diff --git a/cmd/openshift-install/create.go b/cmd/openshift-install/create.go
index c5c035e72..e44a4d03e 100644
--- a/cmd/openshift-install/create.go
+++ b/cmd/openshift-install/create.go
@@ -252,7 +252,7 @@ func waitForBootstrapComplete(ctx context.Context, config *rest.Config, director
 
 	discovery := client.Discovery()
 
-	apiTimeout := 30 * time.Minute
+	apiTimeout := 120 * time.Minute
 	logrus.Infof("Waiting up to %v for the Kubernetes API at %s...", apiTimeout, config.Host)
 	apiContext, cancel := context.WithTimeout(ctx, apiTimeout)
 	defer cancel()
@@ -293,7 +293,7 @@ func waitForBootstrapComplete(ctx context.Context, config *rest.Config, director
 // and waits for the bootstrap configmap to report that bootstrapping has
 // completed.
 func waitForBootstrapConfigMap(ctx context.Context, client *kubernetes.Clientset) error {
-	timeout := 30 * time.Minute
+	timeout := 120 * time.Minute
 	logrus.Infof("Waiting up to %v for bootstrapping to complete...", timeout)
 
 	waitCtx, cancel := context.WithTimeout(ctx, timeout)
@@ -331,7 +331,7 @@ func waitForBootstrapConfigMap(ctx context.Context, client *kubernetes.Clientset
 // waitForInitializedCluster watches the ClusterVersion waiting for confirmation
 // that the cluster has been initialized.
 func waitForInitializedCluster(ctx context.Context, config *rest.Config) error {
-	timeout := 30 * time.Minute
+	timeout := 120 * time.Minute
 
 	// Wait longer for baremetal, due to length of time it takes to boot
 	if assetStore, err := assetstore.NewStore(rootOpts.dir); err == nil {
diff --git a/data/data/libvirt/main.tf b/data/data/libvirt/main.tf
index 9ba88c9cf..09f6500bf 100644
--- a/data/data/libvirt/main.tf
+++ b/data/data/libvirt/main.tf
@@ -33,6 +33,7 @@ resource "libvirt_volume" "master" {
   name           = "${var.cluster_id}-master-${count.index}"
   base_volume_id = module.volume.coreos_base_volume_id
   pool           = libvirt_pool.storage_pool.name
+  size           = 32212254720
 }
 
 resource "libvirt_ignition" "master" {
@@ -73,6 +74,8 @@ resource "libvirt_network" "net" {
         data.libvirt_network_dns_host_template.masters.*.rendered,
         data.libvirt_network_dns_host_template.masters_int.*.rendered,
         data.libvirt_network_dns_host_template.etcds.*.rendered,
+        data.libvirt_network_dns_host_template.console.*.rendered,
+        data.libvirt_network_dns_host_template.auth.*.rendered,
       )
       content {
         hostname = hosts.value.hostname
@@ -114,6 +117,19 @@ resource "libvirt_domain" "master" {
   }
 }
 
+data "libvirt_network_dns_host_template" "auth" {
+  count    = "${var.master_count}"
+  ip       = "${var.libvirt_auth_ip}"
+  hostname = "oauth-openshift.apps.${var.cluster_domain}"
+}
+
+data "libvirt_network_dns_host_template" "console" {
+  count    = "${var.master_count}"
+  ip       = "${var.libvirt_auth_ip}"
+  hostname = "console-openshift-console.apps.${var.cluster_domain}"
+}
+
+
 data "libvirt_network_dns_host_template" "bootstrap" {
   count    = var.bootstrap_dns ? 1 : 0
   ip       = var.libvirt_bootstrap_ip
diff --git a/data/data/libvirt/variables-libvirt.tf b/data/data/libvirt/variables-libvirt.tf
index 53cf68bae..3c5f7f905 100644
--- a/data/data/libvirt/variables-libvirt.tf
+++ b/data/data/libvirt/variables-libvirt.tf
@@ -28,6 +28,11 @@ variable "libvirt_master_ips" {
   description = "the list of desired master ips. Must match master_count"
 }
 
+variable "libvirt_auth_ip" {
+  type        = "string"
+  description = "node with authentication server ip"
+}
+
 # It's definitely recommended to bump this if you can.
 variable "libvirt_master_memory" {
   type        = string
diff --git a/pkg/asset/tls/aggregator.go b/pkg/asset/tls/aggregator.go
index 9ec6432da..6dac0b736 100644
--- a/pkg/asset/tls/aggregator.go
+++ b/pkg/asset/tls/aggregator.go
@@ -27,7 +27,7 @@ func (a *AggregatorCA) Generate(dependencies asset.Parents) error {
 	cfg := &CertCfg{
 		Subject:   pkix.Name{CommonName: "aggregator", OrganizationalUnit: []string{"bootkube"}},
 		KeyUsages: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
-		Validity:  ValidityOneDay,
+		Validity:  ValidityOneYear,
 		IsCA:      true,
 	}
 
@@ -65,7 +65,7 @@ func (a *APIServerProxyCertKey) Generate(dependencies asset.Parents) error {
 		Subject:      pkix.Name{CommonName: "system:kube-apiserver-proxy", Organization: []string{"kube-master"}},
 		KeyUsages:    x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
 		ExtKeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
-		Validity:     ValidityOneDay,
+		Validity:     ValidityOneYear,
 	}
 
 	return a.SignedCertKey.Generate(cfg, aggregatorCA, "apiserver-proxy", DoNotAppendParent)
@@ -93,7 +93,7 @@ func (c *AggregatorSignerCertKey) Generate(parents asset.Parents) error {
 	cfg := &CertCfg{
 		Subject:   pkix.Name{CommonName: "aggregator-signer", OrganizationalUnit: []string{"openshift"}},
 		KeyUsages: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
-		Validity:  ValidityOneDay,
+		Validity:  ValidityOneYear,
 		IsCA:      true,
 	}
 
@@ -158,7 +158,7 @@ func (a *AggregatorClientCertKey) Generate(dependencies asset.Parents) error {
 		Subject:      pkix.Name{CommonName: "system:kube-apiserver-proxy", Organization: []string{"kube-master"}},
 		KeyUsages:    x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
 		ExtKeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
-		Validity:     ValidityOneDay,
+		Validity:     ValidityOneYear,
 	}
 
 	return a.SignedCertKey.Generate(cfg, ca, "aggregator-client", DoNotAppendParent)
diff --git a/pkg/asset/tls/apiserver.go b/pkg/asset/tls/apiserver.go
index a50bee836..cd63ff13c 100644
--- a/pkg/asset/tls/apiserver.go
+++ b/pkg/asset/tls/apiserver.go
@@ -185,7 +185,7 @@ func (a *KubeAPIServerLocalhostServerCertKey) Generate(dependencies asset.Parent
 		Subject:      pkix.Name{CommonName: "system:kube-apiserver", Organization: []string{"kube-master"}},
 		KeyUsages:    x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
 		ExtKeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-		Validity:     ValidityOneDay,
+		Validity:     ValidityOneYear,
 		DNSNames: []string{
 			"localhost",
 		},
@@ -288,7 +288,7 @@ func (a *KubeAPIServerServiceNetworkServerCertKey) Generate(dependencies asset.P
 		Subject:      pkix.Name{CommonName: "system:kube-apiserver", Organization: []string{"kube-master"}},
 		KeyUsages:    x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
 		ExtKeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-		Validity:     ValidityOneDay,
+		Validity:     ValidityOneYear,
 		DNSNames: []string{
 			"kubernetes", "kubernetes.default",
 			"kubernetes.default.svc",
@@ -392,7 +392,7 @@ func (a *KubeAPIServerExternalLBServerCertKey) Generate(dependencies asset.Paren
 		Subject:      pkix.Name{CommonName: "system:kube-apiserver", Organization: []string{"kube-master"}},
 		KeyUsages:    x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
 		ExtKeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-		Validity:     ValidityOneDay,
+		Validity:     ValidityOneYear,
 		DNSNames: []string{
 			apiAddress(installConfig.Config),
 		},
@@ -431,7 +431,7 @@ func (a *KubeAPIServerInternalLBServerCertKey) Generate(dependencies asset.Paren
 		Subject:      pkix.Name{CommonName: "system:kube-apiserver", Organization: []string{"kube-master"}},
 		KeyUsages:    x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
 		ExtKeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-		Validity:     ValidityOneDay,
+		Validity:     ValidityOneYear,
 		DNSNames: []string{
 			internalAPIAddress(installConfig.Config),
 		},
diff --git a/pkg/asset/tls/kubelet.go b/pkg/asset/tls/kubelet.go
index 01264e898..32cc8059d 100644
--- a/pkg/asset/tls/kubelet.go
+++ b/pkg/asset/tls/kubelet.go
@@ -24,7 +24,7 @@ func (c *KubeletCSRSignerCertKey) Generate(parents asset.Parents) error {
 	cfg := &CertCfg{
 		Subject:   pkix.Name{CommonName: "kubelet-signer", OrganizationalUnit: []string{"openshift"}},
 		KeyUsages: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
-		Validity:  ValidityOneDay,
+		Validity:  ValidityOneYear,
 		IsCA:      true,
 	}
 
@@ -181,7 +181,7 @@ func (a *KubeletClientCertKey) Generate(dependencies asset.Parents) error {
 		Subject:      pkix.Name{CommonName: "system:serviceaccount:openshift-machine-config-operator:node-bootstrapper", Organization: []string{"system:serviceaccounts:openshift-machine-config-operator"}},
 		KeyUsages:    x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
 		ExtKeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
-		Validity:     ValidityOneDay,
+		Validity:     ValidityOneYear,
 	}
 
 	return a.SignedCertKey.Generate(cfg, ca, "kubelet-client", DoNotAppendParent)
diff --git a/pkg/tfvars/libvirt/libvirt.go b/pkg/tfvars/libvirt/libvirt.go
index e4e5e4927..43bcdc8a2 100644
--- a/pkg/tfvars/libvirt/libvirt.go
+++ b/pkg/tfvars/libvirt/libvirt.go
@@ -21,6 +21,7 @@ type config struct {
 	BootstrapIP  string   `json:"libvirt_bootstrap_ip,omitempty"`
 	MasterMemory string   `json:"libvirt_master_memory,omitempty"`
 	MasterVcpu   string   `json:"libvirt_master_vcpu,omitempty"`
+	AuthNodeIP   string   `json:"libvirt_auth_ip,omitempty"`
 }
 
 // TFVars generates libvirt-specific Terraform variables.
@@ -46,6 +47,7 @@ func TFVars(masterConfig *v1beta1.LibvirtMachineProviderConfig, osImage string,
 		IfName:       bridge,
 		BootstrapIP:  bootstrapIP.String(),
 		MasterIPs:    masterIPs,
+		AuthNodeIP:   "192.168.126.51",
 		MasterMemory: strconv.Itoa(masterConfig.DomainMemory),
 		MasterVcpu:   strconv.Itoa(masterConfig.DomainVcpu),
 	}
