// Module included in the following assemblies:
//
// * virt/install/virt-install-ibm-cloud-bm-nodes.adoc

:_mod-docs-content-type: PROCEDURE
[id="virt-install-ibm-cloud-complete-cluster-config_{context}"]
= Completing the cluster configuration

[role="_abstract"]
Complete the cluster configuration by installing software on the control plane and compute nodes and configuring DNS for external access.

.Procedure

. For each bare-metal server, perform the following tasks:
.. Access the server using the IPMI console.
+
[NOTE]
====
The IP address and credentials for IPMI console access is available in the *Remote management* section for each server.
====

.. Mount the Assisted Installer ISO file with the following attributes:
+
* *Virtual Media*: CD-ROM Image
* *Share host*: The private IP address of the Bastion server.
* *Path to image*: The location of the Assisted Installer ISO file.
* *User*: root
* *Password*: The root user password you configured.

.. Click *Save and Mount*.
.. Verify the ISO mounted successfully.
.. Restart the server by selecting *Remote Control* -> *Power Control* -> *Reset Server* -> *Perform Action*.

. Return to the *Assisted Installer* service.

. Select the *Install {VirtProductName}* and *Install {rh-storage}* checkboxes in the *Assisted Installer* options.

. Select a role for each host.
+
[NOTE]
====
The cluster consists of 3 control plane and 3 compute nodes.
====

. Wait for the *Assisted Installer* interface to indicate each node is ready.

. Click *Next*.

. Select *Cluster Managed Network*.

. Select the *API VIP* and *Ingress VIP* checkboxes to obtain them from DHCP or leave them unchecked to enter static values.

. Click *Install*.

. For each bare-metal server, perform the following tasks:
.. Access the server using the IPMI console.
+
[NOTE]
====
The IP address and credentials for IPMI console access is available in the *Remote management* section for each server.
====

.. Select *Virtual Media* -> *CD-Rom Image*.
.. Click *Unmount*.
.. Select *Remote Control* -> *Power Control* -> *Reset Server* -> *Perform Action* to restart the server.

. Locate the *Cluster Credentials* section of the installation summary.

. Perform the following tasks in the *Cluster Credentials* section:
.. Download the `kubeconfig` file.
.. Save the `kubeadmin` password.

. Install `haproxy` on the Bastion virtual server instance.

. Configure `haproxy` for your environment. The following is an example configuration:
+
[source,text]
----
#---------------------------------------------------------------------
# Example configuration for a possible web application.  See the
# full configuration options online.
#
#   https://www.haproxy.org/download/1.8/doc/configuration.txt
#
#---------------------------------------------------------------------

#---------------------------------------------------------------------
# Global settings
#---------------------------------------------------------------------
global
  # to have these messages end up in /var/log/haproxy.log you will
  # need to:
  #
  # 1) configure syslog to accept network log events.  This is done
  # by adding the '-r' option to the SYSLOGD_OPTIONS in
  # /etc/sysconfig/syslog
  #
  # 2) configure local2 events to go to the /var/log/haproxy.log
  #   file. A line like the following can be added to
  #   /etc/sysconfig/syslog
  #
  # local2.*                    /var/log/haproxy.log
  #
  log       127.0.0.1 local2

  chroot    /var/lib/haproxy
  pidfile   /var/run/haproxy.pid
  maxconn   4000
  user      haproxy
  group     haproxy
  daemon

  # turn on stats unix socket
  stats socket /var/lib/haproxy/stats

  # utilize system-wide crypto-policies
  #ssl-default-bind-ciphers PROFILE=SYSTEM
  #ssl-default-server-ciphers PROFILE=SYSTEM

#---------------------------------------------------------------------
# common defaults that all the 'listen' and 'backend' sections will
# use if not designated in their block
#---------------------------------------------------------------------
defaults
  mode                  tcp
  log                   global
  option                httplog
  option                dontlognull
  option http-server-close
  option forwardfor     except 127.0.0.0/8
  option                redispatch
  retries               3
  timeout http-request  10s
  timeout queue         1m
  timeout connect       10s
  timeout client        1m
  timeout server        1m
  timeout http-keep-alive 10s
  timeout check         10s
  maxconn               3000
#---------------------------------------------------------------------
# main frontend which proxys to the backends
#---------------------------------------------------------------------

frontend api
  bind <api_ip_address>:<api_port>
  default_backend controlplaneapi

frontend apiinternal
  bind <apiinternal_ip_address>:<apiinternal_port>
  default_backend controlplaneapiinternal

frontend secure
  bind <frontend_secure_ip_address>:<frontend_secure_port>
  default_backend secure

frontend insecure
  bind <frontend_insecure_ip_address>:<frontend_insecure_port>
  default_backend insecure

#---------------------------------------------------------------------
# static backend
#---------------------------------------------------------------------

backend controlplaneapi
  balance source
  server api <controlplaneapi_ip_address>:<controlplaneapi_port> check

backend controlplaneapiinternal
  balance source
  server api <controlplaneapiinternal_ip_address>:<controlplaneapiinternal_port> check

backend secure
  balance source
  server ingress <backend_secure_ip_address>:<backend_secure_port> check

backend insecure
  balance source
  server ingress <backend_insecure_ip_address>:<backend_insecure_port> check
----
+
where:
+
`<api_ip_address>:<api_port>`:: Specifies the front end IP address and port used by the Kubernetes API server.
`<apiinternal_ip_address>:<apiinternal_port>`:: Specifies the front end IP address and port used for internal cluster management.
`<frontend_secure_ip_address>:<frontend_secure_port>`:: Specifies the front end IP address and port used for HTTPS traffic for hosted applications.
`<frontend_insecure_ip_address>:<frontend_insecure_port>`:: Specifies the front end IP address and port used for HTTP traffic for hosted applications.
`<controlplaneapi_ip_address>:<controlplaneapi_port>`:: Specifies the back end IP address and port used by the Kubernetes API server.
`<controlplaneapiinternal_ip_address>:<controlplaneapiinternal_port>`:: Specifies the back end IP address and port used for internal cluster management.
`<backend_secure_ip_address>:<backend_secure_port>`:: Specifies the back end IP address and port used for HTTPS traffic for hosted applications.
`<backend_insecure_ip_address>:<backend_insecure_port>`:: Specifies the back end IP address and port used for HTTP traffic for hosted applications.
+
[NOTE]
====
Replace the example values with values applicable to your network configuration.
====

. Save the `haproxy` configuration.

. Configure two DNS Address records (A records) for the subdomain that are externally available over the Internet:
+
[source,text]
----
<bastion_public_ip_address> api.<cluster_name>.<cluster_domain>
<bastion_public_ip_address> *.apps..<cluster_name>.<cluster_domain>
----
+
where:
+
`<bastion_public_ip_address>`:: Specifies the externally available IP address of the Bastion virtual server instance.
`<cluster_name>`:: Specifies the name assigned to the cluster.
`<cluster_domain>`:: Specifies the domain assigned to the cluster.

.Verification

. Perform the following tasks to verify cluster access using command line access:
.. Set your environment with the `kubeconfig` file:
+
[source,terminal]
----
$ export KUBECONFIG=<kubeconfig_file_path>
----
+
where:
+
`<kubeconfig_file_path>`:: Specifies the path to the downloaded `kubeconfig` file.

.. Check cluster node status:
+
[source,terminal]
----
$ oc get nodes
----
+
[NOTE]
====
The command output should show all nodes as `Ready` in the `STATUS` column and the `ROLES` column should show that control plane and compute nodes are present.
====
.. Check the cluster version:
+
[source, terminal]
----
$ oc get clusterversion
----
+
[NOTE]
====
The command output should say `Condition: Available`.
====

. Perform the following tasks to verify cluster access using the web console:
.. Paste the access URL provided by Assisted Installer into your web browser.
+
[NOTE]
====
By default, clusters use self-signed certificates. This may cause your browser to display a message that says *Connection not private* or a similar warning. You can close this warning and continue.
====
.. Navigate to the URL.
.. Log in to the cluster with the username `kubeadmin` and the `kubeadmin` password provided in the *Cluster Credentials* section.
