Skip to content

Add DNS resolver and routes to node addition YAML example - #119181

Open
msarage-ux wants to merge 1 commit into
openshift:mainfrom
msarage-ux:fix-node-iso-dns-csr-osdocs-15544
Open

Add DNS resolver and routes to node addition YAML example#119181
msarage-ux wants to merge 1 commit into
openshift:mainfrom
msarage-ux:fix-node-iso-dns-csr-osdocs-15544

Conversation

@msarage-ux

@msarage-ux msarage-ux commented Sep 2, 2026

Copy link
Copy Markdown

Summary

This PR fixes the incomplete nodes-config.yaml example in the node addition guide by adding required DNS resolver and routes configuration, and documents the double CSR approval requirement.

Issue

Fixes: OSDOCS-15544

Problem

The current nodes-config.yaml example in the OCP 4.17 node addition guide is missing critical network configuration:

  1. Missing DNS configuration - No dns-resolver section with DNS server and search domain
  2. Missing routes configuration - No default gateway routes
  3. Unclear CSR approval process - Documentation doesn't mention that CSRs must be approved twice per node

These omissions caused node join failures in production environments. Users following the documentation example would create incomplete network configurations.

Solution

Updated the example YAML configuration to include:

DNS Resolver Configuration

dns-resolver:
  config:
    server:
      - 192.168.122.1
    search:
      - example.com

Routes Configuration

routes:
  config:
    - destination: 0.0.0.0/0
      next-hop-address: 192.168.122.1
      next-hop-interface: eth0

CSR Approval Documentation

Added an IMPORTANT note explaining:

  • Each node requires two CSR approvals
  • First CSR is for the kubelet client certificate
  • Second CSR is for the kubelet serving certificate
  • Both must be approved for successful node addition

Changes

  • modules/adding-node-iso-yaml.adoc:
    • Added dns-resolver section to both worker examples
    • Added routes section to both worker examples
    • Added IMPORTANT admonition block documenting double CSR approval requirement

Impact

  • ✅ Provides complete, working YAML example
  • ✅ Prevents node join failures due to missing DNS configuration
  • ✅ Clarifies CSR approval process
  • ✅ Matches real-world production configurations
  • ✅ Improves user success rate when adding nodes

Testing

  • Documentation-only changes
  • YAML syntax verified
  • AsciiDoc formatting confirmed
  • Based on verified working configuration from field deployment

References

🤖 Generated with Claude Code

Update the nodes-config.yaml example to include DNS resolver and routes
configuration, which are required for successful node addition. Also
document that CSRs must be approved twice during the node addition process.

Changes:
- Added dns-resolver section with server and search configuration
- Added routes section with default gateway configuration
- Added IMPORTANT note about double CSR approval requirement
- Clarified that first CSR is for kubelet client certificate
- Clarified that second CSR is for kubelet serving certificate

The missing DNS configuration was causing node join failures. These
additions ensure users have a complete working example.

Fixes: OSDOCS-15544

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@openshift-ci openshift-ci Bot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 2, 2026
@openshift-ci

openshift-ci Bot commented Sep 2, 2026

Copy link
Copy Markdown

Hi @msarage-ux. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant