|
| 1 | +:_mod-docs-content-type: ASSEMBLY |
| 2 | +[id="installing-aws-specialized-region"] |
| 3 | += Installing a cluster on AWS into a specialized region |
| 4 | +include::_attributes/common-attributes.adoc[] |
| 5 | +:context: installing-aws-specialized-region |
| 6 | + |
| 7 | +toc::[] |
| 8 | + |
| 9 | +In {product-title} version {product-version}, you can install a cluster on |
| 10 | +{aws-first} into specialized regions, including secret and top secret regions, |
| 11 | +government regions, and China regions. To configure the region, modify parameters in the `install-config.yaml` file before you install the cluster. |
| 12 | + |
| 13 | +The following specialized regions are supported: |
| 14 | + |
| 15 | +.Specialized regions |
| 16 | +|==== |
| 17 | +|Region type|Supported regions |
| 18 | + |
| 19 | +|China |
| 20 | +a| |
| 21 | +* `cn-north-1` (Beijing) |
| 22 | +* `cn-northwest-1` (Ningxia) |
| 23 | + |
| 24 | +|Secret and Top Secret |
| 25 | +a| |
| 26 | +* `us-isob-east-1` (SC2S) |
| 27 | +* `us-iso-east-1` (C2S) |
| 28 | + |
| 29 | +|Government |
| 30 | +a| |
| 31 | +* `us-gov-east-1` |
| 32 | +* `us-gov-west-1` |
| 33 | + |
| 34 | +|==== |
| 35 | + |
| 36 | +[WARNING] |
| 37 | +==== |
| 38 | +In {product-title} {product-version}, the installation program uses Cluster API instead of Terraform to provision cluster infrastructure during installations on AWS. Installing a cluster on AWS into a secret or top-secret region by using the Cluster API implementation has not been tested as of the release of {product-title} {product-version}. This document will be updated when installation into a secret region has been tested. |
| 39 | +
|
| 40 | +There is a known issue with Network Load Balancers' support for security groups in secret or top secret regions that causes installations in these regions to fail. For more information, see link:https://issues.redhat.com/browse/OCPBUGS-33311[OCPBUGS-33311]. |
| 41 | +
|
| 42 | +The maximum supported MTU in the AWS SC2S and C2S regions is not the same as |
| 43 | +the public regions. For more information about configuring MTU during installation, |
| 44 | +see the _Cluster Network Operator configuration object_ section in _Installing |
| 45 | +a cluster on AWS with network customizations_ |
| 46 | +==== |
| 47 | + |
| 48 | +[id="prerequisites_{context}"] |
| 49 | +== Prerequisites |
| 50 | + |
| 51 | +* If you install a cluster into a China region, you have an Internet Content Provider (ICP) license. |
| 52 | +* You reviewed details about the xref:../../../architecture/architecture-installation.adoc#architecture-installation[{product-title} installation and update] processes. |
| 53 | +* You read the documentation on xref:../../../installing/overview/installing-preparing.adoc#installing-preparing[selecting a cluster installation method and preparing it for users]. |
| 54 | +* You xref:../../../installing/installing_aws/installing-aws-account.adoc#installing-aws-account[configured an AWS account] to host the cluster. |
| 55 | +* If you use a firewall, you xref:../../../installing/install_config/configuring-firewall.adoc#configuring-firewall[configured it to allow the sites] that your cluster requires access to. |
| 56 | + |
| 57 | +[IMPORTANT] |
| 58 | +==== |
| 59 | +If you have an AWS profile stored on your computer, it must not use a temporary session token that you generated while using a multi-factor authentication device. The cluster continues to use your current AWS credentials to create AWS resources for the entire life of the cluster, so you must use long-term credentials. To generate appropriate keys, see link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html[Managing Access Keys for IAM Users] in the AWS documentation. You can supply the keys when you run the installation program. |
| 60 | +==== |
| 61 | + |
| 62 | +include::modules/installation-aws-about-government-region.adoc[leveloffset=+1] |
| 63 | +include::modules/installation-aws-marketplace-government.adoc[leveloffset=+1] |
| 64 | + |
| 65 | +[role="_additional-resources"] |
| 66 | +.Additional resources |
| 67 | +* xref:../../../installing/installing_aws/installation-config-parameters-aws.adoc#installation-config-parameters-aws[Installation configuration parameters for AWS] |
| 68 | + |
| 69 | +include::modules/installation-aws-regions-with-no-ami.adoc[leveloffset=+1] |
| 70 | + |
| 71 | +include::modules/private-clusters-default.adoc[leveloffset=+1] |
| 72 | +include::modules/private-clusters-about-aws.adoc[leveloffset=+2] |
| 73 | + |
| 74 | +include::modules/installation-custom-aws-vpc.adoc[leveloffset=+1] |
| 75 | +include::modules/installation-aws-security-groups.adoc[leveloffset=+2] |
| 76 | + |
| 77 | +include::modules/installation-aws-upload-custom-rhcos-ami.adoc[leveloffset=+1] |
| 78 | + |
| 79 | +include::modules/installation-initializing-manual.adoc[leveloffset=+1] |
| 80 | + |
| 81 | +[role="_additional-resources"] |
| 82 | +.Additional resources |
| 83 | +* xref:../../../installing/installing_aws/installation-config-parameters-aws.adoc#installation-config-parameters-aws[Installation configuration parameters for AWS] |
| 84 | + |
| 85 | +include::modules/installation-aws-config-yaml-customizations.adoc[leveloffset=+2] |
| 86 | + |
| 87 | +[role="_additional-resources"] |
| 88 | +.Additional resources |
| 89 | + |
| 90 | +* xref:../../../installing/installing_aws/installation-config-parameters-aws.adoc#installation-config-parameters-aws[Installation configuration parameters for AWS] |
| 91 | + |
| 92 | +include::modules/installation-minimum-resource-requirements.adoc[leveloffset=+2] |
| 93 | + |
| 94 | +[role="_additional-resources"] |
| 95 | +.Additional resources |
| 96 | + |
| 97 | +* xref:../../../scalability_and_performance/optimization/optimizing-storage.adoc#optimizing-storage[Optimizing storage] |
| 98 | + |
| 99 | +include::modules/installation-aws-tested-machine-types.adoc[leveloffset=+2] |
| 100 | +include::modules/installation-aws-arm-tested-machine-types.adoc[leveloffset=+2] |
| 101 | + |
| 102 | +include::modules/installation-configure-proxy.adoc[leveloffset=+2] |
| 103 | + |
| 104 | +include::modules/installation-applying-aws-security-groups.adoc[leveloffset=+2] |
| 105 | + |
| 106 | +[id="installing-aws-manual-modes_{context}"] |
| 107 | +== Alternatives to storing administrator-level secrets in the kube-system project |
| 108 | + |
| 109 | +By default, administrator secrets are stored in the `kube-system` project. If you configured the `credentialsMode` parameter in the `install-config.yaml` file to `Manual`, you must use one of the following alternatives: |
| 110 | + |
| 111 | +* To manage long-term cloud credentials manually, follow the procedure in xref:../../../installing/installing_aws/ipi/installing-aws-specialized-region.adoc#manually-create-iam_installing-aws-specialized-region[Manually creating long-term credentials]. |
| 112 | + |
| 113 | +* To implement short-term credentials that are managed outside the cluster for individual components, follow the procedures in xref:../../../installing/installing_aws/ipi/installing-aws-specialized-region.adoc#installing-aws-with-short-term-creds_installing-aws-specialized-region[Configuring an AWS cluster to use short-term credentials]. |
| 114 | + |
| 115 | +//Manually creating long-term credentials |
| 116 | +include::modules/manually-create-identity-access-management.adoc[leveloffset=+2] |
| 117 | + |
| 118 | +//Supertask: Configuring an AWS cluster to use short-term credentials |
| 119 | +[id="installing-aws-with-short-term-creds_{context}"] |
| 120 | +=== Configuring an AWS cluster to use short-term credentials |
| 121 | + |
| 122 | +To install a cluster that is configured to use the AWS Security Token Service (STS), you must configure the CCO utility and create the required AWS resources for your cluster. |
| 123 | + |
| 124 | +//Task part 1: Configuring the Cloud Credential Operator utility |
| 125 | +include::modules/cco-ccoctl-configuring.adoc[leveloffset=+3] |
| 126 | + |
| 127 | +//Task part 2: Creating the required AWS resources |
| 128 | +[id="sts-mode-create-aws-resources-ccoctl_{context}"] |
| 129 | +==== Creating AWS resources with the Cloud Credential Operator utility |
| 130 | + |
| 131 | +You have the following options when creating AWS resources: |
| 132 | + |
| 133 | +* You can use the `ccoctl aws create-all` command to create the AWS resources automatically. This is the quickest way to create the resources. See xref:../../../installing/installing_aws/ipi/installing-aws-specialized-region.adoc#cco-ccoctl-creating-at-once_installing-aws-specialized-region[Creating AWS resources with a single command]. |
| 134 | + |
| 135 | +* If you need to review the JSON files that the `ccoctl` tool creates before modifying AWS resources, or if the process the `ccoctl` tool uses to create AWS resources automatically does not meet the requirements of your organization, you can create the AWS resources individually. See xref:../../../installing/installing_aws/ipi/installing-aws-specialized-region.adoc#cco-ccoctl-creating-individually_installing-aws-specialized-region[Creating AWS resources individually]. |
| 136 | + |
| 137 | +//Task part 2a: Creating the required AWS resources all at once |
| 138 | +include::modules/cco-ccoctl-creating-at-once.adoc[leveloffset=+4] |
| 139 | + |
| 140 | +//Task part 2b: Creating the required AWS resources individually |
| 141 | +include::modules/cco-ccoctl-creating-individually.adoc[leveloffset=+4] |
| 142 | + |
| 143 | +//Task part 3: Incorporating the Cloud Credential Operator utility manifests |
| 144 | +include::modules/cco-ccoctl-install-creating-manifests.adoc[leveloffset=+3] |
| 145 | + |
| 146 | +include::modules/installation-launching-installer.adoc[leveloffset=+1] |
| 147 | + |
| 148 | +include::modules/cli-logging-in-kubeadmin.adoc[leveloffset=+1] |
| 149 | + |
| 150 | +include::modules/logging-in-by-using-the-web-console.adoc[leveloffset=+1] |
| 151 | + |
| 152 | +[role="_additional-resources"] |
| 153 | +.Additional resources |
| 154 | + |
| 155 | +* See xref:../../../web_console/web-console.adoc#web-console[Accessing the web console] for more details about accessing and understanding the {product-title} web console. |
| 156 | + |
| 157 | +[id="next-steps_{context}"] |
| 158 | +== Next steps |
| 159 | + |
| 160 | +* xref:../../../installing/validation_and_troubleshooting/validating-an-installation.adoc#validating-an-installation[Validating an installation]. |
| 161 | +* xref:../../../post_installation_configuration/cluster-tasks.adoc#available_cluster_customizations[Customize your cluster]. |
| 162 | +* If necessary, you can xref:../../../support/remote_health_monitoring/opting-out-of-remote-health-reporting.adoc#opting-out-remote-health-reporting_opting-out-remote-health-reporting[opt out of remote health reporting]. |
| 163 | +* If necessary, you can xref:../../../post_installation_configuration/changing-cloud-credentials-configuration.adoc#manually-removing-cloud-creds_changing-cloud-credentials-configuration[remove cloud provider credentials]. |
0 commit comments