L2 — Cluster provisioning (Day-0)
Four OpenShift 4.20.26 clusters, FIPS, agent-based install (FIPS installer runs on the bastion), 3-node compact (schedulable masters).
The 4 clusters
| Cluster | Role | Domain | API VIP | Ing VIP | Nodes | Pod CIDR | Svc CIDR |
|---|---|---|---|---|---|---|---|
| hub | ACM mgmt (active) | hub.airgap.lab | .5 | .6 | .11/.12/.13 | 10.128.0.0/14 | 172.30.0.0/16 |
| hub-dr | ACM passive/restore | hub-dr.airgap.lab | .57 | .58 | .17/.18/.19 | 10.128.0.0/14 | 172.30.0.0/16 |
| wl | Workload (primary) | wl.airgap.lab | .7 | .8 | .14/.15/.16 | 10.128.0.0/14 | 172.30.0.0/16 |
| wl-dr | Workload DR | wl-dr.airgap.lab | .62 | .63 | .59/.60/.61 | 10.132.0.0/14 | 172.31.0.0/16 |
⚠️ wl-dr uses non-overlapping CIDRs vs wl. Regional-DR (Submariner, globalnet off) requires this — reusing wl’s CIDRs forces Globalnet, which ODF StorageClusterPeer can’t NAT, and peering never completes. This is why wl-dr was rebuilt once. Never reuse wl’s CIDRs for wl-dr. (hub/hub-dr may share CIDRs — they don’t peer.)
Node spec
| Role | vCPU / RAM / OS disk | Extra |
|---|---|---|
| hub / hub-dr master | 32 / 96 GB / 300 GB | infra-labeled (mgmt-only, compute replicas 0) |
| wl / wl-dr master | 32 / 96 GB / 300 GB | +3× 500 GB ODF data disks; ODF-labeled |
Install specifics
| Item | Detail |
|---|---|
| Installer | FIPS openshift-install on bastion; agent create image → boot the 3 master VMs |
| install-config backups | hub /root/ocp420-backup, wl /root/spoke-backup; hub-dr/wl-dr /root/<c>-backup/install-config.reference.yaml |
| SSH keys | RSA only (FIPS rejects Ed25519) |
| Disk encryption | wl/wl-dr nodes LUKS→Tang (bastion :7500); hub/hub-dr no LUKS by design |
| kubeconfig | bastion:/root/<cluster>/auth/kubeconfig (+ kubeadmin-password) |
Gotchas (see Gotchas)
- Staged install-configs may carry
openshift/99-master-tang-luks-root.yaml— remove beforeagent create imageor the install hangs. - Install-time admin kubeconfig client-cert stops being trusted after ~9 days — refetch the rotated
lb-ext.kubeconfigfrom a master. - If Tang (bastion) is down, wl/wl-dr nodes cannot boot-unseal.
GitOps vs. out-of-band
Day-0 install is out-of-band (agent installer, not GitOps — GitOps can’t install the cluster it runs on). Everything after the cluster is up is GitOps → see L3.