPUT=/path/to/conn-details-output

ssh -i ${OUTPUT}/id_rsa \
    -o StrictHostKeyChecking=no \
    core@$(cat ${OUTPUT}/host)

Kubernetes access

OUTPUT=/path/to/conn-details-output

export KUBECONFIG=${OUTPUT}/kubeconfig
oc get nodes

Profiles

Profiles are optional addons installed on the cluster after it is ready. They work identically to the AWS SNC profiles:

mapt ibmcloud openshift-snc create \
    --version 4.22.14 \
    --project-name my-snc \
    --backed-url file:///workspace \
    --conn-details-output /tmp/snc \
    --pull-secret-file /path/to/pull-secret \
    --profile virtualization

See the AWS SNC docs for the full list of available profiles and operator override flags (--operator-channel, --catalog-source).

Destroy

podman run -d --name ibmcloud-snc \
        -v ${PWD}:/workspace:z \
        -e IBMCLOUD_API_KEY=XXX \
        -e IC_REGION=eu-de \
        quay.io/redhat-developer/mapt:v1.0.0-dev mapt ibmcloud openshift-snc destroy \
            --project-name ibmcloud-snc \
            --backed-url file:///workspace