Post-rack reset

After rack reset completes successfully, you must proceed with stage 1 and stage 2 installations to deploy OpenShift®.

Stage 1 installation

Stage 1 installation prepares the infrastructure for OpenShift deployment.

Prerequisites
  • Rack reset must be completed successfully.
  • The service node is accessible.

Proceed with the stage 1 installation. For more information, contact IBM Support.

Preparing for stage 2 installation

Before starting stage 2 installation, complete the following preparation steps.
  1. Generate an SSH key pair by running the following command: 
    ssh-keygen -t rsa -b 4096 -f /home/kni/.ssh/id_rsa -N ""
cat > /home/kni/.ssh/config << 'EOF'
Host *
    StrictHostKeyChecking no
    UserKnownHostsFile=/dev/null
    IdentityFile /home/kni/.ssh/id_rsa
EOF
  2. Configure Vault based on your service node topology:
    • For Day 0 service node topology: Retrieve the Vault keys from the earlier downloaded keysAndPassword.zip file after successful stage 2 completion.
    • For Day 2 service node topology and service node upgrade scenario: Retrieve the Vault keys from the backup of vault-secret and vault-login-secret taken before executing rack reset.
      Note: The vault.config file must contain encoded content for the Vault root token and unseal keys.
  3. Create the following files in the /var/vault directory path by using the vault.config file and vaultLogin content:
    • vault.config
    • unsealKey1
    • unsealKey2
    • unsealKey3
    • unsealKey4
    • unsealKey5
    • rootToken
    • vaultLogin
    Important: The content of all these files must be Base64-encoded.
    Example of vault.config file:
    Unseal Key 1: 20vcme9qFfZoJJ2Dl40lTkHMudcZ9yoSPG4O5rrPkpsa
Unseal Key 2: KvsaHf3pocBmM/F8CEd+E9WknXnl8cp+Emdhjo7noV2L
Unseal Key 3: /B5aCjleJwIKM1oB7vF5f8kr7n3FiRgGvRlJMAt+kr04
Unseal Key 4: zbgQhs8v1PnHrXeAR24z7ELFdjnlgpvqfME0MfWQbGCs
Unseal Key 5: 3KFywLCGnRy0ry/Q279HB4aRR8H5aXWfQ8TkrSulaPoj

Initial Root Token: hvs.etJ4YvVk5O26fqXS91jP0XFR

Vault initialized with 5 key shares and a key threshold of 3. Please securely
distribute the key shares printed above. When the Vault is re-sealed,
restarted, or stopped, you must supply at least 3 of these keys to unseal it
before it can start servicing requests.
  
Vault does not store the generated root key. Without at least 3 keys to
reconstruct the root key, Vault will remain permanently sealed!

It is possible to generate new unseal keys, provided you have a quorum of
existing unseal keys shares.

Stage 2 installation (OpenShift installation and IBM Fusion HCI setup)

Stage 2 installation deploys OpenShift and configures IBM Fusion HCI.

Prerequisites
  • The stage 1 installation is completed successfully.
  • The service node UI is accessible.

Proceed with the stage 2 installation. For more information, see Installing IBM Fusion HCI.