|
1 | | - |
2 | | -// Module included in the following assemblies: |
3 | | -// |
4 | | -// * rosa_planning/rosa-sts-aws-prereqs.html |
5 | | - |
6 | | - |
7 | | -:_content-type: PROCEDURE |
8 | | -[id="rosa-mobb-prereq-checklist_{context}"] |
9 | | -= Prerequisites checklist to deploy a ROSA classic cluster |
10 | | - |
11 | | -//Mobb content metadata |
12 | | -//Brought into ROSA product docs 2023-09-15; does not follow typical OpenShift documentation formatting |
13 | | -//--- |
14 | | -//date: '2023-07-27' |
15 | | -//title: Prerequisites Checklist to Deploy ROSA Cluster with STS |
16 | | -//tags: ["ROSA", "STS"] |
17 | | -//authors: |
18 | | -// - Byron Miller |
19 | | -// - Connor Wooley |
20 | | -// - Diana Sari |
21 | | -//--- |
22 | | - |
23 | | -This is a checklist of prerequisites needed to spin up a {product-title} classic cluster with link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html[STS]. |
24 | | - |
25 | | -[NOTE] |
26 | | -==== |
27 | | -This is a high level checklist and your implementation can vary. |
28 | | -==== |
29 | | - |
30 | | -Before running the installation process, verify that you deploy this from a machine that has access to: |
31 | | - |
32 | | -* The API services for the cloud to which you provision. |
33 | | -* Access to `api.openshift.com` and `sso.redhat.com`. |
34 | | -* The hosts on the network that you provision. |
35 | | -* The internet to obtain installation media. |
36 | | -
|
37 | | -== Accounts and CLIs Prerequisites |
38 | | - |
39 | | -Accounts and CLIs you must install to deploy the cluster. |
40 | | - |
41 | | -=== AWS account |
42 | | - |
43 | | -* Gather the following details: |
44 | | -** AWS IAM User |
45 | | -** AWS Access Key ID |
46 | | -** AWS Secret Access Key |
47 | | -* Ensure that you have the right permissions as detailed link:https://docs.aws.amazon.com/ROSA/latest/userguide/security-iam-awsmanpol.html[AWS managed IAM policies for ROSA] and link:https://docs.openshift.com/rosa/rosa_architecture/rosa-sts-about-iam-resources.html[About IAM resources for ROSA clusters that use STS]. |
48 | | -* See link:https://docs.openshift.com/rosa/rosa_planning/rosa-sts-aws-prereqs.html#rosa-account_rosa-sts-aws-prereqs[Account] for more details. |
49 | | - |
50 | | -=== AWS CLI (`aws`) |
51 | | - |
52 | | -* Install from https://aws.amazon.com/cli/[AWS Command Line Interface] if you have not already. |
53 | | -* Configure the CLI: |
54 | | -+ |
55 | | -. Enter `aws configure` in the terminal: |
56 | | -+ |
57 | | -[source,terminal] |
58 | | ----- |
59 | | -$ aws configure |
60 | | ----- |
61 | | -+ |
62 | | -. Enter the AWS Access Key ID and press *enter*. |
63 | | -. Enter the AWS Secret Access Key and press *enter*. |
64 | | -. Enter the default region you want to deploy into. |
65 | | -. Enter the output format you want, “table” or “json”. |
66 | | -. Verify the output by running: |
67 | | -+ |
68 | | -[source,terminal] |
69 | | ----- |
70 | | - $ aws sts get-caller-identity |
71 | | ----- |
72 | | -+ |
73 | | -. Ensure that the service role for ELB already exists by running: |
74 | | -+ |
75 | | -[source,terminal] |
76 | | ----- |
77 | | -$ aws iam get-role --role-name "AWSServiceRoleForElasticLoadBalancing" |
78 | | ----- |
79 | | -+ |
80 | | -.. If it does not exist, run: |
81 | | -+ |
82 | | -[source,terminal] |
83 | | ----- |
84 | | -$ aws iam create-service-linked-role --aws-service-name "elasticloadbalancing.amazonaws.com" |
85 | | ----- |
86 | | - |
87 | | -=== Red Hat account |
88 | | - |
89 | | -* Create a https://console.redhat.com/[hybrid-console] account if you have not already. |
90 | | - |
91 | | -=== ROSA CLI (`rosa`) |
92 | | - |
93 | | -. Enable ROSA from your AWS account on the https://console.aws.amazon.com/rosa/[AWS console] if you have not already. |
94 | | -. Install the CLI from https://docs.openshift.com/rosa/rosa_install_access_delete_clusters/rosa_getting_started_iam/rosa-installing-rosa.html[Installing the Red Hat OpenShift Service on AWS (ROSA) CLI, rosa[] or from the OpenShift console https://console.redhat.com/openshift/downloads#tool-rosa[AWS console]. |
95 | | -. Enter `rosa login` in a terminal, and this will prompt you to go to the https://console.redhat.com/openshift/token/rosa[token page] through the console: |
96 | | -+ |
97 | | -[source,terminal] |
98 | | ----- |
99 | | -$ rosa login |
100 | | ----- |
101 | | -+ |
102 | | -. Log in with your Red Hat account credentials. |
103 | | -. Click the *Load token* button. |
104 | | -. Copy the token and paste it back into the CLI prompt and press *enter*. |
105 | | -+ |
106 | | -* Alternatively, you can copy the full `$ rosa login --token=abc...` command and paste that in the terminal: |
107 | | -+ |
108 | | -[source,terminal] |
109 | | ----- |
110 | | -$ rosa login --token=<abc..> |
111 | | ----- |
112 | | -+ |
113 | | -. Verify your credentials by running: |
114 | | -+ |
115 | | -[source,terminal] |
116 | | ----- |
117 | | -$ rosa whoami |
118 | | ----- |
119 | | -+ |
120 | | -. Ensure you have sufficient quota by running: |
121 | | -+ |
122 | | -[source,terminal] |
123 | | ----- |
124 | | -$ rosa verify quota |
125 | | ----- |
126 | | -+ |
127 | | -* See link:https://docs.openshift.com/rosa/rosa_planning/rosa-sts-aws-prereqs.html#rosa-aws-policy-provisioned_rosa-sts-aws-prereqs[Provisioned AWS Infrastructure] for more details on AWS services provisioned for ROSA cluster. |
128 | | -* See link:https://docs.openshift.com/rosa/rosa_planning/rosa-sts-required-aws-service-quotas.html[Required AWS service quotas] for more details on AWS services quota. |
129 | | - |
130 | | -=== OpenShift CLI (`oc`) |
131 | | - |
132 | | -. Install from link:https://docs.openshift.com/container-platform/4.13/cli_reference/openshift_cli/getting-started-cli.html[Getting started with the OpenShift CLI] or from the OpenShift console link:https://console.redhat.com/openshift/downloads#tool-oc[Command-line interface (CLI) tools]. |
133 | | -. Verify that the OpenShift CLI has been installed correctly by running: |
134 | | -+ |
135 | | -[source,terminal] |
136 | | ----- |
137 | | -$ rosa verify openshift-client |
138 | | ----- |
139 | | - |
140 | | -Once you have the above prerequisites installed and enabled, proceed to the next steps. |
141 | | - |
142 | | - |
143 | | -== SCP Prerequisites |
144 | | - |
145 | | -ROSA clusters are hosted in an AWS account within an AWS organizational unit. A link:https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html[service control policy (SCP)] is created and applied to the AWS organizational unit that manages what services the AWS sub-accounts are permitted to access. |
146 | | - |
147 | | -* Ensure that your organization's SCPs are not more restrictive than the roles and policies required by the cluster. |
148 | | -* Ensure that your SCP is configured to allow the required `aws-marketplace:Subscribe` permission when you choose *Enable ROSA* from the console, and see link:https://docs.aws.amazon.com/ROSA/latest/userguide/troubleshoot-rosa-enablement.html#error-aws-orgs-scp-denies-permissions[AWS Organizations service control policy (SCP) is denying required AWS Marketplace permissions] for more details. |
149 | | -* When you create a ROSA classic cluster, an associated AWS OpenID Connect (OIDC) identity provider is created. |
150 | | -** This OIDC provider configuration relies on a public key that is located in the `us-east-1` AWS region. |
151 | | -** Customers with AWS SCPs must allow the use of the `us-east-1` AWS region, even if these clusters are deployed in a different region. |
152 | | - |
153 | | -== Networking Prerequisites |
154 | | - |
155 | | -Prerequisites needed from a networking standpoint. |
156 | | - |
157 | | -=== Firewall |
158 | | - |
159 | | -* Configure your firewall to allow access to the domains and ports listed in link:https://docs.openshift.com/rosa/rosa_planning/rosa-sts-aws-prereqs.html#osd-aws-privatelink-firewall-prerequisites_rosa-sts-aws-prereqs[AWS firewall prerequisites]. |
160 | | - |
161 | | -=== Custom DNS |
162 | | - |
163 | | -* If you want to use custom DNS, then the ROSA installer must be able to use VPC DNS with default DHCP options so it can resolve hosts locally. |
164 | | -** To do so, run `aws ec2 describe-dhcp-options` and see if the VPC is using VPC Resolver: |
165 | | -+ |
166 | | -[source,terminal] |
167 | | ----- |
168 | | -$ aws ec2 describe-dhcp-options |
169 | | ----- |
170 | | -+ |
171 | | -* Otherwise, the upstream DNS will need to forward the cluster scope to this VPC so the cluster can resolve internal IPs and services. |
172 | | - |
173 | | -== PrivateLink Prerequisites |
174 | | - |
175 | | -If you choose to deploy a PrivateLink cluster, then be sure to deploy the cluster in the pre-existing BYO VPC: |
176 | | - |
177 | | -* Create a public and private subnet for each AZ that your cluster uses. |
178 | | -** Alternatively, implement transit gateway for internet and egress with appropriate routes. |
179 | | -* The VPC's CIDR block must contain the `Networking.MachineCIDR` range, which is the IP address for cluster machines. |
180 | | -** The subnet CIDR blocks must belong to the machine CIDR that you specify. |
181 | | -* Set both `enableDnsHostnames` and `enableDnsSupport` to `true`. |
182 | | -** That way, the cluster can use the Route 53 zones that are attached to the VPC to resolve cluster internal DNS records. |
183 | | -* Verify route tables by running: |
184 | | -+ |
185 | | -[source,terminal] |
186 | | - ---- |
187 | | - $ aws ec2 describe-route-tables --filters "Name=vpc-id,Values=<vpc-id>" |
188 | | - ---- |
189 | | - |
190 | | -** Ensure that the cluster can egress either through NAT gateway in public subnet or through transit gateway. |
191 | | -** Ensure whatever UDR you would like to follow is set up. |
192 | | -* You can also configure a cluster-wide proxy during or after install. |
193 | | -https://docs.openshift.com/rosa/networking/configuring-cluster-wide-proxy.html[Configuring a cluster-wide proxy] for more details. |
194 | | - |
195 | | -[NOTE] |
196 | | -==== |
197 | | -You can install a non-PrivateLink ROSA cluster in a pre-existing BYO VPC. |
198 | | -==== |
0 commit comments