OSDOCS-17013-bm-upi-4: CQAs bare metal UPI doc

dfitzmau · dfitzmau · commit aaebfb5dc1e0 · 2025-12-22T16:49:45.000Z
diff --git a/installing/installing_bare_metal/upi/installing-bare-metal-network-customizations.adoc b/installing/installing_bare_metal/upi/installing-bare-metal-network-customizations.adoc
@@ -67,6 +67,8 @@ include::modules/installation-network-user-infra.adoc[leveloffset=+2]
 
 include::modules/installation-dns-user-infra.adoc[leveloffset=+2]
 
+include::modules/installation-dns-user-infra-example.adoc[leveloffset=+3]
+
 * xref:../../../installing/installing_bare_metal/upi/installing-bare-metal-network-customizations.adoc#installation-user-provisioned-validating-dns_installing-bare-metal-network-customizations[Validating DNS resolution for user-provisioned infrastructure]
 
 include::modules/installation-load-balancing-user-infra.adoc[leveloffset=+2]
diff --git a/installing/installing_bare_metal/upi/installing-bare-metal.adoc b/installing/installing_bare_metal/upi/installing-bare-metal.adoc
@@ -69,6 +69,8 @@ include::modules/installation-network-user-infra.adoc[leveloffset=+2]
 
 include::modules/installation-dns-user-infra.adoc[leveloffset=+2]
 
+include::modules/installation-dns-user-infra-example.adoc[leveloffset=+3]
+
 [role="_additional-resources"]
 .Additional resources
 
diff --git a/installing/installing_bare_metal/upi/installing-restricted-networks-bare-metal.adoc b/installing/installing_bare_metal/upi/installing-restricted-networks-bare-metal.adoc
@@ -79,6 +79,8 @@ include::modules/installation-network-user-infra.adoc[leveloffset=+2]
 
 include::modules/installation-dns-user-infra.adoc[leveloffset=+2]
 
+include::modules/installation-dns-user-infra-example.adoc[leveloffset=+3]
+
 [role="_additional-resources"]
 .Additional resources
 
diff --git a/installing/installing_ibm_power/installing-ibm-power.adoc b/installing/installing_ibm_power/installing-ibm-power.adoc
@@ -62,6 +62,8 @@ include::modules/installation-network-user-infra.adoc[leveloffset=+2]
 
 include::modules/installation-dns-user-infra.adoc[leveloffset=+2]
 
+include::modules/installation-dns-user-infra-example.adoc[leveloffset=+3]
+
 include::modules/installation-load-balancing-user-infra.adoc[leveloffset=+2]
 
 include::modules/installation-infrastructure-user-infra.adoc[leveloffset=+1]
diff --git a/installing/installing_ibm_power/installing-restricted-networks-ibm-power.adoc b/installing/installing_ibm_power/installing-restricted-networks-ibm-power.adoc
@@ -70,6 +70,8 @@ include::modules/installation-network-user-infra.adoc[leveloffset=+2]
 
 include::modules/installation-dns-user-infra.adoc[leveloffset=+2]
 
+include::modules/installation-dns-user-infra-example.adoc[leveloffset=+3]
+
 include::modules/installation-load-balancing-user-infra.adoc[leveloffset=+2]
 
 include::modules/installation-infrastructure-user-infra.adoc[leveloffset=+1]
diff --git a/installing/installing_ibm_z/upi/installing-ibm-z-reqs.adoc b/installing/installing_ibm_z/upi/installing-ibm-z-reqs.adoc
@@ -49,4 +49,6 @@ include::modules/installation-network-user-infra.adoc[leveloffset=+2]
 
 include::modules/installation-dns-user-infra.adoc[leveloffset=+2]
 
+include::modules/installation-dns-user-infra-example.adoc[leveloffset=+3]
+
 include::modules/installation-load-balancing-user-infra.adoc[leveloffset=+2]
diff --git a/installing/installing_platform_agnostic/installing-platform-agnostic.adoc b/installing/installing_platform_agnostic/installing-platform-agnostic.adoc
@@ -50,6 +50,8 @@ include::modules/installation-network-user-infra.adoc[leveloffset=+2]
 
 include::modules/installation-dns-user-infra.adoc[leveloffset=+2]
 
+include::modules/installation-dns-user-infra-example.adoc[leveloffset=+3]
+
 include::modules/installation-load-balancing-user-infra.adoc[leveloffset=+2]
 
 include::modules/installation-infrastructure-user-infra.adoc[leveloffset=+1]
diff --git a/installing/installing_two_node_cluster/installing_tnf/installing-two-node-fencing.adoc b/installing/installing_two_node_cluster/installing_tnf/installing-two-node-fencing.adoc
@@ -48,6 +48,8 @@ include::modules/installation-two-node-cluster-min-resource-reqs.adoc[leveloffse
 // Two-node-dns-requirements - user-provisioned infrastructure
 include::modules/installation-dns-user-infra.adoc[leveloffset=+1]
 
+include::modules/installation-dns-user-infra-example.adoc[leveloffset=+2]
+
 // Two-node-dns-requirements - installer-provisioned infrastructure
 include::modules/installation-dns-installer-infra.adoc[leveloffset=+1]
 
diff --git a/installing/installing_vsphere/upi/upi-vsphere-installation-reqs.adoc b/installing/installing_vsphere/upi/upi-vsphere-installation-reqs.adoc
@@ -59,4 +59,6 @@ include::modules/installation-network-user-infra.adoc[leveloffset=+2]
 
 include::modules/installation-dns-user-infra.adoc[leveloffset=+2]
 
+include::modules/installation-dns-user-infra-example.adoc[leveloffset=+3]
+
 include::modules/installation-load-balancing-user-infra.adoc[leveloffset=+2]
diff --git a/modules/cluster-entitlements.adoc b/modules/cluster-entitlements.adoc
@@ -109,6 +109,7 @@ endif::[]
 ifndef::openshift-origin[]
 = Internet access for {product-title}
 
+[role="_abstract"]
 In {product-title} {product-version}, you require access to the internet to
 ifndef::restricted[]
 install
diff --git a/modules/csr-management.adoc b/modules/csr-management.adoc
@@ -29,4 +29,5 @@
 [id="csr-management_{context}"]
 = Certificate signing requests management
 
+[role="_abstract"]
 Because your cluster has limited access to automatic machine management when you use infrastructure that you provision, you must provide a mechanism for approving cluster certificate signing requests (CSRs) after installation. The `kube-controller-manager` only approves the kubelet client CSRs. The `machine-approver` cannot guarantee the validity of a serving certificate that is requested by using kubelet credentials because it cannot confirm that the correct machine issued the request. You must determine and implement a method of verifying the validity of the kubelet serving certificate requests and approving them.
diff --git a/modules/installation-dns-user-infra-example.adoc b/modules/installation-dns-user-infra-example.adoc
@@ -0,0 +1,172 @@
+// Module included in the following assemblies:
+//
+// * installing/installing_bare_metal/upi/installing-bare-metal-network-customizations.adoc
+// * installing/installing_bare_metal/upi/installing-bare-metal.adoc
+// * installing/installing_bare_metal/upi/installing-restricted-networks-bare-metal.adoc
+// * installing/installing_ibm_power/installing-ibm-power.adoc
+// * installing/installing_ibm_power/installing-restricted-networks-ibm-power.adoc
+// * installing/installing_ibm_z/installing-restricted-networks-ibm-z-kvm.adoc
+// * installing/installing_ibm_z/installing-ibm-z-kvm.adoc
+// * installing/installing_ibm_z/installing-ibm-z.adoc
+// * installing/installing_ibm_z/installing-restricted-networks-ibm-z.adoc
+// * installing/installing_ibm_z/installing-ibm-z-lpar.adoc
+// * installing/installing_ibm_z/installing-restricted-networks-ibm-z-lpar.adoc
+// * installing/installing_platform_agnostic/installing-platform-agnostic.adoc
+// * installing/installing_vmc/installing-restricted-networks-vmc-user-infra.adoc
+// * installing/installing_vmc/installing-vmc-user-infra.adoc
+// * installing/installing_vmc/installing-vmc-network-customizations-user-infra.adoc
+// * installing/installing_vsphere/upi/upi-vsphere-installation-reqs.adoc
+
+ifeval::["{context}" == "installing-ibm-z"]
+:ibm-z:
+endif::[]
+ifeval::["{context}" == "installing-ibm-z-kvm"]
+:ibm-z-kvm:
+endif::[]
+ifeval::["{context}" == "installing-ibm-z-lpar"]
+:ibm-z:
+endif::[]
+ifeval::["{context}" == "installing-restricted-networks-ibm-z"]
+:ibm-z:
+endif::[]
+ifeval::["{context}" == "installing-restricted-networks-ibm-z-kvm"]
+:ibm-z-kvm:
+endif::[]
+ifeval::["{context}" == "installing-restricted-networks-ibm-z-lpar"]
+:ibm-z:
+endif::[]
+
+:_mod-docs-content-type: REFERENCE
+[id="installation-dns-user-infra-example_{context}"]
+= Example DNS configuration for user-provisioned clusters
+
+[role="_abstract"]
+Reference the example DNS configurations to understand how A and PTR record configuration samples meet the DNS requirements for deploying {product-title} on user-provisioned infrastructure. The samples are not meant to provide advice for choosing one DNS solution over another.
+
+In the examples, the cluster name is `ocp4` and the base domain is `example.com`.
+
+ifeval::["{context}" == "installing-two-node-fencing"]
+[NOTE]
+====
+In a two-node cluster with fencing, the control plane machines are also schedulable worker nodes. The DNS configuration must therefore include only the two control plane nodes. If you later add compute machines, provide corresponding A and PTR records for them as in a standard user-provisioned installation.
+====
+endif::[]
+
+The following example is a BIND zone file that shows sample DNS A records for name resolution in a user-provisioned cluster:
+
+[source,text]
+----
+$TTL 1W
+@	IN	SOA	ns1.example.com.	root (
+			2019070700	; serial
+			3H		; refresh (3 hours)
+			30M		; retry (30 minutes)
+			2W		; expiry (2 weeks)
+			1W )		; minimum (1 week)
+	IN	NS	ns1.example.com.
+	IN	MX 10	smtp.example.com.
+;
+;
+ns1.example.com.		IN	A	192.168.1.5
+smtp.example.com.		IN	A	192.168.1.5
+;
+helper.example.com.		IN	A	192.168.1.5
+helper.ocp4.example.com.	IN	A	192.168.1.5
+;
+api.ocp4.example.com.		IN	A	192.168.1.5
+api-int.ocp4.example.com.	IN	A	192.168.1.5
+;
+*.apps.ocp4.example.com.	IN	A	192.168.1.5
+;
+bootstrap.ocp4.example.com.	IN	A	192.168.1.96
+;
+control-plane0.ocp4.example.com.	IN	A	192.168.1.97
+control-plane1.ocp4.example.com.	IN	A	192.168.1.98
+;
+ifeval::["{context}" != "installing-two-node-fencing"]
+control-plane2.ocp4.example.com.	IN	A	192.168.1.99
+;
+compute0.ocp4.example.com.	IN	A	192.168.1.11
+compute1.ocp4.example.com.	IN	A	192.168.1.7
+endif::[]
+;
+;EOF
+----
+
+* `api.ocp4.example.com.`: Provides name resolution for the Kubernetes API. The record refers to the IP address of the API load balancer.
+* `api-int.ocp4.example.com.`: Provides name resolution for the Kubernetes API. The record refers to the IP address of the API load balancer and is used for internal cluster communications.
+* `*.apps.ocp4.example.com.`: Provides name resolution for the wildcard routes. The record refers to the IP address of the application ingress load balancer. The application ingress load balancer targets the machines that run the Ingress Controller pods.
++
+[NOTE]
+====
+In the example, the same load balancer is used for the Kubernetes API and application ingress traffic. In production scenarios, you can deploy the API and application ingress load balancers separately so that you can scale the load balancer infrastructure for each in isolation.
+====
++
+* `bootstrap.ocp4.example.com.`: Provides name resolution for the bootstrap machine.
+* `control-plane0.ocp4.example.com.`: Provides name resolution for the control plane machines.
+ifeval::["{context}" != "installing-two-node-fencing"]
+* `compute0.ocp4.example.com.`: Provides name resolution for the compute machines.
+endif::[]
+
+The following example BIND zone file shows sample PTR records for reverse name resolution in a user-provisioned cluster:
+
+[source,text]
+----
+$TTL 1W
+@	IN	SOA	ns1.example.com.	root (
+			2019070700	; serial
+			3H		; refresh (3 hours)
+			30M		; retry (30 minutes)
+			2W		; expiry (2 weeks)
+			1W )		; minimum (1 week)
+	IN	NS	ns1.example.com.
+;
+5.1.168.192.in-addr.arpa.	IN	PTR	api.ocp4.example.com.
+5.1.168.192.in-addr.arpa.	IN	PTR	api-int.ocp4.example.com.
+;
+96.1.168.192.in-addr.arpa.	IN	PTR	bootstrap.ocp4.example.com.
+;
+97.1.168.192.in-addr.arpa.	IN	PTR	control-plane0.ocp4.example.com.
+98.1.168.192.in-addr.arpa.	IN	PTR	control-plane1.ocp4.example.com.
+;
+ifeval::["{context}" != "installing-two-node-fencing"]
+99.1.168.192.in-addr.arpa.	IN	PTR	control-plane2.ocp4.example.com.
+;
+11.1.168.192.in-addr.arpa.	IN	PTR	compute0.ocp4.example.com.
+7.1.168.192.in-addr.arpa.	IN	PTR	compute1.ocp4.example.com.
+endif::[]
+;
+;EOF
+----
+
+* `api.ocp4.example.com.`: Provides reverse DNS resolution for the Kubernetes API. The PTR record refers to the record name of the API load balancer.
+* `api-int.ocp4.example.com.`: Provides reverse DNS resolution for the Kubernetes API. The PTR record refers to the record name of the API load balancer and is used for internal cluster communications.
+* `bootstrap.ocp4.example.com.`: Provides reverse DNS resolution for the bootstrap machine.
+* `control-plane0.ocp4.example.com.`: Provides rebootstrap.ocp4.example.com.verse DNS resolution for the control plane machines.
+ifeval::["{context}" != "installing-two-node-fencing"]
+* `compute0.ocp4.example.com.`: Provides reverse DNS resolution for the compute machines.
+endif::[]
+
+[NOTE]
+====
+A PTR record is not required for the {product-title} application wildcard.
+====
+
+ifeval::["{context}" == "installing-ibm-z"]
+:!ibm-z:
+endif::[]
+ifeval::["{context}" == "installing-ibm-z-kvm"]
+:!ibm-z-kvm:
+endif::[]
+ifeval::["{context}" == "installing-ibm-z-lpar"]
+:!ibm-z:
+endif::[]
+ifeval::["{context}" == "installing-restricted-networks-ibm-z"]
+:!ibm-z:
+endif::[]
+ifeval::["{context}" == "installing-restricted-networks-ibm-z-kvm"]
+:!ibm-z-kvm:
+endif::[]
+ifeval::["{context}" == "installing-restricted-networks-ibm-z-lpar"]
+:!ibm-z:
+endif::[]
diff --git a/modules/installation-dns-user-infra.adoc b/modules/installation-dns-user-infra.adoc
diff --git a/modules/installation-load-balancing-user-infra-example.adoc b/modules/installation-load-balancing-user-infra-example.adoc
diff --git a/modules/installation-load-balancing-user-infra.adoc b/modules/installation-load-balancing-user-infra.adoc
diff --git a/modules/installation-machine-requirements.adoc b/modules/installation-machine-requirements.adoc
diff --git a/modules/installation-minimum-resource-requirements.adoc b/modules/installation-minimum-resource-requirements.adoc
