:_mod-docs-content-type: ASSEMBLY
[id="installing-restricted-networks-gcp"]
= Installing a cluster on GCP in a restricted network with user-provisioned infrastructure
include::_attributes/common-attributes.adoc[]
:context: installing-restricted-networks-gcp

toc::[]

In {product-title} version {product-version}, you can install a cluster on Google Cloud Platform (GCP) that uses infrastructure that you provide and an internal mirror of the installation release content.

[IMPORTANT]
====
While you can install an {product-title} cluster by using mirrored installation release content, your cluster still requires internet access to use the GCP APIs.
====

The steps for performing a user-provided infrastructure install are outlined here. Several link:https://cloud.google.com/deployment-manager/docs[Deployment Manager] templates are provided to assist in completing these steps or to help model your own. You are also free to create the required resources through other methods.

[IMPORTANT]
====
The steps for performing a user-provisioned infrastructure installation are provided as an example only. Installing a cluster with infrastructure you provide requires knowledge of the cloud provider and the installation process of {product-title}. Several Deployment Manager templates are provided to assist in completing these steps or to help model your own. You are also free to create the required resources through other methods; the templates are just an example.
====


== Prerequisites

* You reviewed details about the xref:../../architecture/architecture-installation.adoc#architecture-installation[{product-title} installation and update] processes.
* You read the documentation on xref:../../installing/overview/installing-preparing.adoc#installing-preparing[selecting a cluster installation method and preparing it for users].
* You xref:../../disconnected/mirroring/installing-mirroring-installation-images.adoc#installing-mirroring-installation-images[created a registry on your mirror host] and obtained the `imageContentSources` data for your version of {product-title}.
+
[IMPORTANT]
====
Because the installation media is on the mirror host, you can use that computer to complete all installation steps.
====
* If you use a firewall, you xref:../../installing/install_config/configuring-firewall.adoc#configuring-firewall[configured it to allow the sites] that your cluster requires access to. While you might need to grant access to more sites, you must grant access to `*.googleapis.com` and `accounts.google.com`.
* If the cloud identity and access management (IAM) APIs are not accessible in your environment, or if you do not want to store an administrator-level credential secret in the `kube-system` namespace, you can xref:../../installing/installing_gcp/installing-gcp-customizations.adoc#manually-create-iam_installing-gcp-customizations[manually create and maintain long-term credentials].

include::modules/installation-about-restricted-network.adoc[leveloffset=+1]

include::modules/cluster-entitlements.adoc[leveloffset=+1]

[id="installation-restricted-networks-gcp-user-infra-config-project"]
== Configuring your GCP project

Before you can install {product-title}, you must configure a Google Cloud Platform (GCP) project to host it.

include::modules/installation-gcp-project.adoc[leveloffset=+2]
include::modules/installation-gcp-enabling-api-services.adoc[leveloffset=+2]
include::modules/installation-gcp-dns.adoc[leveloffset=+2]
include::modules/installation-gcp-limits.adoc[leveloffset=+2]
include::modules/installation-gcp-service-account.adoc[leveloffset=+2]
include::modules/installation-gcp-permissions.adoc[leveloffset=+2]
include::modules/minimum-required-permissions-upi-gcp.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources

* xref:../../scalability_and_performance/optimization/optimizing-storage.adoc#optimizing-storage[Optimizing storage]

include::modules/installation-gcp-regions.adoc[leveloffset=+2]
include::modules/installation-gcp-install-cli.adoc[leveloffset=+2]

[id="installation-requirements-user-infra_{context}"]
== Requirements for a cluster with user-provisioned infrastructure

For a cluster that contains user-provisioned infrastructure, you must deploy all
of the required machines.

This section describes the requirements for deploying {product-title} on user-provisioned infrastructure.

include::modules/installation-machine-requirements.adoc[leveloffset=+2]
include::modules/installation-minimum-resource-requirements.adoc[leveloffset=+2]
include::modules/installation-gcp-tested-machine-types.adoc[leveloffset=+2]
include::modules/installation-using-gcp-custom-machine-types.adoc[leveloffset=+2]

include::modules/installation-user-infra-generate.adoc[leveloffset=+1]
include::modules/installation-disk-partitioning-upi-templates.adoc[leveloffset=+2]
include::modules/installation-initializing.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources
* xref:../../installing/installing_gcp/installation-config-parameters-gcp.adoc#installation-config-parameters-gcp[Installation configuration parameters for GCP]

include::modules/installation-gcp-enabling-shielded-vms.adoc[leveloffset=+2]
include::modules/installation-gcp-enabling-confidential-vms.adoc[leveloffset=+2]
include::modules/installation-configure-proxy.adoc[leveloffset=+2]
include::modules/installation-user-infra-generate-k8s-manifest-ignition.adoc[leveloffset=+2]

[role="_additional-resources"]
.Additional resources

* xref:../../installing/installing_gcp/installing-gcp-user-infra.adoc#installation-gcp-user-infra-adding-ingress_installing-gcp-user-infra[Optional: Adding the ingress DNS records]

[id="installation-restricted-networks-gcp-user-infra-exporting-common-variables"]
== Exporting common variables

include::modules/installation-extracting-infraid.adoc[leveloffset=+2]
include::modules/installation-user-infra-exporting-common-variables.adoc[leveloffset=+2]

include::modules/installation-creating-gcp-vpc.adoc[leveloffset=+1]
include::modules/installation-deployment-manager-vpc.adoc[leveloffset=+2]

include::modules/installation-network-user-infra.adoc[leveloffset=+1]

include::modules/installation-creating-gcp-lb.adoc[leveloffset=+1]
include::modules/installation-deployment-manager-ext-lb.adoc[leveloffset=+2]
include::modules/installation-deployment-manager-int-lb.adoc[leveloffset=+2]

include::modules/installation-creating-gcp-private-dns.adoc[leveloffset=+1]
include::modules/installation-deployment-manager-private-dns.adoc[leveloffset=+2]

include::modules/installation-creating-gcp-firewall-rules-vpc.adoc[leveloffset=+1]
include::modules/installation-deployment-manager-firewall-rules.adoc[leveloffset=+2]

include::modules/installation-creating-gcp-iam-shared-vpc.adoc[leveloffset=+1]
include::modules/installation-deployment-manager-iam-shared-vpc.adoc[leveloffset=+2]

include::modules/installation-gcp-user-infra-rhcos.adoc[leveloffset=+1]

include::modules/installation-creating-gcp-bootstrap.adoc[leveloffset=+1]
include::modules/installation-deployment-manager-bootstrap.adoc[leveloffset=+2]

include::modules/installation-creating-gcp-control-plane.adoc[leveloffset=+1]
include::modules/installation-deployment-manager-control-plane.adoc[leveloffset=+2]

include::modules/installation-gcp-user-infra-wait-for-bootstrap.adoc[leveloffset=+1]

include::modules/installation-creating-gcp-worker.adoc[leveloffset=+1]
include::modules/installation-deployment-manager-worker.adoc[leveloffset=+2]

//You install the CLI on the mirror host.

include::modules/cli-logging-in-kubeadmin.adoc[leveloffset=+1]

include::modules/olm-restricted-networks-configuring-operatorhub.adoc[leveloffset=+1]

include::modules/installation-approve-csrs.adoc[leveloffset=+1]

include::modules/installation-gcp-user-infra-adding-ingress.adoc[leveloffset=+1]

include::modules/installation-gcp-user-infra-completing.adoc[leveloffset=+1]

include::modules/cluster-telemetry.adoc[leveloffset=+1]

[role="_additional-resources"]
.Additional resources

* See xref:../../support/remote_health_monitoring/about-remote-health-monitoring.adoc#about-remote-health-monitoring[About remote health monitoring] for more information about the Telemetry service

== Next steps

* xref:../../post_installation_configuration/cluster-tasks.adoc#available_cluster_customizations[Customize your cluster].
* xref:../../post_installation_configuration/cluster-tasks.adoc#post-install-must-gather-disconnected[Configure image streams] for the Cluster Samples Operator and the `must-gather` tool.
* Learn how to xref:../../disconnected/using-olm.adoc#olm-restricted-networks[Use Operator Lifecycle Manager in disconnected environments].
* If the mirror registry that you used to install your cluster has a trusted CA, add it to the cluster by xref:../../openshift_images/image-configuration.adoc#images-configuration-cas_image-configuration[configuring additional trust stores].
* If necessary, you can xref:../../support/remote_health_monitoring/opting-out-of-remote-health-reporting.adoc#opting-out-remote-health-reporting_opting-out-remote-health-reporting[opt out of remote health reporting].
* If necessary, see xref:../../support/remote_health_monitoring/opting-out-of-remote-health-reporting.adoc#insights-operator-register-disconnected-cluster_opting-out-remote-health-reporting[Registering your disconnected cluster]
