upi/vsphere: multiple terraform updates #1518
Conversation
staebler
commented
Apr 2, 2019
•
staebler
commented
- Add DNS records for the control plane and compute hostnames so that they are resolvable from within the cluster.
- Use IP addresses reserved from an IPAM server.
openshift-ci-robot
added
size/L
The bootstrap ignition has pull secret in multiple locations, secret object, files etc. What about the kubeconfig? IMO users need to make sure the security of the endpoint serving them because ignition doesn't.... Why are we doing this?
|
@abhinavdahiya How do we provide a URL that the bootstrap VM can access but is not accessible publicly? I don't see a way to provide credentials in the ignition file. The only thing that I see is a way to provide a cert to verify the ignition file pulled from the URL. In AWS, the ignition config is stored in S3 to make it secure. In OpenStack, the ignition config is stored in objectstorage. VSphere does not have that capability. |
|
I'll take out the commit for dealing with the pull secret. There is clearly more work that needs to be done to address the issue of exposing the pull secret. The ignition config fed from the machine config operator also contains the pull secret and is publicly accessible. |
|
a31370864...cc8f9f70a removed the changes dealing with the pull secret |
|
cc8f9f70a..041b00f79 switches to reserving IP addresses from an IPAM server. |
|
/lgtm |
Add DNS records for the control plane and compute hostnames so that they are resolvable from within the cluster.
Static IP addresses are now working with rhcos.
change network to IPAM query and add local-exec provisioner for VM on destroy update examples file by removing IP address and adding machine_cidr
We can use the cidr_to_ip.sh external data source to reserve IP addresses for each machine individually rather than all of the machines at once. This greatly simplifies the cidr_to_ip.sh script. Additionally, update the README and terraform.tfvars.example.
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dav1x, staebler The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
