OKD - configure chrony

When installing OpenShift or OKD4, all nodes will be using a default chrony config which doesn't necessarily work for all environments, such as firewalled-environments for example.

Here's a quick how-to on how to create a custom /etc/chrony.conf for all nodes in your OpenShift Cluster:

There are some prerequisites however. Butane is required as well as access to the openshift cluster along with administrative permissions.

Start by downloading the 'butane' binary from github:

 [root@helper01 ~]# BUTANE_VERSION='v0.18.0'  
 [root@helper01 ~]# curl -4kLo '/usr/bin/butane' -X GET "https://github.com/coreos/butane/releases/download/${BUTANEVER}/butane-x86_64-unknown-linux-gnu"  
 [root@helper01 ~]# chown root:root /usr/bin/butane  
 [root@helper01 ~]# chmod 755 /usr/bin/butane  

Create the two butane configs, first the master nodes:

 [root@helper01 ~]# cat 99-master-chrony.bu  
 variant: openshift  
 version: 4.13.0  
 metadata:  
   name: 99-master-chrony  
   labels:  
     machineconfiguration.openshift.io/role: master  
 openshift:  
  kernel_arguments:  
    - loglevel=7  
 storage:  
   files:  
     - path: /etc/chrony.conf  
       mode: 0644  
       overwrite: true  
       contents:   
         inline: |  
           # List of Servers to sync with.  
           server ipa01.archyslife.lan minpoll 6 maxpoll 10 iburst trust  
           server ipa02.archyslife.lan minpoll 6 maxpoll 10 iburst trust  
           # Allow the system clock to be stepped in the first three updates.  
           makestep 1.0 3  
           # Enable kernel synchronization of the real-time clock (RTC).  
           rtcsync  
           # Record the rate at which the system clock gains/losses time.  
           driftfile /var/lib/chrony/drift  
           # Save NTS keys and cookies.  
           ntsdumpdir /var/lib/chrony  
           # Custom settings  
           user chrony  
           keyfile /etc/chrony.keys  
           logdir /var/log/chrony  
           log measurements statistics tracking  
           local stratum 10  

Now create the worker butane config:

 [root@helper01 ~]# cat 99-worker-chrony.bu   
 variant: openshift  
 version: 4.13.0  
 metadata:  
   name: 99-worker-chrony  
   labels:  
     machineconfiguration.openshift.io/role: worker  
 openshift:  
   kernel_arguments:  
     - loglevel=7  
 storage:  
   files:  
     - path: /etc/chrony.conf  
       mode: 0644  
       overwrite: true  
       contents:   
         inline: |  
           # List of Servers to sync with.  
           server ipa01.archyslife.lan minpoll 6 maxpoll 10 iburst trust  
           server ipa02.archyslife.lan minpoll 6 maxpoll 10 iburst trust  
           # Allow the system clock to be stepped in the first three updates.  
           makestep 1.0 3  
           # Enable kernel synchronization of the real-time clock (RTC).  
           rtcsync  
           # Record the rate at which the system clock gains/losses time.  
           driftfile /var/lib/chrony/drift  
           # Save NTS keys and cookies.  
           ntsdumpdir /var/lib/chrony  
           # Custom settings  
           user chrony  
           keyfile /etc/chrony.keys  
           logdir /var/log/chrony  
           log measurements statistics tracking  
           local stratum 10  

Convert the butane config files into yaml:

 [root@helper01 ~]# butane -so 99-master-chrony.yaml 99-master-chrony.bu   
 [root@helper01 ~]# butane -so 99-worker-chrony.yaml 99-worker-chrony.bu  

This will result in two yaml files which can be applied to your running cluster using the 'oc' client:

 [root@helper01 ~]# oc apply -f 99-master-chrony.yaml  
 [root@helper01 ~]# oc apply -f 99-worker-chrony.yaml  

After the manifest has been applied, the cluster will perform a rolling restart and the config will be applied, check using these commands:

 [root@helper01 ~]# nodename=master03.okd.archyslife.lan  
 [root@helper01 ~]# oc -n default debug node/${nodename} -- sh -c 'cat /host/etc/chrony.conf' 2> /dev/null  

Feel free to comment and / or suggest a topic.