Integrate RHCOS worker nodes in IBM Cloud

Red Hat Enterprise Linux CoreOS (RHCOS) worker nodes are now available in Red Hat OpenShift on IBM Cloud and IBM Cloud Satellite, offering enhanced capabilities for containerized workloads.

RHCOS is purpose-built for the Red Hat OpenShift Container Platform (OCP), combining the stability and security of Red Hat Enterprise Linux (RHEL) with a lightweight, minimal design optimized for scalability. To explore the key advantages of RHCOS, refer to the documentation on Red Hat Enterprise Linux CoreOS (RHCOS).

RHCOS uses Ignition, a comprehensive provisioning utility, to securely deliver payloads generated by the machine config server on the control plane. This process efficiently converts RHCOS-based Virtual Server Instances (VSIs) into OpenShift workers, seamlessly integrating them into a cluster.

Explore the benefits of using RHCOS over RHEL in IBM Cloud.

Deploying CoreOS in Red Hat OpenShift on IBM Cloud

To deploy CoreOS worker nodes in Red Hat OpenShift on IBM Cloud, follow these steps similar to creating a cluster or worker pool. Specify --operating-system as RHCOS.

Creating a Red Hat OpenShift Cluster with CoreOS Workers

ibmcloud oc cluster create vpc-gen2 --operating-system RHCOS --version 4.15.9_openshift --name <cluster-name> --flavor <flavor> --zone <zone> --vpc-id <vpc-id> --subnet-id <subnet-id> --workers <num-workers>

Creating a Red Hat OpenShift Worker Pool with CoreOS Workers

ibmcloud ks worker-pool create vpc-gen2 --cluster <cluster-id> --flavor <flavor> --name <worker-pool-name> --size-per-zone <size> --operating-system RHCOS

Note: Refer to instructions for creating a HyperShift enabled cluster or checking worker-pool support for CoreOS.

The following image shows the option to use an RHCOS worker pool during the creation of a worker pool in the user interface (UI):

The following image shows the deployment of two RHCOS worker nodes after the creation of the worker pool.

Deploying CoreOS in IBM Cloud Satellite

In IBM Cloud Satellite, deploying CoreOS involves minimizing the firewall footprint by allowing only one external endpoint for joining and operating within a cluster.

Note: Follow the provided instructions to create a HyperShift enabled cluster or to verify the support for CoreOS in your worker pool.

The following image shows the option to enable CoreOS Support during the creation of a satellite location;

The following image shows the option to specify CoreOS when attaching hosts to a location. The downloaded script will be the ignition script, detailed in the following section.

The following image shows the OS configuration set to RHCOS for both Control Plane and Cruiser clusters.

Exploring Ignition on IBM Cloud

Ignition plays a crucial role in provisioning worker-pool zones within OpenShift clusters running in coreos-enabled Satellite Locations and Red Hat OpenShift clusters.

In IBM Cloud, each OpenShift cluster operates with its own Highly Available Ignition server within the control plane. This server is capable of managing multiple payloads.

The Ignition server can be envisioned as a stateless entity responsible for constructing and maintaining secure payloads tailored to the specific requirements of RHCOS worker nodes. RHCOS follows the instructions provided by the ignition server to seamlessly integrate the machine into the cluster.

An example configuration that is sent to an RHCOS machine follows:

Authentication

The ignition.config.merge.httpHeaders[0].name field specifies the authorization mechanism for accessing the customer's Ignition server using a Bearer token. The ignition.security.tls.certificateAuthorities parameter ensures that a proper certificate chain is provided to establish trust with the Ignition server.

Configuration

The ignition.config.merge.httpHeaders[1].name NodePool value identifies the specific workerPool zone within the cluster. The ignition.config.merge.source specifies the nodeport address of the customer’s Ignition server that the RHCOS worker accesses during machine bootup.

Machine bootup

Upon configuration, a RHCOS machine is ordered using this setup as the user metadata. Typically, this configuration serves as the cloud-init data that RHCOS inherently recognizes as the ignition configuration. The ignition configuration facilitates the retrieval of the payload from the Ignition server.

Firstboot in Satellite

In Satellite, the RHCOS machine initially boots with the host-attach payload. Then, after the host is assigned, the RHCOS host uses the machine config operator to fetch the payload, similar to the machine bootup process described previously.

Payload specifics

The payload contains the release image corresponding to the major.minor.patch version configured for the worker pool (e.g., 4.15.1). This release image includes all essential binaries, such as the kubelet, container runtime, OS-level packages, etc., which are required for machine integration into the cluster. Additionally, it includes extra configurations tailored to IBM Cloud, such as HAProxy configuration for accessing IBM Cloud registries and the cluster API server.

Summary

The article highlights the integration of Red Hat Enterprise Linux CoreOS (RHCOS) worker nodes into Red Hat OpenShift on IBM Cloud and IBM Cloud Satellite, emphasizing their enhanced capabilities for containerized workloads. RHCOS, purpose-built for OpenShift Container Platform, offers stability and security while being optimized for scalability. It employs Ignition for secure provisioning, seamlessly integrating RHCOS-based virtual server instances into OpenShift clusters. Detailed deployment instructions are provided for both IBM Cloud and IBM Cloud Satellite, along with insights into Ignition's role in provisioning and configuring RHCOS machines. Each customer cluster is equipped with Ignition servers, which effectively minimize the number of outbound firewall connections required for RHCOS workers to join a cluster.