---
# System prepended metadata

title: Openshift Agent-based Installation

---

# Openshift Agent-based Installation

### 2024/11/14-15  @Metaage 



# Agent base 安裝的特性

- Run disconnected
- No provisioning host required
- Pre-light validations
- Fully automated
- Static network configuration via NMState
- Supports Single Node PpenShift(SNO) and Baremetal/vSphere platforms


# 0. 安裝架構
![截圖 2024-12-23 下午2.26.36](https://hackmd.io/_uploads/HkIymYUBke.png)


# 1. 軟體下載與工具準備

1. 連線到RedHat的[console.redhat.com](https://console.redhat.com/openshift/downloads)，去下載以下相關的軟體，確認要安裝的平台與作業系統：
    1. OpenShift command-line interface  (oc)
    2. OpenShift for x86_64 Installer
    3. mirror registry for Red Hat OpenShift
    4. OpenShift Client (oc) mirror plugin (oc-mirror)
    
2. 在 download link 上按下右鍵，選” 複製連結網站“取得 URL
    
   ![a1](https://hackmd.io/_uploads/Hyb5QK8Byx.png)

    

1. 在basion機中，去取得這些檔案，並且解壓縮到/usr/local/bin

注意：你從download link中取得是最新的版本，要確認你要安裝的版本，如果版本有問題，可以直接瀏覽https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/ 去取得

```bash
wget https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/4.16.21/openshift-client-linux-4.16.21.tar.gz
wget https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/4.16.21/openshift-install-linux-4.16.21.tar.gz
tar zxvf openshift-client-linux-4.16.21.tar.gz -C /usr/local/bin/
tar zxvf openshift-install-linux-4.16.21.tar.gz -C /usr/local/bin/
chmod +x oc
chmod +x oc-mirror
oc version
oc-mirror version
openshift-install version
oc-mirror version

```

# 2. 網路配置

base domain: **agent.lab**

cluster name: ocp

clusterNetwork: 10.128.0.0/14
    hostPrefix: 23
machineNetwork: 172.20.10.0/24

serviceNetwork:172.30.0.0/16

| Name | ip address  | mac address | 網卡名字 |  |
| --- | --- | --- | --- | --- |
| bastion / quay | 172.20.10.100 |  |  |  |
| apiVIP | 172.20.10.101 | X | X |  |
| ingressVIP | 172.20.10.102 | X | X |  |
| master1.ocp.agent.lab | 172.20.10.103 | 00:50:56:b9:b5:c7 | ens33 |  |
| master2.ocp.agent.lab | 172.20.10.104 | 00:50:56:b9:eb:b | ens33 |  |
| master3.ocp.agent.lab | 172.20.10.106 | 00:50:56:b9:eb:b1 | ens33 |  |
| worker1.ocp.agent.lab | 172.20.10.107 | 00:50:56:b9:62:c8 | ens33 |  |
| worker2.ocp.agent.lab | 172.20.10.108 | 00:50:56:b9:46:aa | ens33 |  |
| worker3.ocp.agent.lab | 172.20.10.109 | 00:50:56:b9:39:83 | ens33 |  |

# 3. DNS 確認

## 配置與確認DNS

```bash
[root@bastion dnsmasq.d]# cat dns.conf
host-record=bastion.ocp.agent.lab,172.20.10.100
host-record=quay.ocp.agent.lab,172.20.10.100
host-record=master1.ocp.agent.lab,172.20.10.103
host-record=master2.ocp.agent.lab,172.20.10.104
host-record=master3.ocp.agent.lab,172.20.10.105
host-record=worker1.ocp.agent.lab,172.20.10.106
host-record=worker2.ocp.agent.lab,172.20.10.107
host-record=worker3.ocp.agent.lab,172.20.10.108

host-record=api.ocp.agent.lab,172.20.10.101
host-record=api-int.ocp.agent.lab,172.20.10.101
host-record=apps.ocp.agent.lab,172.20.10.102
host-record=\*.apps.ocp.agent.lab,172.20.10.102

address=/bastion.ocp.agent.lab/172.20.10.100
address=/quay.ocp.agent.lab/172.20.10.100
address=/master1.ocp.agent.lab/172.20.10.103
address=/master2.ocp.agent.lab/172.20.10.104
address=/master3.ocp.agent.lab/172.20.10.105
address=/worker1.ocp.agent.lab/172.20.10.106
address=/worker2.ocp.agent.lab/172.20.10.107
address=/worker3.ocp.agent.lab/172.20.10.108

address=/apps.ocp.agent.lab/172.20.10.102
address=/\*.apps.ocp.agent.lab/172.20.10.102
address=/api.ocp.agent.lab/172.20.10.101
address=/api-int.ocp.agent.lab/172.20.10.101

server=1.1.1.1

```

# 4. 安裝mirror-registry

## 4.1 install mirror-registry

```bash
./mirror-registry install --quayHostname quay.ocp.agent.lab --quayRoot /quay --quayStorage /quay/quay-Storage
```

https://docs.openshift.com/container-platform/4.10/installing/disconnected_install/installing-mirroring-creating-registry.html

- -quayHostname：quay 的主機名uri。 我們有另外設置一個quay.ocp.agent.lab
- -quayRoot：安裝的目錄 (default "~/quay-install")
- --quayStorage /quay/quay-Storage ：因為空間不夠，另外掛了一個disk出來裝

## 4.2 安裝完成後可以取得帳號與密碼，並且試著登入

```bash
Quay installed successfully, config data is stored in ~/quay
Quay is available at https://mirror-registry.ocp4.lab.local:8443 with credentials (init, yaFRt3MNXBE1v7ZGP9YiOS206Js48gl5)
podman login -u init -p yaFRt3MNXBE1v7ZGP9YiOS206Js48gl5 quay.ocp.agent.lab:8443 --tls-verify=false
Login Succeeded!

```

## 4.3 加入CA憑証

安裝mirror registry 會自動生成CA憑證, 須加入信任憑證中

```bash
$ cp /quay/quay-rootCA/rootCA.pem /usr/share/pki/ca-trust-source/anchors/rootCA.cert
$ update-ca-trust
```

# 5. 建立ocp iso檔

## 5.1 Pull secret

從[console.redhat.com](https://console.redhat.com/openshift/downloads) 下載 Pull secret，改輸出成json格式

```bash
cat pull-secret.txt | jq . pull-secret.json
cat Pull-sercet.json

"auths": {
                "cloud.openshift.com": {
                        "auth": "b3BlbnNoaWZ0LXJlbGVhc2UtZGV2K29jbV9hY2Nlc3NfOWVjY2NmNzJkOWQxNDFiOTk4ZmU1ZWM0ZTA4OTQ2NGY6SzlGU002Qk4zVVo2MTNZV0pEU0QzRVVNSjlMTlI5MjJOOTZSTzVVVVpFUzYzRFY3RU9UM0VIMVJQTkpXMjFWOQ=="
                },
                "quay.io": {
                        "auth": "b3BlbnNoaWZ0LXJlbGVhc2UtZGV2K29jbV9hY2Nlc3NfOWVjY2NmNzJkOWQxNDFiOTk4ZmU1ZWM0ZTA4OTQ2NGY6SzlGU002Qk4zVVo2MTNZV0pEU0QzRVVNSjlMTlI5MjJOOTZSTzVVVVpFUzYzRFY3RU9UM0VIMVJQTkpXMjFWOQ=="
                },
                "registry.connect.redhat.com": {
                        "auth": "fHVoYy1wb29sLWQ1ODM2YWYxLWM0MWYtNGI3ZC05ZjUwLTlj
}  
```

登入內建的mirror register需要的帳號密碼，可以透過以下方式取出

```bash
[root@bastion /]# podman login quay.ocp.agent.lab:8443 --username init --password yaFRt3MNXBE1v7ZGP9YiOS206Js48gl5
Login Succeeded!
[root@bastion /]# cat /run/user/0/containers/auth.json

        "auths": {
                
                "quay.ocp.agent.lab:8443": {
                        "auth": "aW5pdDp5YUZSdDNNTlhCRTF2N1pHUDlZaU9TMjA2SnM0OGdsNQ=="
                }
}                        
```

把找到的值取出，並且加到 pull-secret.json, 並且蓋掉/run/user/0/containers/auth.json

```bash
vi pull-secret.json
cp pull-secret.json /run/user/0/containers/auth.json
cat /run/user/0/containers/auth.json

"auths": {
                "cloud.openshift.com": {
                        "auth": "b3BlbnNoaWZ0LXJlbGVhc2UtZGV2K29jbV9hY2Nlc3NfOWVjY2NmNzJkOWQxNDFiOTk4ZmU1ZWM0ZTA4OTQ2NGY6SzlGU002Qk4zVVo2MTNZV0pEU0QzRVVNSjlMTlI5MTzVVVVpFUzYzRFY3RU9UM0VIMVJQTkpXMjFWOQ=="
                },
                "quay.io": {
                        "auth": "b3BlbnNoaWZ0LXJlbGVhc2UtZGV2K29jbV9hY2Nlc3NfOWVjY2NmNzJkOWQxNDFiOTk4ZmU1ZWM0ZTA4OTQ2NGY6SzlGU002Qk4zVVo2MTNZV0pEU0QzRVVNSjlMTlI5MTzVVVVpFUzYzRFY3RU9UM0VIMVJQTkpXMjFWOQ=="
                },
                "quay.ocp.agent.lab:8443": {
                        "auth": "aW5pdDp5YUZSdDNNTlhCRTF2N1pHUDlZaU9TMjA2SnM0OGdsNQ=="
                },
                "registry.connect.redhat.com": {
                        "auth": "fHVoYy1wb29sLWQ1ODM2YWYxLWM0MWYtNGI3ZC05ZjUwLTljNTViYWUwODJhNzpleUpoYkdjaU9pSlNVelV4TWlKOS5leUp6ZFdJaU9pSXhNRFE0T1dVell6VXhNekkwWUmpNREV6WldNelkyWTVPRE5oTmlKOS5ZQlhoeXd6Yi1zT3RxTTdJUzRjSVVVRWJvb29rWnJadm1VWFdTR0dvd1dLT0VwbjVkVlhMTFNGMW9WYjRlbTJzZGtrandvbTZuZWc1cHJVUVBtZ3VLNUxWVzFwMXM2eUttQkEpvdndVdXlEYlhjM25TYnFIQzZkazZNRWd0ZURNbk4yQTlJSGI4b0Z0LWE1SmFRaDh4Vy1TUDVqWkhXSXdSVjZNYy1vZDFqMjVHcEJVVXVkTHlxdW1CUVR3TFQ2VHFXaV8yQVdSZTI5eHEweExKQ00yY0VEaGh5dFZZBOWF5WVd0M1Fnd3VCWlpPZ0xvWUlzN1ZMSnE0UjZySDRmR1dMZzFIMk1CZjRYWGR0dm8wNWRYNjhUY2tJVkFjclliT2ZmSDRPTVVXWnFIZ1ZVbGNDbU5ZdWh6NlAxVllvUzBGdTFZOTVRcFA1R0g4Wjh4VWc3djNsOaEI4RkxCWHFWa1VEd085THFfWVdQV2xSVHFBMXM1SkNZR3U2cUZlUXZLUEoxc2VZZEJ5OEkxWl9objMtVzk0VklHNEQ2Wk4yeURYSVJsU096UkRNUk4za2VrUF9tS1gwWkVPUDhucWRrYVVlT3JOVll3S05VTm95MNVlFNXBwcHVqNGlEdXQ0ZzZZdVZkWVJlYUJvdENSQ1R6U1N1ZzllTE5UX1Q3MktrOUlyQ3ZnQTQxVmV2b29obk9CcENnWlpkdmUyTDQzOWdNVzRLU2hTcXZqNXJBRHd4TWdtblg2SFMyWUtuZTVtR0lMWU5LaU5tRXTdPM2wtSG5YUzRlTGJFdnVod0tOSVFNaEdua25ESFd6M0o4dXl6ajRwSFlCNHg1NnlWeWowU1FZeVd6cnlaQ1didmJoaThCQQ=="
                },
                "registry.redhat.io": {
                        "auth": "fHVoYy1wb29sLWQ1ODM2YWYxLWM0MWYtNGI3ZC05ZjUwLTljNTViYWUwODJhNzpleUpoYkdjaU9pSlNVelV4TWlKOS5leUp6ZFdJaU9pSXhNRFE0T1dVell6VXhNekkwWUmpNREV6WldNelkyWTVPRE5oTmlKOS5ZQlhoeXd6Yi1zT3RxTTdJUzRjSVVVRWJvb29rWnJadm1VWFdTR0dvd1dLT0VwbjVkVlhMTFNGMW9WYjRlbTJzZGtrandvbTZuZWc1cHJVUVBtZ3VLNUxWVzFwMXM2eUttQkEpvdndVdXlEYlhjM25TYnFIQzZkazZNRWd0ZURNbk4yQTlJSGI4b0Z0LWE1SmFRaDh4Vy1TUDVqWkhXSXdSVjZNYy1vZDFqMjVHcEJVVXVkTHlxdW1CUVR3TFQ2VHFXaV8yQVdSZTI5eHEweExKQ00yY0VEaGh5dFZZBOWF5WVd0M1Fnd3VCWlpPZ0xvWUlzN1ZMSnE0UjZySDRmR1dMZzFIMk1CZjRYWGR0dm8wNWRYNjhUY2tJVkFjclliT2ZmSDRPTVVXWnFIZ1ZVbGNDbU5ZdWh6NlAxVllvUzBGdTFZOTVRcFA1R0g4Wjh4VWc3djNsOaEI4RkxCWHFWa1VEd085THFfWVdQV2xSVHFBMXM1SkNZR3U2cUZlUXZLUEoxc2VZZEJ5OEkxWl9objMtVzk0VklHNEQ2Wk4yeURYSVJsU096UkRNUk4za2VrUF9tS1gwWkVPUDhucWRrYVVlT3JOVll3S05VTm95MNVlFNXBwcHVqNGlEdXQ0ZzZZdVZkWVJlYUJvdENSQ1R6U1N1ZzllTE5UX1Q3MktrOUlyQ3ZnQTQxVmV2b29obk9CcENnWlpkdmUyTDQzOWdNVzRLU2hTcXZqNXJBRHd4TWdtblg2SFMyWUtuZTVtR0lMWU5LaU5tRXTdPM2wtSG5YUzRlTGJFdnVod0tOSVFNaEdua25ESFd6M0o4dXl6ajRwSFlCNHg1NnlWeWowU1FZeVd6cnlaQ1didmJoaThCQQ=="
                }
        }

```

將mirror registry值寫入install-config.yaml中

```bash

pullSecret: '{"auths":{"quay.ocp.agent.lab:8443":{"auth":"aW5pdDp5YUZSdDNNTlhCRTF2N1pHUDlZaU9TMjA2SnM0OGdsNQ==","email":"jasowan@redhat.com"}}}'
```

這個值就是quay的init 密碼去做base 64加密，不過如果直接去進行得不到系統內的值，所以要直接從系統內取出

```bash
[root@bastion /]#  echo aW5pdDp5YUZSdDNNTlhCRTF2N1pHUDlZaU9TMjA2SnM0OGdsNQ== | base64 -d
init:yaFRt3MNXBE1v7ZGP9YiOS206Js48gl5
```

## 5.2 sshKey:

產生ssh key，以備後續連線使用

```bash
ssh-keygen
cd .ssh
cat id_rsa.pub

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC5vSEsokRbpHCJl8PcO5s9DSlz74pOIDu9PLd8+Lgy6j+ymhT1zsuDPgAeHUnttC9j4OQ4A5t0VZGvLax1b82wUStnXptEgKoG/WsvaqODL3S6cobsUyaU9NSjB0OV4WMOcURrEkmzYhj/yQmlZjOQzd6YY1u6wKYPZtTpFjxSslz2R68dXBQS3WiWWL9XyCIf0fZsbExoUHT2hsoBb2f7tSUk354jI9oOVQi1aeBFRF8d+IV5b8shpHSIm2ur2uWwGLy6cEq3iHT1lZ2HlKUPfHhD4APt8SxqtzaY+qXA7suzJmXn5d//Ke4QRCgZj2DYk+ED6GXHfNj7BXCLCYcR0QB5vZURpOcS4QctbOmHG7rqlseNczlaKK0No0uCBQzcXNxbE+QQ5QxAxJVHBOXopbDb3sykpLaT0aWldWyDlZWwrktcnXLI5Y8uGKSC7DdOSNEACEEtJionZ9eIHFyzos+WMJ8L15EM3z+qlvSpMuCEKGOHwavNoXmVYt98k2U= root@bastion.ocp.agent.lab
```

## 5.3 ImageDigestSources:

建立imageset-config.yaml

```bash
apiVersion: mirror.openshift.io/v1alpha2
storageConfig:
  registry:
    imageURL: quay.ocp.agent.lab:8443/mirror/oc-mirror-metadata
    skipTLS: true
mirror:
  platform:
    channels:
    - name: stable-4.16
      type: ocp
```

執行oc-mirror config imagesetl

```bash
oc-mirror --config  imageset-config.yaml  docker://quay.ocp.agent.lab:8443/ocp4
```

 

查詢imageContentSourcePolicy.yaml ，取出repositoryDigestMirrors的值，更新install-config.yaml

```bash
[root@bastion results-1731569746]# cat /root/ocp4-platfrom/oc-mirror-workspace/results-1731569746/imageContentSourcePolicy.yaml
---
apiVersion: operator.openshift.io/v1alpha1
kind: ImageContentSourcePolicy
metadata:
  name: release-0
spec:
  repositoryDigestMirrors:
  - mirrors:
    - quay.ocp.agent.lab:8443/ocp4/openshift/release
    source: quay.io/openshift-release-dev/ocp-v4.0-art-dev
  - mirrors:
    - quay.ocp.agent.lab:8443/ocp4/openshift/release-images
    source: quay.io/openshift-release-dev/ocp-release

```

查詢channel 與version

```bash
[root@bastion ocp4]# oc-mirror list releases --channels --version=4.16
Listing channels for version 4.16.

stable-4.15
eus-4.16
stable-4.16
fast-4.17
candidate-4.15
fast-4.15
candidate-4.16
fast-4.16
candidate-4.17

[root@bastion ocp4]# oc-mirror list releases --channel=stable-4.16
Listing stable channels. Use --channel=<channel-name> to filter.
Use oc-mirror list release --channels to discover other channels.

Channel: stable-4.16
Architecture: amd64
4.15.0
4.15.2
4.15.3
4.15.5
‥
```

## 5.4 additionalTrustBundle: |

透過以下指令取得

```bash
cat /quay/quay-rootCA/rootCA.pem

-----BEGIN CERTIFICATE-----
  MIID3DCCAsSgAwIBAgIUdG6akjlcQTfkJLclNULSf/cP4S8wDQYJKoZIhvcNAQEL
  BQAwbDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAlZBMREwDwYDVQQHDAhOZXcgWW9y
  azENMAsGA1UECgwEUXVheTERMA8GA1UECwwIRGl2aXNpb24xGzAZBgNVBAMMEnF1
  YXkub2NwLmFnZW50LmxhYjAeFw0yNDExMTQwNjQ0MDRaFw0yNzA5MDQwNjQ0MDRa
  MGwxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJWQTERMA8GA1UEBwwITmV3IFlvcmsx
  DTALBgNVBAoMBFF1YXkxETAPBgNVBAsMCERpdmlzaW9uMRswGQYDVQQDDBJxdWF5
  Lm9jcC5hZ2VudC5sYWIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6
  wixM7732lt7euPK4w9LBuUYbWy81nhT4dBtQ5HPcx2UhfTbFdhL3mAkvvGQjbtCv
  SrKjfEPmLT6XFJ3Nkisof0P4Pb5mrU8pM73doaVyKf0kHlIvc05XJEZpGxwccRK0
  8JnxNIRkZsYw3Bl1yqUQesEt9mJZfngFZrrzUrjXOKEDBL6rppFA1Z7RKc5AFxTq
  qoU6yJdykWMHDx0ZkgVXYJwCfnr19ztE2w4/OZ009/3eNHq+Z9UhU1f7CuHA8iES
  FBTY+G8ycDDmfMUD6vLpyV3LjeGRs8R1b4wlgeva6UOvGfzZ5QJm/570CPUsXj55
  pgTfEpw1TOhXJMVTyD/NAgMBAAGjdjB0MAsGA1UdDwQEAwIC5DATBgNVHSUEDDAK
  BggrBgEFBQcDATAdBgNVHREEFjAUghJxdWF5Lm9jcC5hZ2VudC5sYWIwEgYDVR0T
  AQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUO2oV66MF4i4OxITJPGocQvcQPVgwDQYJ
  KoZIhvcNAQELBQADggEBAF1GUxA8Iw7UqPEbrAaWSC4mUEj82Eldc9Ru5kUS66Vy
  nS2G/NNEQxktZ8taJloBu1Q+x0TTrCM+Il5PMtAlvo1DGUpKwoltFerj/pysuN45
  9LOYsxlTw3/Xjwd6lDBaELsBqT/tgMeBMf7O7cvbOmglneUUAu0kM0GppYKRVrcJ
  Es44N0d3Zgr+clRSlFUNCzW+V/IMCHaJrNwEQ2aVcz3x3VLxQ1EUeBe7wWOZoATS
  EH5enbQfjH+vFTQwOC4SIFQYNV32FCV+KuH/Pv7c2szb2b+nCnFMOpHqRp3CBb4W
  QVpqO6UsrxrsT6osI4evolj6yyseuHJJduM/56UOgAc=
  -----END CERTIFICATE-----
```

## 5.5 修改install-config.yaml

```yaml
apiVersion: v1
baseDomain: agent.lab
compute:
- architecture: amd64
  hyperthreading: Enabled
  name: worker
  replicas: 3
controlPlane:
  architecture: amd64
  hyperthreading: Enabled
  name: master
  replicas: 3
metadata:
  name: ocp
networking:
  clusterNetwork:
  - cidr: 10.128.0.0/14
    hostPrefix: 23
  machineNetwork:
  - cidr: 172.20.10.0/24
  networkType: OVNKubernetes
  serviceNetwork:
  - 172.30.0.0/16
platform:
  baremetal:
    apiVIPs:
      - 172.20.10.101
    ingressVIPs:
      - 172.20.10.102
    hosts:
      - name: master1.ocp.agent.lab
        role: master
        bootMACAddress: 00:50:56:b9:b5:c7
      - name: master2.ocp.agent.lab
        role: master
        bootMACAddress: 00:50:56:b9:eb:b1
      - name: master3.ocp.agent.lab
        role: master
        bootMACAddress: 00:50:56:b9:0b:cb
      - name: worker1.ocp.agent.lab
        role: worker
        bootMACAddress: 00:50:56:b9:62:c8
      - name: worker2.ocp.agent.lab
        role: worker
        bootMACAddress: 00:50:56:b9:46:aa
      - name: worker3.ocp.agent.lab
        role: worker
        bootMACAddress: 00:50:56:b9:39:83
pullSecret: '{"auths":{"quay.ocp.agent.lab:8443":{"auth":"aW5pdDp5YUZSdDNNTlhCRTF2N1pHUDlZaU9TMjA2SnM0OGdsNQ==","email":"jasowan@redhat.com"}}}'
sshKey: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC5vSEsokRbpHCJl8PcO5s9DSlz74pOIDu9PLd8+Lgy6j+ymhT1zsuDPgAeHUnttC9j4OQ4A5t0VZGvLax1b82wUStnXptEgKoG/WsvaqODL3S6cobsUyaU9NSjB0OV4WMOcURrEkmzYhj/yQmlZjOQzd6YY1u6wKYPZtTpFjxSslz2R68dXBQS3WiWWL9XyCIf0fZsbExoUHT2hsoBb2f7tSUk354jI9oOVQi1aeBFRF8d+IV5b8shpHSIm2ur2uWwGLy6cEq3iHT1lZ2HlKUPfHhD4APt8SxqtzaY+qXA7suzJmXn5d//Ke4QRCgZj2DYk+ED6GXHfNj7BXCLCYcR0QB5vZURpOcS4QctbOmHG7rqlseNczlaKK0No0uCBQzcXNxbE+QQ5QxAxJVHBOXopbDb3sykpLaT0aWldWyDlZWwrktcnXLI5Y8uGKSC7DdOSNEACEEtJionZ9eIHFyzos+WMJ8L15EM3z+qlvSpMuCEKGOHwavNoXmVYt98k2U= root@bastion.ocp.agent.lab'
ImageDigestSources:
- mirrors:
  - quay.ocp.agent.lab:8443/ocp4/openshift/release
  source: quay.io/openshift-release-dev/ocp-v4.0-art-dev
- mirrors:
  - quay.ocp.agent.lab:8443/ocp4/openshift/release-images
  source: quay.io/openshift-release-dev/ocp-release
additionalTrustBundle: |
  -----BEGIN CERTIFICATE-----
  MIID3DCCAsSgAwIBAgIUdG6akjlcQTfkJLclNULSf/cP4S8wDQYJKoZIhvcNAQEL
  BQAwbDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAlZBMREwDwYDVQQHDAhOZXcgWW9y
  azENMAsGA1UECgwEUXVheTERMA8GA1UECwwIRGl2aXNpb24xGzAZBgNVBAMMEnF1
  YXkub2NwLmFnZW50LmxhYjAeFw0yNDExMTQwNjQ0MDRaFw0yNzA5MDQwNjQ0MDRa
  MGwxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJWQTERMA8GA1UEBwwITmV3IFlvcmsx
  DTALBgNVBAoMBFF1YXkxETAPBgNVBAsMCERpdmlzaW9uMRswGQYDVQQDDBJxdWF5
  Lm9jcC5hZ2VudC5sYWIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6
  wixM7732lt7euPK4w9LBuUYbWy81nhT4dBtQ5HPcx2UhfTbFdhL3mAkvvGQjbtCv
  SrKjfEPmLT6XFJ3Nkisof0P4Pb5mrU8pM73doaVyKf0kHlIvc05XJEZpGxwccRK0
  8JnxNIRkZsYw3Bl1yqUQesEt9mJZfngFZrrzUrjXOKEDBL6rppFA1Z7RKc5AFxTq
  qoU6yJdykWMHDx0ZkgVXYJwCfnr19ztE2w4/OZ009/3eNHq+Z9UhU1f7CuHA8iES
  FBTY+G8ycDDmfMUD6vLpyV3LjeGRs8R1b4wlgeva6UOvGfzZ5QJm/570CPUsXj55
  pgTfEpw1TOhXJMVTyD/NAgMBAAGjdjB0MAsGA1UdDwQEAwIC5DATBgNVHSUEDDAK
  BggrBgEFBQcDATAdBgNVHREEFjAUghJxdWF5Lm9jcC5hZ2VudC5sYWIwEgYDVR0T
  AQH/BAgwBgEB/wIBATAdBgNVHQ4EFgQUO2oV66MF4i4OxITJPGocQvcQPVgwDQYJ
  KoZIhvcNAQELBQADggEBAF1GUxA8Iw7UqPEbrAaWSC4mUEj82Eldc9Ru5kUS66Vy
  nS2G/NNEQxktZ8taJloBu1Q+x0TTrCM+Il5PMtAlvo1DGUpKwoltFerj/pysuN45
  9LOYsxlTw3/Xjwd6lDBaELsBqT/tgMeBMf7O7cvbOmglneUUAu0kM0GppYKRVrcJ
  Es44N0d3Zgr+clRSlFUNCzW+V/IMCHaJrNwEQ2aVcz3x3VLxQ1EUeBe7wWOZoATS
  EH5enbQfjH+vFTQwOC4SIFQYNV32FCV+KuH/Pv7c2szb2b+nCnFMOpHqRp3CBb4W
  QVpqO6UsrxrsT6osI4evolj6yyseuHJJduM/56UOgAc=
  -----END CERTIFICATE-----
```

## 5.6 修改agent-config.yaml

```yaml
apiVersion: v1alpha1
kind: AgentConfig
metadata:
  name: ocp4
rendezvousIP: 172.20.10.103
hosts:
  - hostname: master1.ocp.agent.lab
    role: master
    interfaces:
      - name: ens33
        macAddress: 00:50:56:b9:b5:c7
    networkConfig:
      interfaces:
        - name: ens33
          type: ethernet
          state: up
          mac-address: 00:50:56:b9:b5:c7
          ipv4:
            enabled: true
            address:
              - ip: 172.20.10.103
                prefix-length: 24
            dhcp: false
      dns-resolver:
        config:
          server:
            - 172.20.10.100
      routes:
        config:
          - destination: 0.0.0.0/0
            next-hop-address: 172.20.10.10
            next-hop-interface: ens33
            table-id: 254
  - hostname: master2.ocp.agent.lab
    role: master
    interfaces:
      - name: ens33
        macAddress: 00:50:56:b9:eb:b1
    networkConfig:
      interfaces:
        - name: ens33
          type: ethernet
          state: up
          mac-address: 00:50:56:b9:eb:b1
          ipv4:
            enabled: true
            address:
              - ip: 172.20.10.104
                prefix-length: 24
            dhcp: false
      dns-resolver:
        config:
          server:
            - 172.20.10.100
      routes:
        config:
          - destination: 0.0.0.0/0
            next-hop-address: 172.20.10.10
            next-hop-interface: ens33
            table-id: 254
  - hostname: master3.ocp.agent.lab
    role: master
    interfaces:
      - name: ens33
        macAddress: 00:50:56:b9:0b:cb
    networkConfig:
      interfaces:
        - name: ens33
          type: ethernet
          state: up
          mac-address: 00:50:56:b9:0b:cb
          ipv4:
            enabled: true
            address:
              - ip: 172.20.10.105
                prefix-length: 24
            dhcp: false
      dns-resolver:
        config:
          server:
            - 172.20.10.100
      routes:
        config:
          - destination: 0.0.0.0/0
            next-hop-address: 172.20.10.10
            next-hop-interface: ens33
            table-id: 254
  - hostname: worker1.ocp.agent.lab
    role: worker
    interfaces:
      - name: ens33
        macAddress: 00:50:56:b9:62:c8
    networkConfig:
      interfaces:
        - name: ens33
          type: ethernet
          state: up
          mac-address: 00:50:56:b9:62:c8
          ipv4:
            enabled: true
            address:
              - ip: 172.20.10.106
                prefix-length: 24
            dhcp: false
      dns-resolver:
        config:
          server:
            - 172.20.10.100
      routes:
        config:
          - destination: 0.0.0.0/0
            next-hop-address: 172.20.10.10
            next-hop-interface: ens33
            table-id: 254
  - hostname: worker2.ocp.agent.lab
    role: worker
    interfaces:
      - name: ens33
        macAddress: 00:50:56:b9:46:aa
    networkConfig:
      interfaces:
        - name: ens33
          type: ethernet
          state: up
          mac-address: 00:50:56:b9:46:aa
          ipv4:
            enabled: true
            address:
              - ip: 172.20.10.107
                prefix-length: 24
            dhcp: false
      dns-resolver:
        config:
          server:
            - 172.20.10.100
      routes:
        config:
          - destination: 0.0.0.0/0
            next-hop-address: 172.20.10.10
            next-hop-interface: ens33
            table-id: 254
  - hostname: worker3.ocp.agent.lab
    role: worker
    interfaces:
      - name: ens33
        macAddress: 00:50:56:b9:39:83
    networkConfig:
      interfaces:
        - name: ens33
          type: ethernet
          state: up
          mac-address: 00:50:56:b9:39:83
          ipv4:
            enabled: true
            address:
              - ip: 172.20.10.108
                prefix-length: 24
            dhcp: false
      dns-resolver:
        config:
          server:
            - 172.20.10.100
      routes:
        config:
          - destination: 0.0.0.0/0
            next-hop-address: 172.20.10.10
            next-hop-interface: ens33
            table-id: 254
```

## 5.7 產生ios image檔

```bash
# openshift-install --dir ocp4 agent create image

agent.x86_64.iso 
```

將agent.x86_64.iso  檔掛在VMMware的主機上，進行開機

Note: 如果安裝在VMWare上，要確定disk.EnableUUID設為True

https://access.redhat.com/solutions/4606201

https://docs.openshift.com/container-platform/3.11/install_config/configuring_vsphere.html

# 6. 開始安裝OCP


將iso分別掛載在所有的機器上後，進行開機動作，會開始OCP的安裝工作，會觀察到所有的機器全部開完後，進行安裝。


## 6.1 觀察OCP安裝情況

```bash
openshift-install --dir ocp4 agent wait-for bootstrap-complete --log-level=info
```

## 6.2 安裝完成後取得密碼

```bash
cat /root/ocp4/auth/kubeadmin-password
cat /root/ocp4/auth/kubeconfig
oc login -u kubeadmin -p <kubeadmin-password>
oc login  --kubeconfig=/root/ocp4/auth/kubeconfig --insecure-skip-tls-verify
```

可以在basion機上設定 hosts檔，指向ingressVIP來取取 console

172.20.10.102 console-openshift-console.apps.ocp.agent.lab oauth-openshift.apps.ocp.agent.lab
![a3](https://hackmd.io/_uploads/H1IrLF8ryl.png)





# 7. 參考資料


[Installing an on-premise cluster with the Agent-based Installer](https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/installing_an_on-premise_cluster_with_the_agent-based_installer/index#toc-wrapper-mobile)