Restricting the API server to private for an Amazon Web Services cluster

If the security posture of your organization does not allow clusters to use an open API endpoint, you can restrict the API server to use only internal load balancers. To implement this API server restriction, use the Amazon Web Services (AWS) console and OpenShift CLI (oc) to delete the external load balancer components.

Important

The OpenShift CLI (oc) steps that remove the external load balancers require the Machine API. For clusters that cannot use the Machine API, you must manually remove the external load balancers.

Clusters with the infrastructure platform type none cannot use the Machine API. To view the platform type for your cluster, run the following command:

$ oc get infrastructure cluster -o jsonpath='{.status.platform}'
Prerequisites

  • You have installed an Red Hat OpenShift Container Platform cluster on AWS.

  • You have access to the AWS console as a user with administrator privileges.

  • You have access to the OpenShift CLI (oc) as a user with administrator privileges.

Procedure

  1. Log in to the AWS console as a user with administrator privileges.

  2. Delete the external load balancer.

    Note

    The API DNS entry in the private zone already points to the internal load balancer, which uses an identical configuration, so you do not need to modify the internal load balancer.

  3. Delete the api.<cluster_name>.<domain_name> DNS entry in the public zone.

    where <cluster_name> is the name of the cluster and <domain_name> is the base domain for the cluster.

  4. To remove the external load balancers, log in to the OpenShift CLI (oc) as a user with administrator privileges.

    • If your cluster uses a control plane machine set, remove the external load balancers by editing the ControlPlaneMachineSet custom resource (CR).

      1. Edit the ControlPlaneMachineSet CR by running the following command:

        $ oc edit controlplanemachineset.machine.openshift.io cluster \
  -n openshift-machine-api

      2. Remove the external load balancers by deleting the corresponding lines in the control plane machine set custom resource (CR).

        In the spec.template.spec.providerSpec.value.loadBalancers section of the CR, the name value for the external load balancer ends in -ext. Delete the line with the external load balancer name value and the line with the external load balancer type value that accompanies it.

        apiVersion: machine.openshift.io/v1
kind: ControlPlaneMachineSet
metadata:
  name: cluster
  namespace: openshift-machine-api
spec:
# ...
  template:
# ...
      spec:
        providerSpec:
          value:
            loadBalancers:
            - name: <cluster_id>-ext
              type: network
            - name: <cluster_id>-int
              type: network
# ...

      3. Save your changes and exit the object specification.

        When you save an update to the control plane machine set, the Control Plane Machine Set Operator updates the control plane machines according to your configured update strategy. For more information, see "Updating the control plane configuration".

    • If your cluster does not use a control plane machine set, you must delete the external load balancers from each control plane machine.

      1. List the cluster machines by running the following command:

        $ oc get machine -n openshift-machine-api
        Example output
        NAME                                        STATE     TYPE        REGION      ZONE         AGE
<cluster_id>-master-0                       running   m4.xlarge   us-east-1   us-east-1a   17m
<cluster_id>-master-1                       running   m4.xlarge   us-east-1   us-east-1b   17m
<cluster_id>-master-2                       running   m4.xlarge   us-east-1   us-east-1a   17m
<cluster_id>-worker-us-east-1a-<zone_tag>   running   m4.xlarge   us-east-1   us-east-1a   15m
<cluster_id>-worker-us-east-1a-<zone_tag>   running   m4.xlarge   us-east-1   us-east-1a   15m
<cluster_id>-worker-us-east-1b-<zone_tag>   running   m4.xlarge   us-east-1   us-east-1b   15m

        The control plane machines contain the master string in their names.

      2. Remove the external load balancer from each control plane machine:

        1. Edit a control plane machine object to by running the following command:

          $ oc edit machines -n openshift-machine-api <control_plane_machine_name>

          where <control_plane_machine_name> is the name of the control plane machine object to modify.

        2. Remove the lines that describe the external load balancer.

          In the spec.providerSpec.value.loadBalancers section of the CR, the name value for the external load balancer ends in -ext. Delete the line with the external load balancer name value and the the line with the external load balancer type value that accompanies it.

          apiVersion: machine.openshift.io/v1beta1
kind: Machine
metadata:
  name: <control_plane_machine_name>
  namespace: openshift-machine-api
spec:
  providerSpec:
    value:
      loadBalancers:
      - name: <cluster_id>-ext
        type: network
      - name: <cluster_id>-int
        type: network
# ...

        3. Save your changes and exit the object specification.

        4. Repeat this process for each control plane machine.

← Previous: Setting the Ingress Controller to private | ↑ Up: About private clusters | ⌂ Home: Red Hat OpenShift Container Platform | Next: Restricting the API server to private for an Microsoft Azure cluster →