Required environment variables
IBM Security Verify Directory (ISVD)
| Parameter | Description |
|---|---|
| LDAP_ADMIN_PASSWORD | Password for LDAP administrator account (cn=root) with full administrative privileges. Use strong password with 12+ characters including uppercase, lowercase, numbers, and special characters. |
IBM Verify Identity Access (IVIA)
| Parameter | Description |
|---|---|
| SCIM_ADMIN_USER_PWD | Password for SCIM (System for Cross-domain Identity Management) administrator account used for user provisioning and identity lifecycle management operations via SCIM protocol. Use strong password with 12+ characters. |
| DEFAULT_USER_ADMIN_PWD | Password for default administrative user account in IVIA providing initial access to administration console. After initial setup, create additional admin accounts and consider disabling this default account for security. Use strong password with 12+ characters. |
| EASUSER_PASSWORD | Password for easuser account, a built-in administrative user ID used for authentication between WebSEAL/Web Reverse Proxy and Advanced Access Control (AAC) module. Authenticates backend connection, typically using client certificate (easusercert) for secure communication between components. Use strong password with 12+ characters. |
| IVIA_RUNTIME_ADMIN_PWD | Password for IVIA runtime administrator account used for runtime administrative operations and management of IVIA runtime environment. Use strong password with 12+ characters. |
SMTP configuration
| Parameter | Description |
|---|---|
| SMTP_SERVER_FROM_DISPLAY_NAME | Display name to use in the "From" field. Example: From Name |
| SMTP_SERVER_REPLY_DISPLAY_NAME | Display name to use in the "Reply-To" field. Example: Reply Name |
| SMTP_SERVER_HOST | SMTP server hostname or IP address for sending email notifications. |
| SMTP_SERVER_PORT | SMTP port number. Standard secure ports: 465 (SMTPS - always encrypted, use with SSL_ENABLE=true and STARTTLS_ENABLE=false) or 587 (STARTTLS - starts unencrypted then upgrades, use with SSL_ENABLE=false and STARTTLS_ENABLE=true). |
| SMTP_SERVER_SSL_ENABLE | Enable SSL for SMTP connection (true/false). Use true with port 465 and STARTTLS_ENABLE=false. Use false with port 587 and STARTTLS_ENABLE=true. Both SSL_ENABLE and STARTTLS_ENABLE cannot be true/false. |
| SMTP_SERVER_STARTTLS_ENABLE | Enable STARTTLS for SMTP connection. Use true with port 587 and SSL_ENABLE=false. Non-TLS connection is not supported. |
| SMTP_SERVER_STARTTLS_REQUIRED | Disable fallback to plaintext for STARTTLS (true/false). Use with port 587, STARTTLS_ENABLE=true, and SSL_ENABLE=false to prevent insecure connections. |
| SMTP_SERVER_SSL_CHECK_SERVER_IDENTITY | Enable additional checks based on server certificate content to prevent man-in-the-middle attacks (true/false). Use with either SSL_ENABLE=true or STARTTLS_ENABLE=true. |
| SMTP_SERVER_SSL_PROTOCOLS | SSL protocols to use (TLSv1.2, TLSv1.3). Use with either SSL_ENABLE=true or STARTTLS_ENABLE=true. |
| SMTP_SERVER_AUTH_ENABLE | Enable SMTP authentication (true/false). If true, SMTP_SERVER_USER and SMTP_SERVER_PASSWORD must not be empty. If false, credentials not required. |
| SMTP_SERVER_USER | SMTP username for authentication. Required when SMTP_SERVER_AUTH_ENABLE=true. |
| SMTP_SERVER_PASSWORD | SMTP password for authentication. Required when SMTP_SERVER_AUTH_ENABLE=true. |
| SMTP_SERVER_FROM_EMAIL_ADDRESS | Email address to use in "From" field. Format: user@domain (e.g., sender@example.com). |
| SMTP_SERVER_REPLY_EMAIL_ADDRESS | Email address to use in "Reply-To" field. Format: user@domain (e.g., reply@example.com). |
| SMTP_SERVER_TIMEOUT | SMTP connection timeout in milliseconds. Default: 120000. |
| SMTP_SERVER_CONNECT_TIMEOUT | SMTP connect timeout in milliseconds. Default: 120000. |
DNS configuration
Storage DNS variables, GORI_STORAGE_DOMAIN, GORI_STORAGE_VIP_API_ADDRESS, GORI_STORAGE_VIP_WILDCARD_INGRESS are generally optional except when any one of them is set.
| Parameter | Description |
|---|---|
| GORI_DNS_VIP | Virtual IP address for GORI DNS service running in management cluster. Must be pre-allocated by network team, in same subnet as other VIPs, routable and announced in data center network, and reachable by all nodes needing DNS resolution. GORI DNS does not allocate this address. |
| GORI_MAIN_DOMAIN | Base domain for sovereign boundary and root DNS zone. All subdomains for platform and product accounts created under this base domain. Example: gori.msp.com. This is MANDATORY ZONE #1. |
| GORI_PLATFORM_DOMAIN | Subdomain for platform services in management plane. This is MANDATORY ZONE Dedicated DNS zone created for control plane (e.g., mgmt.gori.msp.com). Bootstrap automatically creates DNS A records: api.PLATFORM.MAIN and *.apps.PLATFORM.MAIN. Example: mgmt. |
| GORI_NAMESERVER_HOSTNAME | Hostname for authoritative name server of DNS domains. NS record configured using this variable. Example: ns (resulting FQDN: ns.gori.msp.com). |
| GORI_POSTMASTER_EMAIL | Email address of domain administrator used for RNAME of SOA record. Example: admin@gori.msp.com. |
| GORI_VIP_API_ADDRESS | Virtual IP address for management plane cluster API server. Must be pre-allocated by network team, routable and announced in network, and reachable from all nodes requiring API access. GORI DNS creates DNS A record mapping api.PLATFORM.MAIN to this address but does not allocate the VIP itself. Example: 192.0.2.1. |
| GORI_VIP_WILDCARD_INGRESS | Virtual IP address for management plane cluster ingress controller. Must be pre-allocated by network team, routable and announced in network, and reachable from all nodes requiring ingress access. GORI DNS creates DNS A record mapping *.apps.PLATFORM.MAIN to this address but does not allocate the VIP itself. Example: 192.0.2.2. |
| AUTOMATIC DNS RECORD CREATION | For each configured zone, the system automatically creates two DNS type A records. A Kubernetes API Server Record, and a wildcard Ingress Record. |
| CUSTOM DNS RECORDS | Users can define additional DNS type A records within any configured zone to support custom infrastructure requirements, service endpoints, or external integrations. Custom records are specified using the GORI_CUSTOM_DNS_RECORDS variable, which automatically distributes records to the appropriate zones based on FQDN matching. |
| VIP CONFIGURATION REQUIREMENTS |
All VIP addresses referenced in the configuration must be PRE-ALLOCATED and configured in your data center network infrastructure before running the installation. No DNS allocation or VIP creation is done, only DNS records that map hostnames to these existing VIP addresses is done. All VIPs must be preallocated and configured by your network team. They must be routable and announced in the data center network, and belong to the same subnet for consistent network routing. Each VIP must be reachable by all nodes that require access to the respective services VIP addresses must be valid IPv4 formatted. This configuration creates DNS A records mapping hostnames to the VIP addresses that you provided. The installation and configuration does not allocate, configure, or manage the VIP addresses. |
Storage configuration
| Parameter | Description |
|---|---|
| BLOCK_STORAGE_CLASS_NAME | Block storage class name for persistent volumes. Must be set or found in values.yaml at .storage.blockStorageClassName. Example: odf-storagecluster-ceph-rbd. |
Registry credentials
| Parameter | Description |
|---|---|
| ICR_USERNAME | IBM Container Registry (ICR) username for pulling images from cp.icr.io. Used by mirror.sh and other scripts requiring registry authentication. |
| ICR_PASSWORD | IBM Container Registry (ICR) password for pulling images from cp.icr.io. Used by mirror.sh and other scripts requiring registry authentication. |
| SAAS_PLATFORM_USERNAME | Not Editable - SaaS Platform username for pulling images from icr.io. Used by mirror.sh and other scripts requiring registry authentication. |
| SAAS_PLATFORM_APIKEY | Not Editable SaaS Platform API key for pulling images from icr.io. Used by mirror.sh and other scripts requiring registry authentication. |
Backup configuration
| Parameter | Description |
|---|---|
| STORAGE_SECRET_ACCESS_KEY_ID | Object storage compatible with S3 ID key. |
| STORAGE_SECRET_ACCESS_KEY | Object storage compatible with S3 secret access key for OADP/Velero backup storage authentication. |
| BUCKET_REGION | Object storage compatible with S3 bucket region where backups are stored. |
| S3_URL | Object storage compatible with S3 endpoint URL without https:// prefix. |
| STORAGE_BUCKET_NAME | Object storage compatible with S3 bucket name for storing OADP/Velero backups. |
Certificates overview
SSL certificates configuration requires three certificates from your Certificate Authority (CA). Copy certificates.example.yaml to certificates.yaml and provide your certificates.
API certificate
| Parameter | Description |
|---|---|
| sslAPICertificateKey | Private key for API certificate. Used for api.clusterName.baseDomain. Must be in PEM format starting with -----BEGIN PRIVATE KEY----- and ending with -----END PRIVATE KEY-----. Keep this key secure and never commit to version control. |
| sslAPICertificateFullChain | Full certificate chain for API endpoint including the certificate and any intermediate CA certificates. Used for api.clusterName.baseDomain. Must be in PEM format. Include all certificates in the chain from server certificate to intermediate CA certificates (if applicable). |
Ingress certificate
| Parameter | Description |
|---|---|
| sslIngressCertificateKey | Private key for wildcard ingress certificate. Used for *.apps.clusterName.baseDomain. Must be in PEM format starting with -----BEGIN PRIVATE KEY----- and ending with -----END PRIVATE KEY-----. This is a wildcard certificate key covering all application routes. Keep this key secure and never commit to version control. |
| sslIngressCertificateFullChain | Full certificate chain for wildcard ingress endpoint including the wildcard certificate and any intermediate CA certificates. Used for *.apps.clusterName.baseDomain. Must be in PEM format. Include all certificates in the chain from wildcard server certificate to intermediate CA certificates (if applicable). |
Root CA certificate
| Parameter | Description |
|---|---|
| sslCACertificate | Root Certificate Authority (CA) certificate that signed your API and ingress certificates. Must be in PEM format starting with -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE-----. This certificate is used to establish trust for the certificate chain. |
Certificate requirements
- All certificates must be valid and not expired
- API certificate must match: api.clusterName.baseDomain
- Ingress certificate must be a wildcard matching: *.apps.clusterName.baseDomain
- All certificates must be in PEM format
- Private keys must be kept secure and never committed to version control
- Full chains should include intermediate CA certificates if applicable
Base configuration
| Parameter | Description |
|---|---|
| workingDir | Root directory for deployment files and working data. All deployment artifacts, configurations, and temporary files will be stored under this directory. Must have sufficient disk space and appropriate permissions. Example: /home/glab. |
Network configuration
| Parameter | Description |
|---|---|
| baseDomain | Base DNS domain for the cluster. All cluster endpoints will be subdomains of this base domain. Must be a valid DNS domain name. |
| clusterName | Name of the OpenShift cluster. Combined with baseDomain to form fully qualified domain names (e.g., api.clusterName.baseDomain). Must be DNS-compliant (lowercase letters, numbers, hyphens). Example: mgmt. Used in install-config.yaml. |
| machineNetwork | CIDR notation for the machine network where cluster nodes reside. All node IP addresses (apiVIP, ingressVIP, rendezvousIP, agent_hosts IPs) must be within this network range. Example: 192.168.2.0/24. Used in install-config.yaml. |
| apiVIP | Virtual IP address for the Kubernetes API server endpoint. Must be within machineNetwork range and not assigned to any physical host. This VIP provides high availability for API access. Example: 192.168.2.201. Used in install-config.yaml. |
| ingressVIP | Virtual IP address for the cluster ingress controller (application routes). Must be within machineNetwork range and not assigned to any physical host. This VIP provides high availability for application ingress traffic. Example: 192.168.2.202. Used in install-config.yaml. |
| defaultDNS | DNS server IP address for cluster nodes to use for name resolution. Must be reachable from the machineNetwork. Used for resolving external domain names and cluster internal DNS. Example: 9.30.31.32. |
| defaultGateway | Default gateway IP address for cluster nodes. Must be within the machineNetwork and provide routing to external networks. Used for outbound network connectivity. Example: 192.168.2.10. |
| defaultPrefix | Network prefix length (subnet mask) for the machineNetwork. Typically 24 for /24 networks (255.255.255.0). Must match the machineNetwork CIDR prefix. Example: 24. |
| rendezvousIP | IP address of the first control plane node. Must be within machineNetwork range and should match the ipAddress of the first agent_host entry. This node serves as the bootstrap rendezvous point during installation. Example: 192.168.2.24. |
| lzBmcIP | IP address of the Landing Zone (LZ) web server that serves the installation ISO to IPMI/Redfish nodes. Must be accessible from the Redfish management network. Used for virtual media mounting during node provisioning. Example: 100.64.1.10. |
Quay registry configuration
| Parameter | Description |
|---|---|
| quayUser | Administrator username for Quay container registry. This account has full administrative privileges for managing the registry, repositories, and users. Use a secure username and keep credentials protected. |
| quayPassword | Administrator password for Quay container registry. Use a strong password with at least 12 characters including uppercase, lowercase, numbers, and special characters. Keep this password secure and never commit to version control. |
Quay backend storage configuration
| Parameter | Description |
|---|---|
| quayBackend | Storage backend type for Quay registry. Options: RadosGWStorage (recommended for production with external S3/RadosGW) or LocalStorage (not recommended for production). Determines where container images are stored. |
| quayBackendRGWConfiguration | Configuration object for RadosGW/S3 storage backend. Required when quayBackend is set to RadosGWStorage. Contains access credentials and endpoint information for external object storage. |
| quayBackendRGWConfiguration.access_key | S3/RadosGW access key ID for authentication. Obtain from your S3-compatible storage provider. Used to authenticate Quay to the object storage backend. |
| quayBackendRGWConfiguration.secret_key | S3/RadosGW secret access key for authentication. Keep secure and never commit to version control. Used in conjunction with access_key for storage authentication. |
| quayBackendRGWConfiguration.bucket_name | S3 bucket name where Quay will store container image layers and metadata. Bucket must exist and be accessible with the provided credentials. Example: quay-storage. |
| quayBackendRGWConfiguration.hostname | Hostname or IP address of the RadosGW/S3 endpoint. Must be accessible from the cluster network. Do not include protocol (http/https) or port. Example: s3.example.com or 192.168.1.50. |
| quayBackendRGWConfiguration.minimum_chunk_size_mb | Optional. Minimum chunk size in MB for multipart uploads. Default: 100. Uncomment only to override default value. Affects upload performance for large images. |
| quayBackendRGWConfiguration.maximum_chunk_size_mb | Optional. Maximum chunk size in MB for multipart uploads. Default: 500. Uncomment only to override default value. Affects upload performance and memory usage. |
Storage backend
| Parameter | Description |
|---|---|
| storage_plugin | Storage plugin for block devices used by Quay database and Assisted Installer. Options: lvms (Logical Volume Manager Storage) or odf (OpenShift Data Foundation). Selects which storage plugin from plugins/lvms/ or plugins/odf/ to deploy. Default: lvms. |
| enabled_plugins | Optional. List of plugins to deploy during the pipeline. Default: only the storage plugin specified in storage_plugin. Uncomment and extend to enable additional plugins beyond the storage plugin. Example: [lvms, example]. |
Storage configuration (LVMS)
| Parameter | Description |
|---|---|
| lvmsConfig | Optional. configuration object for LVMS (Logical Volume Manager Storage). Uncomment to restrict which disks LVMS manages. If omitted, LVMS will use all available disks on the nodes. |
| lvmsConfig.deviceSelector | Optional. Device selector to restrict which disks LVMS manages. Use optionalPaths to specify exact disk paths. |
| lvmsConfig.deviceSelector.optionalPaths | Optional. List of disk device paths that LVMS is allowed to manage. Use persistent device paths (by-path) for reliability. Example: [/dev/disk/by-path/pci-0000:00:11.4-ata-1.0, /dev/disk/by-path/pci-0000:00:11.4-ata-2.0]. Verify paths to avoid data loss. |
Storage configuration (ODF)
| Parameter | Description |
|---|---|
| odfExternalConfig | Required when storage_plugin is set to odf. configuration data obtained from ceph-external-cluster-details-exporter.py script. Contains connection details and credentials for external Ceph cluster. Must be valid JSON array format containing ConfigMap and Secret definitions. |
Red Hat OpenShift deployment configuration
| Parameter | Description |
|---|---|
| disconnected | Optional. Enable disconnected/air-gapped deployment mode. Default: true. Set to false for connected deployments with direct internet access. Affects image mirroring and update strategies. |
| diskEncryption | Optional. Enable disk encryption for installation partition using TPM v2. Default: false. Set to true to enable encryption at rest. Requires TPM 2.0 hardware support on all nodes. |
| ocMirrorLogLevel | Optional. Log level for oc-mirror tool used in image mirroring. Default: info. Options: trace, debug, info, error. Use debug or trace for troubleshooting mirroring issues. |
| defaultNtpServers | Optional. List of additional NTP server addresses for cluster node time synchronization. No additional servers configured by default. Add NTP servers if default time sources are not accessible. Example: [ntp1.example.com, ntp2.example.com]. |
Pull secret and SSH configuration
| Parameter | Description |
|---|---|
| pullSecret | Red Hat pull secret for accessing OpenShift container images. Obtain from https://console.redhat.com/openshift/install/pull-secret. Must be valid JSON format. Do not wrap in quotes. Required for downloading OpenShift images and operators. Keep secure and never commit to public repositories. |
| sshPubPath | Path to SSH public key file for cluster node access. This key will be added to the authorized_keys on all cluster nodes, enabling SSH access for troubleshooting and maintenance. Example: /home/user/.ssh/id_rsa.pub or ~/.ssh/id_rsa.pub. |
Cluster hosts configuration (agent hosts)
| Parameter | Description |
|---|---|
| agent_hosts | List of control plane nodes for the cluster. Must contain exactly 3 entries, no more, no less, for high availability. Each entry defines a control plane node with network and management details. |
| agent_hosts[].name | Hostname for the control plane node. Must be unique within the cluster. Example: mgmt-ctl01. Used to identify the node in cluster operations. |
| agent_hosts[].macAddress | MAC address of the primary network interface for the control plane node. Used for network boot and node identification. Format: XX:XX:XX:XX:XX:XX. Example: 0c:c4:7a:62:fe:ec. For complex network setups, use mapInterfaces instead. |
| agent_hosts[].ipAddress | IP address for the control plane node. Must be within machineNetwork range. First node's IP should match rendezvousIP. Example: 192.168.2.24. For complex network setups, use networkConfig instead. |
| agent_hosts[].redfish | IPMI/Redfish management IP address for remote node management. Used for power control and console access. Must be accessible from deployment environment. Example: 192.168.1.101. |
| agent_hosts[].rootDisk | Path to root disk device for OS installation. Use persistent device path (by-path) for reliability. Example: /dev/disk/by-path/pci-0000:00:11.4-ata-1.0. Verify correct disk to avoid data loss. |
| agent_hosts[].redfishUser | Username for Redfish/IPMI authentication. Must have power management privileges. Used for remote node control during installation. |
| agent_hosts[].redfishPassword | Password for Redfish/IPMI authentication. Keep secure. Used with redfishUser for remote node management. |
| agent_hosts[].mapInterfaces | Optional. For complex network setups, use instead of macAddress. Maps logical interface names to MAC addresses. See docs/CONFIGURATION_REFERENCE.md for details. |
| agent_hosts[].networkConfig | Optional. For complex network setups, use instead of ipAddress. Provides detailed network configuration including VLANs, bonds, and static routes. See docs/CONFIGURATION_REFERENCE.md for details. |
Configuration notes
- All settings with defaults are optional. To override, uncomment the setting.
- Three agent_host entries are required for control plane high availability.
- All IP addresses must be correctly allocated and within specified network ranges.
- VIP addresses, such as apiVIP and ingressVIP, must not be assigned to physical hosts.
- The first agent_host ipAddress should match the rendezvousIP.
- Keep credentials secure and never commit to version control.
ODF plugin configuration
| Parameter | Description |
|---|---|
| odfExternalConfig | JSON string containing external Ceph cluster configuration required when using the ODF storage plugin. Generated using the ceph-external-cluster-details-exporter.py script. Defines connection details, credentials, storage classes, and monitoring endpoints. |
| odfExternalConfig[].name | Name of the Kubernetes resource (ConfigMap, Secret, or StorageClass) used to configure access to the external Ceph cluster. Must match expected names used by ODF components. |
| odfExternalConfig[].kind | Type of Kubernetes resource being defined. Supported values include ConfigMap, Secret, CephCluster, and StorageClass. Determines how the data is interpreted. |
| odfExternalConfig[].data | Key-value configuration data specific to the resource type. Includes cluster endpoints, credentials, pool names, and operational settings required for Ceph integration. |
| external-cluster-user-command.data.args | Configuration block for Ceph client behavior. Includes pool prefix, RBD pool name, port settings, and output format. Provided as a formatted string. |
| rook-ceph-mon-endpoints.data | Defines monitor endpoints for the Ceph cluster, including hostnames and IP:port mappings. Required for establishing communication with Ceph monitors. |
| rook-ceph-mon.data | Contains cluster-level secrets such as fsid, admin-secret, and mon-secret used for authentication between ODF and the Ceph cluster. |
| rook-ceph-operator-creds.data | Credentials for the Ceph operator, including userID and userKey. Used for cluster health monitoring and operator-level actions. |
| monitoring-endpoint.data | Defines Ceph monitoring endpoint, including IP address and port used for metrics collection and observability integration. |
| rook-csi-rbd-node.data | Credentials used by RBD CSI node components to access Ceph storage. Includes userID and userKey for node-level operations. |
| rook-csi-rbd-provisioner.data | Credentials used by the CSI provisioner to dynamically create and manage RBD volumes in Ceph. |
| rook-ceph-dashboard-link.data | URL endpoint for accessing the Ceph dashboard. Enables administrators to monitor and manage the Ceph cluster through a web interface. |
| ceph-rbd.data.pool | Name of the Ceph RADOS Block Device (RBD) pool used for storage provisioning. Example: odfdata. |
| ceph-rbd.data.csi.storage.k8s.io/provisioner-secret-name | Name of the Kubernetes Secret containing credentials for the CSI provisioner. |
| ceph-rbd.data.csi.storage.k8s.io/controller-expand-secret-name | Name of the Secret used when expanding volumes through the CSI controller. |
| ceph-rbd.data.csi.storage.k8s.io/node-stage-secret-name | Name of the Secret used by nodes when mounting and staging volumes. |