Provisioning details
OpenShift Container Platform installations that use Red Hat Enterprise Linux CoreOS (RHCOS) are installed by using Ignition. This process is split into two parts:
-
An Ignition config is created that references a URL for the full configuration served by the MCS.
-
For user-provisioned infrastructure installation methods, the Ignition config manifests as a
worker.ignfile created by theopenshift-installcommand. For installer-provisioned infrastructure installation methods that use the Machine API Operator, this configuration appears as theworker-user-datasecret.
|
|
Currently, there is no supported way to block or restrict the machine config server endpoint. The machine config server must be exposed to the network so that newly-provisioned machines, which have no existing configuration or state, are able to fetch their configuration. In this model, the root of trust is the certificate signing requests (CSR) endpoint, which is where the kubelet sends its certificate signing request for approval to join the cluster. Because of this, machine configs should not be used to distribute sensitive information, such as secrets and certificates. To ensure that the machine config server endpoints, ports 22623 and 22624, are secured in bare metal scenarios, customers must configure proper network policies. |