Adding compute machines to AWS by using CloudFormation templates

• You installed your cluster on AWS by using the provided AWS CloudFormation templates.

• You have the JSON file and CloudFormation template that you used to create the compute machines during cluster installation. If you do not have these files, you must recreate them by following the instructions in the .

You can add more compute machines to your OKD cluster on Amazon Web Services (AWS) that you created by using the sample CloudFormation templates.

Prerequisites

• You installed an OKD cluster by using CloudFormation templates and have access to the JSON file and CloudFormation template that you used to create the compute machines during cluster installation.

• You installed the AWS CLI.

Procedure

1. Create another compute stack.

   1. Launch the template:

      1	is the name for the CloudFormation stack, such as cluster-workers. You must provide the name of this stack if you remove the cluster.
      2	<template> is the relative path to and name of the CloudFormation template YAML file that you saved.
      3	<parameters> is the relative path to and name of the CloudFormation parameters JSON file.

   2. Confirm that the template components exist:

      $ aws cloudformation describe-stacks --stack-name <name>

When you add machines to a cluster, two pending certificate signing requests (CSRs) are generated for each machine that you added. You must confirm that these CSRs are approved or, if necessary, approve them yourself. The client requests must be approved first, followed by the server requests.

Prerequisites

• You added machines to your cluster.

Procedure

1. Confirm that the cluster recognizes the machines:

   $ oc get nodes

   Example output

   master-0  Ready     master  63m  v1.21.0
   master-1  Ready     master  63m  v1.21.0
   master-2  Ready     master  64m  v1.21.0

   The output lists all of the machines that you created.

2. Review the pending CSRs and ensure that you see the client requests with the Pending or Approved status for each machine that you added to the cluster:

   Example output

   NAME        AGE     REQUESTOR                                                                   CONDITION
   csr-8b2br   15m     system:serviceaccount:openshift-machine-config-operator:node-bootstrapper   Pending
   ...

   In this example, two machines are joining the cluster. You might see more approved CSRs in the list.

3. If the CSRs were not approved, after all of the pending CSRs for the machines you added are in Pending status, approve the CSRs for your cluster machines:

   Because the CSRs rotate automatically, approve your CSRs within an hour of adding the machines to the cluster. If you do not approve them within an hour, the certificates will rotate, and more than two certificates will be present for each node. You must approve all of these certificates. After the client CSR is approved, the Kubelet creates a secondary CSR for the serving certificate, which requires manual approval. Then, subsequent serving certificate renewal requests are automatically approved by the machine-approver if the Kubelet requests a new certificate with identical parameters.

   • To approve them individually, run the following command for each valid CSR:

     $ oc adm certificate approve <csr_name> (1)

   • To approve all pending CSRs, run the following command:

     $ oc get csr -o go-template='{{range .items}}{{if not .status}}{{.metadata.name}}{{"\n"}}{{end}}{{end}}' | xargs --no-run-if-empty oc adm certificate approve

     Some Operators might not become available until some CSRs are approved.

4. Now that your client requests are approved, you must review the server requests for each machine that you added to the cluster:

   Example output

   NAME        AGE     REQUESTOR                                                                   CONDITION
   csr-c57lv   5m26s   system:node:ip-10-0-95-157.us-east-2.compute.internal                       Pending
   ...

5. If the remaining CSRs are not approved, and are in the Pending status, approve the CSRs for your cluster machines:

   • To approve them individually, run the following command for each valid CSR:

     $ oc adm certificate approve <csr_name> (1)

     1	<csr_name> is the name of a CSR from the list of current CSRs.

   • To approve all pending CSRs, run the following command:

     $ oc get csr -o go-template='{{range .items}}{{if not .status}}{{.metadata.name}}{{"\n"}}{{end}}{{end}}' | xargs oc adm certificate approve

6. After all client and server CSRs have been approved, the machines have the Ready status. Verify this by running the following command:

   Example output

   NAME      STATUS    ROLES   AGE  VERSION
   master-0  Ready     master  73m  v1.21.0
   master-1  Ready     master  73m  v1.21.0
   master-2  Ready     master  74m  v1.21.0
   worker-0  Ready     worker  11m  v1.21.0
   worker-1  Ready     worker  11m  v1.21.0

Additional information

• For more information on CSRs, see Certificate Signing Requests.