Confused on which pullSecret to use

[aholen]

Hi, I'm trying to install a singlenode OKD 4.10 on a vsphere:

• Both {"auths":{"fake":{"auth": "bar"}}} and{"auths":{"fake":{"auth":"aWQ6cGFzcwo="}}} results in that the bootstrap can't download from quay, and the installation fails: Error: Error initializing source docker://quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:81a4cb120f297de74a2d11fb914ffc4f33f792d44a462308eac61dc7d79e935e: Error reading manifest sha256:81a4cb120f297de74a2d11fb914ffc4f33f792d44a462308eac61dc7d79e935e in quay.io/openshift-release-dev/ocp-v4.0-art-dev: unauthorized: access to the requested resource is not authorized
• I can successfully get a singlenode-cluster up by using the pullSecret from https://console.redhat.com/openshift/install/pull-secret - but that's a OpenShift 60-days trial, not OKD.

[vrutkovs]

singlenode OKD 4.10 on a vsphere

Are you using assisted-installer or just openshift-installer to do that?

[aholen]

Hi, I'm using openshift-installer together with the install-config.yml below: ./openshift-install create cluster --dir install_dir --log-level debug

I changed the installer-tag from 4.10.0-0.okd-2022-03-07-131213 to 4.10.0-0.okd-2022-04-23-131357 - and it looks like that helped..

apiVersion: v1
baseDomain: <redacted>
compute:
- architecture: amd64
  hyperthreading: Enabled
  name: worker
  platform: {}
  replicas: 0
controlPlane:
  architecture: amd64
  hyperthreading: Enabled
  name: master
  platform: {}
  replicas: 1
metadata:
  creationTimestamp: null
  name: okdlab
networking:
  clusterNetwork:
  - cidr: 10.128.0.0/14
    hostPrefix: 23
  machineNetwork:
  - cidr: 10.0.0.0/16
  networkType: OpenShiftSDN
  serviceNetwork:
  - 172.30.0.0/16
platform:
  vsphere:
    apiVIP: 10.96.70.10
    cluster: <redacted>
    datacenter: <redacted>
    defaultDatastore: <redacted>
    ingressVIP: 10.96.70.20
    network: <redacted>
    password: <redacted>
    username: <redacted>
    vCenter: <redacted>
publish: External
pullSecret: '{"auths":{"fake":{"auth":"aWQ6cGFzcwo="}}}'
sshKey: |
  <redacted>

[vrutkovs]

Please attach log bundle

[aholen]

Sorry, I don't have the logs for the failed installation anymore, but the version mentioned above installed the single node cluster OK.

[mzukal]

Hi,
sorry to open an old thread but I am facing the same problem as @aholen. I am trying to install OKD using assisted installer. I am following this guide: https://hackmd.io/tDnHM2BoQru0VgqMGI_Q5g and I am having trouble with the pull secret.
If I use {"auths":{"fake":{"auth":"aWQ6cGFzcwo="}}} the installer does not let me continue with the following message:
pull secret for new cluster is invalid: pull secret must contain auth for "registry.ci.openshift.org"
I changed the pull secret to {"auths":{"registry.ci.openshift.org":{"auth":"aWQ6cGFzcwo="}}} which allows me to continue to set up the cluster and generate the discovery ISO. When I start the installation it ends in couple of minutes with the following message in the cluster event log:
Failed to prepare the installation due to an unexpected error: failed generating install config for cluster 19aeb098-0ad2-4566-967b-70a3dfc559d8: failed to get installer path: command 'oc adm release extract --command=openshift-baremetal-install --to=/data/install-config-generate/installercache/registry.ci.openshift.org/origin/release:4.16 --insecure=false registry.ci.openshift.org/origin/release:4.16 --registry-config=/tmp/registry-config2098566652' exited with non-zero exit code 1: error: unable to read image registry.ci.openshift.org/origin/release:4.16: Head "https://registry.ci.openshift.org/v2/origin/release/manifests/4.16": unauthorized: unable to validate token . Please retry later

I would be happy for any hint how to install OKD on bare metal.

[bdlink]

The guide you are trying to follow is very old, and probably no longer works.
You can look at Miniagent, https://github.com/okd-project/miniagent , for a working example using the agent-based installer. I have verified that this works out of the box for an Intel CentOS Stream OS server with libvirt installed. The assisted installer is different and uses a Red Hat web site to prepare the install image. It seems to be for the commercial OCP, not OKD (I stand to be corrected on this).
The easiest bare metal install is for single node OKD, since you do not need to deal with as many network issues.
For the general multi-node case, I have had the best success using scripts based on https://upstreamwithoutapaddle.com.

[mzukal]

Thank you very much for pointing out Miniagent. I was not aware of that at all.
I am sorry for a misleading information in my previous comment. I am trying to set up a single node OKD in our Virtual Data Center (the provider uses KVM). I created a VM specifically for this purpose (8CPU, 16GB RAM, 200GB hard drive) and I would like to set up OKD on it. After reading a lot of guides I am not sure whether it is even possible. I will probably run into issues becasue of nested virtualization is that right? I tried to install OpenShift local with OKD preset but it was not possible to start oc because of the nested virtualization.
Is there a way how to set up single node OKD on a VM?

[bdlink]

The miniagent example sets up a single node OKD on a kvm-based VM. The OKD documentation at https://docs.okd.io/latest/installing/installing_sno/install-sno-installing-sno.html has several methods for installing SNO on a single node. I have not tried most of them, as I have used a bootstrap node to deploy the single node (my main use case being HA clusters with 3 control plane nodes and multiple worker nodes). I am now looking into agent-based installs, but have not yet tried the assisted-service installs.
Unfortunately there are many ways to set up single node OKD on a VM. The ideal starter path is currently under discussion.

My personal opinion is to ignore OpenShift Local (previously known as Code Ready Containers) for the moment and work on getting an agent-install working. Look at the short scripts in the miniagent repo and see if you can adapt them to your environment. You can remove the parts of the script that creates the VM and try using your VM, booting up using the ISO produced by the agent.

[mzukal]

Thank you for further pointers! The way of adapting the scripts from miniagent could work. I will give it a try. Thanks for support!

[mzukal]

I adapted the scripts from miniagent to create the ISO file which I then mounted to an empty VM and was able to start and monitor the installation from a different machine. According to the output of openshift-install openshift was successfully installed but I was not able to connect to the openshift VM after the installation at all (some networking problem whcih I was not able to resolve).
After that I tried (again) the assisted installer but with a different version of OKD (I used the versions from this commit: https://github.com/openshift/assisted-service/blob/61c847fa13ce57656972d8b4f04a5b430acc9ad2/deploy/podman/okd-configmap.yml). This time the installer accepted the {"auths":{"fake":{"auth":"aWQ6cGFzcwo="}}} pull secret and I was able to successfully install OKD on an empty VM.
The only problem I faced was getting the kubeadmin password. There is a bug in the UI and it is not possible to copy the password from the web page. I needed to find the password in the HTTP communication.