Generate install-config.yaml and agent-config.yaml for a compact,
user-provisioned OpenShift cluster.
Use this guide to decide the best OpenShift installation path before filling full cluster details.
Start from which infrastructure you have and how you want to install; then narrow to IPI/UPI, agent-based or assisted, and whether you are disconnected.
Cloud Orchestrated (e.g. ROSA, OSD on AWS/Azure/GCP) or bring-your-own cloud.
On-prem Bare metal or virtualized (VMware, Nutanix, KVM, Hyper-V).
Assisted (e.g. console.redhat.com, no dedicated bootstrap), local/agent-based, full control (UPI), or installer-provisioned (IPI).
Disconnected installs use a mirror registry (no direct internet from the cluster).
User-provisioned: you provide hardware or VMs (physical or virtual). You manage networking, DNS, load balancers, and node lifecycle.
Installer-provisioned: installer creates machines on supported cloud or virtualization (with credentials and permissions). Needs access to the virtual environment.
If you are new to OpenShift, review this checklist before you run the installer. Choose the scenario that best matches your environment.
For full details and supported topologies, refer to the official OpenShift bare metal and virtualization install documentation.
Sensitive value: you can add or update this later in generated install-config.yaml.
Sensitive value: you can add or update this later in generated install-config.yaml.
Use this page to sketch concrete DNS, VIP, and firewall values for your environment. Examples are dummy values — replace them with your own.
| Name | Type | Value | Purpose |
|---|---|---|---|
| api.ocp4.lab.example.com | A | 192.168.50.5 | API VIP (port 6443) |
| api-int.ocp4.lab.example.com | A | 192.168.50.5 | Internal API / machine config (22623) |
| *.apps.ocp4.lab.example.com | Wildcard | 192.168.50.6 | Ingress VIP (80/443) |
| master-0.ocp4.lab.example.com | A | 192.168.50.10 | Control plane node 1 |
| master-1.ocp4.lab.example.com | A | 192.168.50.11 | Control plane node 2 |
| master-2.ocp4.lab.example.com | A | 192.168.50.12 | Control plane node 3 |
| worker-0.ocp4.lab.example.com | A | 192.168.50.20 | Worker node 1 |
| worker-1.ocp4.lab.example.com | A | 192.168.50.21 | Worker node 2 |
| LB FQDN | VIP | Ports | Backends (example nodes) |
|---|---|---|---|
| api.ocp4.lab.example.com | 192.168.50.5 | 6443 | master-0, master-1, master-2 |
| api-int.ocp4.lab.example.com | 192.168.50.5 | 22623 | master-0, master-1, master-2 |
| *.apps.ocp4.lab.example.com | 192.168.50.6 | 80, 443 | worker-0, worker-1 |
| Source | Destination | Port/Protocol | Reason |
|---|---|---|---|
| Admins / automation | api.ocp4.lab.example.com | 6443/TCP | Kubernetes API access |
| Cluster nodes | api-int.ocp4.lab.example.com | 22623/TCP | Machine config server |
| Users / browsers | *.apps.ocp4.lab.example.com | 80,443/TCP | App and console ingress |
In a lab, the bastion VM often provides DNS, NTP, HTTPD, proxy, and HAProxy VIPs. These examples assume a single vSphere or KVM environment.
| Name | Type | Value | Purpose |
|---|---|---|---|
| api.ocp4.lab.example.com | A | 192.168.50.5 | API VIP on bastion HAProxy |
| api-int.ocp4.lab.example.com | A | 192.168.50.5 | Internal API / machine config |
| *.apps.ocp4.lab.example.com | Wildcard | 192.168.50.6 | Ingress VIP on bastion HAProxy |
| master-0.ocp4.lab.example.com | A | 192.168.50.10 | Control plane node 1 |
| master-1.ocp4.lab.example.com | A | 192.168.50.11 | Control plane node 2 |
| master-2.ocp4.lab.example.com | A | 192.168.50.12 | Control plane node 3 |
| worker-0.ocp4.lab.example.com | A | 192.168.50.20 | Worker node 1 |
| worker-1.ocp4.lab.example.com | A | 192.168.50.21 | Worker node 2 |
| LB FQDN | VIP | Ports | Backends (example nodes) |
|---|---|---|---|
| api.ocp4.lab.example.com | 192.168.50.5 | 6443 | master-0, master-1, master-2 |
| api-int.ocp4.lab.example.com | 192.168.50.5 | 22623 | master-0, master-1, master-2 |
| *.apps.ocp4.lab.example.com | 192.168.50.6 | 80, 443 | worker-0, worker-1 |
| Source | Destination | Port/Protocol | Reason |
|---|---|---|---|
| Bastion / admin host | api.ocp4.lab.example.com | 6443/TCP | Install and `oc` API connectivity |
| Nodes | api-int.ocp4.lab.example.com | 22623/TCP | Machine config during bootstrapping |
| Workstation users | *.apps.ocp4.lab.example.com | 80,443/TCP | Console and application ingress |
These examples are for learning labs only. For supported configurations and full port lists, always refer to the official OpenShift installation and firewall documentation.
Enter only the fields for your selected platform.
Bare Metal (none) has no platform-specific settings in this step.
vSphere and Nutanix
AWS and Azure
For a compact cluster, define three master hosts and zero workers.
| Hostname | Role | IP | MAC | Primary NIC | Bond? | Secondary NIC | Secondary MAC | Static IP? | Gateway | DNS servers (comma) |
|---|
Required for agent-based installs. Optional for UPI/IPI.
Compact cluster, bare metal / agent-based
After generating YAML:
install-config.yaml and (if present) agent-config.yaml to a working directory.imageContentSources, additionalTrustBundle, and
operator-mirror-config.yaml with oc-mirror /
oc adm release mirror to mirror content to your internal registry.
openshift-install agent create image --dir . in that directory to
create a discovery ISO.
Copy these commands and run them on your jump host / workstation as indicated.