Unless directed otherwise, run all the following commands as user core.
Note: Cluster administration is performed on the CSAH node only.
To validate the Certificate Signing Requests (CSRs):
- Ensure that all the master nodes are visible and in READY status by running the following command:
oc get nodes
NAME STATUS ROLES AGE VERSION
etcd-0.ocp.example.com Ready master 54m v1.14.6+c07e432da
etcd-1.ocp.example.com Ready master 54m v1.14.6+c07e432da
etcd-2.ocp.example.com Ready master 54m v1.14.6+c07e432da
- Check for any pending certificates and approve them to add the worker nodes as part of the cluster. The following output is displayed:
oc get csr
NAME AGE REQUESTOR CONDITION
csr-7nrxg 34m system:serviceaccount:openshift-machine-config-operator:node-bootstrapper Pending
csr-7rr6w 47m system:serviceaccount:openshift-machine-config-operator:node-bootstrapper Pending
csr-fdt85 60m system:serviceaccount:openshift-machine-config-operator:node-bootstrapper Approved,Issued
csr-fwtcq 59m system:node:etcd-1.ocp.example.com Approved,Issued
csr-gcz5g 4m26s system:serviceaccount:openshift-machine-config-operator:node-bootstrapper Pending
csr-h7w54 60m system:serviceaccount:openshift-machine-config-operator:node-bootstrapper Approved,Issued
Note: It is sometimes necessary to run the command twice to ensure that the worker nodes are seen as part of oc get nodes.
- Approve all pending CSRs by running a single command:
oc get csr -ojson | jq -r '.items[] | select(.status == {} ) | .metadata.name' | xargs oc adm certificate approve
certificatesigningrequest.certificates.k8s.io/csr-7nrxg approved
certificatesigningrequest.certificates.k8s.io/csr-7rr6w approved
certificatesigningrequest.certificates.k8s.io/csr-gcz5g approved
certificatesigningrequest.certificates.k8s.io/csr-q942b approved
certificatesigningrequest.certificates.k8s.io/csr-tddzj approved
certificatesigningrequest.certificates.k8s.io/csr-w8fxd approved
certificatesigningrequest.certificates.k8s.io/csr-x76lp approved
- Ensure that the worker nodes are part the cluster nodes by running the following command:
oc get nodes
NAME STATUS ROLES AGE VERSION
etcd-0.ocp.example.com Ready master 65m v1.14.6+c07e432da
etcd-1.ocp.example.com Ready master 64m v1.14.6+c07e432da
etcd-2.ocp.example.com Ready master 65m v1.14.6+c07e432da
worker1.ocp.example.com Ready worker 3m12s v1.14.6+c07e432da
worker2.ocp.example.com Ready worker 3m9s v1.14.6+c07e432da
- For a nonproduction configuration, set up a temporary image registry by running the following command:
oc patch configs.imageregistry.operator.openshift.io cluster --type merge --patch '{"spec":{"storage":{"emptyDir":{}}}}'
config.imageregistry.operator.openshift.io/cluster patched
