Skip to content

Commit 47b75ce

Browse files
EricPonvelleEricPonvelle
authored
Merge pull request #72192 from EricPonvelle/OSDOCS-9112_Subnet-Validation
OSDOCS-9112: Added tagging requirements for subnets for ROSA with HCP
2 parents ec5cd46 + ee0e746 commit 47b75ce

File tree

4 files changed

+88
-11
lines changed

4 files changed

+88
-11
lines changed

‎modules/rosa-hcp-creating-account-wide-sts-roles-and-policies.adoc

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,20 +24,13 @@ Before using the {product-title} (ROSA) CLI (`rosa`) to create {hcp-title-first}
2424
+
2525
[source,terminal]
2626
----
27-
$ rosa create account-roles --hosted-cp
27+
$ rosa create account-roles --hosted-cp --mode auto --yes
2828
----
2929
** Optional: Set your prefix as an environmental variable by running the following command:
3030
+
3131
[source,terminal]
3232
----
3333
$ export ACCOUNT_ROLES_PREFIX="${ACCOUNT_ROLES_PREFIX}"
3434
----
35-
+
36-
Then, run the following command to create your account roles with the environmental variable:
37-
+
38-
[source,terminal]
39-
----
40-
$ rosa create account-roles --hosted-cp --prefix $ACCOUNT_ROLES_PREFIX
41-
----
4235
43-
For more information regarding AWS managed IAM policies for ROSA, see link:https://docs.aws.amazon.com/ROSA/latest/userguide/security-iam-awsmanpol.html[AWS managed IAM policies for ROSA].
36+
For more information regarding AWS managed IAM policies for ROSA, see link:https://docs.aws.amazon.com/ROSA/latest/userguide/security-iam-awsmanpol.html[AWS managed IAM policies for ROSA].

‎modules/rosa-hcp-vpc-manual.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ If you choose to manually create your Virtual Private Cloud (VPC) instead of usi
2323
| You need one availability zone for a single zone, and you need three for availability zones for multi-zone.
2424

2525
| Public subnet
26-
| You must have one public subnet with a NAT gateway.
26+
| You must have one public subnet with a NAT gateway for public clusters. Private clusters do not need a public subnet.
2727

2828
| DNS hostname and resolution
2929
| You must ensure that the DNS hostname and resolution are enabled.

‎modules/rosa-hcp-vpc-subnet-tagging.adoc

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc
4+
:_mod-docs-content-type: PROCEDURE
5+
[id="rosa-hcp-vpc-subnet-tagging_{context}"]
6+
= Tagging your subnets
7+
8+
Before you can use your VPC to create a {hcp-title} cluster, you must tag your VPC subnets. Automated service preflight checks verify that these resources are tagged correctly before you can use these resources. The following table shows how your resources should be tagged as the following:
9+
10+
[cols="3a,8a,8a", options="header"]
11+
|===
12+
| Resource
13+
| Key
14+
| Value
15+
16+
| Public subnet
17+
| `kubernetes.io/role/elb`
18+
| `1` or no value
19+
20+
| Private subnet
21+
| `kubernetes.io/role/internal-elb`
22+
| `1` or no value
23+
24+
|===
25+
26+
[NOTE]
27+
====
28+
You must tag at least one private subnet and, if applicable, and one public subnet.
29+
====
30+
31+
.Prerequisites
32+
33+
* You have created a VPC.
34+
* You have installed the `aws` CLI.
35+
36+
.Procedure
37+
38+
. Verify the tags currently on your subnet by running the following command:
39+
+
40+
[source,terminal]
41+
----
42+
$ aws ec2 describe-tags --filters "Name=resource-id,Values=<subnet-id>"
43+
----
44+
+
45+
.Example output
46+
+
47+
[source,text]
48+
----
49+
TAGS Name <subnet-id> subnet <prefix>-subnet-public1-us-east-1a
50+
----
51+
52+
. Tag your resources in your terminal by running the following commands:
53+
.. For public subnets, run:
54+
+
55+
[source,terminal]
56+
----
57+
$ aws ec2 create-tags --resources <public-subnet-id> --tags Key=kubernetes.io/role/elb,Value=1
58+
----
59+
.. For private subnets, run:
60+
+
61+
[source,terminal]
62+
----
63+
$ aws ec2 create-tags --resources <private-subnet-id> --tags Key=kubernetes.io/role/internal-elb,Value=1
64+
----
65+
66+
.Verification
67+
68+
. Verify that the tag is correctly applied by running the following command:
69+
+
70+
[source,terminal]
71+
----
72+
$ aws ec2 describe-tags --filters "Name=resource-id,Values=<subnet_id>"
73+
----
74+
+
75+
.Example output
76+
+
77+
[source,text]
78+
----
79+
TAGS Name <subnet-id> subnet <prefix>-subnet-public1-us-east-1a
80+
TAGS kubernetes.io/role/elb <subnet-id> subnet 1
81+
----

‎rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,14 +92,17 @@ include::modules/rosa-hcp-vpc-terraform.adoc[leveloffset=+3]
9292
* See the link:https://github.com/openshift-cs/terraform-vpc-example[Terraform VPC] repository for a detailed list of all options available when customizing the VPC for your needs.
9393

9494
[discrete]
95-
include::modules/rosa-hcp-vpc-manual.adoc[leveloffset=+3]
95+
include::modules/rosa-hcp-vpc-manual.adoc[leveloffset=+2]
96+
[discrete]
97+
include::modules/rosa-hcp-vpc-subnet-tagging.adoc[leveloffset=+2]
9698

9799
[role="_additional-resources"]
98100
[id="additional-resources_rosa-hcp-vpc-aws"]
99101
.Additional resources
100102

101103
* link:https://docs.aws.amazon.com/vpc/latest/userguide/vpc-getting-started.html[Get Started with Amazon VPC]
102104
* link:https://developer.hashicorp.com/terraform[HashiCorp Terraform documentation]
105+
* link:https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/deploy/subnet_discovery/[Subnet Auto Discovery]
103106

104107
include::modules/rosa-hcp-creating-account-wide-sts-roles-and-policies.adoc[leveloffset=+2]
105108

0 commit comments

Comments
 (0)