You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
You must create the `ocm-role` IAM resource to enable a Red Hat organization of users to create ROSA clusters.
10
+
11
+
Some considerations for your `ocm-role` IAM resource are:
12
+
13
+
* You have only one `ocm-role` per AWS account in a Red Hat organization. You can have multiple `ocm-role` IAM roles in a Red Hat organization as long as these roles are for different AWS accounts.
14
+
* Any user in a Red Hat organization may create and link an `ocm-role` IAM resource.
15
+
* Only the Red Hat Organization Administrator can unlink an `ocm-role` IAM resource. This limitation is to protect other Red Hat organization members from disturbing the interface capabilities of other users.
16
+
+
17
+
[NOTE]
18
+
====
19
+
If you just created a Red Hat account that is not part of an existing organization, this account is also the Red Hat Organization Administrator.
20
+
====
21
+
+
22
+
* Only one `ocm-role` IAM resource can be created per AWS account per Red Hat organization.
23
+
* See the associated permission tables for a list of the AWS permissions policy for the basic and admin `ocm-role` IAM resources.
24
+
25
+
Using the `rosa` CLI, you can link your IAM resource when you create it.
26
+
27
+
[NOTE]
28
+
====
29
+
"Linking" or "associating" your IAM resources with your AWS account means creating a trust-policy with your `ocm-role` IAM role and the Red Hat {cluster-manager} AWS role. After creating and linking your IAM resource, you see a trust relationship from your `ocm-role` IAM resource in AWS with the `arn:aws:iam::7333:role/RH-Managed-OpenShift-Installer` resource.
30
+
====
31
+
32
+
After a Red Hat Organization Administrator has created and linked an `ocm-role` IAM resource, all organization members may want to create and link their own `user-role` IAM role. This IAM resource only needs to be created and linked only once per user. If another user in your Red Hat organization has already created and linked an `ocm-role` IAM resource, you need to ensure you have created and linked your own `user-role` IAM role.
You need to create the `user-role` IAM role to enable a Red Hat organization of users to create ROSA clusters.
11
+
12
+
Some considerations for your `user-role` IAM role are:
13
+
14
+
* You only need one `user-role` IAM role per Red Hat user account, but your Red Hat organization can have many of these IAM resources.
15
+
* Any user in a Red Hat organization may create and link an `user-role` IAM role.
16
+
* There can be numerous `user-role` IAM roles per AWS account per Red Hat organization.
17
+
* Red Hat uses the `user-role` IAM role to identify the user. This IAM resource has no AWS account permissions.
18
+
19
+
[NOTE]
20
+
====
21
+
"Linking" or "associating" your IAM resources with your AWS account means creating a trust-policy with your `user-role` IAM role and the Red Hat {cluster-manager} AWS role. After creating and linking this IAM resource, you see a trust relationship from your `user-role` IAM role in AWS with the `arn:aws:iam::710019948333:role/RH-Managed-OpenShift-Installer` resource.
// You can create account-wide roles by using the `rosa` CLI tool or the {cluster-manager-url} guided installation. You can create the roles manually or by using an automatic process that uses pre-defined names for these roles and polices.
18
-
//
19
-
// Commenting out until ROSA UI release
15
+
You can create account-wide roles by using the `rosa` CLI tool or the {cluster-manager-url} guided installation. You can create the roles manually or by using an automatic process that uses pre-defined names for these roles and polices.
20
16
21
17
You can create account-wide roles by using the `rosa` CLI tool. You can create the roles manually or by using an automatic process that uses pre-defined names for these roles and polices.
// You can use the manual creation method if you have the necessary CLI access to create these roles on your system. You can run this option in your desired CLI tool or from {cluster-manager}. After you start the manual creation process, the CLI presents a series of commands for you to run that create the roles and link them to the needed policies.
30
-
//
31
-
// Commenting out until ROSA UI release
32
-
33
23
You can use the manual creation method if you have the necessary CLI access to create these roles on your system. You can run this option in your desired CLI tool or from {cluster-manager}. After you start the manual creation process, the CLI presents a series of commands for you to run that create the roles and link them to the needed policies.
// If you created an `ocm-role` resource with administrative permissions, you can use the automatic creation method in the CLI and from {cluster-manager}. Selecting this method creates the roles and policies that uses the default names.
42
-
//
43
-
// If you use the ROSA guided installation on {cluster-manager}, you must have created an `ocm-role` resource with administrative permissions in the first step of the guided cluster installation. Without this role, you cannot use the automatic Operator role and policy creation option.
44
-
//
45
-
// Commenting out until ROSA UI release
29
+
If you created an `ocm-role` resource with administrative permissions, you can use the automatic creation method from {cluster-manager}. The `rosa` CLI does not require that you have this admin `ocm-role` IAM resource to automatically create these roles and polices. Selecting this method creates the roles and policies that uses the default names.
46
30
47
-
If you created an `ocm-role` resource with administrative permissions, you can use the automatic creation method in the CLI. Selecting this method creates the roles and policies that uses the default names.
31
+
If you use the ROSA guided installation on {cluster-manager}, you must have created an `ocm-role` resource with administrative permissions in the first step of the guided cluster installation. Without this role, you cannot use the automatic Operator role and policy creation option, but you can still create the cluster and its roles and policies with the manual process.
* Red Hat must have AWS console access to the customer-provided AWS account. Red Hat protects and manages this access.
9
+
* You must not use the AWS account to elevate your permissions within the {product-title} cluster.
10
+
* Actions available in the `rosa` CLI utility or {cluster-manager-url} console must not be directly performed in your AWS account.
11
+
* You do not need to have a preconfigured domain to deploy ROSA clusters. If you wish to use a custom domain, see the Additional resources for information.
* You must ensure that the AWS limits are sufficient to support {product-title} provisioned within your AWS account. Running `rosa verify quota` in the CLI validates that you have the required quota to run a cluster.
8
+
+
9
+
[NOTE]
10
+
====
11
+
Quota verification checks your AWS quota, but it does not compare your consumption to your AWS quota. See the "Limits and scalability" link in Additional resources for more information.
12
+
====
13
+
+
14
+
* If SCP policies are applied and enforced, these policies must not be more restrictive than the roles and policies required by the cluster.
15
+
* Your AWS account should not be transferable to Red Hat.
16
+
* You should not impose additional AWS usage restrictions beyond the defined roles and policies on Red Hat activities. Imposing restrictions will severely hinder Red Hat's ability to respond to incidents.
17
+
* You may deploy native AWS services within the same AWS account.
18
+
* Your account must have a service-linked role set up as it is required for elastic load balancers (ELBs) to be configured. See the "Creating the service role for the elastic load balancer (ELB)" link in the Additional resources for information about creating a service-linked role for your ELB if you have not created a load balancer in your AWS account previously.
19
+
+
20
+
[NOTE]
21
+
====
22
+
You are encouraged, but not required, to deploy resources in a Virtual Private Cloud (VPC) separate from the VPC hosting {product-title} and other Red Hat supported services.
{product-title} (ROSA) cluster-provisioning tasks require linking `ocm-role` and `user-role`{cluster-manager} IAM resources to your AWS account using your Amazon Resource Name (ARN).
11
+
12
+
The `ocm-role` ARN is stored as a label in your Red Hat organization while the `user-role` ARN is stored as a label inside your Red Hat user account. Red Hat uses these ARN labels to confirm that the user is a valid account holder and that the correct permissions are available to perform the necessary tasks in the AWS account.
* You are using {cluster-manager-url} to create clusters.
16
+
* You have the permissions required to install AWS account-wide roles.
17
+
* You have installed and configured the latest AWS (`aws`) and ROSA (`rosa`) CLIs on your installation host.
18
+
* You have created your `ocm-role` and `user-role` IAM roles.
19
+
20
+
.Procedure
21
+
22
+
. From the CLI, link your `ocm-role` resource to your Red Hat organization by using your Amazon Resource Name (ARN):
23
+
+
24
+
[NOTE]
25
+
====
26
+
You must have Red Hat Organization Administrator privileges to run the `rosa link` command. After you link the `ocm-role` resource with your AWS account, it is visible for all users in the organization.
27
+
====
28
+
+
29
+
[source,terminal]
30
+
----
31
+
$ rosa link ocm-role --role-arn <arn>
32
+
----
33
+
+
34
+
.Example output
35
+
[source,terminal]
36
+
----
37
+
I: Linking OCM role
38
+
? Link the '<AWS ACCOUNT ID>` role with organization '<ORG ID>'? Yes
= Associating multiple AWS accounts with your Red Hat organization
9
+
10
+
You can associate multiple AWS accounts with your Red Hat organization. Associating multiple accounts lets you create {product-title} (ROSA) clusters on any of the associated AWS accounts from your Red Hat organization.
11
+
12
+
With this feature, you can create clusters in different AWS regions by using multiple AWS profiles as region-bound environments.
13
+
14
+
.Prerequisites
15
+
16
+
* You have an AWS account.
17
+
* You are using {cluster-manager-url} to create clusters.
18
+
* You have the permissions required to install AWS account-wide roles.
19
+
* You have installed and configured the latest AWS (`aws`) and ROSA (`rosa`) CLIs on your installation host.
20
+
* You have created your `ocm-role` and `user-role` IAM roles.
21
+
22
+
.Procedure
23
+
24
+
To associate an additional AWS account, first create a profile in your local AWS configuration. Then, associate the account with your Red Hat organization by creating the `ocm-role`, user, and account roles in the additional AWS account.
25
+
26
+
To create the roles in an additional region, specify the `--profile <aws-profile>` parameter when running the `rosa create` commands and replace `<aws_profile>` with the additional account profile name:
27
+
28
+
* To specify an AWS account profile when creating an {cluster-manager} role:
29
+
+
30
+
[source,terminal]
31
+
----
32
+
$ rosa create --profile <aws_profile> ocm-role
33
+
----
34
+
35
+
* To specify an AWS account profile when creating a user role:
36
+
+
37
+
[source,terminal]
38
+
----
39
+
$ rosa create --profile <aws_profile> user-role
40
+
----
41
+
42
+
* To specify an AWS account profile when creating the account roles:
43
+
+
44
+
[source,terminal]
45
+
----
46
+
$ rosa create --profile <aws_profile> account-roles
47
+
----
48
+
49
+
[NOTE]
50
+
====
51
+
If you do not specify a profile, the default AWS profile is used.
0 commit comments