Worker nodes of the Hosted Cluster are KubeVirt VMs on the SNO. The control plane runs as pods. The only option for fully virtualised clusters on SNO.
Prerequisites checklist
Confirm these before running steps:
- TC-HCP-001Verify HyperShift Operator and MCE
- PRE-05Install OpenShift Virtualization Operator
- PRE-06Set up LVM Storage Operator — storage for VMs
- PRE-07Pull secret, import golden image, prepare SSH keys
- min. 8 CPU + 16Gi RAM free
- PRE-09Install MetalLB Operator and configure IP pools (3 options)
- TC-MLB-002Expose VM Services via MetalLB (SSH)
- ⚠️ maxPods set to 500 (SNO node) — default limit of 250 is often insufficient (see first step, CAUSES NODE REBOOT)
1⚠️ PREPARATION: Be sure the TC-HCP-001 steps have been completed before starting this test case.
2Use pull secret from PRE-07: ~/pull-secret.json
3Determine release image from running cluster:
RELEASE=$(oc get clusterversion version -o jsonpath='{.status.desired.image}')oc get svc -A | grep $(oc get ipaddresspool external-pool -n metallb-system -o jsonpath='{.spec.addresses[0]}' | cut -d/ -f1)→ if a match appears (e.g. vm-ssh-lb from TC-MLB-002): oc delete svc <name> -n <namespace> before proceeding
4Optional: if a SECOND, separate additional IP is available, apply dedicated hcp-api-pool (block in 'Commands / YAML' tab) — otherwise skip and use external-pool directly below
5Run hcp create cluster kubevirt (full command in Commands / YAML tab)
6Watch worker VMs:
watch oc get vm -n clusters-hc-demo7HostedCluster status:
watch oc get hostedcluster -n clusters8Check etcd pods for verification — with correct SingleReplica configuration, ONLY 1 etcd pod must exist (not 3 with 2 stuck Pending)
oc get pods -n clusters-hc-demo -l app=etcd9Wait until Status: Available (10–20 minutes!)
10Optional: Wait for kube-apiserver Service and patch to the correct pool — the Service is already type=LoadBalancer, only the pool annotation needs to be set
oc get svc kube-apiserver -n clusters-hc-demo -woc patch svc kube-apiserver -n clusters-hc-demo --type=merge -p '{"metadata":{"annotations":{"metallb.io/address-pool":"external-pool"}},"spec":{"loadBalancerIP":null}}'This is only required if you want to use a different pool. For now the external-pool with its one free IP was used by default
→ EXTERNAL-IP must match the reserved pool IP (not <pending>, not internal-pool)
11Create DNS entry or local /etc/hosts entry for the API name (e.g. hc-demo-api.local)
echo '<pool-ip> hc-demo-api.local' | sudo tee -a /etc/hosts
12Retrieve and test kubeconfig
hcp create kubeconfig --namespace clusters --name hc-demo > hc-demo.kubeconfigkubectl --kubeconfig hc-demo.kubeconfig get nodes
→ Hosted Cluster node list appears directly from the laptop, no Ingress/port-forward required
13Reach Hosted Cluster web console
oc --kubeconfig hc-demo.kubeconfig get routes -n openshift-console→ URL pattern: console-openshift-console.apps.hc-demo.apps.<cluster-domain>
⚠️ In this default mode, ONLY HTTPS (443) works; port 80 is deliberately blocked by HyperShift
14Perform some basic tests:
export KUBECONFIG=hc-demo.kubeconfigoc new-project testoc new-app nginxsleep 10oc get pods -n test→ nginx pod should be Running
15Check IP stability after MetalLB speaker restart (important for production!)
oc delete pod -n metallb-system -l component=speakeroc get svc kube-apiserver -n clusters-hc-demo→ EXTERNAL-IP must remain the same, kubectl access must continue to work