Installing a cluster on Oracle Cloud Infrastructure (OCI) by using the Agent-based Installer

Create a compartment and ensure you defined your Oracle® Cloud Identifier (OCID) in the compartment. A compartment is a component where you can organize and isolate your cloud resources. After you create a compartment, Oracle automatically assigns an OCID to your organization’s account. An administrator can access all compartments tagged to your organization’s OCI account.

Create a virtual cloud network (VCN). A compute instance, load balancer, and other resources need this network infrastructure to connect to each other over an internet connection. To establish an on-premise network you must manually create subnets, gateways, routing rules, and security policies. Ensure that you complete the following steps:

Create a network security group (NSG) in your VCN. You can use the NSG to establish advanced security rules for your network. You must locate the NSG in your compartment, so that certain groups can access network resources. Ensure that you complete the following steps:

Create a dynamic group that hosts compute instances. After you create the dynamic group, you can then create a policy statement that defines rules for your cluster environment. This statement sets the precedent for each compute instance to join your OpenShift Container Platform cluster as a self-managed node.

Create a policy statement. You must create a policy so that your administrator can grant access to your groups, users, or resources that operate in your network.

Create a load balancer, so that you can provide automated traffic distribution on your VCN.

Create three Domain Name System (DNS) records and then add the records to a DNS, so that Oracle’s edge-network can maintain your domain’s DNS queries.

For a disconnected environment, mirror the Mirror registry for Red Hat OpenShift to your local container image registry.

$ ./openshift-install version

./openshift-install 4.15.0
built from commit ae7977b7d1ca908674a0d45c5c243c766fa4b2ca
release image registry.ci.openshift.org/origin/release:4.15ocp-release@sha256:0da6316466d60a3a4535d5fed3589feb0391989982fba59d47d4c729912d6363
release architecture amd64

Configure the install-config.yaml configuration file to meet the needs of your organization.

# install-config.yaml
apiVersion: v1
baseDomain: <base_domain> (1)
networking:
  clusterNetwork:
  - cidr: 10.128.0.0/14
    hostPrefix: 23
  network type: OVNKubernetes
  machineNetwork:
  - cidr: <ip_address_from_cidr> (2)
  serviceNetwork:
  - 172.30.0.0/16
compute:
  - architecture: amd64 (3)
  hyperthreading: Enabled
  name: worker
  replicas: 0
controlPlane:
  architecture: amd64 (3)
  hyperthreading: Enabled
  name: master
  replicas: 3
platform:
   external:
    platformName: oci (4)
    cloudControllerManager: External
sshKey: <public_ssh_key> (5)
pullSecret: '<pull_secret>' (6)
# ...

Create a directory on your local system named openshift.

From the oracle-quickstart / oci-openshift GitHub web page, select the <> Code button and click Download ZIP. Save the archive file to your openshift directory, so that all the Oracle Cloud Controller Manager (CCM) and Oracle Container Storage Interface (CSI) manifests exist in the same directory. The downloaded archive file includes files for creating cluster resources and custom manifests.

Go to the custom_manifests web page on GitHub to access the custom manifest files.

Use the Agent-based Installer to generate a minimal ISO image, which excludes the rootfs image, by entering the following command in your OpenShift Container Platform CLI. You can use this image later in the process to boot all your cluster’s nodes.

$ ./openshift-install agent create image --log-level debug

Configure the agent-config.yaml configuration file to meet your organization’s requirements.

apiVersion: v1alpha1
metadata:
  name: <cluster_name> (1)
  namespace: <cluster_namespace> (2)
rendezvousIP: <ip_address_from_CIDR> (3)
bootArtifactsBaseURL: <server_URL> (4)
# ...

Apply one of the following two updates to your agent-config.yaml configuration file:

Set the following registry URLs for your firewall’s allowlist:

Set your firewall’s allowlist to include any site that provides resources for a language or framework that your builds require.

If you do not disable Telemetry, you must grant access to the following URLs to access Red Hat Insights:

Set your firewall’s allowlist to include the following registry URLs:

Set your firewall’s allowlist to include the following external URLs. Each repository URL hosts OCI containers. Consider mirroring images to as few repositories as possible to reduce any performance issues.

Upload the agent ISO image to Oracle’s default Object Storage bucket and then import the agent ISO image as a custom image to this bucket. You must then configure the custom image to boot in Unified Extensible Firmware Interface (UEFI) mode. See Creating a custom image and Using the Console in Oracle’s documentation.

After the image imports, go to the Edit image capabilities setting and ensure that only UEFI_64 is selected for the Firmware field.

For instructions on creating a compute instance from the supplied base image for your cluster topology, see Creating an instance in the Oracle documentation. The following OpenShift Container Platform cluster topologies are supported on OCI: