You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
= Associating your AWS account with your Red Hat organization
8
+
9
+
Before using {cluster-manager-first} to create {product-title} (ROSA) clusters that use the AWS Security Token Service (STS), create an {cluster-manager} IAM role and link it to your Red Hat organization. Then, create a user IAM role and link it to your Red Hat user account in the same Red Hat organization.
10
+
11
+
.Prerequisites
12
+
13
+
* You have completed the AWS prerequisites for ROSA with STS.
14
+
* You have available AWS service quotas.
15
+
* You have enabled the ROSA service in the AWS Console.
16
+
* You have installed and configured the latest ROSA CLI (`rosa`) on your installation host.
17
+
+
18
+
[NOTE]
19
+
====
20
+
To successfully install ROSA clusters, use the latest version of the ROSA CLI.
21
+
====
22
+
* You have logged in to your Red Hat account by using the `rosa` CLI.
23
+
* You have organization administrator privileges in your Red Hat organization.
24
+
25
+
.Procedure
26
+
27
+
. Create an {cluster-manager} role and link it to your Red Hat organization:
28
+
+
29
+
[source,terminal]
30
+
----
31
+
$ rosa create ocm-role --admin
32
+
----
33
+
+
34
+
Select the default values at the prompts to quickly create and link the role.
35
+
+
36
+
[NOTE]
37
+
====
38
+
If you want to enable automatic deployment of the cluster-specific Operator roles and the OpenID Connect (OIDC) provider using {cluster-manager}, you must apply the administrative privileges to the role. For more information about the basic and administrative privileges for the {cluster-manager} role, see _Understanding AWS account association_.
39
+
====
40
+
41
+
. Create a user role and link it to your {cluster-manager} user account:
42
+
+
43
+
[source,terminal]
44
+
----
45
+
$ rosa create user-role
46
+
----
47
+
+
48
+
Select the default values at the prompts to quickly create and link the role
49
+
+
50
+
[NOTE]
51
+
====
52
+
The Red Hat user account must exist in the Red Hat organization that is linked to your {cluster-manager} role.
When using the {product-title} (ROSA) CLI (`rosa`) to create a cluster that uses the AWS Security Token Service (STS), you can select the default options to create the cluster quickly.
11
11
@@ -18,7 +18,7 @@ When using the {product-title} (ROSA) CLI (`rosa`) to create a cluster that uses
18
18
+
19
19
[NOTE]
20
20
====
21
-
To successfully install ROSA 4.10 clusters, use the latest version of the ROSA CLI.
21
+
To successfully install ROSA clusters, use the latest version of the ROSA CLI.
22
22
====
23
23
* You have logged in to your Red Hat account by using the `rosa` CLI.
24
24
* You have verified that the AWS Elastic Load Balancing (ELB) service role exists in your AWS account.
= Creating a cluster with the default options using {cluster-manager}
8
+
9
+
When using {cluster-manager-first} to create a {product-title} (ROSA) cluster that uses the AWS Security Token Service (STS), you can select the default options to create the cluster quickly. You can also use the admin {cluster-manager} IAM role to enable automatic deployment of the cluster-specific Operator roles and the OpenID Connect (OIDC) provider.
10
+
11
+
.Prerequisites
12
+
13
+
* You have completed the AWS prerequisites for ROSA with STS.
14
+
* You have available AWS service quotas.
15
+
* You have enabled the ROSA service in the AWS Console.
16
+
* You have installed and configured the latest ROSA CLI (`rosa`) on your installation host.
17
+
+
18
+
[NOTE]
19
+
====
20
+
To successfully install ROSA clusters, use the latest version of the ROSA CLI.
21
+
====
22
+
* You have verified that the AWS Elastic Load Balancing (ELB) service role exists in your AWS account.
23
+
* You have associated your AWS account with your Red Hat organization. When you associated your account, you applied the administrative permissions to the {cluster-manager} role. For detailed steps, see _Associating your AWS account with your Red Hat organization_.
24
+
* You have created the required account-wide STS roles and policies, including the Operator policies. For detailed steps, see _Creating the account-wide STS roles and policies_.
25
+
26
+
.Procedure
27
+
28
+
. Navigate to {cluster-manager-url} and select *Create cluster*.
29
+
30
+
. On the *Create an OpenShift cluster* page, select *Create cluster* in the *{product-title} (ROSA)* row.
31
+
32
+
. Review and complete the *Prerequisites* listed on the *Accounts and roles* page. Select the checkbox to acknowledge that you have read and completed all of the prerequisites.
33
+
34
+
. Verify that your AWS account ID is listed in the *Associated AWS accounts* drop-down menu and that the installer, support, worker, and control plane account role Amazon Resource Names (ARNs) are listed on the *Accounts and roles* page.
35
+
+
36
+
[NOTE]
37
+
====
38
+
If your AWS account ID is not listed, check that you have successfully associated your AWS account with your Red Hat organization. If your account role ARNs are not listed, check that the required account-wide STS roles exist in your AWS account.
39
+
====
40
+
41
+
. Click *Next*.
42
+
43
+
. On the *Cluster details* page, provide a *Cluster name*. Leave the default values in the remaining fields and click *Next*.
44
+
45
+
. To deploy a cluster quickly, leave the default options in the *Cluster settings*, *Networking*, *Cluster roles and policies*, and *Cluster updates* pages and click *Next* on each page.
46
+
47
+
. On the *Review your ROSA cluster* page, review the summary of your selections and click *Create cluster* to start the installation.
48
+
49
+
.Verification
50
+
51
+
* You can monitor the progress of the installation in the *Overview* page for your cluster. You can view the installation logs on the same page. Your cluster is ready when the *Status* in the *Details* section of the page is listed as *Ready*.
52
+
+
53
+
[NOTE]
54
+
====
55
+
If the installation fails or the cluster *State* does not change to *Ready* after about 40 minutes, check the installation troubleshooting documentation for details. For more information, see _Troubleshooting installations_. For steps to contact Red Hat Support for assistance, see _Getting support for Red Hat OpenShift Service on AWS_.
To successfully install ROSA 4.10 clusters, use latest version of the ROSA CLI.
34
+
To successfully install ROSA clusters, use latest version of the ROSA CLI.
35
35
====
36
36
* If you are using a customer-managed AWS Key Management Service (KMS) key for encryption, you have created a symmetric KMS key and you have the key ID and Amazon Resource Name (ARN). For more information about creating AWS KMS keys, see link:https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html[the AWS documentation].
To successfully install ROSA 4.10 clusters, use the latest version of the ROSA CLI.
30
+
To successfully install ROSA clusters, use the latest version of the ROSA CLI.
31
31
====
32
-
* You have logged in to your Red Hat account by using the `rosa` CLI.
33
32
* You have verified that the AWS Elastic Load Balancing (ELB) service role exists in your AWS account.
34
33
35
34
.Procedure
@@ -40,8 +39,9 @@ To successfully install ROSA 4.10 clusters, use the latest version of the ROSA C
40
39
41
40
. Review and complete the *Prerequisites* listed on the *Accounts and roles* page. Select the checkbox to acknowledge that you have read and completed all of the prerequisites.
42
41
43
-
. Select an AWS account from the *Associated AWS account* drop-down menu. If no associated AWS accounts are found, click *Associate AWS account* and follow these steps:
44
-
.. On the *Authenticate* page, click the copy button next to the `rosa login` command. The provided command includes your ROSA API login token.
42
+
. If an AWS account is automatically detected, the account ID is listed in the *Associated AWS accounts* drop-down menu. If no AWS accounts are automatically detected, click *Select an account*->*Associate AWS account* and follow these steps:
43
+
+
44
+
.. On the *Authenticate* page, click the copy button next to the `rosa login` command. The command includes your {cluster-manager} API login token.
45
45
+
46
46
[NOTE]
47
47
====
@@ -61,7 +61,7 @@ $ rosa login --token=<api_login_token> <1>
61
61
----
62
62
I: Logged in as '<username>' on 'https://api.openshift.com'
63
63
----
64
-
.. On the *Authenticate page* in {cluster-manager}, click *Next*.
64
+
.. On the *Authenticate* page in {cluster-manager}, click *Next*.
65
65
.. On the *OCM role* page, click the copy button next to the *Basic OCM role* or the *Admin OCM role* commands.
66
66
+
67
67
The basic role enables {cluster-manager} to detect the AWS IAM roles and policies required by ROSA. The admin role also enables the detection of the roles and policies. In addition, the admin role enables automatic deployment of the cluster-specific Operator roles and the OpenID Connect (OIDC) provider by using {cluster-manager}.
@@ -101,7 +101,9 @@ $ rosa link ocm-role <arn> <1>
101
101
----
102
102
<1> Replace `<arn>` with the ARN of the {cluster-manager} IAM role that is included in the output of the preceding command.
103
103
.. Select *Next* on the {cluster-manager}*OCM role* page.
104
-
.. On the *User role* page, click the copy button for the *User role* command and run the command in the CLI. Follow the prompts to create the user role:
104
+
.. On the *User role* page, click the copy button for the *User role* command and run the command in the CLI. Red Hat uses the user role to verify your AWS identity when you install a cluster and the required resources with {cluster-manager}.
105
+
+
106
+
Follow the prompts to create the user role:
105
107
+
106
108
[source,terminal]
107
109
----
@@ -134,11 +136,9 @@ I: Successfully linked role ARN 'arn:aws:iam::<aws_account_id>:role/ManagedOpenS
134
136
$ rosa link user-role <arn> <1>
135
137
----
136
138
<1> Replace `<arn>` with the ARN of the user role that is included in the output of the preceding command.
137
-
.. On the {cluster-manager}*User role* page, select *Ok*.
138
-
.. Under the *Accounts and roles* page, verify that your AWS account is listed as an *Associated AWS account*.
139
-
140
-
. If the required AWS IAM *Account roles* are not automatically detected and listed on the *Accounts and roles* page, create the roles and policies:
141
-
.. Click the copy buffer next to the `rosa create account-roles` command. Run the command in the CLI to create the required AWS account-wide roles and policies, including the Operator policies::
139
+
.. On the {cluster-manager}*User role* page, click *Ok*.
140
+
.. Verify that the AWS account ID is listed in the *Associated AWS accounts* drop-down menu on the *Accounts and roles* page.
141
+
.. If the required account roles do not exist, a notification is provided stating that *Some account roles ARNs were not detected*. You can create the AWS account-wide roles and policies, including the Operator policies, by clicking the copy buffer next to the `rosa create account-roles` command and running the command in the CLI:
142
142
+
143
143
[source,terminal]
144
144
----
@@ -183,9 +183,14 @@ rosa create cluster --sts
183
183
<3> Selects the role creation mode. You can use `auto` mode to automatically create the account wide roles and policies. In `manual` mode, the `rosa` CLI generates the `aws` commands needed to create the roles and policies. In `manual` mode, the corresponding policy JSON files are also saved to the current directory. `manual` mode enables you to review the details before running the `aws` commands manually.
184
184
<4> Creates the account-wide installer, control plane, worker and support roles and corresponding IAM policies. For more information, see _Account-wide IAM role and policy reference_.
185
185
<5> Creates the cluster-specific Operator IAM roles that permit the ROSA cluster Operators to carry out core OpenShift functionality. For more information, see _Account-wide IAM role and policy reference_.
186
-
.. On the *Accounts and roles* page, click *Refresh ARNs* and verify that the installer, support, worker, and control plane account roles are detected.
186
+
.. On the *Accounts and roles* page, click *Refresh ARNs* and verify that the installer, support, worker, and control plane account role ARNs are listed.
187
187
188
-
. Select *Next*.
188
+
. Click *Next*.
189
+
+
190
+
[NOTE]
191
+
====
192
+
If the *Accounts and roles* page was refreshed, you might need to select the checkbox again to acknowledge that you have read and completed all of the prerequisites.
193
+
====
189
194
190
195
. On the *Cluster details* page, provide a name for your cluster and specify the cluster details:
191
196
.. Add a *Cluster name*.
@@ -244,7 +249,7 @@ Alternatively, you can set your autoscaling preferences for the default machine
244
249
If you are using private API endpoints, you cannot access your cluster until you update the network settings in your cloud provider account.
245
250
====
246
251
247
-
. Optional: If you opted to use public API endpoints, you can select *Install into an existing VPC*to install your cluster into an existing VPC.
252
+
. Optional: If you opted to use public API endpoints, by default a new VPC is created for your cluster. If you want to install your cluster in an existing VPC instead, select *Install into an existing VPC*.
= Creating the account-wide STS roles and policies
8
+
9
+
Before using {cluster-manager-first} to create {product-title} (ROSA) clusters that use the AWS Security Token Service (STS), create the required account-wide STS roles and policies, including the Operator policies.
10
+
11
+
.Prerequisites
12
+
13
+
* You have completed the AWS prerequisites for ROSA with STS.
14
+
* You have available AWS service quotas.
15
+
* You have enabled the ROSA service in the AWS Console.
16
+
* You have installed and configured the latest ROSA CLI (`rosa`) on your installation host.
17
+
+
18
+
[NOTE]
19
+
====
20
+
To successfully install ROSA clusters, use the latest version of the ROSA CLI.
21
+
====
22
+
* You have logged in to your Red Hat account by using the `rosa` CLI.
23
+
24
+
.Procedure
25
+
26
+
. If they do not exist in your AWS account, create the required account-wide STS roles and policies, including the Operator policies:
27
+
+
28
+
[source,terminal]
29
+
----
30
+
$ rosa create account-roles
31
+
----
32
+
+
33
+
Select the default values at the prompts to quickly create the roles and policies.
You can quickly create a {product-title} (ROSA) cluster with the AWS Security Token Service (STS) by using the default installation options. The following summary describes the default cluster specifications.
10
+
11
+
.Default ROSA with STS cluster specifications
12
+
[cols=".^1,.^3a",options="header"]
13
+
|===
14
+
15
+
|Component
16
+
|Default specifications
17
+
18
+
|Accounts and roles
19
+
|* Default IAM role prefix: `ManagedOpenShift`
20
+
21
+
|Cluster settings
22
+
|* Default cluster version: Latest
23
+
* Default AWS region for installations using {cluster-manager}: us-east-1 (US East, North Virginia)
24
+
* Default AWS region for installations using the `rosa` CLI: Defined by your `aws` CLI configuration
25
+
* Availability: Single zone
26
+
* Monitoring for user-defined projects: Enabled
27
+
28
+
|Encryption
29
+
|* Cloud storage is encrypted at rest
30
+
* Additional etcd encryption is not enabled
31
+
* The default AWS Key Management Service (KMS) key is used as the encryption key for persistent data
Before you can use {cluster-manager-first} to create {product-title} (ROSA) clusters that use the AWS Security Token Service (STS), you must associate your AWS account with your Red Hat organization. You can associate your account by creating and linking the following IAM roles.
17
+
18
+
{cluster-manager} role:: Create an {cluster-manager} IAM role and link it to your Red Hat organization.
19
+
+
20
+
You can apply basic or administrative permissions to the {cluster-manager} role. The basic permissions enable cluster maintenance using {cluster-manager}. The administrative permissions enable automatic deployment of the cluster-specific Operator roles and the OpenID Connect (OIDC) provider using {cluster-manager}.
21
+
ifdef::quick-install[]
22
+
+
23
+
You can use the administrative permissions with the {cluster-manager} role to deploy a cluster quickly.
24
+
endif::quick-install[]
25
+
26
+
User role:: Create a user IAM role and link it to your Red Hat user account. The Red Hat user account must exist in the Red Hat organization that is linked to your {cluster-manager} role.
27
+
+
28
+
The user role is used by Red Hat to verify your AWS identity when you use {cluster-manager} to install a cluster and the required STS resources.
0 commit comments