Red Hat OpenShift OKD Working Group, 17 Aug 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: OKD4 on oVirt Bare Metal Deployment Justin Pittman OKD4 Deployment Marathon

Description

OKD4 on oVirt Bare Metal Deployment
Justin Pittman (Red Hat)
OKD4 Live Deployment Marathon
August 17th, 2020
Day Zero Kubecon EU 2020

A

B

How about that a little bit better.

A

I love the t-shirt. You could just you have to show that off a little bit.

B

Okay, so the the reason for that is, I did not read your email diane that you sent on tuesday. I thought you might enjoy that.

A

B

So cool this is actually an old think, geek shirt. If folks remember thinkgeek.

B

I'm just going to share the whole screen. There's nothing to private.

B

I see yourself for a minute.

B

Does everyone see that uh screen share yeah.

A

It just says you are sure there you go, there's justin.

B

Okay, so just as a background, because a lot of different people, um I've worked uh since the linux 2 2.0 days on various different linuxes.

B

And currently I do work at red hat and I'm focused on openshift, but I have played with okd just outside of my work. So that's the the background here and just to give you a background, I always like to show you know what what who you're talking to so we have some furry friends here, and the story I like to to say is: I was flying for work up to toronto.

B

This is before covid and my dog thought was very jealous that I'd be flying, so she chewed my passport and if any of you had tried to look into the details of flying with damaged ids damaged, ids are no good, at least in the us. The tsa does not accept them, so I had to do a same-day passport replacement.

B

Buyer be beware for for pups and owners or pups to keep valuable things like photo, ids and passports away from them anyway. Today we're gonna do okd 4 on overt, so hopefully that's what you came here for and we are going to do this live.

B

I I jokingly told diane um that my overt lab was was down last week and so for hardware, replacements, and so for a moment I actually went to a packet if people are familiar with packet.net they're, an equinox company, they have excellent bare metal, so I temporarily spun up over it in uh packet because they um provide pretty cheap. It was about two dollars for the size instance that you would need.

B

So if, if you want to try this at home, you can go into packet, and I can just briefly show you how you can spin this up, what you would need to spin up over on okd you'll be looking for their m2x large. They run about two dollars an hour.

B

I don't get paid for for a packet, I'm just letting you know this didn't work for me. However, for overt, because of the way that overt uh needs to do networking, uh there's certain uh packet does uh bonded network interfaces.

B

I can actually show you that, just so you know and and can be aware, so these interfaces get bonded. So I wasn't uh and overt needs to have a a vm guest network, so I wasn't able to go this route. I had to abandon it, so I had to go back to using and and quickly spinning up my own um hardware lab that I have so that's what I'm showing you here. This is not on packet.

B

This is actually my own hardware that I use, and I I'll show you the the version that it's running and stuff like that, because this is what we'll be um deploying okay d2.

B

So it's a version 4.3.10 if over this is a a centos 7 based um overt so and it's actually launch it's actually launching okd right now, that's what's going on in the background here, so we'll get to this in a minute, um but I just wanted to show you if you want to try this uh see, there's a second master going up for okd.

B

If you want to try, this packet might be an option. If you don't have your own hardware, because packet has pretty cheap, bare metal instances, you'll want to shoot for per you know the the minimum requirements probably shoot for at least 256 uh gig of memory.

B

um We're going to slim it down a little bit today, but but this lab, for example, doesn't have the minimum requirements that okd is supposed to have, but let's get into it, so I'm going to have to actually rewind because I have a deployment running so can you can anyone see the? Is the text large enough on that.

A

Could be, it could be a little bit bigger for us with older.

B

I feel you okay, so I made it a little bit bigger, so there's a deployment currently running, but I want to actually destroy this cluster because today uh we're supposed to be live, deploying okd4 right and I want to destroy it. Also, to tell you a couple caveats that you'll have to have to know about okd for in order to get it running on your overt virtualized system.

B

So the first is: if you go into the documents so that the documents let me make that screen bigger as well, the documents for uh okd have, if you switch to version uh oh see, this is already wrong. I'm on the wrong installer. That's the open shift, installer so get to the right installation. Dock. There we go.

B

I was comparing the open shift, install dock to the okd install dock and there are some differences, so I think a dock bug is in order. So here's the latest okd for installing rev quickly. This is what you'll want. This is the method that I've used before before I had all of this uh over lab fiasco.

B

um It's under docs, okay, dot, the usual stuff. So we're going to step through this today, I do want to share with you the diagram of what this is, if you're familiar with any other virtualization environment vsphere.

B

Basically, you have multiple virtual hosts that will be running okd4 in vms, and so that's what this is describing.

B

There are several things that you need to do in order to set this up and there's at least one doc bug so diane talk about community. We I I may file the doc bug live with us here, because I pounded away at some issues and I think it's just some documentation that needs to be changed.

A

So there's always documentation that needs to be updated, but thank you docs.okd.io for us. Thank you. Much appreciated.

B

Yes, yes for sure for sure, so let me um I hate to destroy a cluster, but let but let's do it uh so I'm actually gonna cancel out of this install. Now, if you're curious about what my what I was doing there you can see, I was doing an open shift. Install the installer still called for free for okd is called openshift, even though we get it from the okd build.

B

Release, but that doesn't matter, I just wanted to show you what it was now I needed to destroy this cluster, and so, um let's see, if that's actually in the dock, about the the specific way to destroy the cluster. I always try to go by the document, because if you reference something, then people always ask okay, so is it going to doc? No, it's not going to document that oh wait there. It is destroy, destroy bootstrap but not destroy cluster okay. Anyway, it's destroy cluster.

B

Oh, no, oh sorry, it probably wants me to tell it that the durr, so I created a directory test three, and so it probably just wants me to specify test three. Oh, I bet I did not keep my install yaml did I so I may not be able to destroy this cluster. Let's see, okay, there it goes so. I used this directory to install because I had several different test. Installs running that had issues.

B

So you can see now it's removing the vms and whatnot now just to show you that that was happening on what was happening on the over side. You can see over. It is saying removing vms. Let me make that bigger for you if we were to go into overt and up finish, removing master one yep.

B

So it's cleaning out these um vms that okd was created on and it's actually leaving one around it's leaving this bootstrap and uh you can destroy that with the bootstrap command you if you want to do it that way. Sometimes I just destroy the vm.

B

It doesn't really matter, it's just a bootstrap node. So if I stop it and do a stop shutdown, we're gonna destroy it. Those are you not familiar with over. This is basically the ui interface to it um and then we're going to remove that. We don't need it. I don't need okay, let's get a clean, install.

B

uh This tip vm is interesting. I don't recall it in a previous install anyway. Okay, so let's go through the installation and what you need, let's actually run through the whole uh document to install to overt. So we can. We can get to any issues that don't make sense to folks.

B

Let's go back to the very top so requirements. uh Remember. I said that there were certain requirements to be met.

B

For example, they recommend 230 gig on the docks of disk space, I'm running less than that, but I'm doing thin pull so in the virtualized world for storage, you can do a thin pool back to vms and get around some of these hefty uh install requirements. They also recommend 28 cores, that's pretty reasonable. They do recommend here at least 112 gig of memory.

B

um So those are the basic requirements. You can go to the main kind of dashboard of overt and you can see that we meet most of those requirements. I have 140 some gig of free memory and I have about 200 gig of storage, so we might just barely be squeezing by on the storage back to the dock and what's required, it gets into step four.

B

It doesn't really make a whole lot of sense in the document, but I I I'm gonna step through, because I want you to to know the whole process and you know, ask questions if you if the process doesn't make a whole lot of sense, so this this curl command. What they're doing is they're just trying to get a um access to this engine. uh This manager engine for over they're just trying to get a local certificate out of it. So what I'm going to do is I'm actually going to install from my local box here.

B

So this is just my laptop. That's not running anything special, um but you know, let's start from scratch. How about I do that? Let's, let's just make a new directory we're going to do live okd4 uh install!

B

Let's just go into that and the first command it had was that see this is the the docs do this wrapping, so the first command that they have is to try to get the rest api um in order for you to uh download the uh pim. uh Now I don't want to show you my password, so I I hope you understand that I already did this, but the bigger point is to understand that there's this api endpoint uh that you'll need to connect to right.

B

That's the bigger point so that api endpoint is right here and I could I could try to do that with a curl. If I did something like, let me get rid of this url here and append the api on the beginning and then ignore security, and then it's going to prompt me or a password right and see it's going to. Let's see if it will. Let me do it this way. I think it's going to require um an authenticate okay hold on.

B

I think it needs to have an at internal. I'm.

A

Just going to pause for a second, your terminal is kind of blurry. It's like you've got one thing in the background and.

B

Oh, you don't like the uh yeah, the transparency.

A

Could be my eyes again, but you know.

B

I, like the transparency, because then I can see while I'm typing notes, behind no worries.

A

It might be just a preferences thing.

B

Yes, no transparent background. How about that? Is that better.

A

The transparency is blurring things in the video a little bit yeah, that's much better. Thank you.

B

No worries, okay, so uh I did do the curl command, but I didn't include the password, which is security's sake, so you can see all this gibberish is what the api returned and that's what you want to see. You want to make sure that your command works, but this is the first thing that you'll notice is that over by default, has this admin at internal that's needed for the api in in, and that's not clearly documented.

B

So if you bump into that, just just make sure you have the at internal, it is in our document on okd's website, but just make sure now the next uh things- and this verifies that whatever you're installing from has access to that overt manager, that you should already be able to access now. The next steps are where you will make sure, there's some free ip addresses on your network.

B

So this is assuming that you have access to like a subnet.

B

You will need to have three ips at minimum. Those are used for the dns, the internal dns, that the oak, the overt okd uses okd uses on overt. It is for ingress, that's the second ip is for ingress and the third ip is for the api, the kubernetes api. So those are the three ips. You just need to make sure that they're not uh used, and you know, there's an arp command to make sure that they're not used.

B

The second thing is to make sure your dns has got um the two entries that are required now, so there's been some changes in which dns entries are required, and this may have been talked about a little bit in the previous discussions, but it's been ramped down. We used to require, for example, and some installs still require ncd entries and dns, but the overt install does not require that.

B

It just requires these two, so um I put in my ones that I'm going to use are called api.okd4.lab.

B

Let's see if that's going to return. Yes, so that's the api and obviously and dns has this a record entry. So this is a nice test. Now I had some issues with the dns server that I I'm using uh for the apps or what's used as the ingress.

B

I don't think it's resolving correctly. I tried to fix this earlier, so we're going to see if my dns server is cooperating or we might have to stand up a new dns server to complete the installation, but those are the only two dns entries that are required. So that's good, the the third one. It makes a note that you don't actually have a dns entry for it because it becomes the dns server for the cluster.

B

Next is the um the the the install dog jumbles around so now we're back to the overt manager, the curl command that we issued before and now we're actually going to get the certificate from it. So you'll notice that there is a certificate, because this is an https connection and that api back to overt is going to be communicated by the okd installer.

B

So we're going to have to trust that certificate somehow because it's going to be interactive. So what the installer is saying is you need to download that pim uh or the certificate in a pen format? So that's what this does here and if I just redo my previous command, this shouldn't require a password. So I'm going to redo my curl command, I'm going to get rid of the password. It shouldn't need a password.

B

Okay, yep and I'm going to get whack the api and instead we're going to get the services and I'm going to output it to a c8pm.

B

Oh, oh, I did not close my quote sorry about that. There we go so now we have the pen file and that's it looks pretty normal there. It is now the installer will take care of injecting that into the authentication mechanism for forever I'll get to that in just a second, because that can cause you a a heck of a lot of pain if it doesn't, if you don't get the pen file correct the for this, for this uh self-signed cert, um and then we changed some uh file permissions for that file.

B

I don't know why it thinks it needs sudo. Aha, this is the first time it it thinks it needs sudo and, quite frankly, I found out that anytime, the install duck does use sudo, just don't and also I I moved it to a different directory.

B

I keep on doing sudo. I love sudo, but I'll show you in a second why it became a problem in a couple minutes we'll get to why it became a problem. Okay and then I'm going to copy that pen file that came from the overt manager into the local anchors on my box.

B

So let me just now. This may indeed require sudo, because I'm sure this is owned by roots this area down there, that that etsy directory is probably owned by root and then to update the ca search. Usually that is a super user. That's required to do that, so we'll do that quickly.

B

So now, what's happened is the local search on this, this box that I'm going to install from my laptop uh locally trusts, the overt manager, so that was that whole process and you'll see I'll explain in the installer where that fits in, and why you need to do that. Then the next part is an ssh key. Now the ssh keys are used mostly by folks, if you're familiar with okd or openshift, it's used to log in to the actual nodes.

B

So as the core user stuff like that, so the installer needs it to be injected. I did this process before, but we can do it again if you think that you need it, but this is a standard. Ssh generate a new key pair run the agent locally and then the installer can pick it up. I'm not going to run through that because I think most of us probably understand ssh and how to do it. But the point is either use a key or create a new key for the installer.

B

That's all that is and pretty sure I'm still running my agent yep so just make.

B

Sure running my agent still yep, I'm still running my agent, my ssh agent, locally. Okay. So that's a lot of the prep work. We covered the ssh. We covered the uh certificate for the overt manager. We covered the dns entries and recovered the ip addresses, that's kind of like the prep work. Now we get into the okd installer you'll you'll get the installer from the standard releases, so you can go to any of them that are listed here as assets on the main okd releases, and I already installed this.

B

I downloaded this, but it's the 4.5 for linux is the one I installed. So I put that down. I put that in a previous directory. I was using that okd4 demo, I believe, is where I dropped it. Let me make sure yep, so I'm just going to quickly move it, so I don't have to wait for my slow internet connection, open shift, install and move into the current directory, and just so folks can verify that it is what it is.

B

Then there it is 4.5 okd right built on the 12th so five days ago, all right um and you'll want the ins, uh the cli, but we'll do that later. All right so got it already got it um locally uh and I don't need to antarctic. It's already unloaded now the pull secret. Now this one's a little odd okay.

B

So when you click on I'm gonna, click on this link in the dock in a new private you'll be prompted for a login. That's what okay! So what do you do? um I don't know of a way around this, even though it redirects you to a red hat site, you're trying to install okd, okay, well, the the way that I have found the easiest way to get around this is go to the developers.redhat.com site.

B

Sorry, if the url is not big enough, um but press login at the developers.redhead.site and create a new login like log in with your github account or something that will create a developer account for you at red hat, and it will work with this. Pull secret so again go to developers create an account and log in with that account to get the pull secret.

B

That's how to do that any any questions about that, because it doesn't really clearly explain how to get that pull secret.

B

You do need an account with the red hat to do that, and there are questions I guess since I'm a red header. I can go ahead and answer this. This question, sarah questions about. Well, what do you do with that information?

B

Well, if your cluster is disconnected, uh there's nothing, that's being communicated between the two, uh you can run okd and open shift disconnected, but the way to generate a pull secret for you. We have to have an account in order to do that.

B

If you have any more questions, just ask one of us: okay, so I already downloaded my pull secret, um I put it into a different directory. I think it was that previous directory okd for overt downloaded yep, I downloaded a pull secret and that pull secret is valid, for I can't remember 24 hours or it might be a couple days. I can't remember so: I'm just going to reuse it from this morning, all right. So now you have the pull secret and you have the open shift, okd installer from okidi 4.5.

B

Now it's the time to install this command will not work. Let me just restate that this command in this dock will not work.

B

So I'm going to show you here we go with the the dock, bug I'm going to show you what what does work if you were to run this command, let's just copy and paste it it's got. It's got a line carriage, a rich new line separator, but I'm going to get rid of that. Let's just try!

B

It won't work directory.

B

Let's do log level info paste that all right enter. My video pillages look at this. It's a nice little interface that prompts you for overt, sits. There.

B

Sits there and errors fatal something about terraform, can't get uh authentication to some admin internal, but you'll notice the admin internal again. So it makes you think, oh it can't communicate with over. There must be something wrong with my overt cluster. No, this is just a dock bug. So if I re-run the command.

B

With let's just try will work rerun that command without sudo.

B

It prompts me for my ssh key now why the doc has you installed the agent and then still prompts you for the public, secure key and not entirely clear, and then we get prompted for which platform you select overt.

B

So it actually pulls in some information and it automatically detected the cluster name now. The reason I can tell it's communicating with overt is: if we were to go back over to the manager of ubert and we would look at clusters, that is the name of the cluster, so the openshift installer is pulling information out of overt and let's look at storage. What is the name of oops? Sorry? What is the name of my storage?

B

Let's look at domains for storage, aha, hosted storage, so the open, the okd openshift installer is communicating with overt and we can tell because it's dynamically pulling this information out. But the real question is because I'm going to cancel out of this install the real question is: why did this failure message happen? And it's all because of this document telling you to use sudo, don't do it and after we get install working, I'm gonna, I think I'm just gonna. Do a dock book live with us? Don't don't do sudo, it's gonna bypass it.

B

I'm gonna show you exactly what it's bypassing so here's here's the bug, the oh, the the okd installer needs to access over somehow the way that it accesses it is. It creates this file uh under a hidden directory in your home directory, dot, overt and then over it that comes from the uh installer. The okd installer doesn't come from overt.

B

uh Let me see if I've got an old one here to show you. I don't want to show you my new one, because it's got the a password in it. So I'll show you an old one, and just so you can see the contents of it.

B

If I go up a level oops I'll show you an old one of those. I copied it. Okay, d4, let's see, if we do over it four three: do we have an old overt here we go old, I don't care showing you the old one, because it's not valid anymore.

B

You can see in this file it's actually literally calling that api endpoint it's got the username and password and it has a cert bundle, all generated from the the okd openshift installer and for a while. The only reason I knew this was an issue is for a while. There was a separate bug well, where this file wasn't being created or people were complaining that uh they had multiple overt clusters and data centers and they weren't connecting to new ones.

B

It was just using old ones and so the way that we got around that was to delete this directory. So literally, if you, if you have any issues with this, you can delete this directory and it will re-prompt for all this information. So that's what I'm going to do. Oh yeah, recursively, of course yep.

B

So if you have any issues connecting to your over cluster for the installer blow away that directory uh and try a uh open shift install with the create instead of the create cluster, here's here's what I would recommend, I would recommend the create, install config instead of cluster it. This is good anyway.

B

I'll show you why it's not in the dock and it will still work in the dock, but here's why so no sudo and do the install config it will generate all of the required files again select overt and now you're being prompted for the api endpoint. Now that's where you have to enter in the overt engine.

B

I am having a copy and paste it because it does, it doesn't know it does it doesn't have that file anymore. It needs an api endpoint.

B

You can say that it's trusted, but it's still going to prompt you for the certificate bundle again. If anyone knows why it prompts for that again. That might be an interesting thing to look at um just a second. I need to copy this.

B

Oh that's the pool secret. I need to copy my cert bundle just copy the cert bundle that it copied down. I need to get into the right directory live, okay, install now you can see that we're actually using some stuff see. I need to copy and paste this cert that we downloaded again. I I know it's part of the local trust, but this is what it needs so two empty lines at the end. This is a little weird.

B

You paste did that paste correctly see here we go with bad pasting.

B

I cut, I copied the begin certificate, but I don't see the begin certificate we'll see we'll see if it errors out, so you gotta enter in two empty lines. Okay, there's the begin certificate.

B

Admin internal is the standard unless you've changed it and then I'm going to enter my new password and voila, you can see home lab cluster being accessed, so these prompts these last five prompts are creating that over yaml so that it can communicate with over absolutely critical, and I think another thing to document may be to help people through this process. If they, if they have issues here, the does that make sense any questions about how the installer is accessing overt.

B

Well, do I bore everyone to tears with that? Did.

A

Not bore anybody to tears, we're all just thrilled at your enthusiasm um earlier question uh mike asked, and we may you may have answered it, but about the storage requirements that he's always seen. Each node should have 120 gigabytes.

B

And he comes 120 gig per node, I think, is what he's referring to right yeah, so how? How much of that is actually used on a node uh I've gone down and I think I've seen as little as maybe 30 gig actually used. So if you set up the vms as thin pool, then you can gradually.

B

You know that over will work. You can grow that disk over time. That's the nice part of that and you don't have to thick provision 120 gig for each node, uh but yeah. It's a bit of a heavy heavy requirement for those nodes. But yes to get to get full support from red hat. It's supposed to be 120 gig, but for okd yeah use what you what you have.

A

We've been having emphasis today a little bit on the cheap side of things: okay, the cheapest, uh whether it's digital ocean or a cheap version of aws. It's been a running theme, so thanks. um There was also a little bit of conversation about the whole secret use and charo was mentioning that he used his clay dot io account for that and then uh ah christian. Okay, that you don't actually need full secret.

A

um You can use fake. I think we did that in one of the other demos we just fake it out.

B

So how do you, how do you pick it out.

A

Question you want to pipe in here.

B

Okay, because the quaid I o images you'll still know to pull them down. Somehow are they? Are they entirely public? Let's see what he says.

C

So I think the usual quay: if there are public images, they don't need a pull request, a post secret um and they pull secret. You, you have to add into the installer, really is just for pulling the images from red hat and in the case of okd everything's on quay. So you don't need it. So you can really use.

D

C

One you can use because we haven't disabled the functionality in our installer fork, because we didn't diverge from the ocp installer too much. You can really use anything in there. It just has to be a proper json blob with like field off and then one auth field um yeah. What chara just uh pasted in the chat, but it could be, you know it could be offs, it could be, and then you know fake could be anything. Then it has to have another field off and in there it could be anything again. So um yeah.

C

B

Just I I got you so so. Do you inject that pull secret into like the install config, yaml and and it could be just a standard quite io um like if someone were to go in with with quite io, they just use it.

C

Oh yeah yeah. Definitely you could put in your quay.io one there and then you could even pull uh if you, if you change the payload references to a private image, you could use that with it. Okay, but you're not required to put it in or to put in a valid one for the okd use case, because all of our images are actually publicly pullable.

D

Without it, okay, yeah wow, the face secret, didn't work for me for mirroring uh the, and it's been a while, since I tried it with the fake one again. So maybe it does work now. But that's why I started using my free quad.io account you. You can actually generate a kubernetes pull secret um from your profile and your quay.io account and those are free to set up.

C

And- and that is probably because you're not using it as a pull secret, then when you're mirroring you're pulling but then also pushing again to quay. So you need your your own valid secret to pull to your quay account. At least, I would assume that oh.

D

No, the push was to my sonotype nexus, so so yeah I did have to include a a secret um for my sonotype nexus too, so that it could push the images into the local registry.

C

Okay, I yeah I'd have to investigate why that didn't work, but that's actually kind of an open, an open thing right now we have to um clean up a little bit because it's first of all, it's annoying to to have to put that in there uh the fake one, uh if it's not really used or needed. If you put in the the normal red hat, pull pull secret there um okd will actually send telemetry to red hat as well. um It's not a lot of data, but it's like a bit of data.

C

How healthy is the cluster? There's? No, you know personal information, but some people may still won't lose. They still not want that. So we've definitely at least enabled folks to to go without any any. You know calling back to red hat uh by using that um we we opted to not.

D

Pull that functionality out.

C

Completely to not diverge too much from the upstream from yeah from the installer.

B

uh So so, at least on the on the red hat side, I can't say entirely what what's possible, but for like super secure customers who don't want any phone homing at all, one way to not do the telemetry is we have an entirely disconnected restricted cluster, so that involves not only the um the install is mirrored, but then they might have a proxy that intercepts any outbound requests that the cluster is making um and then it can't go back to quay or red hat at all.

B

um So that's that, but you had you have to extract everything, uh the openshift installer and everything from the mirror. You can't I saw some people that were doing it and they saw things still going phoning home it's because they didn't extract everything from their local mirror. um I did notice something, though, mike mike rusherford said that I asked.

B

Would the registry red hat, I o images, um you wouldn't have access to those red hat, specific images, and that is that is true. You can enable that back into an okd cluster, you could inject a red hat, username, password or token back into the cluster, and you would have access to the red hat images but yeah. The registry.redhead.or images, I think, would um would you wouldn't have access to that without a lock.

C

Yeah, that's right and that's also the reason we don't currently support the um the bare metal ipi path, because we don't have public images for those um they're all rail-based. So you need that pull secret um and yeah we've been trying to get the the api the bare metal folks to to release something um either on top of centos or fedora to make that install path. Work as well, but yeah there's a few limitations. You won't be able to pull any any operators from red hat or anything without the red hat, pull secret.

B

There's another question diane. I don't want to take over your no that's okay scanning of the chat, but there is a ask about: can you just do overt insecure and then don't have to worry about the ca cert so a couple of months ago, back in the okd 4.4 beta days, I did try that um and if I remember correctly, it still didn't work. uh The installer would still fail out. I don't remember exactly where it would fail, but it it.

B

um I don't know if that's something to do, and maybe they changed it in the okd 4.5 and they fixed it. So all of it you could retry that it is an option, but it did not work for me.

B

All right, so I have um 10 minutes, which means we. We must have an install okay, so I'm going to move forward. Okay, so we're going to select the storage uh and I'm actually going to select this over management. That's not what you're supposed to do, but I currently have an issue in this lab with the uh the typical vm subnet anyway.

B

We'll get it around that now. um These are the three ips that are need to be reserved that I talked about earlier. So I know what those are off. The top of my head, uh they're in the 10 and api, is actually let me make sure I I said I knew, but I I probably don't really remember was there. Did I see this.

B

Is it not returning an ip for me? Oh no did my my router fork supposed to be there. Did I type it with something okay, d, word.lab supposed to be there? What about ant? Is it there as well.

B

Well, something just changed. Let me that my lab uses. Oh oh syntax, error. What did I change? I shouldn't have changed anything. Try to restart.

B

I'm using it in this lab, I just have pf sense running with it with unbound as the dns, and I obviously made a change right before I went live with you all. So apologies about that. um Okay, we send it okay, while that restarts let's move forward because that's the ip that's going to have to be is the one.

B

The 199 is what it's supposed to be. Let's move forward, 199 cns is supposed to be. The 197 is what I had reserved and the ingress is supposed to be the 198. I just bunch all three ips together, make it easier for myself and lab is supposed to be the base.

B

Okay, d4 is supposed to be the cluster name, and here we go with the the pull secret. I'm actually going to use my actual pull secret that I got but nice that we have these options. That's really! I want to try the quay.io option, uh so that's not to have to log in to red hat. Thank you for that. That was awesome. Okay, I'm going to insert that. Oh wait. What oh, I had a typo, so we have some validation going on. Well, that's good.

B

Did I really typo that oh yeah, it did no one caught it. I I was typing. Sorry, sorry, that's what happens when you do things live. That's how you know. That's real.

A

And we distract you by asking questions.

B

No, no, no! It's all good one! Nine, nine, two one, six, eight, two, one, nine seven and let's type it correctly this time. If we go over a little bit, don't worry about it!

B

Well I'll at least get the vn starting up an overt that that that should happen. That shouldn't be a problem all right, so it generated our install config oops will work right voila. So now what I want to do is just start now, the the reason I showed you. That is because I wanted you to see that it really did create this hidden directory. That you'll want to just verify the contents of so that you can get your over working. But now I'm going to run the openshift install, create cluster using our directory.

B

Will work being optimistic and I just like to set some info level. So it's consuming the installing ammo.

B

It should go a little bit faster. Okay, ah it use is using a cached image. Okay, good! That's from my previous attempt. So it's already using coreos 32, that's cached locally! That's good! All right! So now it's going to make the calls out to overt, and we should eventually start to see the manager.

B

If I go to vms it will eventually start creating uh vms there. In overt.

B

Yeah and I think, as soon as we'll have to wait a couple of minutes for it to start creating the vms, but we have what six minutes left diane anything else. Any oddball.

A

Yeah, you can, you can go a little over everybody's run a little bit over today. So don't worry if you need it.

B

I'm thinking if, if I've done see, this error is still here in my dns server. Oh well, that's not supposed to be. There is that there.

A

We do like proof of.

A

B

Living on the edge.

B

I was fuxing around with my dns server right before the the call today, and I wonder what just happened.

B

Else I and my dns server is gonna have to stay up for the open shift install to actually make a call out. Let's see this is still running yeah, okay, good! Well, that's cached, probably, but.

B

Sending a request.

B

B

B

B

B

Very slow something's going on.

A

Well, yeah, the gerbils are running.

B

Well, that kind of latency.

B

Is not good um okay? Well, unless my router starts to crash, I do want to file that uh doc bug. So I I do have a question. What's the best way to file a dock back against okd's? Is it there in the installer? Does it say, contact us somewhere in here.

B

Because ascii binder was used.

A

So christian, where, where would you like him to log this.

B

For the don't use sudo, and also how to troubleshoot uh overt.

D

We've been opening most of the issues on the okd um yeah. I.

C

Was gonna say just open.

D

C

Issue you find on the okay openshift, slash okd in the okd repository and we'll we'll work out how to find the proper place for it and and uh refer it. There.

A

So you could file a live, a live issue.

B

I just want that a sudo removed- I don't remember it being there before. uh Okay, so okd.

B

Oh document's still referring to okay, okay, so I'll tag it as kind documentation. Okay, I can do that.

A

There you go and- and you know what that's almost a great way to end a um a live demo on- is filing an issue, because it's a wonderful community thing to do, and.

B

A

B

Wanted the vms to start coming up and before we we totally signed off.

A

That's okay, so we may bring you back again um to do this.

A

Another day.

B

A

B

A

How about that I'll give you five minutes absolutely and just tell waleed and joseph who are logging in now that we're going to be about five minutes late and so just take a breather.

E

Yeah yeah, we can see.

A

Okay, cool, hey joseph.

E

We'll claim justin for our demo.

B

Yeah for messing everything up.

C

A

So, while he's doing that, I will make a pitch again um in the chat. So if, if you're listening in today- and you want to get involved in the okd working group- um please you can go to okd.io and find all the links there too. But you can also just go direct to.

A

The groups, google groups for okd working group and join in there and post any questions. That's also where I will be posting. The links as the videos from today go up so there's another reason to join there and then the fedora calendar is the other place. You can go to find out when we are meeting to chat about stuff and to work on things collaboratively with the fedora community and others.

A

So please do check out and sign up for our calendar.

C

Yeah, maybe I can uh say a few words on on our road map again right now, because I'll have to drop soon but yeah as long as.

C

Figuring out um things so yeah.

A

C

It's just um hooking into we want to collaborate, um and we we really do want to collaborate as the working group with not only the fedora community. But all the communities that are interested in are all the individuals that are interested in joining in.

C

And so what we've planned is to work closely with the with the operator sdk team to and and all the the people that develop the operators to get them to release their operators in a way that it works on okd and also um we want to revive um well that is again fedora a little bit more fedora specific, revive the container special interest group um in fedora to make more fedora based containers, which will obviously run well on fedora core os and make those the bases for some operators too, and so anything any any community.

C

You can think of. Please do invite them to our working group meetings and also individuals that may want to contribute we're really interested in in growing this in a collaborative way and just in general, making making what we've been showing today even more seamless. So it's we're already at a really great point where all these platforms work very very similarly, so the installation process is almost the same on all of them and we really want to get that even more make that even more seamless and just uh yeah improve on on all all the things.

C

So that's just me saying again: uh please join the working group and bring your folks as.

A

Well, and and mike you are asking about um the the container sig meetup, I haven't seen any action on that. I have been um on vacation for a couple of weeks, so I haven't looked, but we were going to try and spin that group up again or get them to spin themselves up again, so we could participate with them so um I'll check back in with them and see if we can't get something going with the fedora container sig group.

A

How are we doing there? Justin.

B

It is working so uh the vms for the masters are coming up, uh they're, so they're booting, core os and they're starting the bootstrap uh had already come up, and I also filed that duck bug so right under time.

A

B

Thank you all uh for for giving me a couple of minutes to to share this with you, and um it really is awesome to to see the progress here. I mean we really didn't even have much to install without until 4.4. So this is really awesome.

A

So there's one last question: for you from aaron um he's asking: is the lab storage on ssd.

B

ah So uh this lab storage actually has spinning rust with an ssd in front of it.

B

So it has a an lvm, a dm cache to accelerate. I guess people call it an accelerator in storage world yeah. You can't survive any of the ncd requirements if you're, if you don't use at least ss these. I think that is made mention of in here in the document.

B

If you click on this etcd back-end performance requirements, um there'll be a link to some testing that some ibm folks did and what the kubernetes folks said for requirements uh and the general consensus. Is you can't get to that kind of speed with uh without at least ssd or nvme good question?.

A

B

Again, diane! Yes, thank you.

A

I I totally my hat's off to you, my red hat somewhere behind me is off to you.

A

Taking on the challenge today, um we've got a new challenge coming up here, I'm just going to pause the recording for a second. So we can have this.

A