<p>I try to run OKD on my desktop (Ubuntu 18). I follow instruction: <a href="https://opensource.com/article/18/11/local-okd-cluster-linux" rel="nofollow noreferrer">https://opensource.com/article/18/11/local-okd-cluster-linux</a> (<a href="https://www.techrepublic.com/article/how-to-install-openshift-origin-on-ubuntu-18-04/" rel="nofollow noreferrer">similar</a>).</p>
<ol>
<li>I have Docker installed:</li>
</ol>
<pre><code>$ docker version
...
 Version:           19.03.12
</code></pre>
<ol start="2">
<li>Insecured registry:</li>
</ol>
<pre><code>$ sudo cat /etc/docker/daemon.json
{
    &quot;insecure-registries&quot; : [ &quot;172.30.0.0/16&quot; ]
}
</code></pre>
<ol start="3">
<li>Restarted Docker deamon:</li>
</ol>
<pre><code>$ docker info
...
Insecure Registries:
  172.30.0.0/16
  127.0.0.0/8
</code></pre>
<ol start="4">
<li>Disabled firewall:</li>
</ol>
<pre><code>$ sudo ufw status
Status: inactive
</code></pre>
<ol start="5">
<li>Downloaded OKD client tools:</li>
</ol>
<p><code>oc</code> and <code>kubectl</code> from <a href="https://github.com/openshift/origin/releases/download/v3.11.0/openshift-origin-client-tools-v3.11.0-0cbc58b-linux-64bit.tar.gz" rel="nofollow noreferrer">https://github.com/openshift/origin/releases/download/v3.11.0/openshift-origin-client-tools-v3.11.0-0cbc58b-linux-64bit.tar.gz</a></p>
<pre><code>$ ./oc version
oc v3.11.0+0cbc58b
kubernetes v1.11.0+d4cacc0
features: Basic-Auth GSSAPI Kerberos SPNEGO
</code></pre>
<ol start="6">
<li>I try to start cluster but it fails.</li>
</ol>
<pre><code>$ ./oc cluster up
Getting a Docker client ...
Checking if image openshift/origin-control-plane:v3.11 is available ...
Creating shared mount directory on the remote host ...
Determining server IP ...
Checking if OpenShift is already running ...
Checking for supported Docker version (=&gt;1.22) ...
Checking if insecured registry is configured properly in Docker ...
Checking if required ports are available ...
Checking if OpenShift client is configured properly ...
Checking if image openshift/origin-control-plane:v3.11 is available ...
Starting OpenShift using openshift/origin-control-plane:v3.11 ...
I1104 16:54:53.631254    6317 config.go:40] Running &quot;create-master-config&quot;
I1104 16:54:56.048019    6317 config.go:46] Running &quot;create-node-config&quot;
I1104 16:54:57.639381    6317 flags.go:30] Running &quot;create-kubelet-flags&quot;
I1104 16:54:58.559780    6317 run_kubelet.go:49] Running &quot;start-kubelet&quot;
I1104 16:54:58.862023    6317 run_self_hosted.go:181] Waiting for the kube-apiserver to be ready ...
</code></pre>
<p>Long waiting and after that:</p>
<pre><code>E1104 16:59:58.864017    6317 run_self_hosted.go:571] API server error: Get https://127.0.0.1:8443/healthz?timeout=32s: dial tcp 127.0.0.1:8443: connect: connection refused ()
Error: timed out waiting for the condition
</code></pre>
<hr />
<p>With higher logging level (I know that I have to remove <code>openshift.local.clusterup</code> directory or pass <code>--base-dir</code> when I want to fresh <code>oc cluster up</code>):</p>
<pre><code>$ ./oc cluster up --loglevel=5
...
I1104 17:07:50.991364   14512 run_self_hosted.go:181] Waiting for the kube-apiserver to be ready 
I1104 17:07:50.992053   14512 run_self_hosted.go:557] Server isn't healthy yet.  Waiting a little while. Get https://127.0.0.1:8443/healthz?timeout=32s: dial tcp 127.0.0.1:8443: connect: connection refused
I1104 17:07:51.992467   14512 run_self_hosted.go:557] Server isn't healthy yet.  Waiting a little while. Get https://127.0.0.1:8443/healthz?timeout=32s: dial tcp 127.0.0.1:8443: connect: connection refused
I1104 17:07:52.993484   14512 run_self_hosted.go:557] Server isn't healthy yet.  Waiting a little while. Get https://127.0.0.1:8443/healthz?timeout=32s: dial tcp 127.0.0.1:8443: connect: connection refused
...
I1104 17:08:10.992682   14512 run_self_hosted.go:557] Server isn't healthy yet.  Waiting a little while. Get https://127.0.0.1:8443/healthz?timeout=32s: net/http: TLS handshake timeout
...
error: unable to recognize &quot;/namespace.yaml&quot;: Get https://127.0.0.1:8443/api?timeout=32s: dial tcp 127.0.0.1:8443: connect: connection refused
...
The connection to the server 127.0.0.1:8443 was refused - did you specify the right host or port?
...
E1104 17:08:52.435348   14512 interface.go:34] Failed to install &quot;openshift-service-cert-signer-operator&quot;: failed to install &quot;openshift-service-cert-signer-operator&quot;: cannot create container using image openshift/origin-cli:v3.11; caused by: cannot create container using image openshift/origin-cli:v3.11
E1104 17:08:53.087022   14512 interface.go:34] Failed to install &quot;kube-dns&quot;: failed to install &quot;kube-dns&quot;: cannot create container using image openshift/origin-cli:v3.11; caused by: cannot create container using image openshift/origin-cli:v3.11
I1104 17:08:53.087047   14512 interface.go:41] Finished installing &quot;kube-proxy&quot; &quot;kube-dns&quot; &quot;openshift-service-cert-signer-operator&quot; &quot;openshift-apiserver&quot;
Error: [failed to install &quot;kube-proxy&quot;: cannot create container using image openshift/origin-cli:v3.11; caused by: cannot create container using image openshift/origin-cli:v3.11, failed to install &quot;openshift-apiserver&quot;: cannot create container using image openshift/origin-cli:v3.11; caused by: cannot create container using image openshift/origin-cli:v3.11, failed to install &quot;openshift-service-cert-signer-operator&quot;: cannot create container using image openshift/origin-cli:v3.11; caused by: cannot create container using image openshift/origin-cli:v3.11, failed to install &quot;kube-dns&quot;: cannot create container using image openshift/origin-cli:v3.11; caused by: cannot create container using image openshift/origin-cli:v3.11]
</code></pre>
<hr />
<p>I try to check what is wrong and I notice there is issue with missing configuration.</p>
<pre><code>$ ./oc cluster status
Error: invalid configuration: Missing or incomplete configuration info.  Please login or point to an existing, complete config file:

  1. Via the command-line flag --config
  2. Via the KUBECONFIG environment variable
  3. In your home directory as ~/.kube/config

To view or setup config directly use the 'config' command.
</code></pre>
<p>I don't have environment variable:</p>
<pre><code>$ echo $KUBECONFIG

</code></pre>
<p>And I don't have <code>~/.kube/config</code> file:</p>
<pre><code>$ cat ~/.kube/config
cat: /home/my-username/.kube/config: No such file or directory
$ ls ~/.kube/
ls: cannot access '/home/my-username/.kube/': No such file or directory
</code></pre>
<p>I know that <code>oc cluster up</code> should create <code>~/.kube/config</code>. <strong>But in my case, it doesn't create.</strong></p>
<hr />
<p>Even <code>kubectl</code> doesn't work due to missing configuration (I think it should work with typical kubectl installation from binary <a href="https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl-binary-with-curl-on-linux" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl-binary-with-curl-on-linux</a>):</p>
<pre><code>$ ./kubectl version --client
error: no configuration has been provided
</code></pre>
<pre><code>$ ./kubectl config view
apiVersion: v1
clusters: []
contexts: []
current-context: &quot;&quot;
kind: Config
preferences: {}
users: []
</code></pre>

mkczyk
<p>I resolved the issue.</p>
<p>I have Ubuntu with disabled firewall (ufw). But iptables still works.</p>
<p>Command <code>sudo iptables -L</code> shows me many rules which those four:</p>
<pre><code>Chain KUBE-SERVICES (1 references)
target     prot opt source               destination         
REJECT     tcp  --  anywhere             172.30.237.36        /* default/router:80-tcp has no endpoints */ tcp dpt:http reject-with icmp-port-unreachable
REJECT     tcp  --  anywhere             172.30.1.1           /* default/docker-registry:5000-tcp has no endpoints */ tcp dpt:5000 reject-with icmp-port-unreachable
REJECT     tcp  --  anywhere             172.30.237.36        /* default/router:443-tcp has no endpoints */ tcp dpt:https reject-with icmp-port-unreachable
REJECT     tcp  --  anywhere             172.30.237.36        /* default/router:1936-tcp has no endpoints */ tcp dpt:1936 reject-with icmp-port-unreachable
</code></pre>
<p>I don't know where they come from (I can guess - below). I decited to delete it.</p>
<pre><code>sudo iptables -L --line-numbers
sudo iptables -D KUBE-SERVICES 1
sudo iptables -D KUBE-SERVICES 1
sudo iptables -D KUBE-SERVICES 1
sudo iptables -D KUBE-SERVICES 1
</code></pre>
<p>And restart system (for sure that iptables is reloaded).</p>
<p>After <code>./oc cluster up</code> it starts and <code>~/.kube/config</code> is created.</p>
<pre><code>Server Information ...
OpenShift server started.

The server is accessible via web console at:
    https://127.0.0.1:8443
</code></pre>
<hr />
<p>I guess rules can come from <code>oc cluster up</code> when I run it once at beginning without adding  <code>&quot;insecure-registries&quot; : [ &quot;172.30.0.0/16&quot; ]</code> to <code>/etc/docker/daemon.json</code> (I tried to check if this is mandatory)</p>
