►
From YouTube: Ask an OpenShift Admin (Ep 27): Day 2 Operations, part 2
Description
Continuing our closer look at Day 2 Operations, in part two of two, we'll review the network and storage configuration tasks to be done after the cluster is deployed. No matter how well and thoroughly the cluster is configured for the application workload, if the application administrators, developers, and users can't access those resources, it's all meaningless. We'll also spend some time looking at how to configure authentication and authorization controls for your clusters.
About Ask an OpenShift Admin:
Do you have questions? We want to answer them! Every Wednesday at 11am ET, hosts Andrew Sullivan and Chris Short sit down to answer your questions about Red Hat OpenShift.
Follow us:
Andrew Sullivan https://twitter.com/practicalandrew
Chris Short https://twitter.com/chrisshort
Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_confirmation=1
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
Openshift.com https://red.ht/33Fh6uV
OpenShift on GitHub https://github.com/openshift/
OpenShift on redhat.com https://red.ht/2o4ccDk
#RedHat #OpenShift #Kubernetes
A
B
No,
it's
I
I'm!
I
I
think
christian
calls
me
a
curmudgeon,
because
I
tend
to
be
very
conservative
in
my
approach
to
things.
That's
a
that's
a
admittably,
a
learned,
behavior
right.
You
know
I
was
a
an
administrator
for
a
long
time.
So
you
know
the
first
big
boy
job.
If
you
will
that
I
had
was
as
a
an
administrator
for
a
production,
vsphere
environment
and
our
storage
admin
decided
one
day
that
nope
I'm
just
I'm
done
with
this.
B
B
A
B
Yeah
it's
yeah
and,
and
my
favorite
one
was
I
was
working
with
the
government
and
we
had
a
a
junior
enlisted
person
who
was
responsible
for
vacuuming
the
data
center
and
they
were
traversing
through
doors
and
the
vacuum
hose
caught.
The
lid
for
the
epo
right,
the
emergency
power
off
button,
and,
of
course,
when
the
lid
lift
up
lifts
up,
it
sets
off
an
alarm
right
and
the
immediate
reaction
was
well.
If
I
mash
this
button,
the
alarm
will
stop,
which
was
true.
B
B
A
Well,
it's
not
yeah,
it's
the
it's
the
you
know.
Don't
I
use
julia
evans
like
don't
feign,
surprise
right
like
treat
it
as
an
opportunity
to
learn.
I
don't
have
it
printed
out,
but
I'm
pretty
sure
it's
still
hanging
up
in
my
basement,
my
basement
office
that
is
kind
of
a
construction
zone
right
now,
but
it's
you
know
treated
as
an
opportunity
to
teach
somebody
new
and
exciting
to
them.
Not
you
know
like,
oh,
why
don't
you
know
this
already
right
like
go?
Read
the
man
page?
A
B
Yeah
and
it's
one
of
those
like
when
I
was
an
administrator
when
I
you
know
I,
I
eventually
became
an
architect
and
all
that
other
stuff,
and
it
became
one
of
those.
The
more
you
know
the
less
you
have
to
ask
me.
I
want
to
be
a
single
point
of
failure.
I
got
other
stuff
to
do.
I
don't
need
to
do
your
job
and
my
job,
so
it
very
much
becomes
one
of
those
education
teaching
helping
rates,
bringing
everybody
along
and
up,
and
that's
one
of
the
things
I
love
about
red
hat
right.
B
B
B
Yeah,
so
this
is
one
of
those
releases
are
done
holistically
across
all
platforms,
so
there
isn't
a
an
upgrade
or,
or
there
isn't
a
it's,
not.
I
can't
target
a
release
that
says
you
can
upgrade
all
platforms
except
vsphere.
It's
either
all
or
none
in
that
case
yeah.
So
in
this
instance,
yes,
all
upgrades
from
or
to
openshift
4.7
are
blocked
as
a
result
of
a
bug
that
we
found
in
vsphere,
so
for
those
customers
who
aren't
using
vsphere
right
yeah.
B
Yes,
I
I
know,
and
even
for
those
who
are
using
the
vsphere
right,
it's
frustrating
yeah
we're
two
months
past
now
we
feel
your
pain,
trust,
yeah,
trust
me.
We
we
feel
it
both
on
a
personal
level
of
I'm
constantly
trying
to
deploy
and
troubleshoot
and
work
with
these
things
and-
and
you
know,
help
you
all
our
audience-
our
customers,
you
know
with
these
problems,
so
I
feel
it
as
well.
As
I
know,
there's
a
lot
of
pressure.
B
A
B
B
So
what
that
means
is
that
our
goal
here,
our
our
purpose.
The
reason
why
we
have
the
stream
is
for
you
to
ask
us
questions.
Doesn't
matter
what
it's
about
doesn't
matter,
you
know
whether
or
not
it's
something
that
we
can
help
with
and
what
I
mean
by
that
is.
If
we
don't
know
the
answer,
we'll
find
the
answer
right.
B
Yeah
it's
one
of
my
favorite
things,
as
I
was
just
saying,
is
just
finding
the
right
people
inside
a
red
hat
and
getting
those
answers.
You
know
a
couple
weeks
ago
we
had
mark
curry
on
with
the
we
were
talking
about
multisin
and
cni,
and
all
that
other
stuff,
and
you
know
doug
and
and
oh
man
now
tommy.
Yes,
both
in
engineering
on
you
know
and
working
in
multis.
I
have
learned
so
much
from
them
and
seeing
the
email
chains
that
have
been
generated
out
of
that.
B
So
you
all
our
audience.
There
was
a
couple
people
who
sent
me
emails
and
basically
said
hey.
How
does
this
work
or
how
can
I
do
this
and
I've?
You
know
connected
the
dots
there
or
connected
the
people
there,
and
I've
already
learned
just
a
tremendous
amount
about
how
that
stuff
works.
So
to
me,
it's
it's
really
exciting
to
to
see
all
that
stuff.
B
B
So
yeah
at
any
point
in
time,
please
feel
free,
ask
questions
whatever
it
is.
That
is
at
the
top
of
your
mind,
something
that's
bothering
you
some
problem
or
issue
that
you're
having
you
know,
architecture,
questions,
functionality,
questions
all
that
stuff.
Please
please,
please,
please
don't
hesitate
to
ask
those
questions
yeah,
we
encourage
it
and
if,
for
whatever
reason
we
can't
get
to
your
question,
we
can't
answer
it
here
on
the
stream.
I
always
follow
up
each
one
of
our
episodes
with
a
blog
post.
B
So
if
we
switch
over
to
this
tab
here,
this
is
the
blog
post
from
last
week,
I'll
post,
that
into
the
chat
here,
and
you
can
see
that
we
essentially
do
a
synopsis
so
coming
down
here.
Remember
last
week
I
said:
hey,
you
know
we,
we
don't
have
enough
time
to
cover
all
of
these
items,
all
of
these
different
parts
and
components
but
I'll
provide
links
to
all
of
those
inside
of
the
blog
post.
Well,
here
here's
the
they're
putting.
B
So
you
can
absolutely
find
all
that
we
try
to
get
those
published
every
friday.
So
far,
we've
been
pretty
consistent
with
that
so
check,
openshift.com
blog
on
friday
mornings,
usually-
and
you
can
see
this
week's
blog
post,
including
links
to
if
we
come
all
the
way
down
here
to
the
bottom,
you
can
see
we
have
links
directly
to
in
the
stream
where
we
answer
those
questions
right.
So
any
questions
that
you
happen
to
bring
up.
B
B
Not
just
now,
just
always
always
so.
One
of
the
things
I
like
to
do
here
is
talk
about
the
things
that
have
come
to
my
attention,
the
things
that
are
top
of
mind
for
me
that
I
think
are
important
to
relevant
for
you
all
so
this
week,
there's
a
couple
of
things
that
I
want
to
to
bring
up
in
that
respect.
B
So,
first
I've
had
quite
a
few
conversations
over
the
last
six
or
eight
or
nine
months
around
the
load.
Balancer
that's
used
with
ipi.
So
if
you're
not
familiar
with
this
effectively
with
on-premises
ipi
deployments,
so
vsphere
red
hat,
virtualization
openstack
and
bare
metal
ipi,
we
deploy
a
built-in
load
balancer.
B
So
the
problem
with
that
is
particularly
for
the
apps
for
the
in
the
star
dot,
apps
ingress
point:
it's
limited
to
a
single
node
in
the
cluster
right.
It's
one
ip
address!
It's
that
ip
address
is
hosted
on
a
node
that
has
a
router
instance
right,
the
aj
proxy
openshift
router
instance,
and
it
doesn't
do
any
real
load
balancing
behind
the
scenes.
So,
if
you
have
you
know,
if
you
scale
your
router
instances
from
two
to
three
to
five
to
twelve
or
however
many
you
have
all
of
that,
traffic
still
goes
into
one.
B
Those
additional
instances
are
just
there
for
high
availability
or
failover
capability.
So
the
question
is:
can
I
use
an
external
load
balancer
with
on-prem
ipi
and
the
answer
here?
There's
really
kind
of
three
answers
that
or
three
possibilities
that
you
have
here
so
the
first
one
is
more
or
less
to
replace
the
ingress
load
balancer.
B
B
B
B
B
So
that's
one
option
right,
just
don't
use
the
default
one
right
instead
use
the
one.
You
know,
use
a
different
ingress
controller
with
your
cluster
and
then
you
can
absolutely
take
advantage
of
kind
of
whatever
you
know.
Whichever
of
the
load
balancers,
you
want
to
right.
So
the
other
option-
and
this
is
something
that,
as
far
as
I
know,
is
only
documented
by
openstack.
B
B
And
effectively
what
this
is
documenting
is
for
on-prem
ipi
with
openstack
here's
how
you
can
configure
an
external
load
balancer
and
then
effectively
swing
that
ingress
and
api
endpoints
over
to
that.
So,
unfortunately,
this
isn't
tested
or
documented
with
any
of
the
other
deployment
methods.
So
therefore
we
can't
authoritatively
say:
yes,
it
will
work
and
therefore
it
falls
into
kind
of
a
support,
gray
area.
B
So
I
I
haven't
been
able
to
get
an
answer
out
of
the
support
folks
as
to
yes,
it's
documented
for
openstack,
but
does
that
mean
it's
also
supported
with
vsphere,
for
example?
Even
though
right,
the
infrastructure
isn't
really
material
in
that
instance,
so
just
fyi.
This
is
here
if
you
happen
to
be
using
openstack
and
you
want
to
migrate
off
of
that
default,
built-in
load,
balancer
and
you're,
not
using
you,
know
the
courier
or
the
octavia
integration.
B
So
really
the
two
options
are
use:
a
different
ingress
controller
or
use
an
external
load
balancer
following
this
open
stack
configuration
here.
So
there
is
some
stuff
going
on
here.
You
know
behind
the
scenes
around.
How
can
we
make
this
better?
How
can
we
configure
this?
How
can
we
make
it
more
configurable,
so
just
keep
an
eye
out.
I
do
have
somewhere
in
my
multitude
of
tabs.
B
I
do
have
an
rfe
that
I
can
dig
up
for
this
so
that
way
we
can
take
it
or
that
way
we
can
track
that
progress
and
if
it's
something
you
any
of
our
any
of
our
audience
right.
If
you
raise
that
with
your
account
team,
let
them
know
they
can
just
reach
out
to
me
and
then
we
can
kind
of
associate
account
information
with
that
which
helps
product
management
with
prioritization.
B
B
So
yes,
yeah,
okay
yeah,
so
with
upi,
absolutely
or
even
the
non-integrated
install
right
I
I
can
it
can
be
infra
nodes,
it
can
be.
You
know,
router
nodes,
you
can
tag
them
whatever
you
want,
but
essentially
you
can
scale
that
ingress
controller
to
you
know:
2
5,
8
10.
However
many
instances
and
normally
with
ipi.
Excuse
me
with
upi
or
a
non-integrated
install
you
have
an
external
load
balancer
that
is
pointed
at
each
one
of
your
nodes,
that's
eligible
or
that's
hosting
a
router
instance
right,
a
h,
a
proxy
ingress
instance.
B
So
incoming
traffic
comes
in
it
hits
that
external
load
balancer
the
external
load
balancer
looks
at
all
of
the
nodes
that
it
has
available
to
it.
So
all
the
ones
that
are
running
that
h,
a
proxy
ingress
controller
instance
and
then
it
routes
that
you
know
external
session
over
to
one
of
those-
and
you
know
assuming
and
I
think
the
documentation
by
default
says
you
know,
configure
all
worker
nodes.
You
know
inside
of
that
external
load
balancer.
B
So
if
I
have
12
ingress
instances,
12
ingress,
h.a
proxy
instances,
then
it
would
be
load
balanced
across
all
12..
The
problem
with
ipi
on-prem
ipi
is
that
external
load
balancer
basically
doesn't
exist.
So
it's
just
a
single
virtual
ip
address
right,
the
star.apps,
the
one
associated
with
the
start.apps
dns
name,
and
it
just
moves
from
node
to
node.
You
know
with
and
only
on
nodes
that
have
an
h,
a
proxy
ingress
instance
on
it.
A
B
B
Dhcp,
it's
it's
a
reoccurring
theme.
I
think
we
have
talked
about
dhcp
in
more
episodes
than
we
haven't
talked
about
dhcp,
that's,
probably
accurate,
yeah.
So
a
reoccurring
question
that
we
get
is,
if
you
look
in
the
documentation
and
I'll
I'll
see
if
I
can
find
it
here,
real
quick.
So
let's
go
to
installing
I'll
pick
on
vsphere
this
time
and
we'll
just
go
with
this.
We'll
go
with
this
one
installing
a
cluster.
B
B
So
we
we
tell
you
blah
blah
blah
anyways
the
documentation
says:
dhcp
is
required
for
ipi,
because
it
is
right.
We
require
you
to
the
nodes
to
be
able
to
dynamically,
get
their
ip
addresses.
But
then
we
also
say
static.
Dhcp
reservations
are
encouraged
for
worker
nodes
and
should
be
used
for
control
plate
nodes.
So
the
rationale
here
is-
and
if
I
come
back
over
here,
let
me
see
if
I
can
search
the
kcs
this
time.
B
B
B
B
B
Is
you
know
somebody
will
shut
off
a
cluster
and
it'll
be
down,
for
you
know
an
hour
a
day
a
week,
whatever
turn
it
back
on
and
the
nodes
get
a
different
dhcp
address.
You
know
this
can
particularly
be
an
issue
if
you
have
a
short
lease
time
or
if
your
dhcp
pool
is
very
busy
right.
Basically,
the
node
goes
down
right.
Basically,
it
does
a
release
and
then
something
else
immediately
is
requesting
an
ip
address
and
there's
so
few
available
that
it
immediately
starts
reusing
the
ones
that
are
there
right
that
type
of
stuff.
B
B
So
for
that
reason
we
encourage
you
to
use
dhcp
reservations.
The
question
is,
but
it's
ipi,
I
don't
know
the
mac
addresses
beforehand.
The
installer
creates
the
control,
plane,
nodes
and
machine
api
creates
worker
nodes.
So
how
can
I
create
those?
And
the
answer
is
both
simple
and
frustrating
and
and
that
is
more
or
less
after
provisioning
use
the
tools
of
your
dhcp
server
to
convert
it
to
a
reservation.
B
I
have
reached
out
to
some
vmware
peers.
I've
reached
out
to
some
others
and
and
to
figure
out
things
like
you
know.
Vmware
has
this
concept
of
a
mac
address
pool.
Can
I
create
a
pool
of
known
addresses
and
then
associate
that
with
my
openshift
vms,
so
that
they
only
you
know
whenever
it
provisions
a
new
node?
It
only
comes
from
this
pool
and
stuff
like
that,
more
or
less
what
I
got
told
is
well,
it
doesn't
work
that
way.
B
B
So
just
fyi
when
you
see
that
we
suggest
and
encourage
dhcp
reservations,
especially
for
control,
plane
nodes.
You
just
have
to
do
that
day,
two
right
so
after
the
after
the
node
is
deployed
change
that
over
to
a
dhcp
reservation.
I
will
note
that
if
you,
if
you
are
deploying
physical
ipi,
bare
metal,
ipi
and
your
dhcp
lease
time
is
set
to
infinite,
then
it
will
automatically
convert.
B
A
B
B
B
The
only
time
that
would
be
an
issue
is
if
you
want
to
connect
directly
to
a
node.
So
if
you're
trying
to,
for
example,
ssh
from
your
workstation
into
you,
know,
worker17.clustername.domainname
that
dns
name
wouldn't
be
externally
visible.
Unless
you're
doing
like
a
dhcp,
dynamic,
dns
update,
in
which
case
it
would
be
visible
with
upi,
I
don't
believe
they're
required.
B
B
So
if
there
is
no
reverse
entry,
I
don't
know
how
it
will
react
to
that,
because
normally
it
would
want
to
use
the
node
name
like
if
you
do
an
oc
get
node
right.
It'll
show
the
node
name
inside
of
there.
If
it
can't
look
that
up,
if
it
doesn't
understand
how
to
talk
to
that,
I
don't
know
how
that
would
work
if
it
would
just
return
back
an
ip
address
or
something
like
that.
B
B
B
So
I
I
know
that
we
say
that
it
is
required
here
so
yeah,
your
control,
plane,
nodes
worker
nodes,
and
that's
just
to
avoid.
I
I,
if
nothing
else,
that
is
to
avoid
a
lot
of
potential
issues,
so
I
would
say,
follow
the
docs:
they
are
required
with
upi
with
ipi.
It's
not
on
the
docs
it'll
take
care
of
itself.
B
A
B
B
And
in
here
we're
looking
for
the
templates
directory
and
then
we
go
into,
I
think
it's
common
and
then
bare
metal
and
files
yeah.
So
we
have
this
network
manager,
static,
dhcp,
dot,
yaml
and
effectively.
What
this
is
doing
is
exactly
what
we
just
described
right.
It's
it
says:
is
this
an
infinite
lease?
If
so,
I'm
going
to
apply
the
ip
address
as
static,
but
you'll
note
it's
only
with
bare
metal,
right
and
and
specifically
bare
metal
ipi.
B
So
if
you're
using
you
know
any
of
the
other
ipis
on-prem,
it
doesn't
take
effect
if
you're
just
doing
a
a
bare
metal,
upi
or
a
non-integrated
install,
it
doesn't
take
effect
right.
It's
only
bare
metal,
ipi,
so
yeah,
you
can
see
exactly
where
that
logic
lives
and
what
triggers
it
inside
of
here,
because
I
think
if
we
go
up
a
window
or
up
one
of
these
here
is
the
one
that
basically
says
if
it
has
the
template
for
the.
B
And
ntp
yes,
yeah
yeah,
so
the
ntp,
if
your
dhcp
server
is
serving
ntp,
that's
a
nice
convenient
way
to
get
everything
configured
correctly.
If
not,
we
talked
about
this
last
week
in
the
day,
two
stuff
of
configuring.
No,
I
don't
know
where
it
went
inside
of
here,
but
somewhere
inside
of
here.
Is
configuring
crony?
B
A
B
A
B
A
B
Peers
from
down
under
he
lives
out
in
australia.
He
released
an
update
to
this
tested
solution
for
openshift
on
openstack.
So
essentially
he
went
through
it's.
It's
not
a
reference
architecture,
but
it's
a
tested,
architecture
tested
and
validated
architecture
for
deploying
openshift
on
openstack,
so
great
resource,
if
you
happen
to
be
doing
openshift
on
openstack,
be
sure
to
check
that
out.
I
know
he
put
a
lot
of
time,
effort,
blood,
sweat
and
tears
into
that,
and
it's
a
hugely
hugely
same
time.
B
B
B
You
know
it's,
it's
not!
Actually,
you
know
creating
machines
on
the
fly.
It's
just
configuring
them
on
the
fly.
So
I
think
that's
one
of
the
things
that
leads
to
it.
I
I
hope
that
we
do
add
it
for
the
others.
Simply
because
I
know
dhcp
is
a
point
of
contention,
and
this
is
something
that
would
actually
be
really
interesting
to
me
for
anybody
who's
listening
in.
B
You
know
of
you
know:
hey,
I
can't
do
dhcp
in
my
data
center.
You
know,
can
I
do
ipi
without
dhcp
and
a
lot
of
times
we
get
back
this
kind
of
hand,
wavy.
Well,
the
securities
team
won't
let
us
and
right.
While
I
can
make
a
lot
of
assumptions
there
it'd
be
interesting
to
know
like.
What's
the
details
there
what's
what's
going
on
behind
the
scenes,
why
won't
they?
Let
us
do
it.
If
you
will.
A
And
you
know,
in
my
experience
it
and
please
audience
why
won't
your
people,
you
know,
run
dhcp
in
the
data
center.
Please
tell
us
why,
in
my
experience,
it's
because
there
is
anything,
that's
not
using
dhcp
that
you
would
then
have
to
configure
and
that
anything
could
be
of
varying
sizes
between
you
know,
four
to
four
hundred.
You
know
instances
of
something
or
entire
ranges
of
ipa
classes
like
slash,
16s
and
so
off
so
yeah,
maybe
cisco
proprietary
os.
A
Well,
if
you're,
using
your
switches
and
routers
as
gateways
and
dhcp
servers
and
everything
else,
yeah
there's
some
limitations
there,
potentially
like
hard
to
configure
in
limitations.
I
mean
right
like
not
ubiquitous
right
like
I'm,
not
gonna.
Let
my
you
know:
windows,
dns
admin,
jump
into
the
cisco
router
and
start
configuring.
B
B
B
A
B
A
B
The
current
and
even
really
the
last
generation
of
applications.
You
know
when
we
think
back
to
like
the
2000s,
you
know
2010
and
earlier
applications
didn't
change
a
lot
right,
especially
when
everything
you
know
before
virtualization
really
took
holds.
You
know,
servers
were
put
into
iraq,
they
were
given
a
static
ip
address
and
then
all
of
the
things
that
needed
to
connect
to
it
would
a
lot
of
times
just
use
the
ip
address
right.
They
wouldn't
use
a
dns
name
yeah.
So
because.
B
B
So
yeah
that's
an
interesting
one.
I
I've
been
wondering
that
for
a
while
as
to
why
we
don't
see
dhcp,
you
know
more
widespread
in
data
centers
cluster
adhcp
servers.
Yes,
that
is
something
that's
absolutely.
If
you're
going
to
be
using,
you
know
dhcp
in
your
data
center.
You
know
something
like
openshift,
which
are
ipi,
which
requires
hdp,
make
sure
it
is
an
enterprise
grade
service.
B
That
was
one
of
the
things
I
learned
from
our
field
early
on.
Is
that
a
lot
of
customers,
even
if
they
have
dhcp
in
the
data
center?
It's
running
off
of
like
one
vm
and
it's
not.
You
know
it's
not
treated
with
the
same
level
of
resiliency
and
availability
that
we
see
with
other
data
center
services.
B
So
I
know
we're
just
like
last
week
we're
pretty
far
in
at
this
point
and
we've
we've
kind
of
brushed
against
several
things
that
I
wanted
to
talk
about
with
regard
to
today's
topic,
which
is,
as
the
title
suggests,
day
two
operations
so
effectively.
You
know:
hey,
we
just
finished
deploying
our
cluster.
B
So
last
week,
as
you
saw
you
know,
if
you
look
at
these
headings
here,
we
talked
about
kind
of
node
level
or
machine
level
operations
that
need
to
happen
or
could
happen,
cluster
level
operations
and
then
kind
of
some
other
things
just
to
be
aware
of
you
know.
Many
of
these
could
probably
be
lumped
up
into
the
cluster
side
of
things,
but
so
this
week
I
want
to
focus
on
network
storage
and
kind
of
preparing
for
users
so
network.
This
almost
always
comes
down
to.
B
How
do
I
do,
or
how
do
I
configure,
or
how
do
I
manage
the
network
configuration
after
deployment
and
especially
and
we're
seeing
this
more
and
more
now
for
people
who
want
to
have
a
secondary
or
tertiary
or,
however,
many
interfaces
for
additional
network
traffic
or
additional
traffic
types?
I
should
say
the
most
common
one
by
far
is
a
isolated,
non-routable
storage
network
right.
We
I
need
to
connect
to
nfs
pvcs
or
iscsi
pvcs
or
whatever
that
happens
to
be,
and
the
storage
team
has
a
dedicated.
B
B
Let's
come
up
here
to
I
want
networking
and
we're
going
to
where
is
it
nm
state
so
I'll
say
that
there's
really
two
so
there's
three
answers
of
which
one
of
them
I
don't
consider
to
be
a
valid
option.
So
the
first
one
is:
you
should
configure
those
interfaces
at
install
time
so
with
upi
or
with
a
non-integrated
installation.
That
means
either
passing
ip
equals
configuration
parameters
you're
going
to
multiple
ip
equals.
B
B
So
right
here
in
the
documentation
we
can
see,
we
can
just
append
as
many
of
those
as
we
have
interfaces,
and
that
includes
things
like
creating
bonds.
So
if
we
scroll
down
a
little
bit
further
here,
so
we
have
this
bond
equals
and
then
we
can
create
bond
zero.
That
has
two
interfaces.
We
provide
the
bonding
mode
and
then
I
can
then
assign
an
ip
address
to
that
bond.
We
do
the
same
thing
with
vlans
somewhere
in
here.
B
Is
the
vlan
documentation
on
how
to
create
a
vlan
on
top
of
that,
so
this
is
one
way
that
you
can
do
that
it
becomes
persistent.
It
is
then
controlled
right
throughout
the
normal,
open
shift
management
processes.
You
do
effectively
the
exact
same
thing
using
core
os
installer
and
the
live
iso
method
so
boot
to
the
iso.
It
drops
you
into
a
command
line,
prompt
you
can
use
nmcli
and
then
within
mcli
configure
the
network.
However,
it
needs
to
be
configured
and
then
use
the
copy
network.
B
Here
we
go
the
copy
network
option
when
you
execute
coreos
installer
and
that
will
take
the
currently
configured
network
config
and
the
live
iso
or
the
live
environment
and
copy
it
to
the
sorry
for
pumping
the
microphone
copy
it
into
the
installed
os
on
the
host,
so
that
is
with
upi.
That
is
the
suggested
method
of
doing
it
with
ipi
it's
going
to
be
a
little
bit
different
in
particular,
and
I'm
going
to
pick
on
vmware
again.
B
A
B
B
A
B
So
if
you're
deploying,
for
example,
with
vsphere
ipi,
you
want
to
create
a
machine
set
that
will
have
multiple
network
device
definitions
here
right
so
for
each
network
that
you
need
to
connect
to
you
create
a
new
network
name
device
here.
You
add
that
in
when
the
machine
site
goes
to
deploy
that
node,
it
will
ensure
that
each
one
of
those
is
there
so
the
first
device,
presumably
the
one
that
is
on
the
primary
network
that
has
dhcp
enabled
remember
ipi-
requires
dhcp
it'll
boot
it'll
get
its
ip
address,
so
we
find
the
second
device.
B
B
B
B
The
problem
is
now
you
have
to
have
a
machine
config
per
node,
because
that
node
rate
each
node
has
a
different
static
ip
address
and
that
machine
config.
You
can't
just
say
you
know:
here's!
I
have
10
nodes
in
my
cluster
that
all
needs
static,
ips,
I'm
going
to
create
10
machine
configs,
and
then
I'm
going
to
put
them
all
in
the
same
machine.
Config
pool
because
that'll
push
out
the
same
config
to
all
machines
in
the
pool
and
right.
Well,
they
don't
all
have
the
same
static
ip
address.
B
So
now
you
have
to
have
10
machine
config
pools
one
for
each
one
of
the
nodes
in
the
cluster
that
inherits
that
chain
right.
So
it
would
be,
for
example,
the
worker
and
then
the
node
specific,
and
then
you
end
up
with
a
machine
conf
machine
config
specific
to
that
pool
to
configure
the
workers
static
ip
address
technically
possible.
Nothing
wrong
with
that.
Absolutely
fully
supported
a
management
nightmare.
B
B
It
learns
things
or
it
inherits
things
like
how
many
nodes
can
be
down
at
a
time
from
the
machine.
Config
pool
great.
So
when
it
needs
to
do
something
like
apply
updates,
it
says
well
machine
config,
pool
how
many
nodes
can
be
done
at
a
time.
Oh
only
one,
okay!
Well,
I
will
sequentially
go
through
and
reboot.
You
know
apply,
updates
and
reboot
the
nodes
one
at
a
time-
or
you
could
say
maybe
it's
25
percent,
so
in
a
pool
with
you
know,
10
nodes.
B
B
B
It's
really
really
not
the
other
option,
which
you
can
kind
of
squint
at
and
maybe
be
okay
would
be
to
do
something
like
write.
A
bash
script,
oh
I'll,
say
bash
and
have
it
be
so
write
a
bash
script
that
detects
which
nodes
it
in
which
node
it's
on
and
then
applies
the
static
ip
configuration
that
way
right.
So
then,
you
have
one
machine
config
for
all
of
the
nodes
in
the
machine,
config
pool
and
that
script
just
says:
hey
I'm
on
node
12..
I
need
to
give
it
this
ip
address.
B
A
B
A
new
node
to
the
pool
I
went
from
12
nodes
to
14
nodes.
Well
now
you
have
to
recreate
that
script.
When
you
recreate
that
script
and
update
the
machine
config,
it's
going
to
trigger
a
reconfigure
of
all
of
the
nodes
in
the
machine,
config
pool
so
they'll
all
go
through,
get
the
new
file
and
then
have
to
go
through
a
reboot
and
all
that
other
stuff,
so
still
not
a
panacea.
If
you
will
do
we
have
any
questions
chris,
I
haven't
seen
no.
B
B
Just
as
with
last
week
I
I've
got,
I
don't
know
20
or
30
different
links
here
that
I'll
put
all
of
these
into
the
blog
post.
Look
for
that
on
monday
morning
or
excuse
me
friday
morning,
friday
morning,
so
you
can
find
all
of
the
stuff
that
we
would
talk
about.
You
can,
of
course,
always
reach
out
at
any
point
in
time
streaming
or
not
through
social
media.
So
on
twitter
I
am
practical
andrew.
B
B
B
But
I
also
want
to
remind
us
that
we
can
change
the
size
of
the
nodes,
for
example,
and
we
can
balance
the
resources,
so
cpu
memory,
storage,
etc
according
to
what
the
applications
are
actually
using
and
additionally,
you
know
the
metric
service
gives
us
things
like
well,
the
pods
are
making
requests.
Remember,
request
is
effectively
a
reservation,
but
they're
only
using
you
know,
maybe
10
of
that
so
working
with
our
applications,
peers
to
basically
say
hey.
Why
are
you
requesting
10
gigabytes
of
ram?
B
And
you
know
only
using
one-
that's
nine
gigabytes
of
memory
that
I
can't
use
for
other
applications
in
the
cluster,
and
maybe
their
answer
is
well.
You
know
we
do
have
a
batch
job.
That
runs.
You
know
twice
a
month
that
does
require
that
much
memory.
You
know,
okay.
Well,
let's
see
if
we
can
find
a
better.
B
B
B
I
recently
saw
the
terminology
folks
give
a
demo
where
they
were
able
to
predictively
move
pods
to
free
up
resources
for
things
that
were
happening,
and
it
was
pretty
cool
stuff,
so
definitely
always
be.
Cognizant
of
you
know
real
resource
utilization
versus
reserved
resource
utilization.
How
can
I
best
optimize
the
cluster?
B
A
B
Yes,
so
so
the
sdn
can
only
be
deployed
at
install
time,
so
it
doesn't
matter
if
it's
ipi
or
upi
or
even
non-integrated,
it'll
absolutely
work,
and
you
can.
If
you
haven't
seen
calico's
docs,
you
can
look
at
their
docs
here
about
how
to
deploy
inside
of
openshift
more
or
less
the.
The
principle
is
the
same,
regardless
of
the
installation
method.
So
you
see
this
create
manifests
and
then
you
drop
all
of
their
manifests
into
the
correct
place
and
then
continue
with
the
rest
of
the
install.
B
B
B
You
know
it'll
clone
that
ova
for
the
new
worker,
node
it'll
reach
out
to
the
control
plane
to
the
machine,
config
operator
and
it'll
say
give
me
my
ignition
and
part
of
that
is:
hey,
pull
down
this
new
rpmos
tree
image
and
switch
over
so
that
should
work.
You
might
be
able
to
slightly
speed
up
the
node
provisioning,
no
joining
process
if
you're
on
the
same
release
that
it
wants,
but
yeah.
A
B
A
B
Yeah
plea,
please
feel
free
to
reach
out
andrew.sullivan
redhat.com
yeah,
okay,
so
that's
really
all
I
think
we've
got
time
to
get
through
today.
As
I
said,
I
have
a
whole
list
of
of
stuff
that
I
will
include
in
the
blog
post.
We
can
talk
about
that
during
the
next
show
as
well.
So,
which
brings
me
to
my
next
point,
which
is
we
won't
be
back
for
three
weeks.
B
A
B
So
yeah
absolutely
registered
for
red
hat
summits.
It
is
a
two-part
event,
so
the
first
one
is
next
week.
The
second
part
will
be
in
june,
you'll
get
all
the
announcements
and
alerts
and
emails,
and
everything
about
both
of
those
events
so
definitely
encourage
you
to
do
that.
If
you
haven't
already
the
following
week,
so
the
first
week
of
may
is
kubecon,
so
we
will
be
off
air,
so
this
show
will
be
off
air
for.