Credentials

Red Hat Advanced Cluster Management for Kubernetes 2.3

Read more to learn how to create and manage your cluster credentials.

Abstract

Read more to learn how to create and manage your cluster credentials.

Chapter 1. Managing credentials overview

You can create and manage your cluster credentials. A credential is required to create a Red Hat OpenShift Container Platform cluster on a cloud service provider with Red Hat Advanced Cluster Management for Kubernetes. The credential stores the access information for a cloud provider. Each provider account requires its own credential, as does each domain on a single provider.

Credentials are stored as Kubernetes secrets. Secrets are copied to the namespace of a managed cluster so that the controllers for the managed cluster can access the secrets. When a credential is updated, the copies of the secret are automatically updated in the managed cluster namespaces.

Note: Changes to the pull secret or SSH keys of cloud provider credentials are not reflected for existing managed clusters, as they have already been provisioned using the original credentials.

Required access: Edit

1.1. Creating a credential for Amazon Web Services

You need a credential to use Red Hat Advanced Cluster Management for Kubernetes console to deploy and manage an Red Hat OpenShift Container Platform cluster on Amazon Web Services (AWS).

Required access: Edit

Note: This procedure must be done before you can create a cluster with Red Hat Advanced Cluster Management for Kubernetes.

1.1.1. Prerequisites

You must have the following prerequisites before creating a credential:

  • A deployed Red Hat Advanced Cluster Management for Kubernetes hub cluster
  • Internet access for your Red Hat Advanced Cluster Management for Kubernetes hub cluster so it can create the Kubernetes cluster on Amazon Web Services (AWS)
  • AWS login credentials, which include access key ID and secret access key. See Understanding and getting your security credentials.
  • Account permissions that allow installing clusters on AWS. See Configuring an AWS account for instructions on how to configure.

1.1.2. Creating a credential by using the console

To create a credential from the Red Hat Advanced Cluster Management for Kubernetes console, complete the following steps:

  1. From the navigation menu, navigate to Credentials. Existing credentials are displayed.
  2. Select Add credential.
  3. Select Amazon Web Services as your provider.
  4. Add a name for your credential.

  5. Select a namespace for your credential from the list.

    Tip: Create a namespace specifically to host your credentials, both for convenience and added security.

  6. You can optionally add a Base DNS domain for your credential. If you add the base DNS domain to the credential, it is automatically populated in the correct field when you create a cluster with this credential.
  7. Add your AWS access key ID for your AWS account. Log in to AWS to find the ID.
  8. Add your AWS Secret Access Key.
  9. Enter your Red Hat OpenShift pull secret. You can download your pull secret from Pull secret.
  10. Add your SSH private key and SSH public key, which allows you to connect to the cluster. You can use an existing key pair, or create a new one with key generation program. See Generating an SSH private key and adding it to the agent for more information about how to generate a key.
  11. Click Create.
  12. Review the new credential information, then click Add. When you add the credential, it is added to the list of credentials.

You can create a cluster that uses this credential by completing the steps in Creating a cluster on Amazon Web Services.

1.1.3. Editing a credential by using the console

Edit a credential for a Red Hat OpenShift Container Platform cluster on Amazon Web Services (AWS) by using the following steps:

  1. From the navigation menu, navigate to Credentials. Existing credentials are displayed.
  2. Find the credential you want to edit and click to update credential.
  3. Click Edit and enter new cloud credentials for Amazon Web Services (AWS).
  4. Click Save to update credentials.

If the cluster was created by using this provider connection, then the <cluster-name>-aws-creds> secret from <cluster-namespace> will get updated with the new credentials.

Note: Updating credentials does not work for cluster pool claimed clusters.

1.1.4. Deleting your credential

When you are no longer managing a cluster that is using a credential, delete the credential to protect the information in the credential.

  1. From the navigation menu, navigate to Credentials.
  2. Select Actions to delete in bulk, or select the options menu beside the credential that you want to delete.
  3. Select Delete credentials or Delete credential.

1.2. Creating a credential for Microsoft Azure

You need a credential to use Red Hat Advanced Cluster Management for Kubernetes console to create and manage a Red Hat OpenShift Container Platform cluster on Microsoft Azure.

Required access: Edit

Note: This procedure is a prerequisite for creating a cluster with Red Hat Advanced Cluster Management for Kubernetes.

1.2.1. Prerequisites

You must have the following prerequisites before creating a credential:

  • A deployed Red Hat Advanced Cluster Management for Kubernetes hub cluster.
  • Internet access for your Red Hat Advanced Cluster Management for Kubernetes hub cluster so that it can create the Kubernetes cluster on Azure.
  • Azure login credentials, which include your Base Domain Resource Group and Azure Service Principal JSON. See azure.microsoft.com.
  • Account permissions that allow installing clusters on Azure. See How to configure Cloud Services and Configuring an Azure account for more information.

1.2.2. Creating a credential by using the console

To create a credential from the Red Hat Advanced Cluster Management for Kubernetes console, complete the following steps:

  1. From the navigation menu, navigate to Credentials. Existing credentials are displayed.
  2. Select Add credential.
  3. Select Microsoft Azure as your provider.
  4. Add a name for your credential.

  5. Select a namespace for your credential from the list.

    Tip: You can create a namespace specifically to host your credentials, both for convenience and added security.

  6. You can optionally add a Base DNS domain for your credential. If you add the base DNS domain to the credential, it is automatically populated in the correct field when you create a cluster with this credential.
  7. Add your Base domain resource group name for your Azure account. This entry is the resource name that you created with your Azure account. You can find your Base Domain Resource Group Name by selecting Home > DNS Zones in the Azure interface. Your Base domain resource group name is in the Resource Group column of the entry that contains the Base DNS domain that applies to your account.

  8. Add your Client ID. This value is generated as the appId property when you create a service principal with the following command: 

    az ad sp create-for-rbac --role Contributor --name <service_principal>

    Replace service_principal with the name of your service principal.

  9. Add your Client Secret. This value is generated as the password property when you create a service principal with the following command: 

    az ad sp create-for-rbac --role Contributor --name <service_principal>

    Replace service_principal with the name of your service principal.

  10. Add your Subscription ID. This value is the id property in the output of the following command: 

    az account show

  11. Add your Tenant ID. This value is the tenantId property in the output of the following command: 

    az account show
  12. Enter your Red Hat OpenShift pull secret. You can download your pull secret from Pull secret.
  13. Add your SSH private key and SSH public key to use to connect to the cluster. You can use an existing key pair, or create a new pair using a key generation program. See Generating an SSH private key and adding it to the agent for more information about how to generate a key.
  14. Click Create.
  15. Review the new credential information, then click Add. When you add the credential, it is added to the list of credentials.

You can create a cluster that uses this credential by completing the steps in Creating a cluster on Microsoft Azure.

1.2.3. Deleting your credential

When you are no longer managing a cluster that is using a credential, delete the credential to protect the information in the credential.

  1. From the navigation menu, navigate to Credentials.
  2. Select Actions to delete in bulk, or select the options menu beside the credential that you want to delete.
  3. Select Delete credentials or *Delete credential.

1.3. Creating a credential for Google Cloud Platform

You need a credential to use Red Hat Advanced Cluster Management for Kubernetes console to create and manage a Red Hat OpenShift Container Platform cluster on Google Cloud Platform (GCP).

Required access: Edit

Note: This procedure is a prerequisite for creating a cluster with Red Hat Advanced Cluster Management for Kubernetes.

1.3.1. Prerequisites

You must have the following prerequisites before creating a credential:

  • A deployed Red Hat Advanced Cluster Management for Kubernetes hub cluster
  • Internet access for your Red Hat Advanced Cluster Management for Kubernetes hub cluster so it can create the Kubernetes cluster on GCP
  • GCP login credentials, which include user Google Cloud Platform Project ID and Google Cloud Platform service account JSON key. See Creating and managing projects.
  • Account permissions that allow installing clusters on GCP. See Configuring a GCP project for instructions on how to configure an account.

1.3.2. Creating a credential by using the console

To create a credential from the Red Hat Advanced Cluster Management for Kubernetes console, complete the following steps:

  1. From the navigation menu, navigate to Credentials. Existing credentials are displayed.
  2. Select Add credential.
  3. Select Google Cloud Platform as your provider.
  4. Add a name for your credential.

  5. Select a namespace for your credential from the list.

    Tip: Create a namespace specifically to host your credentials, for both convenience and security.

  6. You can optionally add a Base DNS domain for your credential. If you add the base DNS domain to the credential, it is automatically populated in the correct field when you create a cluster with this credential.
  7. Add your Google Cloud Platform project ID for your GCP account. Log in to GCP to retrieve your settings.

  8. Add your Google Cloud Platform service account JSON key. Complete the following steps to create one with the correct permissions:

    1. In the GCP main menu, select IAM & Admin and start the Service Accounts applet
    2. Select Create Service Account.
    3. Provide the Name, Service account ID, and Description of your service account.
    4. Select Create to create the service account.
    5. Select a role of Owner, and click Continue.
    6. Click Create Key
    7. Select JSON, and click Create.
    8. Save the resulting file to your computer.
    9. Provide the contents for the Google Cloud Platform service account JSON key.
  9. Enter your Red Hat OpenShift pull secret. You can download your pull secret from Pull secret.
  10. Add your SSH private key and SSH public key so you can access the cluster. You can use an existing key pair, or create a new pair using a key generation program. See Generating an SSH private key and adding it to the agent for more information about how to generate a key.
  11. Click Create.
  12. Review the new credential information, then click Add. When you add the credential, it is added to the list of credentials.

You can use this connection when you create a cluster by completing the steps in Creating a cluster on Google Cloud Platform.

1.3.3. Deleting your credential

When you are no longer managing a cluster that is using a credential, delete the credential to protect the information in the credential.

  1. From the navigation menu, navigate to Credentials.
  2. Select Actions to delete in bulk, or select the options menu beside the credential that you want to delete.
  3. Select Delete credentials or *Delete credential.

1.4. Creating a credential for VMware vSphere

You need a credential to use Red Hat Advanced Cluster Management for Kubernetes console to deploy and manage a Red Hat OpenShift Container Platform cluster on VMware vSphere. Note: Only OpenShift Container Platform versions 4.5.x, and later, are supported.

Required access: Edit

Note: This procedure must be done before you can create a cluster with Red Hat Advanced Cluster Management.

1.4.1. Prerequisites

You must have the following prerequisites before you create a credential:

  • A deployed Red Hat Advanced Cluster Management hub cluster on OpenShift Container Platform version 4.6 or later.
  • Internet access for your Red Hat Advanced Cluster Management hub cluster so it can create the Kubernetes cluster on VMware vSphere.

  • VMware vSphere login credentials and vCenter requirements configured for OpenShift Container Platform when using installer-provisioned infrastructure. See Installing a cluster on vSphere. These credentials include the following information:

    • vCenter account privileges.
    • Cluster resources.
    • DHCP available.
    • ESXi hosts have time synchronized (for example, NTP).

1.4.2. Creating a credential by using the console

To create a credential from the Red Hat Advanced Cluster Management console, complete the following steps:

  1. From the navigation menu, navigate to Credentials. Existing credentials are displayed.
  2. Select Add credential.
  3. Select VMware vSphere as your provider.
  4. Add a name for your credential.

  5. Select a namespace for your credential from the list.

    Tip: Create a namespace specifically to host your credentials, for both convenience and added security.

  6. You can optionally add a Base DNS domain for your credential. If you add the base DNS domain to the credential, it is automatically populated in the correct field when you create a cluster with this credential.
  7. Add your VMware vCenter server fully-qualified host name or IP address. The value must be defined in the vCenter server root CA certificate. If possible, use the fully-qualified host name.
  8. Add your VMware vCenter username.
  9. Add your VMware vCenter password.

  10. Add your VMware vCenter root CA certificate.

    1. You can download your certificate in the download.zip package with the certificate from your VMware vCenter server at: https://<vCenter_address>/certs/download.zip. Replace vCenter_address with the address to your vCenter server.
    2. Unpackage the download.zip.

    3. Use the certificate from the certs/<platform> directory that has a .0 extension. Tip: You can use the ls certs/<platform> command to list all of the available certificates for your platform.

      Replace <platform> with the abbreviation for your platform: lin, mac, or win.

      For example: certs/lin/3a343545.0

  11. Add your VMware vSphere cluster name.
  12. Add your VMware vSphere datacenter.
  13. Add your VMware vSphere default datastore.
  14. Enter your Red Hat OpenShift pull secret. You can download your pull secret from Pull secret.
  15. Add your SSH private key and SSH public key, which allows you to connect to the cluster. You can use an existing key pair, or create a new one with key generation program. See Generating an SSH private key and adding it to the agent for more information.
  16. Click Create.
  17. Review the new credential information, then click Add. When you add the credential, it is added to the list of credentials.

You can create a cluster that uses this credential by completing the steps in Creating a cluster on VMware vSphere.

1.4.3. Deleting your credential

When you are no longer managing a cluster that is using a credential, delete the credential to protect the information in the credential.

  1. From the navigation menu, navigate to Credentials.
  2. Select the options menu beside the credential that you want to delete.
  3. Select Delete credential.

1.5. Creating a credential for Red Hat OpenStack

You need a credential to use Red Hat Advanced Cluster Management for Kubernetes console to deploy and manage a Red Hat OpenShift Container Platform cluster on Red Hat OpenStack Platform. Note: Only OpenShift Container Platform versions 4.5.x, and later, are supported.

Note: This procedure must be done before you can create a cluster with Red Hat Advanced Cluster Management.

1.5.1. Prerequisites

You must have the following prerequisites before you create a credential:

  • A deployed Red Hat Advanced Cluster Management hub cluster on OpenShift Container Platform version 4.6 or later.
  • Internet access for your Red Hat Advanced Cluster Management hub cluster so it can create the Kubernetes cluster on Red Hat OpenStack Platform.
  • Red Hat OpenStack Platform login credentials and Red Hat OpenStack Platform requirements configured for OpenShift Container Platform when using installer-provisioned infrastructure. See Installing a cluster on OpenStack.

  • Download or create a clouds.yaml file for accessing the CloudStack API. Within the clouds.yaml file:

    • Determine the cloud auth section name to use.
    • Add a line for the password, immediately following the username line.

1.5.2. Creating a credential by using the console

To create a credential from the Red Hat Advanced Cluster Management console, complete the following steps:

  1. From the navigation menu, navigate to Credentials. On the Credentials page, the existing credentials are displayed.
  2. Select Add credentials to enter the credential information into the Add credentials_ editor.
  3. Select Red Hat OpenStack Platform as your credential type.
  4. Add a name for your credential.

  5. Select a namespace for your credential from the list.

    Tip: Create a namespace specifically to host your credentials, for both convenience and added security.

  6. Add your Red Hat OpenStack Platform clouds.yaml file contents. The contents of the clouds.yaml file, including the password, provide the required information for connecting to the Red Hat OpenStack Platform server. The file contents must include the password, which you add to a new line immediately after the username.
  7. Add your Red Hat OpenStack Platform cloud name. This entry is the name specified in the cloud section of the clouds.yaml to use for establishing communication to the Red Hat OpenStack Platform server.
  8. You can optionally add a Base DNS domain for your credential. If you add the base DNS domain to the credential, it is automatically populated in the correct field when you create a cluster with this credential.
  9. Enter your Red Hat OpenShift Pull Secret. You can download your pull secret from Pull secret.
  10. Add your SSH Private Key and SSH Public Key, which allows you to connect to the cluster. You can use an existing key pair, or create a new one with key generation program. See Generating an SSH private key and adding it to the agent for more information.
  11. Click Create.
  12. Review the new credential information, then click Add. When you add the credential, it is added to the list of credentials.

You can create a cluster that uses this credential by completing the steps in Creating a cluster on Red Hat OpenStack Platform.

1.5.3. Deleting your credential

When you are no longer managing a cluster that is using a credential, delete the credential to protect the information in the credential.

  1. From the navigation menu, navigate to Credentials.
  2. Select Actions to delete in bulk, or select the options menu beside the credential that you want to delete.
  3. Select Delete credentials or *Delete credential.

1.6. Creating a credential for bare metal

You need a credential to use the Red Hat Advanced Cluster Management for Kubernetes console to deploy and manage a Red Hat OpenShift Container Platform cluster in a bare metal environment. The credential specifies the connection to a provisioning node that is used as a bootstrap host virtual machine (VM) when creating the cluster.

Required access: Edit

1.6.1. Prerequisites

You need the following prerequisites before creating a credential:

  • A Red Hat Advanced Cluster Management for Kubernetes hub cluster that is deployed. When managing bare metal clusters, you must have the hub cluster installed on Red Hat OpenShift Container Platform version 4.6 or later.
  • Internet access for your Red Hat Advanced Cluster Management for Kubernetes hub cluster so it can create the Kubernetes cluster on your bare metal server.
  • For a disconnected environment, you must have a configured mirror registry where you can copy the release images for your cluster creation. See Mirroring images for a disconnected installation in the OpenShift Container Platform documentation for more information.
  • Account permissions that support installing clusters on the bare metal infrastructure.

1.6.2. Preparing a provisioning host

When you create a bare metal credential and cluster, you must have an available provisioning host. The provisioning host provides a bootstrap host VM for the installation. This can be a VM or a service running Kernel-based virtual machine (KVM). You need the details of this host when you are creating the credential and the cluster. Complete the following steps to configure a provisioning host:

  1. Log in to the provisioner node using SSH.

  2. Create a non-root user (user-name) and provide that user with sudo privileges by running the following commands: 

    useradd <user-name>
passwd <password>
echo "<user-name> ALL=(root) NOPASSWD:ALL" | tee -a /etc/sudoers.d/<user-name>
chmod 0440 /etc/sudoers.d/<user-name>

  3. Create an SSH key for the new user by entering the following command: 

    su - <user-name> -c "ssh-keygen -t rsa -f /home/<user-name>/.ssh/id_rsa -N ''"

  4. Log in as the new user on the provisioner node. 

    su - <user-name>
[user-name@provisioner ~]$

  5. Use Red Hat Subscription Manager to register the provisioner node by entering the following commands: 

    sudo subscription-manager register --username=<user-name> --password=<password> --auto-attach
sudo subscription-manager repos --enable=rhel-8-for-x86_64-appstream-rpms --enable=rhel-8-for-x86_64-baseos-rpms

    For more information about Red Hat Subscription Manager, see Using and Configuring Red Hat Subscription Manager in the Red Hat OpenShift Container Platform documentation.

  6. Install the required packages by running the following command: 

    sudo dnf install -y libvirt qemu-kvm mkisofs python3-devel jq ipmitool

  7. Modify the user to add the libvirt group to the newly created user. 

    sudo usermod --append --groups libvirt <user-name>

  8. Restart firewalld and enable the http service by entering the following commands: 

    sudo systemctl start firewalld
sudo firewall-cmd --zone=public --add-service=http --permanent
sudo firewall-cmd --add-port=5000/tcp --zone=libvirt  --permanent
sudo firewall-cmd --add-port=5000/tcp --zone=public   --permanent
sudo firewall-cmd --reload

  9. Start and enable the libvirtd service by entering the following commands: 

    sudo systemctl start libvirtd
sudo systemctl enable libvirtd --now

  10. Create the default storage pool and start it by entering the following commands: 

    sudo virsh pool-define-as --name default --type dir --target /var/lib/libvirt/images
sudo virsh pool-start default
sudo virsh pool-autostart default

  11. View the followig examples to configure networking:

    • Provisioning Network (IPv4 address) 

      sudo nohup bash -c """
    nmcli con down "$PROV_CONN"
    nmcli con delete "$PROV_CONN"
    # RHEL 8.1 appends the word "System" in front of the connection, delete in case it exists
    nmcli con down "System $PROV_CONN"
    nmcli con delete "System $PROV_CONN"
    nmcli connection add ifname provisioning type bridge con-name provisioning
    nmcli con add type bridge-worker ifname "$PROV_CONN" master provisioning
    nmcli connection modify provisioning ipv4.addresses 172.22.0.1/24 ipv4.method manual
    nmcli con down provisioning
    nmcli con up provisioning"""

      The SSH connection might disconnect after you complete this step.

      The IPv4 address can be any address as long as it is not routable using the baremetal network.

    • Provisioning Network (IPv6 address) 

      sudo nohup bash -c """
    nmcli con down "$PROV_CONN"
    nmcli con delete "$PROV_CONN"
    # RHEL 8.1 appends the word "System" in front of the connection, delete in case it exists
    nmcli con down "System $PROV_CONN"
    nmcli con delete "System $PROV_CONN"
    nmcli connection add ifname provisioning type bridge con-name provisioning
    nmcli con add type bridge-worker ifname "$PROV_CONN" master provisioning
    nmcli connection modify provisioning ipv6.addresses fd00:1101::1/64 ipv6.method manual
    nmcli con down provisioning
    nmcli con up provisioning"""

      The SSH connection might disconnect after you complete this step.

      The IPv6 address can be any address as long as it is not routable using the baremetal network.

      Ensure that UEFI is enabled and UEFI PXE settings are set to the IPv6 protocol when using IPv6 addressing.

  12. Reconnect to the provisioner node by using SSH (if required). 

    # ssh <user-name>@provisioner.<cluster-name>.<domain>

  13. Verify the connection bridges have been correctly created by running the following command: 

    nmcli con show

    Your returned results resemble the following content:

    NAME

    UUID

    TYPE

    DEVICE

    baremetal

    4d5133a5-8351-4bb9-bfd4-3af264801530

    bridge

    baremetal

    provisioning

    43942805-017f-4d7d-a2c2-7cb3324482ed

    bridge

    provisioning

    virbr0

    d9bca40f-eee1-410b-8879-a2d4bb0465e7

    bridge

    virbr0

    bridge-worker-eno1

    76a8ed50-c7e5-4999-b4f6-6d9014dd0812

    ethernet

    eno1

    bridge-worker-eno2

    f31c3353-54b7-48de-893a-02d2b34c4736

    ethernet

    eno2

  14. Create a pull-secret.txt file by completing the following steps: 

    vim pull-secret.txt
    1. In a web browser, navigate to Install OpenShift on Bare Metal with user-provisioned infrastructure, and scroll down to the Downloads section.
    2. Click Copy pull secret.
    3. Paste the contents into the pull-secret.txt file and save the contents in the home directory of the user-name user.

You are ready to create your bare metal credential.

1.6.3. Creating a credential by using the console

To create a credential from the Red Hat Advanced Cluster Management for Kubernetes console, complete the following steps:

  1. From the navigation menu, navigate to Credentials. Existing credentials are displayed.
  2. Select Add credential.
  3. Select Bare metal as your provider.
  4. Add a name for your credential.

  5. Select a namespace for your credential from the list.

    Tip: Create a namespace specifically to host your credentials, both for convenience and added security.

  6. You can optionally add a Base DNS domain for your credential. If you add the base DNS domain to the credential, it is automatically populated in the correct field when you create a cluster with this credential. If you do not add the DNS domain, you can add it when you create your cluster.

  7. Add your libvirt URI. The libvirt URI is for your provisioning node that you created for your bootstrap node. Your libvirt URI should resemble the following example: 

    <qemu+ssh>:://<user-name>@<provision-host.com>/system
    • Replace qemu+ssh with your method of connecting to the libvirt daemon on the provisioning host.
    • Replace user-name with the user name that has access to create the bootstrap node on the provisioning host.

    • Replace provision-host.com with a link to your provisioning host. This can be either an IP address or a fully-qualified domain name address.

      See Connection URIs for more information.

  8. Add a list of your SSH known hosts for the provisioning host. This value can be an IP address or a fully-qualified domain name address, but is best to use the same format that you used in the libvirt URI value.
  9. Enter your Red Hat OpenShift pull secret. You can download your pull secret from Pull secret.
  10. Add your SSH private key and your SSH public key so you can access the cluster. You can use an existing key, or use a key generation program to create a new one. See Generating an SSH private key and adding it to the agent for more information about how to generate a key.

  11. For disconnected installations only: Complete the fields in the Configuration for disconnected installation subsection with the required information:

    • Image registry mirror: This value contains the disconnected registry path. The path contains the hostname, port, and repository path to all of the installation images for disconnected installations. Example: repository.com:5000/openshift/ocp-release.

      The path creates an image content source policy mapping in the install-config.yaml to the Red Hat OpenShift Container Platform release images. As an example, repository.com:5000 produces this imageContentSource content: 

      imageContentSources:
- mirrors:
  - registry.example.com:5000/ocp4
  source: quay.io/openshift-release-dev/ocp-release-nightly
- mirrors:
  - registry.example.com:5000/ocp4
  source: quay.io/openshift-release-dev/ocp-release
- mirrors:
  - registry.example.com:5000/ocp4
  source: quay.io/openshift-release-dev/ocp-v4.0-art-dev
    • Bootstrap OS image: This value contains the URL to the image to use for the bootstrap machine.
    • Cluster OS image: This value contains the URL to the image to use for Red Hat OpenShift Container Platform cluster machines.

    • Additional trust bundle: This value provides the contents of the certificate file that is required to access the mirror registry.

      Note: If you are deploying managed clusters from a hub that is in a disconnected environment, and want them to be automatically imported post install, add an Image Content Source Policy to the install-config.yaml file by using the YAML editor. A sample entry is shown in the following example: 

      imageContentSources:
- mirrors:
  - registry.example.com:5000/rhacm2
  source: registry.redhat.io/rhacm2
  12. Click Create.
  13. Review the new credential information, then click Add. When you add the credential, it is added to the list of credentials.

You can create a cluster that uses this credential by completing the steps in Creating a cluster on bare metal.

1.6.4. Deleting your credential

When you are no longer managing a cluster that is using a credential, delete the credential to protect the information in the credential.

  1. From the navigation menu, navigate to Credentials.
  2. Select the options menu for the credential that you want to delete.
  3. Select Delete credential.

1.7. Creating a credential for Red Hat OpenShift Cluster Manager

Add an OpenShift Cluster Manager credential so that you can discover clusters.

Required access: Administrator

1.7.1. Prerequisites

You need access to a console.redhat.com account. Later you will need the value that can be obtained from console.redhat.com/openshift/token.

1.7.2. Add your credential

Best practice: Create only one credential in each namespace.

You need to add your credential to discover clusters. If you have no credentials, see the following process.

  1. From the product navigation, click Credentials.
  2. Click the Add credentials button to get to the Add credentials page.
  3. Choose the OpenShift Cluster Manager credential type, then click Next.

  4. Enter the following basic information for your credential:

    • Enter any unique name for your credential.
    • Enter a namespace that you can access. All users assigned to this namespace can also access the resources. All discovered resources that are related to this credential are created in this same namespace. Every credential that you create must be assigned to a unique, existing namespace.
  5. Click Next.
  6. Enter your OpenShift Cluster Manager API token, which can be obtained from console.redhat.com/openshift/token.
  7. Click Next to review your selections or return to a step.
  8. Review the new credential information, then click Add. When you add the credential, it is added to the list of credentials.

1.7.3. Deleting your credential

When you are no longer managing a cluster that is using a credential, delete the credential to protect the information in the credential.

  1. From the navigation menu, navigate to Credentials.
  2. Select Actions to delete in bulk, or select the options menu beside the credential that you want to delete.
  3. Select Delete credentials or Delete credential.

If your credential is removed, or your OpenShift Cluster Manager API token expires or is revoked, then the associated discovered clusters are removed.

1.8. Creating a credential for Ansible Automation Platform

You need a credential to use Red Hat Advanced Cluster Management for Kubernetes console to deploy and manage an Red Hat OpenShift Container Platform cluster that is using Red Hat Ansible Automation Platform.

Required access: Edit

Note: This procedure must be done before you can create a cluster with Red Hat Advanced Cluster Management for Kubernetes.

1.8.1. Prerequisites

You must have the following prerequisites before creating a credential:

  • A deployed Red Hat Advanced Cluster Management for Kubernetes hub cluster
  • Internet access for your Red Hat Advanced Cluster Management for Kubernetes hub cluster
  • Ansible login credentials, which includes Ansible Tower hostname and OAuth token; see Credentials for Ansible Tower.
  • Account permissions that allow you to install hub clusters and work with Ansible. Learn more about Ansible users.

1.8.2. Creating a credential by using the console

To create a credential from the Red Hat Advanced Cluster Management for Kubernetes console, complete the following steps:

  1. From the navigation menu, navigate to Credentials. Existing credential options are displayed.
  2. Select Add credential.
  3. Select Red Hat Ansible Automation Platform as your provider.
  4. Add a name for your credential.

  5. Select a namespace for your credential from the list.

    Tip: Create a namespace specifically to host your credentials, both for convenience and added security.

  6. Click Create.
  7. Review the new credential information, then click Add. When you add the credential, it is added to the list of credentials.

Starting with Red Hat Advanced Cluster Management version 2.3, the Ansible Token and host URL that you provide when you create your Ansible credential are automatically updated for the automations that use that credential when you edit the credential. The updates are copied to any automations that use that Ansible credential, including those related to cluster lifecycle, governance, and application management automations. This ensures that the automations continue to run after the credential is updated.

Ansible credentials are automatically updated in your automation that use that credential when you update them in the credential.

1.8.3. Deleting your credential

When you are no longer managing a cluster that is using a credential, delete the credential to protect the information in the credential.

  1. From the navigation menu, navigate to Credentials.
  2. Select Actions to delete in bulk, or select the options menu beside the credential that you want to delete.
  3. Select Delete credentials or Delete credential.

Legal Notice

Copyright © 2022 Red Hat, Inc.
The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, the Red Hat logo, JBoss, OpenShift, Fedora, the Infinity logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
Java® is a registered trademark of Oracle and/or its affiliates.
XFS® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries.
MySQL® is a registered trademark of MySQL AB in the United States, the European Union and other countries.
Node.js® is an official trademark of Joyent. Red Hat is not formally related to or endorsed by the official Joyent Node.js open source or commercial project.
The OpenStack® Word Mark and OpenStack logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or sponsored by the OpenStack Foundation, or the OpenStack community.
All other trademarks are the property of their respective owners.