Merge pull request #72838 from EricPonvelle/OSDOCS-9612_Additional-Security-Groups-ROSA-HCP

OSDOCS-9612: Added instructions for the additional security groups tag for ROSA with HCP clusters

Author: EricPonvelle

modules/creating-a-machine-pool-cli.adoc

@@ -67,6 +67,11 @@ For fault-tolerant worker machine pools, choosing a Multi-AZ machine pool distri
 * A Single-AZ machine pool with one availability zone can have a machine count in multiples of 1, such as 1,2,3,4 and so on.
 ====
 <10> Optional: For machine pools in clusters that do not have Red Hat managed VPCs, you can select additional custom security groups to use in your machine pools. You must have already created the security groups and associated them with the VPC that you selected for this cluster. You cannot add or edit security groups after you create the machine pool. For more information, see the requirements for security groups in the "Additional resources" section.
++
+[IMPORTANT]
+====
+You can use up to ten additional security groups for machine pools on {hcp-title} clusters. 
+====
 <11> Optional: For BYO VPC clusters, you can select a subnet to create a Single-AZ machine pool.
 If the subnet is out of your cluster creation subnets, there must be a tag with a key `kubernetes.io/cluster/<infra-id>` and value `shared`.
 Customers can obtain the Infra ID by using the following command:

modules/creating-a-machine-pool-ocm.adoc

@@ -100,6 +100,11 @@ Alternatively, you can add the node labels and taints after you create the machi
 
 ifdef::openshift-rosa,openshift-dedicated[]
 . Optional: Select additional custom security groups to use for nodes in this machine pool. You must have already created the security groups and associated them with the VPC that you selected for this cluster. You cannot add or edit security groups after you create the machine pool. For more information, see the requirements for security groups in the "Additional resources" section.
++
+[IMPORTANT]
+====
+You can use up to ten additional security groups for machine pools on {hcp-title} clusters. 
+====
 endif::openshift-rosa,openshift-dedicated[]
 
 ifdef::openshift-dedicated[]

modules/rosa-hcp-sts-creating-a-cluster-cli.adoc

@@ -28,35 +28,48 @@ When using the {product-title} (ROSA) CLI, `rosa`, to create a cluster, you can
 //REGION="<region>"
 //----
 
-. You can create your {hcp-title} cluster with one of the following commands.
+. Use one of the following commands to create your {hcp-title} cluster:
 +
 [NOTE]
 ====
 When creating a {hcp-title} cluster, the default machine Classless Inter-Domain Routing (CIDR) is `10.0.0.0/16`. If this does not correspond to the CIDR range for your VPC subnets, add `--machine-cidr <address_block>` to the following commands. To learn more about the default CIDR ranges for {product-title}, see xref:../networking/cidr-range-definitions.adoc#cidr-range-definitions[CIDR range definitions].
 ====
 +
-** Create a cluster with a single, initial machine pool, publicly available API, and publicly available Ingress by running the following command:
+--
+* If you did not set environmental variables, run the following command:
 +
 [source,terminal]
 ----
-$ rosa create cluster --cluster-name=<cluster_name> \
-    --sts --mode=auto --hosted-cp --operator-roles-prefix <operator-role-prefix> \
-    --oidc-config-id <ID-of-OIDC-configuration> --subnet-ids=<public-subnet-id>,<private-subnet-id>
+$ rosa create cluster --cluster-name=<cluster_name> \ <.>
+    --mode=auto --hosted-cp [--private] \ <.> 
+    --operator-roles-prefix <operator-role-prefix> \ <.>
+    --oidc-config-id <id-of-oidc-configuration> \ 
+    --subnet-ids=<public-subnet-id>,<private-subnet-id>
 ----
-
-** Create a cluster with a single, initial machine pool, privately available API, and privately available Ingress by running the following command:
+<.> Specify the name of your cluster, ensuring that the cluster name consists of no more than 15 lowercase alphanumeric characters or '-', starts with a letter, and ends with an alphanumeric character.
+<.> Optional: The `--private` argument is used to create private {hcp-title} clusters. If you use this argument, ensure that you only use your private subnet ID for `--subnet-ids`.
+<.> By default, the cluster-specific Operator role names are prefixed with the cluster name and a random 4-digit hash. You can optionally specify a custom prefix to replace `<cluster_name>-<hash>` in the role names. The prefix is applied when you create the cluster-specific Operator IAM roles. For information about the prefix, see _About custom Operator IAM role prefixes_.
++
+[NOTE]
+====
+If you specified custom ARN paths when you created the associated account-wide roles, the custom path is automatically detected. The custom path is applied to the cluster-specific Operator roles when you create them in a later step.
+====
+--
++
+* If you set the environmental variables, create a cluster with a single, initial machine pool, using either a publicly or privately available API, and a publicly or privately available Ingress by running the following command:
 +
 [source,terminal]
 ----
-$ rosa create cluster --private --cluster-name=<cluster_name> \
-    --sts --mode=auto --hosted-cp --subnet-ids=<private-subnet-id>
+$ rosa create cluster --private --cluster-name=<cluster_name> \ 
+  --mode=auto --hosted-cp --operator-roles-prefix=$OPERATOR_ROLES_PREFIX \ 
+  --oidc-config-id=$ODIC_CONFIG --subnet-ids=$SUBNET_IDS
 ----
-
-** If you used the `OIDC_ID`, `SUBNET_IDS`, and `OPERATOR_ROLES_PREFIX` variables to prepare your environment, you can continue to use those variables when creating your cluster. For example, run the following command:
++
+* If you set the environmental variables, create a cluster with a single, initial machine pool, a publicly available API, and a publicly available Ingress by running the following command:
 +
 [source,terminal]
 ----
-$ rosa create cluster --hosted-cp --subnet-ids=$SUBNET_IDS --oidc-config-id=$OIDC_ID --cluster-name=<cluster_name> --operator-roles-prefix=$OPERATOR_ROLES_PREFIX
+$ rosa create cluster --cluster-name=<cluster_name> --mode=auto --hosted-cp --operator-roles-prefix=$OPERATOR_ROLES_PREFIX --oidc-config-id=$ODIC_CONFIG --subnet-ids=$SUBNET_IDS
 ----
 
 . Check the status of your cluster by running the following command:
@@ -82,6 +95,6 @@ If the installation fails or the `State` field does not change to `ready` after
 +
 [source,terminal]
 ----
-$ rosa logs install --cluster=<cluster_name> --watch <1>
+$ rosa logs install --cluster=<cluster_name> --watch \ <1>
 ----
 <1> Optional: To watch for new log messages as the installation progresses, use the `--watch` argument.

rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc

@@ -128,6 +128,7 @@ include::modules/rosa-hcp-sts-creating-a-cluster-cli.adoc[leveloffset=+1]
 
 * For steps to deploy a ROSA cluster using manual mode, see xref:../rosa_install_access_delete_clusters/rosa-sts-creating-a-cluster-with-customizations.adoc#rosa-sts-creating-cluster-using-customizations_rosa-sts-creating-a-cluster-with-customizations[Creating a cluster using customizations].
 * For more information about the AWS Identity Access Management (IAM) resources required to deploy {product-title} with STS, see xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-sts-about-iam-resources[About IAM resources for clusters that use STS].
+* See xref:../rosa_install_access_delete_clusters/rosa_getting_started_iam/rosa-aws-prereqs.adoc#rosa-security-groups_prerequisites[Additional custom security groups] for information about security group requirements.
 * For details about optionally setting an Operator role name prefix, see xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-sts-about-operator-role-prefixes_rosa-sts-about-iam-resources[About custom Operator IAM role prefixes].
 * For information about the prerequisites to installing ROSA with STS, see xref:../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-sts-aws-prereqs[AWS prerequisites for ROSA with STS].
 * For details about using the `auto` and `manual` modes to create the required STS resources, see xref:../rosa_install_access_delete_clusters/rosa-sts-creating-a-cluster-with-customizations.adoc#rosa-understanding-deployment-modes_rosa-sts-creating-a-cluster-with-customizations[Understanding the auto and manual deployment modes].

rosa_release_notes/rosa-release-notes.adoc

@@ -13,6 +13,13 @@ toc::[]
 [id="rosa-new-changes-and-updates_{context}"]
 == New changes and updates
 
+[id="rosa-q2-2024_{context}"]
+=== Q2 2024
+
+* **ROSA CLI update.** The ROSA CLI (`rosa`) was updated to a new version. For information about what has changed in this release, see the link:https://github.com/openshift/rosa/releases/tag/v1.2.37[ROSA CLI release notes]. For more information about the ROSA CLI (`rosa`), see xref:../cli_reference/rosa_cli/rosa-get-started-cli.adoc#rosa-about_rosa-getting-started-cli[About the ROSA CLI].
+
+* **Additional Security Groups for {hcp-title}.** Starting with ROSA CLI version 1.2.37, you can now use the `--additional-security-group-ids <sec_group_id>` when creating machine pools on {hcp-title} clusters. For more information, see xref:../rosa_cluster_admin/rosa_nodes/rosa-managing-worker-nodes.html#creating_machine_pools_cli_rosa-managing-worker-nodes[Creating a machine pool using the ROSA CLI] and the xref:../cli_reference/rosa_cli/rosa-manage-objects-cli.html#rosa-create-machinepool_rosa-managing-objects-cli[create machinepool] section of the ROSA CLI reference.
+
 [id="rosa-q1-2024_{context}"]
 === Q1 2024