►
Description
Last year, over the course of several episodes, we discussed many of the different installation platforms available for OpenShift. Since then there have been some updates, changes, and newly added capabilities. This episode will focus on those changes, highlight some new options, and provide some guidance on choosing an infrastructure and install method for your clusters.
About Ask an OpenShift Admin:
Do you have questions? We want to answer them! Every Wednesday at 11am ET, hosts Andrew Sullivan and Chris Short sit down to answer your questions about Red Hat OpenShift.
Follow us:
Andrew Sullivan https://twitter.com/practicalandrew
Chris Short https://twitter.com/chrisshort
Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_c...
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
Openshift.com https://red.ht/33Fh6uV
OpenShift on github https://github.com/openshift/
OpenShift on redhat.com https://red.ht/2o4ccDk
#RedHat #OpenShift #Kubernetes
A
Going
live
good
morning
good
afternoon
good
evening,
wherever
you're
healing
from
welcome
to
another
edition
of
ask
an
open
shift
admin.
I
am
chris
short
executive
producer
of
openshift
tv
and
I
am
joined
by
the
one
and
only
andrew
sullivan
andrew.
We
have
a
special
guest
on
today.
Please
introduce
yourself
and
our
guest.
B
B
B
So
what
that
means
is
that
we
are
here
to
answer
any
of
the
things
that
are
on
your
mind,
right
whatever
it
is.
That
is
bothering
you
that
comes
to
mind.
Whatever
questions
you
happen
to
have
you've
got
three
experts
here.
Catherine
is
somebody
that
I
rely
on
pretty
heavily
to
help
answer
questions
to
reassure
me
that
I
am
either
right
or
wrong,
as
the
case
may
be.
B
So
if
you
recall
last
year,
kind
of
the
some
of
the
first
episodes
that
we
did
here
of
the
ask
an
openshift
admin
live
stream
back
when
it
was
called
the
openshift
admin
office
hours.
We
talked
about
installers.
We
talked
about
the
install
process.
We
kind
of
did
a
bit
of
a
deep
dive
down
into
that
and
all
the
different
things
that
are
going
on
inside
of
there.
But,
of
course,
things
change.
There's
been
some
new
things.
There's
been
some
old
things
that
have
changed.
C
B
All
right
so
we'll
get
to
that
in
just
a
moment.
We'll
talk
about
the
install
process,
we'll
talk
about
you
know
a
day
in
the
life
of
catherine,
which
is
I'm
sure,
even
more
chaotic
than
chris,
and
I
but
first
you
know
in
in
long-standing
tradition
the
things
that
are
top
of
mind
things
that
have
come
up
recently
that
I
want
to
highlight
and
make
sure
that
you
all
are
aware
of.
B
B
I
don't
know
if
I
think
it
was
futurama
right
where,
where
bender
was
the
you
know,
you
know
you've
done
it
right
if
nobody
thinks
you've
done
anything
at
all
right,
that's
a
good
administrator!
If
everybody
goes
what's
that
guy
doing
here,
you
know
that
means
that
you're,
you
know,
nothing's
broken,
that's
a
good
thing.
So
a
couple
of
things.
So
I
got
asked
this
comes
up
periodically
around
the
intri
vmware
storage
provisioner.
B
So
when
we
deploy
a
cluster
that
is
vsphere
integrated,
so
vsphere
ipi,
vsphere
upi,
we
configure
the
entry
storage
provisioner
and
that
provisioner,
if
you
look
in
the
upstream
docs,
supports
some
things
or
is
capable
of
doing
some
things
that
openshift
doesn't
support
or
is
not
capable
of
doing
so.
Things
like
multi-drs
cluster
multi-v
center.
B
Importantly
things
like
storage,
drs
clusters,
so
I
saw
at
least
one
example
this
week
where
the
customer
was,
I
think
they
did
a
upi
install
and
they
were
able
to
successfully
deploy
using
a
datastore
cluster.
However,
what
happened
is
storage,
drs
did
what
storage
drs?
Does
it
moved
one
of
the
disks
for
a
virtual
machine
and
it
caused
a
ripple
of
things
to
happen,
not
the
least
of
which
was
there
was
a
bunch
of
pvs
that
wouldn't
connect
because
it
lost
track
of
where
they
were
at.
B
The
second
thing
that
I
had
was:
oh
somebody,
sent
me
an
email,
so
one
of
our
ibm
compatriots
sent
me
an
email
asking
about
examples
for
deploying
the
registry
and
using
storage,
non-default
storage
or
other
storage
that
is
configured
so
we
were
chatting
about
this
before
the
show
started
and
catherine
very
kindly
corrected
me
in
that
when
the
cluster
is
after
the
cluster
is
deployed,
the
registry
operator
kind
of
detects
what
infrastructure
it's
on
and
then
configures
the
storage
appropriate
for
that
and
catherine.
I'm
gonna
help
help
to
keep
me
honest
here.
B
So
basically,
if
it
says
hey
I'm
on
azure,
it
does
things
like
talks
to
the
credential
mentor
and
says:
hey.
Please
give
me
some,
you
know:
azure
object,
storage
or
whatever
storage
credentials,
so
I
can
request
my
pvc
or
connect
to
that
object,
storage
and
then
goes
through
and
configures
all
of
that.
But
what,
if
I
want
to
do
something
different?
How
can
I
do
that?
B
C
Yeah
so
the
way,
the
way
it
works,
I'm
just
really
quick
not
to
spend
too
much
time
on
it,
but
yeah
when,
when
any
of
the
openshift
components
require
cloud
api
access,
they
will
request
a
credentials
request.
That,
essentially,
is
what
gives
them
enough
credentials
to
go,
create
the
the
resources
that
need
so
in
the
case
of
azure,
since
you
brought
that
up,
that
would
be
its
own
storage
account
so
from
there
once
it
has
the
permissions.
C
B
That's
great,
thank
you.
So
the
last
thing
that
I
have
is
something
that
just
came
out
this
morning.
It
was
shared
by
chris
and
I's
teammate,
eric
jacobs,
who
also
has
a
live
stream
or
two
or
five
on
here
yeah,
so
chris
or
chris.
So
eric
has
been
working
in
conjunction
with
kirsten
newcomer
and
a
handful
of
other
folks
around
updating
what
we
call
the
red
hat,
openshift,
container
platform
architecture,
design
guide
for
pci
dss,
which
is
a
huge
mouthful
yeah
effectively.
B
If
you
are
a
customer
who
is
interested
in
or
has
pci
dss
requirements,
this
is
meant
to
help
you
with
that
architecture
process
right.
How
do
I
design
deploy
manage
my
openshift
deployment
within
those
constraints,
so
I
posted
the
link
to
that
into
the
chat
there
be
sure
to
check
it
out.
If
you
have
any
questions,
feel
free
to
reach
out
to
me
or
chris
andrew.sullivan
redhat.com
chris.short
at
redhead.com.
A
B
We're
only
this
is
what
episode
25
yeah,
we're
only
25
of
us,
so
episodes,
maybe
in
another
25
I'll,
get
it
yeah,
eventually
all
right.
So
I
see
there's
a
couple
of
questions
already,
so
I
I
think
we
should
go
ahead
and
address
those
and
then
we
can,
you
know,
go
from
there
and
and
again,
please
at
any
time
feel
free
to
ask
any
questions
that
you
have
whether
or
not
they're
related
to
today's
topic.
B
A
B
A
B
Yeah
as
I'm,
I
I
spent
a
little
bit
of
time
yesterday,
planning
out
shows
planning
out
episodes
for
the
rest
of
this
quarter.
So
I
think
I'm
going
to
tack
that
migration
topic
on
to
the
end,
so
hopefully,
sometime
in
june,
we'll
be
able
to
cover
that
here
on
this
show.
Okay,
let's
see
another
question
we
had
from
dean.
If
I
use
the
assisted
installer
with
bare
metal,
how
can
I
add
a
new
node
post
installation,
so
catherine
I'll
I'll?
C
Yeah,
I
believe
so
so
it
actually
can
be
done
a
couple
different
ways.
I
believe,
assisted
installer
itself.
You
could-
and
this
isn't
something
I'm
involved
with,
but
I'll
sort
of
you
know
fumble
through
it
as
best
as
I
can.
I
believe
you
can
still
use
the
bootable
assets
under
or
whatever
they
call
it.
The
boot
media,
I
guess,
is
the
right
iso
that
they
give
you
yeah
yeah
yeah.
So
you
can.
C
You
can
still
stand
up
nodes
and
adam
in
that
way,
but
you
actually
really
don't
have
to
it's
an
open
ship
cluster.
At
the
end
of
the
day,
all
you
really
need
to
know
is
booting
of
the
operating
system
and
where
to
go,
get
the
ignition
and
the
ignition
is
always
hosted
on
the
the
master
nodes.
So
there's
a
ignition
boot
service
that
you
can
you
can
leverage,
so
it's
no
different
from
whether
you
do
it
on
day,
one
or
you
do
it
on
day
27.
C
C
You
can
use
machine
sets,
but
essentially
all
it
really
is
is
you're
passing
a
user
data
field
to
that
node,
which
is
a
location
where
to
go,
get
its
ignition
config
so,
depending
on
the
the
node
node's
role
on
whether
it's
a
worker
or
a
master.
In
the
case
of,
if
you
had
to
replace
the
control
plane
mode,
you
would
boot
with
that
ignition.
C
C
C
B
C
C
And-
and
they
you
know,
they
call
it
assist
installer.
So
the
way
I
describe
upi
to
people
is
user
provision.
Infrastructure
is
essentially
like
no
installation
right,
there's
no
installer
you're,
just
getting
all
the
necessary
artifacts
that
you
need
to
bring
up
a
cluster,
but
from
there
you're
responsible
for
provisioning
everything
right
right
with
ipi.
Obviously,
that's
full
stack,
automation,
that's
means
it's
provisioning,
everything
for
you,
it
automatically
just
comes
up
and
you
have
a
running
cluster,
so
assistant
installer
is
really
kind
of
the
middle
of
the
road
right.
C
Where
you
have
the
notion
of
you
know
boot,
media
or
isos
those
nodes
boot
up.
They
essentially
establish
identity
going
by
connecting
back
to
the
service,
and
then
you
form
a
cluster
based
on
where
you're
sort
of
running
those
those
images,
so
it
it
makes
it
a
lot
easier,
as
opposed
to
manually
having
to
go
to
each
node
and
sort
of
provision
it
right.
So
again,
anyway,.
B
Yeah,
so
I
noticed
there
you,
you
answered
or
probably
out
of
habit
at
this
point.
What
I
can
only
imagine
is
your
most
frequently
you
know
asked
and
answered
question,
which
is
the
difference
between
ipi
and
upi.
So
I
I
have
a,
I
guess,
two
questions
related
to
that.
So
one
from
from
your
perspective
are
there
you
know
advantages
or
disadvantages
to
one
install
method
versus
the
other,
and
then
the
second
part
or
the
follow-on
to
that
is.
Is
there
a
difference
in
the
cluster
that
gets
provisioned
right
at
the
end
of
that.
C
Yeah,
that's
a
that's
a
great
question.
You
know
it.
Definitely,
I
think,
there's
a
large
perception
that
upi
is
inferior
to
ipi.
I
would
argue
the
other
direction.
Ipi
is
probably
more
inferior
to
upi
and
the
fact
that
it's
a
bit
more
prescriptive
right.
We
we
try
to
you,
know
get
the
80.
I
think
the
best
way
to
describe
is
the
80
use
case
like
the
80
of
customers,
what
they're
intending
to
use
for
options
and
settings
on
their
deployment.
C
C
That's
actually
customizing
of
the
infrastructure
that
open
shift
runs
on,
so
the
resulting
cluster
itself
isn't
doesn't
necessarily
have
to
be
different
and
well
the
docs
sort
of
explain
it
to
the
maybe
the
far
extreme
of
you
manually
provision,
everything,
including
your
nodes,
your
control,
plane,
nodes
and
everything
else
it
actually
doesn't
have
to.
So
you
can
still
use
some
of
the
ipi
functionality
in
a
upi
cluster
and
you
can
actually
do
it
on
day.
One
for
example
say
you
wanted
to
do
machine
set
creation.
C
C
You
could
actually
instead
apply
the
machine
sets
and
then
the
cluster
would
go
off
and
provision
in
the
case
where
there
is
a
machine
api
provider
available
for
the
the
the
platform
you're
deploying
on
so
you
know,
the
case
would
be
like
vmware
or
aws
or
gcp
or
azure,
etc.
So
you
can
make
those
clusters
look
nearly
identical,
I
would
say:
there's
probably
a
small
small,
really
tiny
differences,
but
not
enough
from
an
operational
perspective.
These
clusters
will
perform
identically.
You
can
have
elastic
in
dynamic,
compute
capacity
same
way.
C
You
can
do
an
ipi
and
you
get
the
the
the
advantage
of
being
able
to
customize
the
infrastructure
in
cases
where
you
wouldn't
be
able
to
do
this
with
ipi.
There's
a
lot
of
cases
where
that
may
be
more
beneficial
to
do
it
in
upi
and
sort
of
script
it
for
your
organization,
as
opposed
to
trying
to
make
ipi
fit
a
model
that
it's
really
not
intended
for.
B
B
So
I
definitely
want
to
talk
about
that
a
little
bit
so
dean
dean
has
a
question
here
which
you
you
kind
of
partially
answered.
So
why
do
we
consider
upi
to
be
superior?
Will
an
ipi
amount
allows
automatically
scaling
nodes
using
effectively
an
oc
command
you
know,
and
whereas
with
upi
you
know
he's
saying
you
have
to
do
your
own
automation,
which
I
see
christian
and
chris,
are
chatting
down
below
saying
that.
B
C
Yeah,
so
the
the
reason
for
that
has
to
do
with
the
provisioning
technology
under
the
covers,
so
ecm
doesn't
require
ipi.
It
requires
ipi
to
be
able
to
provision
a
cluster,
but
it
doesn't
require
ipi
to
adopt
a
cluster,
so
you
could
still
do
a
upi
deployment
adopt
that
deployment
for
management
through
acm.
C
C
You're
gonna,
be
your
own
admin,
your
own
sort
of
controller
of
how
you
want
that
to
look
like
you
know
what
you
know,
what
shape
what
size
whatever
and
that's
where
you
know
you
could
still
look
at
automating
the
provisioning.
A
good
example
is
say:
you're
on
aws.
We
provide
cloud
formation
templates
that
will
pretty
much
you
follow.
You
know
one
by
one,
there's
six
stacks:
you
would
get
a
running
functioning
cluster,
but
do
you
really
need
to
have
six
confirmation
stacks?
No,
actually,
not
you
could
you
could
tie
it
into
all
different.
C
You
know
one
script
with
a
couple
questions
and
it
would
look
just
like
ipi
at
the
end
of
the
day,
you'd
have
an
identical
cluster.
You
can
absolutely
do
that.
So
that's
the
case
where
you
really
need
that
customization
and
that's
why
it
won't
work
with
acm
is
because
it
doesn't
know
that
special
infrastructure
customization.
C
B
B
B
Red
hat's
multi-cluster
management
tool
so
effectively
right.
It's
a
management
plane
where
you
either
create
rate
deploy
as
catherine
was
saying,
or
join
existing
openshift
clusters
into
that
management
plan,
and
then
you
can
do
things
like
manage
right,
apply.
Security
policies
apply
rbac
et
cetera
across
all
of
those
member
clusters,
so
kind
of
walking
through
you
know,
with
with
that
set
so
dean
here
is
saying
things
like
cluster
pooling
are
coming
out.
That
will
require
ipi,
I'm
not
familiar
with
acms
roadmap.
A
B
Well,
I'm
I'm
assuming
what
you're
saying
here
is
that
acm
has
a
feature
called
cluster
pooling
that
will
use
ipi
and
what
what
dean's
building
here
is
a
case.
I,
I
guess,
against
catherine's
statement
that
upi
is
the
superior
method
which
I
will
say
that
I
I
I
agree,
but
it's
like
a
51
to
49
degree.
I
I
agree
because
the
the
flexibility
and
the
scalability
particularly
or
I
should
say
the
simplicity
around
upi.
I
find
to
be
better
particularly
the
load
balancer
aspect
right.
B
Yes,
there's
an
integrated
load
balancer
that
comes
with
ipi.
It
is
fairly
limited,
both
in
scale
as
well
as
in
configuration,
whereas
with
upi.
You
can
configure
that.
However,
you
like
in
whatever
manner
you
want
and
still
add
machine
sets
day,
two
to
be
able
to
get
the
cluster
auto
scaling.
So
I'll
take
a
step
back
now.
Catherine,
if
you
you
know,
do
you
have
any
thoughts?
Do
you
have
anything
to
add
there.
C
Yeah
yeah
you,
you
started
hitting
that
nail
on
the
head
with
that
one.
So
the
reason
why
I
still
stand
by
that
comment
is
ipi
is
good
for
a
certain
prescriptive
use
case
and
I,
I
would
say,
we're
trying
to
get
better
and
expanding
that
out
and
I
think
the
metrics
we've
we've
sort
of
seen
on
you
know
who's
using
what
whether
upi
versus
ipi,
we're
starting
to
see
a
definitely
an
uptick
in
ipi.
Don't
get
me
wrong!
We
want
people
to
use
ipi,
it's
a
lot
more.
C
It's
a
lot
easier
process
right,
so
I
I'm
not
trying
to
argue
there.
But
if
you
look
in
terms
of
what
you
can
do
with
one
versus
the
other
one
ups,
actually
the
more
superior
one,
you
can
pretty
much
do
anything
you
want
a
good
example
is
so
not
just
the
built-in
internal
load,
balancer
and
dns
functionality
that
we
have
with
ipis
actually
for
all
the
on-premise
ones,
but
even
in
the
cloud
you
run
into
the
same
scenario
so
say.
C
C
So,
like
I
think,
that's
where
the
the
you
know
a
lot
of
the
differences
are,
one
is
like
you
know,
we
give
you
what's
the
term,
we
give
you
the
bullets,
we
give
you
the
gun
and
we
let
you
use
it
any
way
you
want,
whereas,
whereas
ibi
we
put
one
in
the
chamber
and
we
point
the
gun,
so
we
we
make
sure
you
don't
get
hurt
with
it.
So
that's
that's
a
big
difference
in
kind
of
how
you
can
do
it.
C
One
is
pretty
much
the
flexibility
to
do
anything
you
want
with
the
the
risk
of
it's,
you
know
could
be
a
lot
more
complex
or
it
can
be.
You
know,
sort
of
is
as
custom
as
you
want.
I
guess
you
know.
Customization
adds
complexity
right,
just
as
a
sort
of
fundamental
statement,
whereas
we
look
at
ipi
as
sort
of
the
most
robust,
near
reliable,
almost
perfect
way
to
get
a
cluster
100
of
the
time.
C
But
we
limit
what
you
can
do
as
part
of
that
initial
bring
up
and
then
everything
else
that
doesn't
fit.
This
is
probably
another
majorly
important
distinction
is
installation
in
openshift.
4
has
really
gotten
a
lot
more
simplistic.
We
purposely
prevent
a
lot
of
options
from
getting
in
the
installer
on
day
one
and
we
push
those
to
day
two
and
the
only
really
sort
of
guidelines
we
have
is
that
you
know
this
feature
is
prolific
like
everyone
wants
it.
C
B
Good,
so
I
I
want
to
poke
on
that.
Just
a
little
bit
of
you
know
I
I
know
we've
discussed.
You
know
here
on
the
ask:
an
admin
live
stream.
Before
of
you
know
the
mic,
with
the
change
from
openshift
three
to
openshift
four,
we
went
from
ansible
playbooks
that
had,
I
think
somebody
told
me
1200,
plus
options
that
you
could
set
in
the
in
the
values.yaml
or
preferences
or
whatever
it
was
right
to
you
know:
openshift
install
in
version
4,
where
you
know
the
install
config.
B
None
of
it
succeeds,
whereas
with
four,
if
the
cluster
install
succeeds,
great
you've
got
a
running
cluster,
and
now
you
can
go
through
that.
You
know
hopefully
not
but
potentially
iterative
process
of
deploying
all
those
add-on
services
so
and
where
I'm
going
with.
All
of
that
is
we
sometimes
get
asked
and
catherine
you
and
I
have
had
these
conversations
before
like
partners,
will
ask
well
hey,
I
want
to
add
and
customers
as
well.
B
I
want
to
add-
maybe
you
know
configuring
my
load
balancer,
my
external
load
balancer
as
a
part
of
the
installer
right
I
want.
I
want
open
shift
install.
I
want
there
to
be
a
stanza
for
my
f5,
so
it'll
go
out
and
configure
the
f5.
Can
we
add
that?
Why
can't
we
do
that
type
of
stuff?
So
I
I
appreciate
your
thoughts,
your
perspective
on
that.
C
Yeah,
it's
it,
that's
a
that's
a
great
way.
To
put
it,
I
I
don't
know
that
it
was
1200,
but
if
it
is,
that's
awesome
I
know
it's.
I
know
it's
many
many
hundreds
put
it
that
way.
So
you
know
that
was
always
the
thing.
I
think
a
lot
of
this.
I
I
sort
of
inherited
the
installer
midway
through
three
direct
stays.
C
So
can't
necessarily
blame
anyone
or-
or
I
don't
want
to
shift
the
blame
anyone,
but
it
was
always
that
one
more
option
it
was
just
one
more
option.
I'd
have
the
cluster
the
way
we
wanted
it
for
this
customer
and
what
we
did
is
a
lot
of
snowflakey
things
where
it
was
unique,
special
really
wasn't
generally
applicable,
but
that
one
customer
had
that
option.
You
know
it
was
all
written
and
ansible
everyone
could
change
it,
they
could
submit
pr.
So
it
was.
C
It
ended
up
kind
of
getting
to
this
point
where
the
reliability
suffered
a
lot
because
of
the
permeation
of
different
options
and
then,
which
ones
could
be
you
know,
put
in
the
same
different
combination
would
cause
different
results,
so
that
was
a
that
was
a
pretty
tricky
problem
and
as
we
get
to
four
we've
really
we've
been
strict.
One
of
the
things
that
we
don't
allow
is
any
flags
whatsoever.
C
I
think
there's
there's
probably
like
two
flags
in
the
whole
installer,
I
know
like
you
know:
minus
minus
durr
is
to
get
the
directory
and
I
want
to
say,
there's
a
there's
one
or
two
other
like
log
level
and
things
like
that,
but
there's
very
little
and-
and
you
know,
we've
gotten
the
the
factions
that
oh,
we
could
just
you
know,
parameterize
it
we'll
just
put
a
bunch
of
tags
or
cv
flags
and
we'll
we'll
just
we'll
be
able
to
just
run
it
without.
You
know
changing
anything
we're
like,
but
that's
not
the
api
right.
C
You
know
the
the
when
you
run
this
command
and
you
basically
fill
out
all
the
options
you're
getting
a
cluster
right
and
unless
it's
something
you
know
broke
or
missed
permissions,
or
you
know
we
we're
trying
to
check
more
and
more
and
more
validation
on
this
environment.
So
once
a
hundred
percent
perfect,
but
it's
significantly
more
reliable,
so
we've
sort
of
shifted
the
problem
now
from
day,
one
to
understanding
how
you
can
figure
kubernetes
on
day
two
and
that
that's
always
been
a
struggle
right,
because
we
sort
of
looked
at
a
knob
bell
and
whistle.
C
It
makes
it
easier
on
day
two,
but
we
sort
of
broke
the
installer
by
making
it
more
complex.
So
that's
been
a
little
bit
of
a
struggle
getting
people
to
think
more
kubernetes,
like
more
config
maps,
more
manifests.
You
know
you
can
still
do
a
lot
of
that.
You
can
still
add
those
in
in
day.
One
you
know
create
manifest,
so
we
do
have
that
option.
So
anything
on
oc
apply.
Think
right.
We
can
make
it
happen
if
you
wanted
more
than
one
machine
set.
C
If
you
wanted
infras
on
day
one,
you
know
everyone
argues,
it
can't
be
done
and
I'm
like
yeah.
Actually
it
can
be
done.
You
just
gotta
create
the
manifest,
so
we
sort
of
given
the
approach,
but
we've
moved
it
from
a
flag
or
a
field
to
a
kubernetes
way
of
doing
it,
and
I
think
that
aligns
a
lot
more
with
how
customers
are
doing
config
management
with
ecm
or
git
ops
types
of
situations
for
policy
enforcement.
So
these
are
the
things
that
I
think
we
just
need
to
kind
of
shift.
C
Our
mindset
from
you
know
having
a
bell
and
whistle
or
a
knob
or
a
flag
to
really
thinking
in
kubernetes.
How
do
we
do
that?
That's
been,
I
think,
the
biggest
challenge,
but
I
think
people
are
starting
to
come
around
to
it
and
I
think,
as
we
see
more
and
more
environments
roll
out,
we
see
the
get
ops
types
of
deployments
where
they
want
to
be
able
to.
B
Yeah
and
I
think
the
the
popularity
of
christians
live
stream.
You
know
the
get
ops
happy
hour,
which
is
happening
tomorrow
by
the
way
you
know
shows
that
I
you
know
we
as
a
kubernetes
using
industry
are
maturing
right
and
adapting
and
adopting
many
of
these
new
philosophies
like
any
new
technology.
It
takes
a
little
while
okay,
so
I'm
gonna
go
back
and
revisit
some
of
those
questions
that
we
were
talking
about
before
I'm
so
lost
now.
B
So
apologies
for
anybody
who's
chatted.
Anything
in
about
the
last
five
minutes,
because
I've
been
holding
the
chat
in
my
screen.
Just
where
ricky
asked
his
question,
which
is,
I
would
like
to
host
multiple
nodes
for
students
to
access
remotely.
Is
there
a
high
level
roadmap
on
how
I
could
accomplish
this
with
openshift?
And
I
think
roadmap
here
is
not
like
roadmap
futures
but
like?
How
can
I
do
this
type
of
thing
so
so
ricky?
First
a
couple
of
things.
B
Alternatively,
if
it's
a
shared
environment,
you
know,
essentially,
you
know,
spin
up
a
cluster
somewhere,
that's
publicly
accessible,
again,
aws,
azure,
et
cetera
and
then
deploy
so
deploy
that
cluster
connect
in
and
then
use
something
simple
like
ht
password
authentication
and
give
each
one
of
those
users
a
you
know,
set
of
credentials
that
they
can
access
the
cluster
with
entitle
them.
You
know
or
give
them
permissions
to
whatever
it
is
that
they
need
permissions
to
and
kind
of,
go
from
there.
B
B
You
know,
in
which
case
code
ready,
workspaces
or
excuse
me
code,
ready
containers
would
be
the
answer
for
that,
so
either
helping
them
to
deploy
that
locally
to
whatever
resources
they
have
or
potentially
deploying
that
onto
something
that
they
can
publicly
access.
So
I
don't
know:
maybe
it's
not.
If
packet
is
no
longer
packet,
it's
now
equinix
equinix
metal.
C
B
C
Yeah
we
we've
got.
The
other
option.
Is
you
you
know?
If
it's
just
like
a
student
case,
you
could
use
hive,
you
know
you
could
leverage
a
hub
and
spoke
model
deploy
hive
in
your
hub
and
then
provision
through
cluster
deployments
additional
clusters
as
then
they're
needed
again,
I'm
not
sure
if
it's
clusters
or
nodes
in
in
the
question,
but
that
is
another
option
and
that's
fairly
minimal
to
do
in
terms
of
using
hive.
A
C
B
B
C
I
thought
they're
they're,
pretty
close
to
that.
I
know
the
the
byo
windows
isn't
quite
there
yet.
I
think
that's
coming
soon,
though,
but
I
thought
the
vmware
support
sort
of
like
think,
like
a
machine
set
type
of
deployment
where
you're
spinning
up
your
own
windows,
I
thought
that's
just
about
available
or
was
already.
C
B
C
You
can
biggest
caveat
is
they
must
be
on
the
same
platform
that
you've
deployed
the
cluster?
On
one
exception
is
so
let
me
let
me
just
maybe
maybe
take
that
one
step
further
yeah,
if
you're
on
aws-
and
you
want
to
put
a
bare
metal
node
manually,
joining
the
cluster
that
won't
work.
But
if
you
did
a
platform
agnostic
install
where
you
didn't
pick
up
a
cloud
provider
so
think
in
the
install
config
platform,
none
would
essentially
allow
you
to
mix
any
which
way
you
want
to
mix
right.
C
C
You
know,
provision
the
underlying
infrastructure,
all
that
so
pretty
much
any
ipi
method
wouldn't
work
in
that
situation,
but
you
could
do
it
if
it's
within
the
same
platform,
so
you
could
do
a
manual
machine
edition
in
the
same
platform.
What
you
would
end
up
doing
is,
you
would
have
to
be
able
to
get.
C
There
is
a
url
for
the
for
the
ignition
config
for
a
worker
on
the
masters,
and
I
have
to
look
up
exactly
where
it
is,
but
I
think
it's
even
covered
in
the
dock
somewhere.
You
would
pass
it
in
through
user
data
depending
on
the
platform.
You
add,
you
know
whether
it's
hosted
in
a
web
server
somewhere
or
you
know
again
using
it
off
the
cluster,
which
is
probably
the
easiest
way
to
do
it.
You
would
then
boot
that
node
and
when
it's
adjoined
it
would
be
a
single
worker
node
on
its
own.
B
So,
essentially
it
so.
This
is
an
interesting
one,
and
it's
not
one
that
I
I
think
off
off
the
top
of
my
head.
I
would
have
said
no
to
this,
but
effectively
it's
the
same
as
a
upi
and
then
adding
machine
sets
day,
two
just
in
reverse,
so
you're,
adding
nodes
that
wouldn't
be
a
member
of
a
machine
set,
but
would
be
a
part
of
a
machine,
config
pool
and
you're.
Just
following
the
exact
same
process.
A
B
C
I
think
it's
one
of
those
trick
questions
because
there's
really
really
not
any
nuance
of
ipi
or
upi
within
the
environment,
think
of
upi
as
user
provision
infrastructure.
So
if
I
use
a
provision
the
infrastructure,
I
can
can
obviously
do
that
right.
You
know
you
can
set
up
all
the
resources
you
need
to
perform
a
successful
deployment
of
openshift.
C
Vice
versa,
if
you
use
ipi
to
have
the
installer
provision
that,
on
your
behalf,
you
could
do
that
as
well.
The
trick
is,
is
what
are
you
trying
to
manage
on
day
two
like?
What
are
you
trying
to
go
from
installer
provision
to
user
provision,
because
the
cluster
on
d2
is
nearly
identical,
I
want
to
say
99
and
40
hundredths
or
ivory
soap
identical,
so
you're
still
going
to
use
a
lot
of
the
same
operators
that
would
essentially
manage
resources.
A
good
example
is
say
the
ingress
operator
on
aws.
C
C
You
could
I'm
trying
to
think
of
the
other
thing.
You
could
stop
using
machine
api,
so
machine
sets
right
and
do
manual
nodes,
so
I
think
it
just
depends
on
what
you're
trying
to
change.
I
don't
think
it's
a
I'm
going
to
convert
a
upi
to
an
ipi
or
a
up
to
an
api
like
there's,
not
really
a
notion
of
that.
It
just
depends
on
what
secondary
level
services
you
want
to
enable
or
disable.
B
C
It's
a
little
trickier
in
their
question.
I
think
I
think
what
they're
probably
asking
for,
and
maybe
I'm
mistaken
or
reading
between
the
lines
here.
My
guess
is
it
like,
for
instance,
they
did
a
vmware
install
where
we
would
have
the
keep
alive,
the
aha
proxy
doing
load
balancing
for
the
cluster,
I'm
sort
of
wondering.
Are
they
talking
about?
No
I'd
like
to
really
use
an
f5
after
I
deploy
the.
C
Yeah,
so
so
that's
that's
the
trick.
I
want
to
say
you
probably
have
the
most
experience
of
this,
but
I'm
gonna,
I'm
gonna
sort
of
flubber
through
it.
There's
no
good
way
to
manage
that.
I'm
aware
of
the
internal
keep
alive
dha
proxy
setup.
I
believe
it's
just
you
like
going
through
mco
to
basically
tell
it
not
to
work
anymore,
but
I
don't
recall
what
other
problems
that
digs
up,
as
as
you
do
that
I
think
it's
technically
possible
and
I'm
sure
someone's
probably
done
it.
You
probably
have
some
more
better
insights.
B
Than
I
do
so
to
answer
your
question
directly,
yes,
but
no
so
what
katherine
is
saying
is
is
true:
technically
you
could
go
in
and
using
mco
you
could
basically
remove
or
disable
the
keep
id
functionality
that's
associated
with
the
ingress
endpoint
and
then
basically
remove
that
virtual
ip
address
or
the
dns
name
associated
with
it
to
an
f5
or
a
citrix
or
whatever
external
load
balancer
you're
using,
but
that
that
goes
back
to
the
whole.
You
know
now:
you're
you're,
breaking
or
deliberately
modifying
that
opinionated.
B
You
know
ipi
installation
process,
and
should
you
really
be
using
upi
in
that
instance?
And
if
you
want
to
continue
to
do
things
like
automatically
scale
machine
sets
well
great.
You
can
add
that
too.
So
the
real
answer
here
is
and
the
way
that
doesn't
you
know
deliberately
break
core.
You
know.
Ipi
functionality
is
to
simply
add
a
second
domain
and
then
point
that
domain
to
the
the
external
load
balancer.
So
if
you
know
the
the
default,
ingress
is
star.apps,
so
maybe
you
have
a
star
dot,
prod
or
a
star
dots.
B
You
know
something
and
that's
hosted
on.
I'm
gonna
pick
on
f5
right
so
and
f5
load
balancer.
So
when
you
create
your
routes,
you
simply
say
that
they
are
managed
by
that
external.
You
know
that
second
set
of
route
instances
or
excuse
me
ingress
instances
and
then,
particularly
with
our
partners,
who
have
certified
operators.
Words
are
hard
at
the
moment.
Certified
operators
right
they'll
do
things
like
automatically
updates.
That's
external
load,
balancer
configuration
for
additional
worker
nodes
as
they
get
provisioned,
read
all
the
things
that
they
normally
need
to
do.
C
So
the
reason
why
we
have
these
services
as
part
of
the
ipi
deployment
and
they're
not
on
the
upi
deployment,
is
upi,
we're
sort
of
at
that
point
of
assuming
you're.
You
have
control
of
your
own.
You
know
infrastructure,
so
you're,
probably
going
to
bring
your
own
dns
you're,
probably
going
to
bring
your
own
load
balancer
chances.
Are
you
have
an
f5
or
something
equivalent?
Since
that's
you
know
what
we
keep
talking
about
here,
but
I
in
the
case
of
ipi,
we
still
need
a
service
to
automate
the
bring
up
of
the
cluster.
C
So
the
reason
for
this
has
to
do
with
the
whole
inception
problem
of
how
do
you
bring
kubernetes
under
management?
If
you
don't
have
kubernetes
running
right,
so
we
have
this
notion
of
a
bootstrap
node,
and
what
that
is.
Is
our
our
temporary
control
plane.
Now
we
need
to
be
able
to,
during
the
pivot,
from
the
temporary
control
plane
to
the
permanent
control
plane,
which
is
your
three
control
plane
nodes
that
you
end
up
with
on
a
running
cluster.
C
Is
we
need
to
be
able
to
perform
tasks
against
the
api
server,
and
at
that
time
you
really
don't
know
where
the
api
server
is
running.
You
know
it's
running
somewhere,
it's
got
an
api
dot,
you
know
cluster
name
dot
domain
name,
but
it
you
don't
really
kind
of
know
where
it
is.
So.
What
we
use
is
a
load
balancer
and
it
could
be
performed
a
couple
different
ways.
C
C
But
what
do
you
need
to
do
is
when
you
resolve
api
or
api?
Int
is
actually
the
right
one.
Here
you
have
to
be
able
to
get
to
the
right
running
control
plane.
So
the
way
we
do
that
is,
we
have
the
master
in
there
and
the
three
masters
and
the
bootstrap
node
and
depending
on
where
it
is
in
the
cycle
someone's
going
to
be
responding.
C
So
without
an
on
cluster
service,
we
have
no
way
to
provision
an
external
service
to
do
that
as
part
of
that
bring
up.
So
that's
sort
of
our
work
around
to
bringing
kubernetes
under
management
of
kubernetes.
It's
the
whole
bootstrap
process
and
that's
why
we're
leveraging
on
cluster
services
for
internal
communication,
yeah.
B
So
jumping
back
to
some
questions
and
I'm
I'm
falling
way
behind
on
chat
here.
My
apologies,
so
dean
has
another
question
that
I
think
is
a
an
important
one
here
other
than
not
having
access
to
dhcp.
What
are
some
of
the
main
oppositions
we
see.
Customers
have
against
using
ipi,
and
I
see
some
of
our
other
audience.
Members
chiming
in
here
with
reasons
so
walid
saying
not
knowing
the
name
right
both
of
nodes
or,
I
guess,
of
nodes
for
compliance
and
dns
approvals.
A
C
C
Even
if
you
handed
me
a
bunch
of
the
of
mac
addresses
and
say
just
go,
fill
them
out
right,
because
everyone's
definition
of
it
isn't
even
just
here's
a
bunch
of
mac
addresses
some
people
say:
well,
here's
a
bunch
of
ip
addresses
right.
So
it's
it's
even
more
specific,
but
it's
really
more
of
the
cattle
versus
pet
mentality.
Right
and
I
think
in
some
environments
you
know
where
you're
very
strict
and
you
can't
have
dhcp
it's.
C
It's
definitely
going
to
be
a
lot
more,
restrict
on
how
you
assign
things
what
you
let
on
the
network,
so
it
it
it
sort
of
breaks
this
paradigm
of
dynamic,
compun
capacity.
You
know
this
whole
thing
that
we
have
with
ipi.
So
that's
one
of
them
and
that's
a
big
one.
I
would
say
the
other
one
is
credentialing
could
also
be
sometimes
challenging
where
they
don't
want
to
automate
a
lot
of
stuff.
C
So
I
think
there's
there's
definitely
some
work
there
and
it's
in
the
other
one
that
I've
also
seen
is
sometimes
some
of
the
architectures
are
very
restrictive.
That
customers
need
to
work
and
work
in
a
good
example
is
like
just
throwing
gcp
out
there.
For
instance,
I
don't
feel
like
that's
got
enough
face
time
today.
C
It
uses
something
called
typically,
customers
use
something
called
cross
project
networking.
Well,
it
sounds
great
on
paper.
You
know
you
create
all
this.
You
create
a
shared
vpc
with
all
your
networks
in
it
and
you
share
it
out
all
the
other
projects
or
open
shift
in
a
different
project.
The
issue
is
that
you
lock
the
account.
That's
provisioning,
open
shift
down
from
accessing
just
beyond
reading
the
networks
in
the
shared
vpc,
so
it
can't
make
any
changes.
You
can't
update
any
firewall
rules
iam
whatever
you
can't
pretty
much
create
anything.
C
So
ipi
is
under
the
assumption,
I'm
going
to
create
everything
you
need
to
be
successful
in
having
a
perfectly
running
cluster
out
of
the
box.
Well,
if
you
can't
create
things
like
firewall
rules
or
failure,
I
am
I
mean
you
pretty
much
broke
the
model,
so
that's
another
reason
why
sometimes
the
restrictive
natures
of
the
architectures,
by
locking
things
down,
prevents,
automation
and
and
there's
really
sort
of
no
good
way
around
it.
You
just
don't
have
the
right
permissions
as
the
account
installing
openshift.
B
So
I
want
to
do
a
bit
of
rapid
fire
with
questions
here
so
for
any
questions
that
we
don't
answer
here
on
the
stream
or
if
we,
you
know,
have
an
incomplete
I'll,
make
sure
to
put
all
of
those
into
the
blog
post
so
friday
morning,
on
openshift.com
blog,
just
look
for
the
blog
post.
That
summarizes
this.
This
particular
episode
and
we'll
have
all
of
those
inside
of
there.
B
Let's
see
any
option
to
use
ipi
plus
external
load
balancer
other
than
router
sharding.
Unfortunately,
no,
although
I
think
the
assisted
installer
folks,
are
working
on
the
ability
to
do
something
like
that,
basically
be
today
when
they
deploy
they
use
that
integrated
keep
a
live
d
load,
balancer
functionality.
I
think
I
have
heard
that
they
are
working
to
be
able
to
add
the
ability
to
specify
an
external
load
balancer
as
a
part
of
that
and
catherine,
please
feel
free
to
jump
in
and
add
anything
if
needed.
A
B
So
in
chat
so-
and
this
is
one
you
know,
catherine
again,
I
see
you
answer
this
question
all
the
time.
I
answer
it,
probably
just
as
frequently
which
is
and
you've
already
said
this.
We
can't
mix
infrastructure
types.
So
if
if
there
is
or
let
me
be
more
specific,
if
there
is
a
cloud
provider
infrastructure
provider
integration
configured,
then
you
can't
mix
infrastructure
types.
So
if
you
deployed
say
vsphere,
ipi
or
upi
or
rev,
ipi
or
upi,
then
you
can't
add
a
physical
server
to
that
because
it
would
not
have
the
same.
C
Yet
this
is
the
one
I
hate,
because
I
hate
saying
you
can
and
then,
if
they
ever
do
down
the
road
and
it
breaks
things
everyone's
going
to
be
mad
and
come
after
me,
but
the
reality
why
it
actually
doesn't
work,
it
has
to
do
with
the
kubernetes
cloud
provider
and
anyone
that
implements
a
node
lifecycle
controller
will
essentially
think
those
nodes
aren't
supposed
to
be
part
of
the
cluster.
It'll,
basically
say:
hey,
you
get
this
four
node
here.
I
don't
know
what
this
is,
and
it
actually
removes
it
right.
C
So
it
doesn't
know
how
to
deal
with
the
integrations
on
that
it
doesn't.
It
knows
that
it's
different
and
unique
and
special,
and
it
thinks
it
should
never
be
part
of
the
cluster.
So
until
the
kubernetes
itself,
as
you
mentioned,
has
the
notion
to
ignore
node
types
that
are
external
to
the
cloud
provider
you've
deployed
on
or
the
provider
you've
deployed.
That's
enough
to
be
a
cloud
provider,
but
the
provider
you
deployed
upon
it
will
never
allow
those
nodes
in
the
cluster.
C
B
Rapscallion
reeves,
so
I
see
your
comments
in
here
about
rev,
going
away
in
favor
of
openshift
virtualization,
and
all
of
that
please
reach
out
to
me
about
that
I'll
I'll.
You
know
we'll
we'll
have
a
conversation
about
that
and
what
the
future
holds
and
how
we
can
help
address
that
so
andrew.sullivan
at
redhat.com
or
dme
on
twitter,
practical,
andrew
and
we'll
we'll
set
that
up
and
we
can
have
that
conversation.
B
B
Okay,
so
jose
openshift
delivers
is
a
ready
cluster
day.
Two
configuration
is
another
level
of
automation.
The
client
needs
to
map
business
logic
kind
of
difference.
So
I
think
hosea
and
christian
have
been
having
a
conversation
around
get
ops
here.
I'm
I'm
keeping
up
with
the
we're
trying
to
keep
up
with
the
shot.
C
B
Usef
for
an
ipi
installation
and
vsphere
is
there
no
option
to
distribute
control
plane
virtual
machines
on
different
esxi
hosts?
So
that's
a
question.
That's
come
up
quite
a
bit
recently
and
catherine
again.
Please
keep
me
honest
here
and
feel
free
to
add
on
so
red
hat
created
the
machine
api
provider
for
vsphere.
B
So
if
you
look
in
the
machine,
config
operator,
repo
and
I'll
I'll
dig
up
a
link,
if
I
can
here
before
the
end
of
the
show
and
post
it
and
included,
basically
all
the
functionality
there
so
today
it
has
no
awareness
of
the
underlying
cluster
topology
or
settings
or
features
or
anything
like
that.
Basically,
it
says
what
cluster
do
you
want
me?
You
know
what's
the
path
in
the
infrastructure,
the
vsphere
infrastructure.
B
B
Honestly,
I
would
be
a
little
surprised
if
it's
on
the
roadmap,
I
think
there's
an
rfe
for
it
because
that's
pretty
complex
and
I
think
that
different
people
have
different
preferences
or
different
desires
there,
and
we
don't
want
to
presume
right
what
that
should
be
or
or
something
like
that,
but
I'll.
Let
catherine
speak
to
that
if
she.
C
Sure
sure
take
the
take
the
good
ones
yeah,
so
so
yes,
they're
actually
is
an
rfe
on
this.
I
will
tell
you,
there's
some
technical
limitations
that
need
to
be
fixed
right
now
in
the
cloud
provider.
I
don't
want
to
sort
of
blame
anyone,
but
I
know
that
there's
a
bug
there
that
to
be
able
to
use
something
like
say
multi-cluster,
which
is
what
a
lot
of
folks
would
like
to
do,
and
I
think
it's
a
good
one.
C
C
We
did
do
sort
of
like
a
poc
to
figure
out
if
we
could
do
it
with
upi,
but
even
upi
isn't
going
to
work
because
you
have
to
hard
code,
the
user
name
and
password
of
vcenter
in
the
cloud
provider
which
is
who
in
their
right
mind,
would
do
that.
So
that's
a
bug
that
needs
to
be
fixed
in
the
upstream
before
we
could
even
say
that
we
would
bless
that
as
a
poc.
So
I
I
think
you
know
I
hear
the
the
question
I
hear
the
ask:
it's
come
up
with
the
number
customers.
B
A
B
B
I
know
that
we
missed
a
few
inside
of
there
again
I'll
go
through
I'll
pull
out
all
those
questions
we'll
make
sure
to
address
them
in
the
blog
post,
so
keep
an
eye
on
openshift.com
blog
alex
has
been
getting
those
published
at
like
six
a.m,
eastern
time
or
something
so
if
you're,
an
early
riser
you'll
you'll
be
good
to
go.
Even
so,
I
will
make
a
plug
real,
quick.
I
will
be
guest
hosting
for
chris,
tomorrow's,
in
the
clouds
with
marco
bill
martin
bill
peter.