Chapter 6. Installing OpenShift DR Cluster Operator on Managed clusters Procedure On each managed cluster, navigate to OperatorHub and filter for OpenShift DR Cluster Operator . Follow the screen instructions to install the operator into the project openshift-dr-system . Note The OpenShift DR Cluster Operator must be installed on both the Primary managed cluster and Secondary managed cluster . Configure SSL access between the s3 endpoints so that metadata can be stored on the alternate cluster in a MCG object bucket using a secure transport protocol and in the Hub cluster for verifying access to the object buckets. Note If all of your OpenShift clusters are deployed using a signed and trusted set of certificates for your environment then this section can be skipped. Extract the ingress certificate for the Primary managed cluster and save the output to primary.crt . Extract the ingress certificate for the Secondary managed cluster and save the output to secondary.crt . Create a new ConfigMap to hold certificate bundle of the remote cluster with file name cm-clusters-crt.yaml on the Primary managed cluster , Secondary managed cluster and the Hub cluster . Note There could be more or less than three certificates for each cluster as shown in this example file. Run the following command on the Primary managed cluster , Secondary managed cluster , and the Hub cluster to create the file. Example output: Important For the Hub cluster to verify access to the object buckets using the DRPolicy resource, the same ConfigMap , cm-clusters-crt.yaml , must be created on the Hub cluster . Modify default Proxy cluster resource. Copy and save the following content into the new YAML file proxy-ca.yaml . Apply this new file to the default proxy resource on the Primary managed cluster , Secondary managed cluster , and the Hub cluster . Example output: Retrieve Multicloud Object Gateway (MCG) keys and external S3 endpoint. Check if MCG is installed on the Primary managed cluster and the Secondary managed cluster , and if Phase is Ready . Example output: Copy the following YAML file to filename odrbucket.yaml . Create a MCG bucket odrbucket on both the Primary managed cluster and the Secondary managed cluster . Example output: Extract the odrbucket OBC access key for each managed cluster as their base-64 encoded values by using the following command. Example output: Extract the odrbucket OBC secret key for each managed cluster as their base-64 encoded values by using the following command. Example output: Create S3 Secrets for Managed clusters. Now that the necessary MCG information has been extracted there must be new Secrets created on the Primary managed cluster and the Secondary managed cluster . These new Secrets stores the MCG access and secret keys for both managed clusters. Note OpenShift DR requires one or more S3 stores to store relevant cluster data of a workload from the managed clusters and to orchestrate a recovery of the workload during failover or relocate actions. These instructions are applicable for creating the necessary object bucket(s) using Multicloud Gateway (MCG). MCG should already be installed as a result of installing OpenShift Data Foundation. Copy the following S3 secret YAML format for the Primary managed cluster to filename odr-s3secret-primary.yaml . Replace <primary cluster base-64 encoded access key> and <primary cluster base-64 encoded secret access key> with actual values retrieved in an earlier step. Create this secret on the Primary managed cluster and the Secondary managed cluster . Example output: Copy the following S3 secret YAML format for the Secondary managed cluster to filename odr-s3secret-secondary.yaml . Replace <secondary cluster base-64 encoded access key> and <secondary cluster base-64 encoded secret access key> with actual values retrieved in step 4. Create this secret on the Primary managed cluster and the Secondary managed cluster . Example output: Important The values for the access and secret key must be base-64 encoded . The encoded values for the keys were retrieved in an earlier step. Configure OpenShift DR Cluster Operator ConfigMaps on each of the managed clusters. Search for the external S3 endpoint s3CompatibleEndpoint or route for MCG on each managed cluster by using the following command. Example output: Important The unique s3CompatibleEndpoint route or s3-openshift-storage.apps.<primary clusterID>.<baseDomain> and s3-openshift-storage.apps.<secondary clusterID>.<baseDomain> must be retrieved for both the Primary managed cluster and Secondary managed cluster respectively. Search for the odrbucket OBC bucket name. Example output: Important The unique s3Bucket name odrbucket-<your value1> and odrbucket-<your value2> must be retrieved on both the Primary managed cluster and Secondary managed cluster respectively. Modify the ConfigMap ramen-dr-cluster-operator-config to add the new content. Add the following new content starting at s3StoreProfiles to the ConfigMap on the Primary managed cluster and the Secondary managed cluster .

Commands:
oc get cm default-ingress-cert -n openshift-config-managed -o jsonpath="{['data']['ca-bundle\.crt']}" > primary.crt
oc get cm default-ingress-cert -n openshift-config-managed -o jsonpath="{['data']['ca-bundle\.crt']}" > secondary.crt
apiVersion: v1 data: ca-bundle.crt: | -----BEGIN CERTIFICATE----- <copy contents of cert1 from primary.crt here> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- <copy contents of cert2 from primary.crt here> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- <copy contents of cert3 primary.crt here> -----END CERTIFICATE---- -----BEGIN CERTIFICATE----- <copy contents of cert1 from secondary.crt here> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- <copy contents of cert2 from secondary.crt here> -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- <copy contents of cert3 from secondary.crt here> -----END CERTIFICATE----- kind: ConfigMap metadata: name: user-ca-bundle namespace: openshift-config
oc create -f cm-clusters-crt.yaml
configmap/user-ca-bundle created
apiVersion: config.openshift.io/v1 kind: Proxy metadata: name: cluster spec: trustedCA: name: user-ca-bundle
oc apply -f proxy-ca.yaml
proxy.config.openshift.io/cluster configured
oc get noobaa -n openshift-storage
NAME MGMT-ENDPOINTS S3-ENDPOINTS IMAGE PHASE AGE noobaa ["https://10.70.56.161:30145"] ["https://10.70.56.84:31721"] quay.io/rhceph-dev/mcg-core@sha256:c4b8857ee9832e6efc5a8597a08b81730b774b2c12a31a436e0c3fadff48e73d Ready 27h
apiVersion: objectbucket.io/v1alpha1 kind: ObjectBucketClaim metadata: name: odrbucket namespace: openshift-dr-system spec: generateBucketName: "odrbucket" storageClassName: openshift-storage.noobaa.io
oc create -f odrbucket.yaml
objectbucketclaim.objectbucket.io/odrbucket created
oc get secret odrbucket -n openshift-dr-system -o jsonpath='{.data.AWS_ACCESS_KEY_ID}{"\n"}'
cFpIYTZWN1NhemJjbEUyWlpwN1E=
oc get secret odrbucket -n openshift-dr-system -o jsonpath='{.data.AWS_SECRET_ACCESS_KEY}{"\n"}'
V1hUSnMzZUoxMHRRTXdGMU9jQXRmUlAyMmd5bGwwYjNvMHprZVhtNw==
apiVersion: v1 data: AWS_ACCESS_KEY_ID: <primary cluster base-64 encoded access key> AWS_SECRET_ACCESS_KEY: <primary cluster base-64 encoded secret access key> kind: Secret metadata: name: odr-s3secret-primary namespace: openshift-dr-system
oc create -f odr-s3secret-primary.yaml
secret/odr-s3secret-primary created
apiVersion: v1 data: AWS_ACCESS_KEY_ID: <secondary cluster base-64 encoded access key> AWS_SECRET_ACCESS_KEY: <secondary cluster base-64 encoded secret access key> kind: Secret metadata: name: odr-s3secret-secondary namespace: openshift-dr-system
oc create -f odr-s3secret-secondary.yaml
secret/odr-s3secret-secondary created
oc get route s3 -n openshift-storage -o jsonpath --template="https://{.spec.host}{'\n'}"
https://s3-openshift-storage.apps.perf1.example.com
oc get configmap odrbucket -n openshift-dr-system -o jsonpath='{.data.BUCKET_NAME}{"\n"}'
odrbucket-2f2d44e4-59cb-4577-b303-7219be809dcd
oc edit configmap ramen-dr-cluster-operator-config -n openshift-dr-system
[...] data: ramen_manager_config.yaml: | apiVersion: ramendr.openshift.io/v1alpha1 kind: RamenConfig [...] ramenControllerType: "dr-cluster" ### Start of new content to be added s3StoreProfiles: - s3ProfileName: s3-primary s3CompatibleEndpoint: https://s3-openshift-storage.apps.<primary clusterID>.<baseDomain> s3Region: primary s3Bucket: odrbucket-<your value1> s3SecretRef: name: odr-s3secret-primary namespace: openshift-dr-system - s3ProfileName: s3-secondary s3CompatibleEndpoint: https://s3-openshift-storage.apps.<secondary clusterID>.<baseDomain> s3Region: secondary s3Bucket: odrbucket-<your value2> s3SecretRef: name: odr-s3secret-secondary namespace: openshift-dr-system [...]