Your Browser is Out of Date

ShareDemos uses technology that works best in other browsers.
For a full experience use one of the browsers below
Deployment Guide—Dell EMC Ready Stack for Red Hat OpenShift Container Platform 4.3

view all chapters

Deploying OpenShift 4.3
Introduction Creating a bootstrap node Installing control plane nodes Installing worker nodes Completing the cluster setup Removing the bootstrap node Validating and approving Certificate Signing Requests Validating the cluster operators Accessing the OpenShift web console Configuring authentication Configuring image registry storage

Validating and approving Certificate Signing Requests

  • Validate and approve Certificate Signing Requests (CSRs) as follows. Unless otherwise specified, run the commands as user core.

    1. Ensure that all the control plane nodes are visible and in Ready status.

    [core@csah ~]$ oc get nodes

    NAME                   STATUS     ROLES    AGE   VERSION

    etcd-0.example.com     Ready      master   52m   v1.16.2

    etcd-1.example.com     Ready      master   52m   v1.16.2

    etcd-2.example.com     Ready      master   52m   v1.16.2

    1. Check for any pending CSRs:

    [core@csah ~]$ oc get csr

    NAME        AGE   REQUESTOR                                                                   CONDITION

    csr-2hkn9   42m   system:node:etcd-1.example.com                                              Approved,Issued

    csr-9gdsn   15m   system:serviceaccount:openshift-machine-config-operator:node-bootstrapper   Pending

    csr-cfl8l   12m   system:serviceaccount:openshift-machine-config-operator:node-bootstrapper   Pending

    csr-f7lf4   30m   system:serviceaccount:openshift-machine-config-operator:node-bootstrapper   Pending

    csr-mk6kk   42m   system:serviceaccount:openshift-machine-config-operator:node-bootstrapper   Approved,Issued

    csr-mq8tm   42m   system:node:etcd-2.example.com                                              Approved,Issued

    csr-n5tlg   43m   system:serviceaccount:openshift-machine-config-operator:node-bootstrapper   Approved,Issued

    csr-rvhwr   33s   system:serviceaccount:openshift-machine-config-operator:node-bootstrapper   Pending

    csr-zlx7p   42m   system:serviceaccount:openshift-machine-config-operator:node-bootstrapper   Approved,Issued

    csr-zvkck   42m   system:node:etcd-0.example.com                                              Approved,Issued

    1. Approve all pending CSRs as follows:

    [core@csah ~]$ oc get csr | grep -i pending | cut -f 1 -d ' ' | xargs -n 1 oc adm certificate approve

    certificatesigningrequest.certificates.k8s.io/csr-9gdsn approved

    certificatesigningrequest.certificates.k8s.io/csr-cfl8l approved

    certificatesigningrequest.certificates.k8s.io/csr-f7lf4 approved

    certificatesigningrequest.certificates.k8s.io/csr-ljpbx approved

    certificatesigningrequest.certificates.k8s.io/csr-rvhwr approved

    1. Ensure that the worker node certificates show as pending and approve them by running the command specified in step 3.

    [core@csah ~]$ oc get csr | grep -i pending

    csr-8zxkk   52s    system:node:worker-0.example.com                                            Pending

    csr-qjztw   53s    system:node:worker-1.example.com                                            Pending

    [core@csah ~]$ oc get csr | grep -i pending | cut -f 1 -d ' ' | xargs -n 1 oc adm certificate approve

    certificatesigningrequest.certificates.k8s.io/csr-8zxkk approved

    certificatesigningrequest.certificates.k8s.io/csr-qjztw approved

    1. Ensure that the worker nodes are part of the cluster nodes:

    [core@csah ~]$ oc get nodes

    NAME                   STATUS   ROLES    AGE     VERSION

    etcd-0.example.com     Ready    master   56m     v1.16.2

    etcd-1.example.com     Ready    master   56m     v1.16.2

    etcd-2.example.com     Ready    master   56m     v1.16.2

    worker-0.example.com   Ready    worker   4m50s   v1.16.2

    worker-1.example.com   Ready    worker   4m51s   v1.16.2