References

KCS 7104022

External clients on an OpenShift Route must use TLS (SNI). That is why students produce with amqps:// on the SNO AMQPS Route, not in-cluster amqp:// on the hub-colocated spoke-* service.

Connecting to the broker from outside OpenShift (AMQ Broker 7.14)

Product documentation for exposed acceptors, Routes, and client URLs (amqps://, not https://).

KCS 7107078

You cannot mix plain and TLS traffic on one acceptor. Hub-01 keeps in-cluster AMQP on port 5672 and adds a second AMQPS acceptor (port 5671, expose: true) for SNO federation.

Configuring acceptors (AMQ Broker 7.14)

How Operator-based ActiveMQArtemis acceptors, sslEnabled, sslSecret, and expose work.

KCS 7131244

AMQ acceptors cannot use edge termination. The hub AMQPS Route is passthrough.

KCS 6706441

AMQP clients that follow broker topology through an OpenShift Route can land on the wrong host. Federation and producer URLs set useTopologyForLoadBalancing=false.

Bridging brokers (AMQ Broker 7.14)

Address federation and AMQP bridges (AMQPConnections.* in brokerProperties) are how each SNO broker forwards regional addresses such as messages.NY.test to hub-01 and pulls messages.ALL from the hub.

Securing brokers — LDAP integration (AMQ Broker 7.14)

The lab uses Keycloak OIDC via DirectAccessGrantsLoginModule for convenience. Production deployments with Active Directory or LDAP can replace this with LDAPLoginModule in the same JAAS login.config chain — no Keycloak required. The AMQ 7.14 docs include a Microsoft Active Directory example.

Preparing to install SNO (OCP 4.22)

Bare-metal minimum requirements (8 vCPU / 16 GB / 120 GB), BMC requirements, and supported CPU architectures. The lab uses GCP n2-standard-8 — this page shows the equivalent on-premises floor.

Assisted Installer for OCP

On-premises SNO provisioning via USB, Redfish virtual media, or iPXE. The bare-metal alternative to the Hive-on-GCP provisioning used in this lab.

Cluster sizing and performance (ACM 2.17)

Hub sizing formulas and 3,500-cluster scale test results. Answers "does this scale beyond 3 clusters?" — see Scale and Production Considerations for a summary.

Multicluster Global Hub (ACM 2.15)

Fleet-of-fleets architecture for >2,000 clusters. Explains when Mode 2 (regional hubs managed by a global hub) is required.

Troubleshooting Klusterlet degraded conditions (ACM 2.16)

Klusterlet behavior when the hub is unreachable. Existing workloads continue running; policies already applied remain enforced. Answers "what happens during WAN loss?" — see Module 6 for the simulation.

MCO Observability (ACM 2.17)

Multicluster Observability (Thanos + Grafana) aggregates Prometheus metrics from managed clusters. The observability-metrics-custom-allowlist ConfigMap controls which custom metrics are collected, preventing cardinality explosion at fleet scale.

PolicyGenerator reference (ACM 2.17)

Kustomize-based policy generation for fleet-scale deployments. Eliminates per-site policy definitions using fromClusterClaim hub-side templating. See PolicyGenerator at Scale for a walkthrough of the scaffold in this repo.

Hub-side templating (ACM 2.17)

{{ fromClusterClaim }} and {{ fromConfigMap }} syntax for injecting per-cluster values into policy templates without maintaining a static site list.

Governance (ACM 2.17)

Policies, placements, and compliance are how AMQ is installed on JOINED SNOs (edge-broker-policies).

Policy deployment (ACM 2.17)

ConfigurationPolicy mustonlyhave / musthave and enforce remediation. Do not bind ztp-policies to create ApplicationSet children on the SNOs.