Skip to content

Azure: document custom VNets & cluster isolation #2573

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-robot merged 1 commit into from
Oct 29, 2019
Merged

Azure: document custom VNets & cluster isolation #2573

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions docs/user/azure/customization.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,10 @@ The following options are available when using Azure:
* `region` (required string): The Azure region where the cluster will be created.
* `baseDomainResourceGroupName` (required string): The resource group where the Azure DNS zone for the base domain is found.
* `defaultMachinePlatform` (optional object): Default [Azure-specific machine pool properties](#machine-pools) which applies to [machine pools](../customization.md#machine-pools) that do not define their own Azure-specific properties.
* `networkResourceGroupName` (optional string): The resource group where the Azure VNet is found.
* `virtualNetwork` (optional string): The name of an existing VNet where the cluster infrastructure should be provisioned.
* `controlPlaneSubnet` (optional string): An existing subnet which should be used for the cluster control plane.
* `computeSubnet` (optional string): An existing subnet which should be used by cluster nodes.

## Machine pools

Expand All @@ -17,6 +21,15 @@ The following options are available when using Azure:
* `type` (optional string): The Azure instance type.
* `zones` (optional string slice): List of Azure availability zones that can be used (for example, `["1", "2", "3"]`).

## Installing to Existing Networks & Subnetworks
Copy link
Contributor

@abhinavdahiya abhinavdahiya Oct 28, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jhixson74 can you provide an example of install-config.yaml for byo-vnet.

Copy link
Contributor Author

@patrickdillon patrickdillon Oct 29, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jhixson74 can you provide an example of install-config.yaml for byo-vnet.

updated based on this: #2521 (comment)


The installer can use an existing VNet and subnets when provisioning an OpenShift cluster. If one of `networkResourceGroupName`, `virtualNetwork`, `controlPlaneSubnet`, or `computeSubnet`is specified, all must be specified [(see example below)](#existing-vnet). The installer will use these existing networks when creating infrastructure such as virtual machines, load balancers, and DNS zones.

### Cluster Isolation

When pre-existing subnets are provided, the installer will not create a network security group (NSG) or alter an existing one attached to the subnet. This restriction means that no security rules are created. If multiple clusters are installed to the same VNet and isolation is desired, it must be enforced through an administrative task after the cluster is installed.


## Examples

Some example `install-config.yaml` are shown below.
Expand Down Expand Up @@ -75,3 +88,23 @@ platform:
pullSecret: '{"auths": ...}'
sshKey: ssh-ed25519 AAAA...
```
### Existing VNet

An example Azure install config to use a pre-existing VNet and subnets:

```yaml
apiVersion: v1
baseDomain: example.com
metadata:
name: test-cluster
platform:
azure:
region: centralus
baseDomainResourceGroupName: os4-common
networkResourceGroupName: example_vnet_rg
virtualNetwork: example_vnet
controlPlaneSubnet: example_master_subnet
computeSubnet: example_worker_subnet
pullSecret: '{"auths": ...}'
sshKey: ssh-ed25519 AAAA...
```