You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Custom domains are specific wildcard domains that can be used with {product-title} applications. The top-level domains (TLDs) are owned by the customer that is operating the {product-title} cluster. The Custom Domains Operator sets up a new `ingresscontroller` with a custom certificate as a second day operation. The public DNS record for this `ingresscontroller` can then be used by an external DNS to create a wildcard CNAME record for use with a custom domain.
Copy file name to clipboardExpand all lines: modules/rosa-sts-aws-requirements.adoc
+15-10Lines changed: 15 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,22 +9,26 @@ The following prerequisites must be complete before you deploy a {product-title}
9
9
10
10
[id="rosa-account_{context}"]
11
11
== Account
12
-
* The customer ensures that the link:https://docs.aws.amazon.com/general/latest/gr/aws_service_limits.html[AWS limits] are sufficient to support {product-title} provisioned within the customer's AWS account.
12
+
* You must ensure that the AWS limits are sufficient to support {product-title} provisioned within your AWS account. Running `rosa verify quota` in the CLI validates that you have the required quota to run a cluster.
13
+
+
14
+
[NOTE]
15
+
====
16
+
Quota verification checks your AWS quota, but it does not compare your consumption to your AWS quota. See the "Limits and scalability" link in Additional resources for more information.
17
+
====
18
+
+
13
19
* If SCP policies are applied and enforced, these policies must not be more restrictive than the roles and policies required by the cluster.
14
-
* The customer's AWS account should not be transferable to Red Hat.
15
-
* The customer should not impose additional AWS usage restrictions beyond the defined roles and policies on Red Hat activities. Imposing restrictions will severely hinder Red Hat's ability to respond to incidents.
16
-
* The customer may deploy native AWS services within the same AWS account.
17
-
* The account must have a service-linked role set up as it is required for elastic load balancers (ELBs) to be configured.
20
+
* You may deploy native AWS services within the same AWS account.
21
+
* Your account must have a service-linked role set up as it is required for elastic load balancers (ELBs) to be configured. See AWS Limits in Additional resources for information about creating a service-linked role for your ELB if you have not created a load balancer in your AWS account previously.
18
22
+
19
23
[NOTE]
20
24
====
21
-
Customers are encouraged, but not mandated, to deploy resources in a Virtual Private Cloud (VPC) separate from the VPC hosting {product-title} and other Red Hat supported services.
25
+
You are encouraged, but not required, to deploy resources in a Virtual Private Cloud (VPC) separate from the VPC hosting {product-title} and other Red Hat supported services.
22
26
====
23
27
24
28
[id="rosa-associating-account_{context}"]
25
29
== Associating your AWS account
26
30
27
-
To perform {product-title} (ROSA) clusterprovisioning tasks, you must create `ocm-role` and `user-role` IAM resources in your AWS account and link them to your Red Hat organization.
31
+
{product-title} (ROSA) cluster-provisioning tasks require linking `ocm-role` and `user-role` {cluster-manager} IAM resources to your AWS account using your Amazon Resource Name (ARN).
28
32
29
33
The `ocm-role` ARN is stored as a label in your Red Hat organization while the `user-role` ARN is stored as a label inside your Red Hat user account. Red Hat uses these ARN labels to confirm that the user is a valid account holder and that the correct permissions are available to perform the necessary tasks in the AWS account.
30
34
@@ -124,8 +128,9 @@ If you do not specify a profile, the default AWS profile is used.
124
128
== Access requirements
125
129
126
130
* Red Hat must have AWS console access to the customer-provided AWS account. This access is protected and managed by Red Hat.
127
-
* The customer must not utilize the AWS account to elevate their permissions within the {product-title} cluster.
128
-
* Actions available in the `rosa` CLI utility or {cluster-manager-url} console must not be directly performed in the customer's AWS account.
131
+
* You must not use the AWS account to elevate your permissions within the {product-title} cluster.
132
+
* Actions available in the `rosa` CLI utility or {cluster-manager-url} console must not be directly performed in your AWS account.
133
+
* You do not need to have a preconfigured domain to deploy ROSA clusters. If you want to use a custom domain, see Additional resources for information.
129
134
130
135
[id="rosa-support-requirements_{context}"]
131
136
== Support requirements
@@ -138,4 +143,4 @@ If you do not specify a profile, the default AWS profile is used.
138
143
== Security requirements
139
144
* Volume snapshots will remain within the customer's AWS account and customer-specified region.
140
145
* Red Hat must have ingress access to EC2 hosts and the API server from allow-listed IP addresses.
141
-
* Red Hat must have egress allowed to the documented domains.
146
+
* Red Hat must have egress allowed to the documented domains. See the "AWS firewall prerequisites" section for the designated domains.
If you have not created a load balancer in your AWS account, it is possible that the service role for the elastic load balancer (ELB) might not exist yet. You may receive the following error:
47
-
48
-
[source,terminal]
49
-
----
50
-
Error: Error creating network Load Balancer: AccessDenied: User: arn:aws:sts::xxxxxxxxxxxx:assumed-role/ManagedOpenShift-Installer-Role/xxxxxxxxxxxxxxxxxxx is not authorized to perform: iam:CreateServiceLinkedRole on resource: arn:aws:iam::xxxxxxxxxxxx:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing"
51
-
----
52
-
53
-
To resolve this issue, ensure that the role exists on your AWS account. If not, create this role with the following command:
54
-
55
-
[source,terminal]
56
-
----
57
-
aws iam get-role --role-name "AWSServiceRoleForElasticLoadBalancing" || aws iam create-service-linked-role --aws-service-name "elasticloadbalancing.amazonaws.com"
58
-
----
59
-
60
-
[NOTE]
61
-
====
62
-
This command only needs to be executed once per account.
= Creating the service role for the elastic load balancer (ELB)
7
+
8
+
If you have not created a load balancer in your AWS account, it is possible that the service role for the elastic load balancer (ELB) might not exist yet. You may receive the following error:
9
+
10
+
[source,terminal]
11
+
----
12
+
Error: Error creating network Load Balancer: AccessDenied: User: arn:aws:sts::xxxxxxxxxxxx:assumed-role/ManagedOpenShift-Installer-Role/xxxxxxxxxxxxxxxxxxx is not authorized to perform: iam:CreateServiceLinkedRole on resource: arn:aws:iam::xxxxxxxxxxxx:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing"
13
+
----
14
+
15
+
To resolve this issue, ensure that the role exists on your AWS account. If not, create this role with the following command:
16
+
17
+
[source,terminal]
18
+
----
19
+
aws iam get-role --role-name "AWSServiceRoleForElasticLoadBalancing" || aws iam create-service-linked-role --aws-service-name "elasticloadbalancing.amazonaws.com"
20
+
----
21
+
22
+
[NOTE]
23
+
====
24
+
This command only needs to be executed once per account.
If a cluster creation action fails, you can receive the following error message.
21
+
22
+
.Example output
23
+
[source,terminal]
24
+
----
25
+
Failed to create cluster: Unable to create cluster spec: Failed to get access keys for user 'osdCcsAdmin': NoSuchEntity: The user with name osdCcsAdmin cannot be found.
* xref:../rosa_planning/rosa-limits-scalability.adoc#rosa-limits-scalability[Limits and scalability]
36
36
* xref:../rosa_architecture/rosa_policy_service_definition/rosa-policy-process-security.adoc#rosa-policy-sre-access_rosa-policy-process-security[SRE access to all Red Hat OpenShift Service on AWS clusters]
37
+
* xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-applications-config-custom-domains[Configuring custom domains for applications]
* xref:../rosa_support/rosa-troubleshooting-deployments.adoc#rosa-troubleshooting-general-deployment-elb[Creating the service role for the Elastic load balancer (ELB)]
0 commit comments