| Parameter | Description |
|---|---|
| apiVersion: | The API version for the install-config.yaml content. The current version is v1. The installation program might also support older API versions.Value: String |
| baseDomain: | The base domain of your cloud provider. The base domain is used to create routes to your OpenShift Container Platform cluster components. The full DNS name for your cluster is a combination of the baseDomain and metadata.name parameter values that uses the <metadata.name>.<baseDomain> format.Value: A fully-qualified domain or subdomain name, such as example.com. |
| metadata: | Kubernetes resource ObjectMeta, from which only the name parameter is consumed.Value: Object |
| metadata: name: | The name of the cluster. DNS records for the cluster are all subdomains of {.metadata.name}.{.baseDomain}. Value: String of lowercase letters, hyphens ( -), and periods (.), such as dev. |
| platform: | The configuration for the specific platform upon which to perform the installation: aws, baremetal, azure, gcp, ibmcloud, nutanix, openstack, powervs, vsphere, or {}. For additional information about platform.<platform> parameters, consult the table for your specific platform that follows.Value: Object |
| pullSecret: | Get a pull secret from Red Hat OpenShift Cluster Manager to authenticate downloading container images for OpenShift Container Platform components from services such as Quay.io. Value: {
"auths":{
"cloud.openshift.com":{
"auth":"b3Blb=",
"email":"you@example.com"
},
"quay.io":{
"auth":"b3Blb=",
"email":"you@example.com"
}
}
} |
| Parameter | Description |
|---|---|
| networking: | The configuration for the cluster network. Value: Object
|
| networking: networkType: | The Red Hat OpenShift Networking network plugin to install. Value: OVNKubernetes. OVNKubernetes is a Container Network Interface (CNI) plugin for Linux networks and hybrid networks that contain both Linux and Windows servers. The default value is OVNKubernetes. |
| networking: clusterNetwork: | The IP address blocks for pods. The default value is 10.128.0.0/14 with a host prefix of /23.If you specify multiple IP address blocks, the blocks must not overlap. Value: An array of objects. For example: networking:
clusterNetwork:
- cidr: 10.128.0.0/14
hostPrefix: 23
networking:
clusterNetwork:
- cidr: 10.128.0.0/14
hostPrefix: 23
- cidr: fd01::/48
hostPrefix: 64 |
| networking: clusterNetwork: cidr: | Required if you use networking.clusterNetwork. An IP address block.An IPv4 network. If you use the OVN-Kubernetes network plugin, you can specify IPv4 and IPv6 networks. Value: An IP address block in Classless Inter-Domain Routing (CIDR) notation. The prefix length for an IPv4 block is between 0 and 32. The prefix length for an IPv6 block is between 0 and 128. For example, 10.128.0.0/14 or fd01::/48. |
| networking: clusterNetwork: hostPrefix: | The subnet prefix length to assign to each individual node. For example, if hostPrefix is set to 23 then each node is assigned a /23 subnet out of the given cidr. A hostPrefix value of 23 provides 510 (2^(32 - 23) - 2) pod IP addresses.Value: A subnet prefix. The default value is 23. For an IPv4 network the default value is 23. For an IPv6 network hostPrefix must be set to 64, which is the default value. |
| networking: serviceNetwork: | The IP address block for services. The default value is 172.30.0.0/16.If you use the OVN-Kubernetes network plugin, you can specify an IP address block for both of the IPv4 and IPv6 address families. Value: An array with an IP address block in CIDR format. For example: networking: serviceNetwork: - 172.30.0.0/16 networking: serviceNetwork: - 172.30.0.0/16 - fd02::/112 |
| networking: machineNetwork: | The IP address blocks for machines. If you specify multiple IP address blocks, the blocks must not overlap. Value: An array of objects. For example: networking: machineNetwork: - cidr: 10.0.0.0/16 |
| networking: machineNetwork: cidr: | Required if you use networking.machineNetwork. An IP address block. The default value is 10.0.0.0/16 for all platforms other than libvirt and IBM Power(R) Virtual Server. For libvirt, the default value is 192.168.126.0/24. For IBM Power(R) Virtual Server, the default value is 192.168.0.0/24.Value: An IP network block in CIDR notation. For example, 10.0.0.0/16.
|
| networking: ovnKubernetesConfig: ipv4: internalJoinSubnet: | Configures the IPv4 join subnet that is used internally by ovn-kubernetes. This subnet must not overlap with any other subnet that OpenShift Container Platform is using, including the node network. The size of the subnet must be larger than the number of nodes. You cannot change the value after installation.Value: An IP network block in CIDR notation. The default value is 100.64.0.0/16. |
| Parameter | Description |
|---|---|
| additionalTrustBundle: | A PEM-encoded X.509 certificate bundle that is added to the nodes' trusted certificate store. This trust bundle might also be used when a proxy has been configured. Value: String |
| capabilities: | Controls the installation of optional core cluster components. You can reduce the footprint of your OpenShift Container Platform cluster by disabling optional components. For more information, see the "Cluster capabilities" page in Installing. Value: String array |
| capabilities: baselineCapabilitySet: | Selects an initial set of optional capabilities to enable. Valid values are None, v4.11, v4.12 and vCurrent. The default value is vCurrent.Value: String |
| capabilities: additionalEnabledCapabilities: | Extends the set of optional capabilities beyond what you specify in baselineCapabilitySet. You can specify multiple capabilities in this parameter.Value: String array |
| cpuPartitioningMode: | Enables workload partitioning, which isolates OpenShift Container Platform services, cluster management workloads, and infrastructure pods to run on a reserved set of CPUs. You can only enable workload partitioning during installation. You cannot disable it after installation. While this field enables workload partitioning, it does not configure workloads to use specific CPUs. For more information, see the Workload partitioning page in the Scalability and Performance section. Value: None or AllNodes. None is the default value. |
| compute: | The configuration for the machines that comprise the compute nodes. Value: Array of MachinePool objects. |
| compute: architecture: | Determines the instruction set architecture of the machines in the pool. Currently, clusters with varied architectures are not supported. All pools must specify the same architecture. Valid values are amd64 and arm64.Not all installation options support the 64-bit ARM architecture. To verify if your installation option is supported on your platform, see Supported installation methods for different platforms in Selecting a cluster installation method and preparing it for users. Value: String |
| compute: hyperthreading: | Whether to enable or disable simultaneous multithreading, or hyperthreading, on compute machines. By default, simultaneous multithreading is enabled to increase the performance of your machines' cores.
Value: Enabled or Disabled |
| compute: name: | Required if you use compute. The name of the machine pool.Value: worker |
| compute: platform: | Required if you use compute. Use this parameter to specify the cloud provider to host the worker machines. This parameter value must match the controlPlane.platform parameter value. |
| compute: replicas: | The number of compute machines, which are also known as worker machines, to provision. Value: A positive integer greater than or equal to 2. The default value is 3. |
| featureSet: | Enables the cluster for a feature set. A feature set is a collection of OpenShift Container Platform features that are not enabled by default. For more information about enabling a feature set during installation, see "Enabling features using feature gates". Value: String. The name of the feature set to enable, such as TechPreviewNoUpgrade. |
| controlPlane: | The configuration for the machines that form the control plane. Value: Array of MachinePool objects. |
| controlPlane: architecture: | Determines the instruction set architecture of the machines in the pool. Currently, clusters with varied architectures are not supported. All pools must specify the same architecture. Valid values are amd64 and arm64.Not all installation options support the 64-bit ARM architecture. To verify if your installation option is supported on your platform, see Supported installation methods for different platforms in Selecting a cluster installation method and preparing it for users. Value: String |
| controlPlane: hyperthreading: | Whether to enable or disable simultaneous multithreading, or hyperthreading, on control plane machines. By default, simultaneous multithreading is enabled to increase the performance of your machines' cores.
Value: Enabled or Disabled |
| controlPlane: name: | Required if you use controlPlane. The name of the machine pool.Value: master |
| controlPlane: platform: | Required if you use controlPlane. Use this parameter to specify the cloud provider that hosts the control plane machines. This parameter value must match the compute.platform parameter value. |
| controlPlane: replicas: | The number of control plane machines to provision. Value: Supported values are 3, or 1 when deploying single-node OpenShift. |
| arbiter: name: | The OpenShift Container Platform cluster requires a name for arbiter nodes. For example, arbiter. |
| arbiter: replicas: | The replicas parameter sets the number of arbiter nodes for the OpenShift Container Platform cluster. You cannot set this field to a value that is greater than 1. |
| credentialsMode: | The Cloud Credential Operator (CCO) mode. If no mode is specified, the CCO dynamically tries to determine the capabilities of the provided credentials, with a preference for mint mode on the platforms where multiple modes are supported.
Value: Mint, Passthrough, Manual or an empty string (""). |
| fips: | Enable or disable FIPS mode. The default is false (disabled). If you enable FIPS mode, the Red Hat Enterprise Linux CoreOS (RHCOS) machines that OpenShift Container Platform runs on bypass the default Kubernetes cryptography suite and use the cryptography modules that RHCOS provides instead.
Value: false or true |
endpoint: name: true or false |
The name parameter contains the name of the Private Service Connect (PSC) endpoints.
When you want the installation program to use the public API endpoints and cluster Operators to use the API endpoint overrides, set clusterUseOnly to true. When you want both the installation program and the cluster Operators to use the API endpoint overrides, for example if you are running the installation program from a bastion host that is within the same VPC where you want to deploy the cluster, set clusterUseOnly to false . The parameter is optional and defaults to false.Value: String or boolean |
| imageContentSources: | Sources and repositories for the release-image content. Value: Array of objects. Includes a source and, optionally, mirrors, as described in the following rows of this table. |
| imageContentSources: source: | Required if you use imageContentSources. Specify the repository that users refer to, for example, in image pull specifications.Value: String |
| imageContentSources: mirrors: | Specify one or more repositories that might also contain the same images. Value: Array of strings |
| osImageStream: | Specifies the image stream that will be used for all machines in the cluster. osImageStream is a Technology Preview feature. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.Value: String. Valid values are rhel-9 or rhel-10. |
| platform: aws: lbType: | Required to set the NLB load balancer type in AWS. Valid values are Classic or NLB. If no value is specified, the installation program defaults to Classic. The installation program sets the value provided here in the ingress cluster configuration object. If you do not specify a load balancer type for other Ingress Controllers, they use the type set in this parameter.If you installed your cluster using the DualStackIPv4Primary or DualStackIPv6Primary values for the platform.aws.ipFamily parameter, any services that have IPv6 addresses must use the NLB load balancer type. The classic load balancer (CLB) does not support IPv6.Value: Classic or NLB. If you do not set the platform.aws.ipFamily parameter or set it to IPv4, the default value is Classic. If you set the platform.aws.ipFamily parameter to DualStackIPv4Primary or DualStackIPv6Primary, the default value is NLB. |
| publish: | How to publish or expose the user-facing endpoints of your cluster, such as the Kubernetes API, OpenShift routes. Value: Internal or External. To deploy a private cluster that cannot be accessed from the internet, set the publish parameter to Internal. The default value is External. |
| sshKey: | The SSH key to authenticate access to your cluster machines.
Value: For example, sshKey: ssh-ed25519 AAAA... |
| Parameter | Description |
|---|---|
| compute: platform: aws: amiID: | The AWS AMI used to boot compute machines for the cluster. This is required for regions that require a custom RHCOS AMI. Value: Any published or custom RHCOS AMI that belongs to the set AWS region. See _RHCOS AMIs for AWS infrastructure_ for available AMI IDs. |
| compute: platform: aws: iamProfile: | The name of the IAM instance profile that you use for the machine. If you want the installation program to create the IAM instance profile for you, do not use the iamProfile parameter. You can specify either the iamProfile or iamRole parameter, but you cannot specify both.Value: String |
| compute: platform: aws: iamRole: | The name of the IAM instance role that you use for the machine. When you specify an IAM role, the installation program creates an instance profile. If you want the installation program to create the IAM instance role for you, do not select the iamRole parameter. You can specify either the iamRole or iamProfile parameter, but you cannot specify both.Value: String |
| compute: platform: aws: rootVolume: iops: | The Input/Output Operations Per Second (IOPS) that is reserved for the root volume. Value: Integer, for example 4000. |
| compute: platform: aws: rootVolume: size: | The size in GiB of the root volume. Value: Integer, for example 500. |
| compute: platform: aws: rootVolume: type: | The type of the root volume. Value: Valid AWS EBS volume type, such as io1. |
| compute: platform: aws: rootVolume: throughput: | The maximum throughput of the root volume. This throughput can be customized only for the gp3 volume type. The minimum value is 125 MiB/s and the maximum value is 2000 MiB/s. Value: Integer, for example 1000. |
| compute: platform: aws: rootVolume: kmsKeyARN: | The Amazon Resource Name (key ARN) of a KMS key. This is required to encrypt operating system volumes of worker nodes with a specific KMS key. Value: Valid key ID or the key ARN. |
| compute: platform: aws: type: | The EC2 instance type for the compute machines. Value: Valid AWS instance type, such as m4.2xlarge. See the "Tested instance types for AWS" table on the "Installing a cluster on AWS with customizations" page. |
| compute: platform: aws: zones: | The availability zones where the installation program creates machines for the compute machine pool. If you provide your own VPC, you must provide a subnet in that availability zone. Value: A list of valid AWS availability zones, such as us-east-1c, in a YAML sequence. |
| compute: platform: aws: hostPlacement: affinity: | Specifies the affinity setting for placing compute machines on AWS Dedicated Hosts. When set to DedicatedHost, machines are pinned to the specific Dedicated Hosts listed in the dedicatedHost field. If a machine is stopped and restarted, the machine returns to the same physical host. When set to AnyAvailable, machines are not pinned to specific Dedicated Hosts. If a machine is stopped and restarted, AWS can place the machine on any available Dedicated Host that matches the instance type and availability zone.
Value: DedicatedHost or AnyAvailable. |
| compute: platform: aws: hostPlacement: dedicatedHost: | A list of AWS Dedicated Host entries for compute machines. Required when hostPlacement.affinity is set to DedicatedHost. Must be omitted when hostPlacement.affinity is set to AnyAvailable.
Value: A list of objects. |
| compute: platform: aws: hostPlacement: dedicatedHost: - id: | The ID of the AWS Dedicated Host. The value must start with h- followed by 17 lowercase hexadecimal characters.
Value: String, for example h-015c6d3ffa1d43d38. |
| controlPlane: platform: aws: amiID: | The AWS AMI used to boot control plane machines for the cluster. This is required for regions that require a custom RHCOS AMI. Value: Any published or custom RHCOS AMI that belongs to the set AWS region. See _RHCOS AMIs for AWS infrastructure_ for available AMI IDs. |
| controlPlane: platform: aws: iamProfile: | The name of the IAM instance profile that you use for the machine. If you want the installation program to create the IAM instance profile for you, do not use the iamProfile parameter. You can specify either the iamProfile or iamRole parameter, but you cannot specify both.Value: String |
| controlPlane: platform: aws: iamRole: | The name of the IAM instance role that you use for the machine. When you specify an IAM role, the installation program creates an instance profile. If you want the installation program to create the IAM instance role for you, do not use the iamRole parameter. You can specify either the iamRole or iamProfile parameter, but you cannot specify both.Value: String |
| controlPlane: platform: aws: rootVolume: iops: | The Input/Output Operations Per Second (IOPS) that is reserved for the root volume on control plane machines. Value: Integer, for example 4000. |
| controlPlane: platform: aws: rootVolume: size: | The size in GiB of the root volume for control plane machines. Value: Integer, for example 500. |
| controlPlane: platform: aws: rootVolume: type: | The type of the root volume for control plane machines. Value: Valid AWS EBS volume type, such as io1. |
| controlPlane: platform: aws: rootVolume: throughput: | The maximum throughput of the root volume. This throughput can be customized only for the gp3 volume type. The minimum value is 125 MiB/s and the maximum value is 2000 MiB/s. Value: Integer, for example 1000. |
| controlPlane: platform: aws: rootVolume: kmsKeyARN: | The Amazon Resource Name (key ARN) of a KMS key. This is required to encrypt operating system volumes of control plane nodes with a specific KMS key. Value: Valid key ID and the key ARN. |
| controlPlane: platform: aws: type: | The EC2 instance type for the control plane machines. Value: Valid AWS instance type, such as m6i.xlarge. See the "Tested instance types for AWS" table on the "Installing a cluster on AWS with customizations" page. |
| controlPlane: platform: aws: zones: | The availability zones where the installation program creates machines for the control plane machine pool. Value: A list of valid AWS availability zones, such as us-east-1c, in a YAML sequence. |
| platform: aws: amiID: | The AWS AMI used to boot all machines for the cluster. If set, the AMI must belong to the same region as the cluster. This is required for regions that require a custom RHCOS AMI. Value: Any published or custom RHCOS AMI that belongs to the set AWS region. See _RHCOS AMIs for AWS infrastructure_ for available AMI IDs. |
| platform: aws: hostedZone: | An existing Route 53 private hosted zone for the cluster. You can only use a pre-existing hosted zone when also supplying your own VPC. The hosted zone must already be associated with the user-provided VPC before installation. Also, the domain of the hosted zone must be the cluster domain or a parent of the cluster domain. If undefined, the installation program creates a new hosted zone. Value: String, for example Z3URY6TWQ91KVV. |
| platform: aws: hostedZoneRole: | An Amazon Resource Name (ARN) for an existing IAM role in the account containing the specified hosted zone. The installation program and cluster operators assume this role when performing operations on the hosted zone. Use this parameter only when you are installing a cluster into a shared VPC. Value: String, for example arn:aws:iam::1234567890:role/shared-vpc-role. |
| platform: aws: userProvisionedDNS: | Enables user-provisioned DNS instead of the default cluster-provisioned DNS solution. If you use this feature, you must provide your own DNS solution that includes records for api.<cluster_name>.<base_domain>. and *.apps.<cluster_name>.<base_domain>.. userProvisionedDNS is a Technology Preview feature.Value: Enabled or Disabled. The default value is Disabled. |
| platform: aws: region: | The AWS region that the installation program creates all cluster resources in. Value: Any valid AWS region, such as us-east-1. You can use the AWS CLI to access the regions available based on your selected instance type by running the following command:$ aws ec2 describe-instance-type-offerings --filters Name=instance-type,Values=c7g.xlarge
|
| platform: aws: serviceEndpoints: - name: url: | The AWS service endpoint name and URL. Custom endpoints are only required for cases where alternative AWS endpoints, such as FIPS, must be used. Custom API endpoints can be specified for EC2, S3, IAM, Elastic Load Balancing, Tagging, Route 53, and STS AWS services. Value: Valid AWS service endpoint name and valid AWS service endpoint URL. |
| platform: aws: userTags: | A map of keys and values that the installation program adds as tags to all resources that it creates. Value: Any valid YAML map, such as key value pairs in the <key>: <value> format. For more information about AWS tags, see Tagging Your Amazon EC2 Resources in the AWS documentation.
|
| platform: aws: propagateUserTags: | A flag that directs in-cluster Operators to include the specified user tags in the tags of the AWS resources that the Operators create. Value: Boolean values, for example true or false. |
| platform: aws: publicIpv4Pool: | The public IPv4 pool ID that is used to allocate Elastic IPs (EIPs) when publish is set to External. You must provision and advertise the pool in the same AWS account and region of the cluster. You must ensure that you have 2n + 1 IPv4 addresses available in the pool where n is the total number of AWS zones used to deploy the Network Load Balancer (NLB) for API, NAT gateways, and bootstrap node. For more information about bring your own IP addresses (BYOIP) in AWS, see Onboard your BYOIP.Value: A valid public IPv4 pool id
|
| platform: aws: bestEffortDeleteIgnition: | An optional flag that determines whether to ignore errors when deleting Ignition objects from the S3 bucket. By default, the installation program fails if it cannot delete the Ignition objects. Value: true or false. The default value is false, which causes the installation program to fail on S3 Ignition deletion errors. |
| platform: aws: ipFamily: | The IP address family for networks used by the cluster. Specify IPv4 for IPv4-only networking, DualStackIPv4Primary for dual-stack networking with IPv4 as the primary address family, or DualStackIPv6Primary for dual-stack networking with IPv6 as the primary address family. When using dual-stack, the VPC and subnets must be configured with both IPv4 and IPv6 CIDR blocks.Consider the following requirements if you use dual-stack networking:
Value: "IPv4", "DualStackIPv4Primary", or "DualStackIPv6Primary". The default value is "IPv4". |
| platform: aws: vpc: subnets: | A list of subnets in an existing VPC to be used in place of automatically created subnets. You specify a subnet by providing the subnet ID and an optional list of roles that apply to that subnet. If you specify subnet IDs but do not specify roles for any subnet, the subnets' roles are decided automatically. If you do not specify any roles, you must ensure that any other subnets in your VPC have the kubernetes.io/cluster/.: . or kubernetes.io/cluster/unmanaged: true tags.The subnets must be part of the same networking.machineNetwork[].cidr ranges that you specify. If you provide dual-stack subnets using this parameter, you must specify IPv6 entries in the networking.machineNetwork[].cidr parameter.For a public cluster, specify a public and a private subnet for each availability zone. For a private cluster, specify a private subnet for each availability zone. For clusters that use AWS Local Zones, you must add AWS Local Zone subnets to this list to ensure edge machine pool creation. Value: List of pairs of id and roles parameters. |
| platform: aws: vpc: subnets: - id: | The ID of an existing subnet to be used in place of a subnet created by the installation program. Value: String. The subnet ID must be a unique ID containing only alphanumeric characters, beginning with "subnet-". The ID must be exactly 24 characters long. |
| platform: aws: vpc: subnets: - id: roles: - type: | One or more roles that apply to the subnet specified by platform.aws.vpc.subnets.id. If you specify a role for any subnet, each subnet must have at least one assigned role, and the ClusterNode, IngressControllerLB, ControlPlaneExternalLB, BootstrapNode, and ControlPlaneInternalLB roles must be assigned to at least one subnet. However, if the cluster scope is internal, then the ControlPlaneExternalLB role is not required.You can only assign the EdgeNode role to subnets in AWS Local Zones.Value: List of one or more role types. Valid values include ClusterNode, EdgeNode, BootstrapNode, IngressControllerLB, ControlPlaneExternalLB, and ControlPlaneInternalLB. |