OpenShift Assisted Installer Service, Universal Deployer

This set of resources handles an idempotent way to deploy OpenShift via the Assisted Installer Service to any number of infrastructure platforms.

Features

• Use the Red Hat hosted Assisted Installer or your own hosted Assisted Installer Service
• End to end deployment and destruction of OpenShift clusters from a bit of YAML and a single command
• Deploy to different AND multiple infrastructure platforms
• Pre-installation configuration of:
  • Additional Root CA Trust Bundles
  • Custom CNIs like Calico and Cilium
  • Injecting additional manifests and ignition overrides
  • Multiple Disks
  • Multiple Network Interfaces, on different networks, with NMState-based configurations
  • NTP Servers
• Post-installation configuration of OpenShift with Roles such as:
  • ocp4-certificates for custom Root and Load Balancer certificates
  • ocp4-deploy-nutanix-csi to deploy the Nutanix CSI
  • ocp4-mario-game for a fun demo workload
  • ocp4-ntp-configuration to configure chrony/ntp
  • ocp4-red-matrix-login to configure the drippy Red Matrix Login
  • ocp4-rhsm-entitlement to apply Red Hat Subscription Manager Entitlement for entitled builds

Supported Infrastructure Platforms

• Libvirt/KVM, tested with RHEL 8.5 and RHEL 9.1
• Nutanix AHV, tested with Nutanix CE
• VMWare, tested with vSphere 7+
• Bare Metal, tested with Dell and Sushy-tools - automation for HP and Supermicro also available

Upcoming Infrastructure Platforms

• HyperV
• OpenStack

---

Operations

The following tasks performed by the different Playbooks are:

bootstrap.yaml

• Preflight for binaries, create asset generation directory, set HTTP Headers & Authentication
• Preflight checks for supported OpenShift versions on the Assisted Installer Service
• Preflight to do connectivity tests to infrastructure platforms
• Query the AI Svc, check for existing cluster with the same name, set facts if so
• Set needed facts, or create a new cluster with new SSH keys
• Configure cluster on the AI Svc with Cluster/InfraEnv deployment specs and ISO Params
• Download the generated Discovery ISO
• Upload the generated Discovery ISO to the target infrastructure platforms
• Create & boot the needed infrastructure resources on the target infrastructure platforms
• Wait for the hosts to report into the AI Svc
• Set Host Names and Roles on the AI Svc
• Set Network VIPs on the AI Svc
• Wait for the hosts to be ready
• Start the cluster installation on the AI Svc
• Wait for the cluster to be fully installed
• Pull cluster credentials from the AI Svc

destroy.yaml

• Preflight for setting HTTP Headers & Authentication
• Preflight to do connectivity tests to infrastructure platforms
• Query the AI Svc, check for existing cluster with the same name, set facts if so
• Power off & delete the infrastructure compute on the target infrastructure platforms
• Delete the Discovery ISO and other shared items from the target infrastructure platforms
• Delete the cluster from the AI Svc
• Delete local generated cluster files

extras-create-sushy-bmh.yaml

This extra Playbook will create some VMs on a Libvirt or VMWare infrastructure provider that will not be turned on in order to act as virtual Bare Metal Hosts via sushy-tools.

• Perform connectivity tests to infrastructure platforms
• Create the virtual infrastructure resources on the target infrastructure platforms

ansible-playbook -e "@credentials-infrastructure.yaml" \
  --skip-tags=infra_libvirt_boot_vm,vmware_boot_vm,infra_libvirt_per_provider_setup,vmware_upload_iso \
  extras-create-sushy-bmh.yaml

---

Prerequisites

• Ansible Automation - python3 -m pip install ansible
• cURL - dnf install curl
• Git - dnf install git
• jq - dnf install jq

Red Hat Registry Pull Secret

To deploy OpenShift in a connected environment, you need to provide a registry pull secret. Get yours from here: https://cloud.redhat.com/openshift/install/pull-secret

It's suggested to use the Copy-to-Clipboard button to copy the registry pull secret to the clipboard. Then, paste it into a file somewhere like ~/ocp-pull-secret - make sure there is no white space in the JSON structure.

Red Hat API Offline Token

To use the Red Hat hosted Assisted Install Service, you need to provide a Red Hat API Offline Token. Get yours from here: https://access.redhat.com/management/api

Take the token and store it in a file somewhere like ~/rh-api-offline-token

One-time | Installing oc

There are a few Ansible Tasks that use the command module to execute commands best/easiest serviced by the oc binary - thusly, oc needs to be available in the system path

## Create a binary directory if needed
sudo mkdir -p /usr/local/bin
echo 'export PATH="/usr/local/bin:$PATH"' | sudo tee /etc/profile.d/usrlibbin.sh
sudo chmod a+x /etc/profile.d/usrlibbin.sh
source /etc/profile.d/usrlibbin.sh

## Download the latest oc binary
mkdir -p /tmp/bindl
cd /tmp/bindl
wget https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/stable/openshift-client-linux.tar.gz
tar zxvf openshift-client-linux.tar.gz

## Set permissions and move it to the bin dir
sudo chmod a+x kubectl
sudo chmod a+x oc

sudo mv kubectl /usr/local/bin
sudo mv oc /usr/local/bin

## Clean up
cd -
rm -rf /tmp/bindl

---

Usage

Clone the repo

git clone http://github.com/kenmoini/ocp4-ai-svc-universal.git
cd ocp4-ai-svc-universal

One-time | Installing Needed Pip Packages

Before running this Ansible content, you will need to install the kubernetes and openshift pip packages, among others - you can do so in one shot by running the following command:

python3 -m pip install --upgrade -r requirements.txt

One-time | Installing Ansible Collections

In order to run this Playbook you'll need to have the needed Ansible Collections already installed - you can do so easily by running the following command:

ansible-galaxy collection install -r collections/requirements.yml

Note: If you're planning on using the Nutanix infrastructure deployment options, you'll need to also manually run ansible-galaxy collection install nutanix.ncp to install the Nutanix collection due to how it hard codes pip modules and the conflicts it causes during the generation of an Execution Environment.

Modify the Variables files

• Copy example_vars/cluster-config.yaml to the working directory, ideally with a prefix of the cluster name - modify as needed.

ls example_vars/cluster-config-*
cp example_vars/cluster-config-selected.yaml CLUSTER_NAME.cluster-config.yaml

• Copy the other relevant files from example_vars/ to vars/ to auto-load them - or the working directory to manually include them - and modify as you see fit, such as those for infrastructure credentials.

cp example_vars/credentials-infrastructure.yaml  credentials-infrastructure.yaml

Running the Playbook

With the needed variables altered, you can run the Playbook with the following command:

ansible-playbook -e "@CLUSTER_NAME.cluster-config.yaml" -e "@credentials-infrastructure.yaml" bootstrap.yaml

Destroying the Cluster

If you are done with the cluster or some error occurred you can quickly delete it from your infrastructure environments, the Assisted Installer Service, and the local assets that were generated during creation:

ansible-playbook -e "@CLUSTER_NAME.cluster-config.yaml" -e "@credentials-infrastructure.yaml" destroy.yaml