1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
|
= Setting up {prod} on a remote server
Configure a remote server to run an {ocp} cluster provided by {prod}.
This procedure assumes the use of a {rhel}, {fed}, or {centos} server.
Run every command in this procedure on the remote server.
[WARNING]
====
**Perform this procedure only on a local network.**
Exposing an insecure server on the internet has many security implications.
====
.Prerequisites
* {prod} is installed and set up on the remote server.
For more information, see link:{crc-gsg-url}#installing_gsg[Installing {prod}] and link:{crc-gsg-url}#setting-up_gsg[Setting up {prod}].
* {prod} is configured to use the {openshift} preset on the remote server.
For more information, see link:{crc-gsg-url}#changing-the-selected-preset_gsg[Changing the selected preset].
* Your user account has `sudo` permissions on the remote server.
.Procedure
. Start the cluster:
+
[subs="+quotes,attributes"]
----
$ {bin} start
----
+
Ensure that the cluster remains running during this procedure.
. Install the [package]`haproxy` package and other utilities:
+
----
$ sudo dnf install haproxy /usr/sbin/semanage
----
. Modify the firewall to allow communication with the cluster:
+
----
$ sudo systemctl enable --now firewalld
$ sudo firewall-cmd --add-service=http --permanent
$ sudo firewall-cmd --add-service=https --permanent
$ sudo firewall-cmd --add-service=kube-apiserver --permanent
$ sudo firewall-cmd --reload
----
. For SELinux, allow HAProxy to listen on TCP port 6443 to serve `kube-apiserver` on this port:
+
----
$ sudo semanage port -a -t http_port_t -p tcp 6443
----
. Create a backup of the default [application]`haproxy` configuration:
+
----
$ sudo cp /etc/haproxy/haproxy.cfg{,.bak}
----
. Configure [application]`haproxy` for use with the cluster:
+
[subs="+quotes,attributes"]
----
$ export CRC_IP=$({bin} ip)
$ sudo tee /etc/haproxy/haproxy.cfg &>/dev/null <<EOF
global
log /dev/log local0
defaults
balance roundrobin
log global
maxconn 100
mode tcp
timeout connect 5s
timeout client 500s
timeout server 500s
listen apps
bind 0.0.0.0:80
server crcvm $CRC_IP:80 check
listen apps_ssl
bind 0.0.0.0:443
server crcvm $CRC_IP:443 check
listen api
bind 0.0.0.0:6443
server crcvm $CRC_IP:6443 check
EOF
----
. Start the [application]`haproxy` service:
+
----
$ sudo systemctl start haproxy
----
|
