Skip to content

Commit e4cef65

Browse files
EricPonvelleEricPonvelle
committed
OSDOCS-8904: Private Cluster on ROSA with HCP docs
1 parent e049463 commit e4cef65

7 files changed

+239
-8
lines changed

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -210,6 +210,8 @@ Topics:
210210
File: rosa-hcp-sts-creating-a-cluster-quickly
211211
- Name: Creating ROSA with HCP clusters using a custom AWS KMS encryption key
212212
File: rosa-hcp-creating-cluster-with-aws-kms-key
213+
- Name: Creating a private cluster on ROSA with HCP
214+
File: rosa-hcp-aws-privatelink-creating-cluster
213215
- Name: Using the Node Tuning Operator on ROSA with HCP
214216
File: rosa-tuning-config
215217
---

‎modules/osd-aws-privatelink-about.adoc

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,34 @@
11
// Module included in the following assemblies:
22
//
33
// * rosa_install_access_delete_clusters/rosa-aws-privatelink-creating-cluster.adoc
4+
// * rosa_hcp/rosa-hcp-aws-privatelink-creating-cluster.adoc
5+
ifeval::["{context}" == "rosa-hcp-aws-privatelink-creating-cluster"]
6+
:rosa-hcp:
7+
endif::[]
8+
ifeval::["{context}" == "rosa-aws-privatelink-creating-cluster"]
9+
:rosa-standalone:
10+
endif::[]
411
:_mod-docs-content-type: CONCEPT
5-
[id="osd-aws-privatelink-about.adoc_{context}"]
12+
[id="osd-aws-privatelink-about_{context}"]
613
= Understanding AWS PrivateLink
714

15+
ifdef::rosa-hcp[]
16+
All {hcp-title} clusters are created with an AWS PrivateLink connection to expose the private Kubernetes API server to the customer's virtual private cloud (VPC).
17+
endif::rosa-hcp[]
18+
ifndef::rosa-hcp[]
819
A {product-title} cluster can be created without any requirements on public subnets, internet gateways, or network address translation (NAT) gateways. In this configuration, Red Hat uses AWS PrivateLink to manage and monitor a cluster to avoid all public ingress network traffic. Without a public subnet, it is not possible to configure an application router as public. Configuring private application routers is the only option.
20+
endif::rosa-hcp[]
921

1022
For more information, see link:https://aws.amazon.com/privatelink/[AWS PrivateLink] on the AWS website.
1123

1224
[IMPORTANT]
1325
====
1426
You can only make a PrivateLink cluster at installation time. You cannot change a cluster to PrivateLink after installation.
15-
====
27+
====
28+
29+
ifeval::["{context}" == "rosa-hcp-aws-privatelink-creating-cluster"]
30+
:!rosa-hcp:
31+
endif::[]
32+
ifeval::["{context}" == "rosa-aws-privatelink-creating-cluster"]
33+
:!rosa-standalone:
34+
endif::[]

‎modules/osd-aws-privatelink-required-resources.adoc

Lines changed: 29 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,21 @@
11
// Module included in the following assemblies:
22
//
33
// * rosa_install_access_delete_clusters/rosa-aws-privatelink-creating-cluster.adoc
4-
[id="osd-aws-privatelink-required-resources.adoc_{context}"]
4+
// * rosa_hcp/rosa-hcp-aws-privatelink-creating-cluster.adoc
5+
ifeval::["{context}" == "rosa-hcp-aws-privatelink-creating-cluster"]
6+
:rosa-hcp:
7+
endif::[]
8+
ifeval::["{context}" == "rosa-aws-privatelink-creating-cluster"]
9+
:rosa-standalone:
10+
endif::[]
11+
[id="osd-aws-privatelink-required-resources_{context}"]
512
= Requirements for using AWS PrivateLink clusters
6-
7-
For AWS PrivateLink clusters, internet gateways, NAT gateways and public subnets are not required, but the private subnets must have internet connectivity provided to install required components. At least one single private subnet is required for Single-AZ clusters and at least 3 private subnets are required for Multi-AZ clusters. The following table shows the AWS resources that are required for a successful installation:
13+
ifdef::rosa-hcp[]
14+
For {hcp-title} private clusters, internet gateways, NAT gateways, and public subnets are not required, but the private subnets must have internet connectivity to install the required components. At least one private subnet is required. The following table shows the AWS resources that are required for a successful installation:
15+
endif::rosa-hcp[]
16+
ifndef::rosa-hcp[]
17+
For AWS PrivateLink clusters, internet gateways, NAT gateways, and public subnets are not required, but the private subnets must have internet connectivity provided to install required components. At least one single private subnet is required for Single-AZ clusters and at least 3 private subnets are required for Multi-AZ clusters. The following table shows the AWS resources that are required for a successful installation:
18+
endif::rosa-hcp[]
819

920
.Required AWS resources
1021
[cols="1a,2a,3a",options="header"]
@@ -14,11 +25,11 @@ For AWS PrivateLink clusters, internet gateways, NAT gateways and public subnets
1425
|* AWS::EC2::VPC
1526
* AWS::EC2::VPCEndpoint
1627
| You must provide a VPC for the cluster to use.
28+
1729
| Network access control
1830
|* AWS::EC2::NetworkAcl
1931
* AWS::EC2::NetworkAclEntry
2032
|
21-
2233
You must allow access to the following ports:
2334
[cols="35%,65%",options="header"]
2435
!===
@@ -34,10 +45,23 @@ You must allow access to the following ports:
3445
! 0-65535
3546
! Outbound ephemeral traffic
3647
!===
48+
3749
| Private subnets
3850
|* AWS::EC2::Subnet
3951
* AWS::EC2::RouteTable
4052
* AWS::EC2::SubnetRouteTableAssociation
41-
| Your VPC must have private subnets in 1 availability zone for Single-AZ deployments or 3 availability zones for Multi-AZ deployments.
53+
|
54+
ifdef::rosa-hcp[]
55+
Your VPC must have private subnets in at least 1 availability zone.
56+
endif::rosa-hcp[]
57+
ifndef::rosa-hcp[]
58+
Your VPC must have private subnets in 1 availability zone for Single-AZ deployments or 3 availability zones for Multi-AZ deployments.
59+
endif::rosa-hcp[]
4260
You must provide appropriate routes and route tables.
4361
|===
62+
ifeval::["{context}" == "rosa-hcp-aws-privatelink-creating-cluster"]
63+
:!rosa-hcp:
64+
endif::[]
65+
ifeval::["{context}" == "rosa-aws-privatelink-creating-cluster"]
66+
:!rosa-standalone:
67+
endif::[]

‎modules/rosa-aws-privatelink-create-cluster.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ AWS PrivateLink is supported on existing VPCs only.
2222

2323
Creating a cluster can take up to 40 minutes.
2424

25-
. With AWS PrivateLink, you can create a cluster with a single availability zone (Single-AZ) or multiple availability zones (Multi-AZ). In either case, your machine's classless inter-domain routing (CIDR) must match your virtual private cloud's CIDR. See https://docs.openshift.com/container-platform/4.13/installing/installing_aws/installing-aws-vpc.html#installation-custom-aws-vpc-requirements_installing-aws-vpc[Requirements for using your own VPC] and link:https://docs.openshift.com/container-platform/4.13/installing/installing_aws/installing-aws-vpc.html#installation-custom-aws-vpc-validation_installing-aws-vpc[VPC Validation] for more information.
25+
. With AWS PrivateLink, you can create a cluster with a single availability zone (Single-AZ) or multiple availability zones (Multi-AZ). In either case, your machine's classless inter-domain routing (CIDR) must match your virtual private cloud's CIDR. See https://docs.openshift.com/container-platform/4.14/installing/installing_aws/installing-aws-vpc.html#installation-custom-aws-vpc-requirements_installing-aws-vpc[Requirements for using your own VPC] and link:https://docs.openshift.com/container-platform/4.14/installing/installing_aws/installing-aws-vpc.html#installation-custom-aws-vpc-validation_installing-aws-vpc[VPC Validation] for more information.
2626
+
2727
[IMPORTANT]
2828
====

‎modules/rosa-hcp-aws-privatelink-create-cluster.adoc

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * rosa_hcp/rosa-hcp-aws-privatelink-creating-cluster.adoc
4+
:_mod-docs-content-type: PROCEDURE
5+
[id="rosa-hcp-aws-privatelink-create-cluster_{context}"]
6+
= Creating an AWS PrivateLink cluster
7+
8+
You can create a private cluster with multiple availability zones (Multi-AZ) on {hcp-title} using the ROSA command line interface (CLI), `rosa`.
9+
10+
[NOTE]
11+
====
12+
AWS PrivateLink is supported on preexisting VPCs only.
13+
====
14+
15+
.Prerequisites
16+
17+
* You have available AWS service quotas.
18+
* You have enabled the ROSA service in the AWS Console.
19+
* You have installed and configured the latest version of the ROSA CLI on your installation host.
20+
21+
.Procedure
22+
23+
Creating a cluster with {hcp} can take around 10 minutes.
24+
25+
. Create a VPC with at least one private subnet. Ensure that your machine's classless inter-domain routing (CIDR) matches your virtual private cloud's CIDR. For more information, see https://docs.openshift.com/container-platform/4.14/installing/installing_aws/installing-aws-vpc.html#installation-custom-aws-vpc-requirements_installing-aws-vpc[Requirements for using your own VPC] and link:https://docs.openshift.com/container-platform/4.14/installing/installing_aws/installing-aws-vpc.html#installation-custom-aws-vpc-validation_installing-aws-vpc[VPC Validation].
26+
+
27+
[IMPORTANT]
28+
====
29+
If you use a firewall, you must configure it so that ROSA can access the sites that required to function.
30+
31+
For more information, see the "AWS PrivateLink firewall prerequisites" section.
32+
====
33+
34+
. Create the account-wide IAM roles by running the following command:
35+
+
36+
[source,terminal]
37+
----
38+
$ rosa create account-roles --hosted-cp
39+
----
40+
41+
. Create the OIDC configuration by running the following command:
42+
+
43+
[source,terminal]
44+
----
45+
$ rosa create oidc-config --mode=auto --yes
46+
----
47+
+
48+
Save the OIDC configuration ID because you need it to create the Operator roles.
49+
+
50+
.Example output
51+
[source,terminal]
52+
----
53+
I: Setting up managed OIDC configuration
54+
I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice:
55+
rosa create operator-roles --prefix <user-defined> --oidc-config-id 28s4avcdt2l318r1jbk3ifmimkurk384
56+
If you are going to create a Hosted Control Plane cluster please include '--hosted-cp'
57+
I: Creating OIDC provider using 'arn:aws:iam::46545644412:user/user'
58+
I: Created OIDC provider with ARN 'arn:aws:iam::46545644412:oidc-provider/oidc.op1.openshiftapps.com/28s4avcdt2l318r1jbk3ifmimkurk384'
59+
----
60+
61+
. Create the Operator roles by running the following command:
62+
+
63+
[source,terminal]
64+
----
65+
$ rosa create operator-roles --hosted-cp --prefix <operator_roles_prefix> --oidc-config-id <oidc_config_id> --installer-role-arn arn:aws:iam::$<account_roles_prefix>:role/$<account_roles_prefix>-HCP-ROSA-Installer-Role
66+
----
67+
68+
. Create a private {hcp-title} cluster by running the following command:
69+
+
70+
[source,terminal]
71+
----
72+
$ rosa create cluster --private-link --cluster-name=<cluster-name> --sts --mode=auto --hosted-cp --operator-roles-prefix <operator_role_prefix> --oidc-config-id <oidc_config_id> [--machine-cidr=<VPC CIDR>/16] --subnet-ids=<private-subnet-id1>[,<private-subnet-id2>,<private-subnet-id3>]
73+
----
74+
75+
. Enter the following command to check the status of your cluster. During cluster creation, the `State` field from the output will transition from `pending` to `installing`, and finally, to `ready`.
76+
+
77+
[source,terminal]
78+
----
79+
$ rosa describe cluster --cluster=<cluster_name>
80+
----
81+
+
82+
[NOTE]
83+
====
84+
If installation fails or the `State` field does not change to `ready` after 10 minutes, see the "Troubleshooting Red Hat OpenShift Service on AWS installations" documentation in the Additional resources section.
85+
====
86+
87+
. Enter the following command to follow the OpenShift installer logs to track the progress of your cluster:
88+
+
89+
[source,terminal]
90+
----
91+
$ rosa logs install --cluster=<cluster_name> --watch
92+
----

‎modules/rosa-hcp-aws-privatelink-security-groups.adoc

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * rosa_hcp/rosa-hcp-aws-privatelink-creating-cluster.adoc
4+
[id="rosa-hcp-aws-privatelink-security-groups_{context}"]
5+
:_mod-docs-content-type: PROCEDURE
6+
= Configuring AWS security groups to access the API
7+
8+
With {hcp-title} private clusters, the AWS PrivateLink endpoint exposed in the customer's VPC has a default security group. This security group has access to the PrivateLink endpoint that is limited to only those resources that exist within the VPC or resources that are present with an IP address associated with the VPC CIDR range. In order to grant access to any entities outside of the VPC, through VPC peering and transit gateway, you must create and attach another security group to the PrivateLink endpoint to grant the necessary access.
9+
10+
.Prerequisites
11+
12+
* Your corporate network or other VPC has connectivity.
13+
* You have permission to create and attach security groups within the VPC.
14+
15+
.Procedure
16+
17+
. Set your cluster name as an environmental variable by running the following command:
18+
+
19+
[source,terminal]
20+
----
21+
$ export CLUSTER_NAME=<cluster_name>
22+
----
23+
+
24+
You can verify that the variable has been set by running the following command:
25+
+
26+
[source,terminal]
27+
----
28+
$ echo $CLUSTER_NAME
29+
----
30+
+
31+
.Example output
32+
+
33+
[source,terminal]
34+
----
35+
hcp-private
36+
----
37+
38+
. Find the VPC endpoint (VPCE) ID and VPC ID by running the following command:
39+
+
40+
[source,terminal]
41+
----
42+
$ read -r VPCE_ID VPC_ID <<< $(aws ec2 describe-vpc-endpoints --filters "Name=tag:api.openshift.com/id,Values=$(rosa describe cluster -c ${CLUSTER_NAME} -o yaml | grep '^id: ' | cut -d' ' -f2)" --query 'VpcEndpoints[].[VpcEndpointId,VpcId]' --output text)
43+
----
44+
45+
. Create your security group by running the following command:
46+
+
47+
[source,terminal]
48+
----
49+
$ export SG_ID=$(aws ec2 create-security-group --description "Granting API access to ${CLUSTER_NAME} from outside of VPC" --group-name "${CLUSTER_NAME}-api-sg" --vpc-id $VPC_ID --output text)
50+
----
51+
52+
. Add an ingress rule to the security group by running the following command:
53+
+
54+
[source,terminal]
55+
----
56+
$ aws ec2 authorize-security-group-ingress --group-id $SG_ID --ip-permissions FromPort=443,ToPort=443,IpProtocol=tcp,IpRanges=[{CidrIp=0.0.0.0/0}]
57+
----
58+
59+
. Add the the new security group to the VPCE by running the following command:
60+
+
61+
[source,terminal]
62+
----
63+
$ aws ec2 modify-vpc-endpoint --vpc-endpoint-id $VPCE_ID --add-security-group-ids $SG_ID
64+
----
65+
66+
You now can access the API with your {hcp-title} private cluster.

‎rosa_hcp/rosa-hcp-aws-privatelink-creating-cluster.adoc

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="rosa-hcp-aws-privatelink-creating-cluster"]
3+
= Creating a private cluster on {hcp-title}
4+
include::_attributes/attributes-openshift-dedicated.adoc[]
5+
:context: rosa-hcp-aws-privatelink-creating-cluster
6+
7+
toc::[]
8+
9+
This document describes how to create a {hcp-title-first} private cluster.
10+
11+
include::modules/osd-aws-privatelink-about.adoc[leveloffset=+1]
12+
include::modules/osd-aws-privatelink-required-resources.adoc[leveloffset=+1]
13+
include::modules/rosa-hcp-aws-privatelink-create-cluster.adoc[leveloffset=+1]
14+
include::modules/rosa-hcp-aws-privatelink-security-groups.adoc[leveloffset=+1]
15+
16+
[id="next-steps_rosa-hcp-aws-privatelink-creating-cluster"]
17+
== Next steps
18+
xref:../rosa_install_access_delete_clusters/rosa-sts-config-identity-providers.adoc#rosa-sts-config-identity-providers[Configuring identity providers]
19+
20+
[role="_additional-resources"]
21+
[id="additional-resources_rosa-hcp-aws-privatelink-creating-cluster"]
22+
== Additional resources
23+
24+
* xref:../rosa_planning/rosa-sts-aws-prereqs.adoc#osd-aws-privatelink-firewall-prerequisites_rosa-sts-aws-prereqs[AWS PrivateLink firewall prerequisites]
25+
* xref:../rosa_getting_started/rosa-sts-getting-started-workflow.adoc#rosa-sts-overview-of-the-deployment-workflow[Overview of the ROSA with STS deployment workflow]
26+
* xref:../rosa_install_access_delete_clusters/rosa-sts-deleting-cluster.adoc#rosa-sts-deleting-cluster[Deleting a ROSA cluster]
27+
* xref:../rosa_architecture/rosa_architecture_sub/rosa-architecture-models.adoc#rosa-architecture-models[Architecture models]
28+
* xref:../support/troubleshooting/rosa-troubleshooting-installations.adoc#rosa-troubleshooting-installing[Troubleshooting Red Hat OpenShift Service on AWS installations]

0 commit comments

Comments
 (0)