Skip to content

Commit 0b42f2b

Browse files
bmcelveebmcelvee
authored
Merge pull request #64789 from bmcelvee/OSDOCS-7749
OSDOCS-7749: [MOBB F2F] Migrate MOBB Prerequisites Checklist to Deploy ROSA Cluster with STS to ROSA product documentation
2 parents ea30a33 + 89703b2 commit 0b42f2b

File tree

5 files changed

+439
-5
lines changed

5 files changed

+439
-5
lines changed

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -77,11 +77,13 @@ Topics:
7777
File: rosa-getting-support
7878
# - Name: Training for ROSA
7979
# File: rosa-training
80-
#---
81-
#Name: Tutorials
82-
#Dir: rosa_tutorials
83-
#Distros: openshift-rosa
84-
#Topics:
80+
---
81+
Name: Tutorials
82+
Dir: rosa_tutorials
83+
Distros: openshift-rosa
84+
Topics:
85+
- Name: ROSA prerequisites
86+
File: rosa-mobb-prerequisites-tutorial
8587
---
8688
Name: Getting started
8789
Dir: rosa_getting_started

‎images/rosa-aws-pre.png

148 KB
Loading

‎modules/rosa-mobb-prereq-checklist.adoc

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
2+
// Module included in the following assemblies:
3+
//
4+
// * rosa_planning/rosa-sts-aws-prereqs.html
5+
6+
7+
:_content-type: PROCEDURE
8+
[id="rosa-mobb-prereq-checklist_{context}"]
9+
= Prerequisites checklist to deploy a ROSA classic cluster
10+
11+
//Mobb content metadata
12+
//Brought into ROSA product docs 2023-09-15; does not follow typical OpenShift documentation formatting
13+
//---
14+
//date: '2023-07-27'
15+
//title: Prerequisites Checklist to Deploy ROSA Cluster with STS
16+
//tags: ["ROSA", "STS"]
17+
//authors:
18+
// - Byron Miller
19+
// - Connor Wooley
20+
// - Diana Sari
21+
//---
22+
23+
This is a checklist of prerequisites needed to spin up a {product-title} classic cluster with link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html[STS].
24+
25+
[NOTE]
26+
====
27+
This is a high level checklist and your implementation can vary.
28+
====
29+
30+
Before running the installation process, verify that you deploy this from a machine that has access to:
31+
32+
* The API services for the cloud to which you provision.
33+
* Access to `api.openshift.com` and `sso.redhat.com`.
34+
* The hosts on the network that you provision.
35+
* The internet to obtain installation media.
36+
37+
== Accounts and CLIs Prerequisites
38+
39+
Accounts and CLIs you must install to deploy the cluster.
40+
41+
=== AWS account
42+
43+
* Gather the following details:
44+
** AWS IAM User
45+
** AWS Access Key ID
46+
** AWS Secret Access Key
47+
* Ensure that you have the right permissions as detailed link:https://docs.aws.amazon.com/ROSA/latest/userguide/security-iam-awsmanpol.html[AWS managed IAM policies for ROSA] and link:https://docs.openshift.com/rosa/rosa_architecture/rosa-sts-about-iam-resources.html[About IAM resources for ROSA clusters that use STS].
48+
* See link:https://docs.openshift.com/rosa/rosa_planning/rosa-sts-aws-prereqs.html#rosa-account_rosa-sts-aws-prereqs[Account] for more details.
49+
50+
=== AWS CLI (`aws`)
51+
52+
* Install from https://aws.amazon.com/cli/[AWS Command Line Interface] if you have not already.
53+
* Configure the CLI:
54+
+
55+
. Enter `aws configure` in the terminal:
56+
+
57+
[source,terminal]
58+
----
59+
$ aws configure
60+
----
61+
+
62+
. Enter the AWS Access Key ID and press *enter*.
63+
. Enter the AWS Secret Access Key and press *enter*.
64+
. Enter the default region you want to deploy into.
65+
. Enter the output format you want, “table” or “json”.
66+
. Verify the output by running:
67+
+
68+
[source,terminal]
69+
----
70+
$ aws sts get-caller-identity
71+
----
72+
+
73+
. Ensure that the service role for ELB already exists by running:
74+
+
75+
[source,terminal]
76+
----
77+
$ aws iam get-role --role-name "AWSServiceRoleForElasticLoadBalancing"
78+
----
79+
+
80+
.. If it does not exist, run:
81+
+
82+
[source,terminal]
83+
----
84+
$ aws iam create-service-linked-role --aws-service-name "elasticloadbalancing.amazonaws.com"
85+
----
86+
87+
=== Red Hat account
88+
89+
* Create a https://console.redhat.com/[hybrid-console] account if you have not already.
90+
91+
=== ROSA CLI (`rosa`)
92+
93+
. Enable ROSA from your AWS account on the https://console.aws.amazon.com/rosa/[AWS console] if you have not already.
94+
. Install the CLI from https://docs.openshift.com/rosa/rosa_install_access_delete_clusters/rosa_getting_started_iam/rosa-installing-rosa.html[Installing the Red Hat OpenShift Service on AWS (ROSA) CLI, rosa[] or from the OpenShift console https://console.redhat.com/openshift/downloads#tool-rosa[AWS console].
95+
. Enter `rosa login` in a terminal, and this will prompt you to go to the https://console.redhat.com/openshift/token/rosa[token page] through the console:
96+
+
97+
[source,terminal]
98+
----
99+
$ rosa login
100+
----
101+
+
102+
. Log in with your Red Hat account credentials.
103+
. Click the *Load token* button.
104+
. Copy the token and paste it back into the CLI prompt and press *enter*.
105+
+
106+
* Alternatively, you can copy the full `$ rosa login --token=abc...` command and paste that in the terminal:
107+
+
108+
[source,terminal]
109+
----
110+
$ rosa login --token=<abc..>
111+
----
112+
+
113+
. Verify your credentials by running:
114+
+
115+
[source,terminal]
116+
----
117+
$ rosa whoami
118+
----
119+
+
120+
. Ensure you have sufficient quota by running:
121+
+
122+
[source,terminal]
123+
----
124+
$ rosa verify quota
125+
----
126+
+
127+
* See link:https://docs.openshift.com/rosa/rosa_planning/rosa-sts-aws-prereqs.html#rosa-aws-policy-provisioned_rosa-sts-aws-prereqs[Provisioned AWS Infrastructure] for more details on AWS services provisioned for ROSA cluster.
128+
* See link:https://docs.openshift.com/rosa/rosa_planning/rosa-sts-required-aws-service-quotas.html[Required AWS service quotas] for more details on AWS services quota.
129+
130+
=== OpenShift CLI (`oc`)
131+
132+
. Install from link:https://docs.openshift.com/container-platform/4.13/cli_reference/openshift_cli/getting-started-cli.html[Getting started with the OpenShift CLI] or from the OpenShift console link:https://console.redhat.com/openshift/downloads#tool-oc[Command-line interface (CLI) tools].
133+
. Verify that the OpenShift CLI has been installed correctly by running:
134+
+
135+
[source,terminal]
136+
----
137+
$ rosa verify openshift-client
138+
----
139+
140+
Once you have the above prerequisites installed and enabled, proceed to the next steps.
141+
142+
143+
== SCP Prerequisites
144+
145+
ROSA clusters are hosted in an AWS account within an AWS organizational unit. A link:https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html[service control policy (SCP)] is created and applied to the AWS organizational unit that manages what services the AWS sub-accounts are permitted to access.
146+
147+
* Ensure that your organization's SCPs are not more restrictive than the roles and policies required by the cluster.
148+
* Ensure that your SCP is configured to allow the required `aws-marketplace:Subscribe` permission when you choose *Enable ROSA* from the console, and see link:https://docs.aws.amazon.com/ROSA/latest/userguide/troubleshoot-rosa-enablement.html#error-aws-orgs-scp-denies-permissions[AWS Organizations service control policy (SCP) is denying required AWS Marketplace permissions] for more details.
149+
* When you create a ROSA classic cluster, an associated AWS OpenID Connect (OIDC) identity provider is created.
150+
** This OIDC provider configuration relies on a public key that is located in the `us-east-1` AWS region.
151+
** Customers with AWS SCPs must allow the use of the `us-east-1` AWS region, even if these clusters are deployed in a different region.
152+
153+
== Networking Prerequisites
154+
155+
Prerequisites needed from a networking standpoint.
156+
157+
=== Firewall
158+
159+
* Configure your firewall to allow access to the domains and ports listed in link:https://docs.openshift.com/rosa/rosa_planning/rosa-sts-aws-prereqs.html#osd-aws-privatelink-firewall-prerequisites_rosa-sts-aws-prereqs[AWS firewall prerequisites].
160+
161+
=== Custom DNS
162+
163+
* If you want to use custom DNS, then the ROSA installer must be able to use VPC DNS with default DHCP options so it can resolve hosts locally.
164+
** To do so, run `aws ec2 describe-dhcp-options` and see if the VPC is using VPC Resolver:
165+
+
166+
[source,terminal]
167+
----
168+
$ aws ec2 describe-dhcp-options
169+
----
170+
+
171+
* Otherwise, the upstream DNS will need to forward the cluster scope to this VPC so the cluster can resolve internal IPs and services.
172+
173+
== PrivateLink Prerequisites
174+
175+
If you choose to deploy a PrivateLink cluster, then be sure to deploy the cluster in the pre-existing BYO VPC:
176+
177+
* Create a public and private subnet for each AZ that your cluster uses.
178+
** Alternatively, implement transit gateway for internet and egress with appropriate routes.
179+
* The VPC's CIDR block must contain the `Networking.MachineCIDR` range, which is the IP address for cluster machines.
180+
** The subnet CIDR blocks must belong to the machine CIDR that you specify.
181+
* Set both `enableDnsHostnames` and `enableDnsSupport` to `true`.
182+
** That way, the cluster can use the Route 53 zones that are attached to the VPC to resolve cluster internal DNS records.
183+
* Verify route tables by running:
184+
+
185+
[source,terminal]
186+
----
187+
$ aws ec2 describe-route-tables --filters "Name=vpc-id,Values=<vpc-id>"
188+
----
189+
190+
** Ensure that the cluster can egress either through NAT gateway in public subnet or through transit gateway.
191+
** Ensure whatever UDR you would like to follow is set up.
192+
* You can also configure a cluster-wide proxy during or after install.
193+
https://docs.openshift.com/rosa/networking/configuring-cluster-wide-proxy.html[Configuring a cluster-wide proxy] for more details.
194+
195+
[NOTE]
196+
====
197+
You can install a non-PrivateLink ROSA cluster in a pre-existing BYO VPC.
198+
====

‎rosa_planning/rosa-sts-aws-prereqs.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ include::snippets/rosa-sts.adoc[]
1212

1313
Ensure that the following AWS prerequisites are met before installing ROSA with STS.
1414

15+
include::modules/rosa-mobb-prereq-checklist.adoc[leveloffset=+1]
16+
1517
include::modules/rosa-aws-understand.adoc[leveloffset=+1]
1618

1719
[IMPORTANT]

0 commit comments

Comments
 (0)