Skip to content

Commit 795b239

Browse files
xenolinuxxenolinux
authored
Merge pull request #82314 from openshift-cherrypick-robot/cherry-pick-82143-to-enterprise-4.17
[enterprise-4.17] OSDOCS#11004: Part 2: Migration: Manage AWS on HCP
2 parents eb37a07 + 82cc24b commit 795b239

13 files changed

+777
-2
lines changed

‎hosted_control_planes/hcp-manage/hcp-manage-aws.adoc‎

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,34 @@
11
:_mod-docs-content-type: ASSEMBLY
22
[id="hcp-manage-aws"]
33
include::_attributes/common-attributes.adoc[]
4-
= Managing {hcp} on AWS
4+
= Managing {hcp} on {aws-short}
55
:context: hcp-managing-aws
66

7-
toc::[]
7+
toc::[]
8+
9+
When you use {hcp} for {product-title} on {aws-first}, the infrastructure requirements vary based on your setup.
10+
11+
12+
include::modules/hcp-manage-aws-prereq.adoc[leveloffset=+1]
13+
14+
include::modules/hcp-manage-aws-infra-req.adoc[leveloffset=+2]
15+
16+
include::modules/hcp-manage-aws-infra-ho-req.adoc[leveloffset=+2]
17+
18+
include::modules/hcp-unmanaged-aws-hc-prereq.adoc[leveloffset=+2]
19+
20+
include::modules/hcp-managed-aws-infra-mgmt.adoc[leveloffset=+2]
21+
22+
include::modules/hcp-managed-aws-infra-hc.adoc[leveloffset=+2]
23+
24+
include::modules/hcp-k8s-managed-aws-infra-hc.adoc[leveloffset=+2]
25+
26+
include::modules/hcp-managed-aws-iam.adoc[leveloffset=+1]
27+
28+
include::modules/hcp-managed-aws-infra-iam-separate.adoc[leveloffset=+1]
29+
30+
include::modules/hcp-managed-aws-infra-separate.adoc[leveloffset=+2]
31+
32+
include::modules/hcp-managed-aws-iam-separate.adoc[leveloffset=+2]
33+
34+
include::modules/hcp-managed-aws-hc-separate.adoc[leveloffset=+2]

‎modules/hcp-k8s-managed-aws-infra-hc.adoc‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * hosted_control_planes/hcp-manage/hcp-manage-aws.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="hcp-k8s-managed-aws-infra-hc_{context}"]
7+
= Kubernetes-managed infrastructure in a hosted cluster {aws-short} account
8+
9+
When Kubernetes manages your infrastructure in a hosted cluster {aws-first} account, the infrastructure requirements are as follows:
10+
11+
* A network load balancer for default Ingress
12+
* An S3 bucket for registry

‎modules/hcp-manage-aws-infra-ho-req.adoc‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * hosted_control_planes/hcp-manage/hcp-manage-aws.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="hcp-manage-aws-infra-ho-req_{context}"]
7+
= Unmanaged infrastructure for the HyperShift Operator in an {aws-short} account
8+
9+
An arbitrary {aws-first} account depends on the provider of the {hcp} service.
10+
11+
In self-managed {hcp}, the cluster service provider controls the {aws-short} account. The cluster service provider is the administrator who hosts cluster control planes and is responsible for uptime. In managed {hcp}, the {aws-short} account belongs to Red Hat.
12+
13+
In a prerequired and unmanaged infrastructure for the HyperShift Operator, the following infrastructure requirements apply for a management cluster {aws-short} account:
14+
15+
* One S3 Bucket
16+
** OpenID Connect (OIDC)
17+
18+
* Route 53 hosted zones
19+
** A domain to host private and public entries for hosted clusters

‎modules/hcp-manage-aws-infra-req.adoc‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * hosted_control_planes/hcp-manage/hcp-manage-aws.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="hcp-manage-aws-infra-req_{context}"]
7+
= Infrastructure requirements for {aws-short}
8+
9+
When you use {hcp} on {aws-first}, the infrastructure requirements fit in the following categories:
10+
11+
* Prerequired and unmanaged infrastructure for the HyperShift Operator in an arbitrary {aws-short} account
12+
* Prerequired and unmanaged infrastructure in a hosted cluster {aws-short} account
13+
* {hcp-capital}-managed infrastructure in a management {aws-short} account
14+
* {hcp-capital}-managed infrastructure in a hosted cluster {aws-short} account
15+
* Kubernetes-managed infrastructure in a hosted cluster {aws-short} account
16+
17+
Prerequired means that {hcp} requires {aws-short} infrastructure to properly work. Unmanaged means that no Operator or controller creates the infrastructure for you.

‎modules/hcp-manage-aws-prereq.adoc‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * hosted_control_planes/hcp-manage/hcp-manage-aws.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="hcp-manage-aws-prereq_{context}"]
7+
= Prerequisites to manage {aws-short} infrastructure and IAM permissions
8+
9+
To configure {hcp} for {product-title} on {aws-first}, you must meet the following the infrastructure requirements:
10+
11+
* You configured {hcp} before you can create hosted clusters.
12+
* You created an {aws-short} Identity and Access Management (IAM) role and {aws-short} Security Token Service (STS) credentials.

‎modules/hcp-managed-aws-hc-separate.adoc‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * hosted_control_planes/hcp-manage/hcp-manage-aws.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="hcp-managed-aws-hc-separate_{context}"]
7+
= Creating a hosted cluster separately
8+
9+
You can create a hosted cluster separately on {aws-first}.
10+
11+
To create a hosted cluster separately, enter the following command:
12+
13+
[source,terminal]
14+
[subs="+quotes"]
15+
----
16+
$ hcp create cluster aws \
17+
--infra-id <infra_id> \// <1>
18+
--name <hosted_cluster_name> \// <2>
19+
--sts-creds <path_to_sts_credential_file> \// <3>
20+
--pull-secret <path_to_pull_secret> \// <4>
21+
--generate-ssh \// <5>
22+
--node-pool-replicas 3
23+
--role-arn <role_name> <6>
24+
----
25+
<1> Replace `<infra_id>` with the same ID that you specified in the `create infra aws` command. This value identifies the IAM resources that are associated with the hosted cluster.
26+
<2> Replace `<hosted_cluster_name>` with the name of your hosted cluster.
27+
<3> Replace `<path_to_sts_credential_file>` with the same name that you specified in the `create infra aws` command.
28+
<4> Replace `<path_to_pull_secret>` with the name of the file that contains a valid {ocp-short} pull secret.
29+
<5> The `--generate-ssh` flag is optional, but is good to include in case you need to SSH to your workers. An SSH key is generated for you and is stored as a secret in the same namespace as the hosted cluster.
30+
<6> Replace `<role_name>` with the Amazon Resource Name (ARN), for example, `arn:aws:iam::820196288204:role/myrole`. Specify the Amazon Resource Name (ARN), for example, `arn:aws:iam::820196288204:role/myrole`. For more information about ARN roles, see "Identity and Access Management (IAM) permissions".
31+
32+
You can also add the `--render` flag to the command and redirect output to a file where you can edit the resources before you apply them to the cluster.
33+
34+
After you run the command, the following resources are applied to your cluster:
35+
36+
* A namespace
37+
* A secret with your pull secret
38+
* A `HostedCluster`
39+
* A `NodePool`
40+
* Three AWS STS secrets for control plane components
41+
* One SSH key secret if you specified the `--generate-ssh` flag.

‎modules/hcp-managed-aws-iam-separate.adoc‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * hosted_control_planes/hcp-manage/hcp-manage-aws.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id=" hcp-managed-aws-iam-separate_{context}"]
7+
= Creating the {aws-short} IAM resources
8+
9+
In {aws-first}, you must create the following IAM resources:
10+
11+
* link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html[An OpenID Connect (OIDC) identity provider in IAM], which is required to enable STS authentication.
12+
* link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html[Seven roles], which are separate for every component that interacts with the provider, such as the Kubernetes controller manager, cluster API provider, and registry
13+
* The link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html[instance profile], which is the profile that is assigned to all worker instances of the cluster

0 commit comments

Comments
 (0)