Skip to content

Commit fb086d9

Browse files
mjpytlakmjpytlak
committed
OSDOCS2647: Adding AWS secret-specific installation topic
1 parent e6fc2f6 commit fb086d9

21 files changed

+130
-26
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,8 @@ Topics:
133133
File: installing-aws-private
134134
- Name: Installing a cluster on AWS into a government region
135135
File: installing-aws-government-region
136+
- Name: Installing a cluster on AWS into a Top Secret Region
137+
File: installing-aws-secret-region
136138
- Name: Installing a cluster on AWS into a China region
137139
File: installing-aws-china
138140
- Name: Installing a cluster on AWS using CloudFormation templates

‎installing/installing_aws/installing-aws-government-region.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ If you have an AWS profile stored on your computer, it must not use a temporary
2525
* If the cloud identity and access management (IAM) APIs are not accessible in your environment, or if you do not want to store an administrator-level credential secret in the `kube-system` namespace, you can xref:../../installing/installing_aws/manually-creating-iam.adoc#manually-creating-iam-aws[manually create and maintain IAM credentials].
2626

2727
include::modules/installation-aws-about-government-region.adoc[leveloffset=+1]
28+
2829
include::modules/installation-prereq-aws-private-cluster.adoc[leveloffset=+1]
2930

3031
include::modules/private-clusters-default.adoc[leveloffset=+1]

‎installing/installing_aws/installing-aws-secret-region.adoc

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
:_content-type: ASSEMBLY
2+
[id="installing-aws-secret-region"]
3+
= Installing a cluster on AWS into a Top Secret Region
4+
include::modules/common-attributes.adoc[]
5+
:context: installing-aws-secret-region
6+
7+
toc::[]
8+
9+
In {product-title} version {product-version}, you can install a cluster on Amazon Web Services (AWS) into a Commercial Cloud Services (C2S) Top Secret Region. To configure the region, modify parameters in the `install config.yaml` file before you install the cluster.
10+
11+
[id="prerequisites_installing-aws-secret-region"]
12+
== Prerequisites
13+
14+
* You reviewed details about the xref:../../architecture/architecture-installation.adoc#architecture-installation[{product-title} installation and update] processes.
15+
* You read the documentation on xref:../../installing/installing-preparing.adoc#installing-preparing[selecting a cluster installation method and preparing it for users].
16+
* You xref:../../installing/installing_aws/installing-aws-account.adoc#installing-aws-account[configured an AWS account] to host the cluster.
17+
+
18+
[IMPORTANT]
19+
====
20+
If you have an AWS profile stored on your computer, it must not use a temporary session token that you generated while using a multifactor authentication device. The cluster continues to use your current AWS credentials to create AWS resources for the entire life of the cluster, so you must use long-lived credentials. To generate appropriate keys, see link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html[Managing Access Keys for IAM Users] in the AWS documentation. You can supply the keys when you run the installation program.
21+
====
22+
* If you use a firewall, you xref:../../installing/install_config/configuring-firewall.adoc#configuring-firewall[configured it to allow the sites] that your cluster requires access to.
23+
* If the cloud identity and access management (IAM) APIs are not accessible in your environment, or if you do not want to store an administrator-level credential secret in the `kube-system` namespace, you can xref:../../installing/installing_aws/manually-creating-iam.adoc#manually-creating-iam-aws[manually create and maintain IAM credentials].
24+
25+
include::modules/installation-aws-about-government-region.adoc[leveloffset=+1]
26+
27+
include::modules/installation-aws-regions-with-no-ami.adoc[leveloffset=+1]
28+
29+
include::modules/private-clusters-default.adoc[leveloffset=+1]
30+
include::modules/private-clusters-about-aws.adoc[leveloffset=+2]
31+
32+
include::modules/installation-custom-aws-vpc.adoc[leveloffset=+1]
33+
34+
include::modules/cluster-entitlements.adoc[leveloffset=+1]
35+
36+
include::modules/installation-aws-upload-custom-rhcos-ami.adoc[leveloffset=+1]
37+
38+
include::modules/ssh-agent-using.adoc[leveloffset=+1]
39+
40+
include::modules/installation-obtaining-installer.adoc[leveloffset=+1]
41+
42+
include::modules/installation-initializing-manual.adoc[leveloffset=+1]
43+
include::modules/installation-configuration-parameters.adoc[leveloffset=+2]
44+
include::modules/installation-supported-aws-machine-types.adoc[leveloffset=+2]
45+
include::modules/installation-aws-config-yaml.adoc[leveloffset=+2]
46+
include::modules/installation-configure-proxy.adoc[leveloffset=+2]
47+
48+
include::modules/installation-launching-installer.adoc[leveloffset=+1]
49+
50+
include::modules/cli-installing-cli.adoc[leveloffset=+1]
51+
52+
include::modules/cli-logging-in-kubeadmin.adoc[leveloffset=+1]
53+
54+
include::modules/logging-in-by-using-the-web-console.adoc[leveloffset=+1]
55+
56+
[role="_additional-resources"]
57+
[id="additional-resources_installing-aws-secret-region_console"]
58+
.Additional resources
59+
60+
* See xref:../../web_console/web-console.adoc#web-console[Accessing the web console] for more details about accessing and understanding the {product-title} web console.
61+
62+
include::modules/cluster-telemetry.adoc[leveloffset=+1]
63+
64+
[role="_additional-resources"]
65+
[id="additional-resources_installing-aws-secret-region_telemetry"]
66+
.Additional resources
67+
68+
* See xref:../../support/remote_health_monitoring/about-remote-health-monitoring.adoc#about-remote-health-monitoring[About remote health monitoring] for more information about the Telemetry service.
69+
70+
[id="next-steps_installing-aws-secret-region"]
71+
== Next steps
72+
73+
* xref:../../installing/validating-an-installation.adoc#validating-an-installation[Validating an installation].
74+
* xref:../../post_installation_configuration/cluster-tasks.adoc#available_cluster_customizations[Customize your cluster].
75+
* If necessary, you can xref:../../support/remote_health_monitoring/opting-out-of-remote-health-reporting.adoc#opting-out-remote-health-reporting_opting-out-remote-health-reporting[opt out of remote health reporting].
76+
* If necessary, you can xref:../../authentication/managing_cloud_provider_credentials/cco-mode-mint.adoc#manually-removing-cloud-creds_cco-mode-mint[remove cloud provider credentials].

‎modules/cli-installing-cli.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
// * installing/installing_aws/installing-aws-default.adoc
77
// * installing/installing_aws/installing-aws-china.adoc
88
// * installing/installing_aws/installing-aws-government-region.adoc
9+
// * installing/installing_aws/installing-aws-secret-region.adoc
910
// * installing/installing_aws/installing-aws-network-customizations.adoc
1011
// * installing/installing_aws/installing-aws-private.adoc
1112
// * installing/installing_aws/installing-aws-vpc.adoc

‎modules/cli-logging-in-kubeadmin.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
// * installing/installing_aws/installing-aws-default.adoc
66
// * installing/installing_aws/installing-aws-china.adoc
77
// * installing/installing_aws/installing-aws-government-region.adoc
8+
// * installing/installing_aws/installing-aws-secret-region.adoc
89
// * installing/installing_aws/installing-aws-network-customizations.adoc
910
// * installing/installing_aws/installing-aws-private.adoc
1011
// * installing/installing_aws/installing-aws-vpc.adoc

‎modules/cluster-entitlements.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
// * installing/installing_aws/installing-aws-default.adoc
3737
// * installing/installing_aws/installing-aws-vpc.adoc
3838
// * installing/installing_aws/installing-aws-government-region.adoc
39+
// * installing/installing_aws/installing-aws-secret-region.adoc
3940
// * installing/installing_aws/installing-aws-china-region.adoc
4041
// * installing/installing_openstack/installing-openstack-installer-kuryr.adoc
4142
// * installing/installing_openstack/installing-openstack-installer-restricted.adoc

‎modules/installation-aws-about-government-region.adoc

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
// Module included in the following assemblies:
22
//
33
// * installing/installing_aws/installing-aws-government-region.adoc
4+
// * installing/installing_aws/installing-aws-secret-region.adoc
45

56
ifeval::["{context}" == "installing-aws-government-region"]
67
:aws-gov:
@@ -14,19 +15,19 @@ ifdef::aws-gov[]
1415
= AWS government regions
1516
endif::aws-gov[]
1617
ifdef::aws-secret[]
17-
= AWS secret region
18+
= AWS Top Secret Region
1819
endif::aws-secret[]
1920

2021
ifdef::aws-gov[]
2122
{product-title} supports deploying a cluster to an link:https://aws.amazon.com/govcloud-us[AWS GovCloud (US)] region.
2223
endif::aws-gov[]
2324

2425
ifdef::aws-secret[]
25-
{product-title} supports deploying a cluster to an link:https://aws.amazon.com/federal/us-intelligence-community/[AWS Commercial Cloud Services (C2S) Secret Region].
26+
{product-title} supports deploying a cluster to an link:https://aws.amazon.com/federal/us-intelligence-community/[AWS Commercial Cloud Services (C2S) Top Secret Region].
2627
endif::aws-secret[]
2728

2829
ifdef::aws-secret[]
29-
The C2S Secret Region does not have a published {op-system-first} Amazon Machine Images (AMI) to select, so you
30+
The C2S Top Secret Region does not have a published {op-system-first} Amazon Machine Images (AMI) to select, so you
3031
must upload a custom AMI that belongs to that region.
3132
endif::aws-secret[]
3233

@@ -38,7 +39,7 @@ The following AWS GovCloud partitions are supported:
3839
endif::aws-gov[]
3940
4041
ifdef::aws-secret[]
41-
The following AWS Secret Region partition is supported:
42+
The following AWS Top Secret Region partition is supported:
4243

4344
* `us-iso-east-1`
4445
endif::aws-secret[]

‎modules/installation-aws-config-yaml.adoc

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
//
33
// * installing/installing_aws/installing-aws-customizations.adoc
44
// * installing/installing_aws/installing-aws-government-region.adoc
5+
// * installing/installing_aws/installing-aws-secret-region.adoc
56
// * installing/installing_aws/installing-aws-network-customizations.adoc
67
// * installing/installing_aws/installing-aws-private.adoc
78
// * installing/installing_aws/installing-aws-vpc.adoc
@@ -113,6 +114,7 @@ ifdef::gov[]
113114
endif::gov[]
114115
ifdef::secret[]
115116
- us-iso-east-1a
117+
- us-iso-east-1b
116118
endif::secret[]
117119
ifndef::gov,china,secret[]
118120
- us-west-2c
@@ -360,10 +362,10 @@ endif::openshift-origin[]
360362
endif::private[]
361363
ifdef::secret[]
362364
ifndef::openshift-origin[]
363-
<14> The custom CA certificate. This is required when deploying to the AWS C2S Secret Region because the AWS API requires a custom CA trust bundle.
365+
<14> The custom CA certificate. This is required when deploying to the AWS C2S Top Secret Region because the AWS API requires a custom CA trust bundle.
364366
endif::openshift-origin[]
365367
ifdef::openshift-origin[]
366-
<13> The custom CA certificate. This is required when deploying to the AWS C2S Secret Region because the AWS API requires a custom CA trust bundle.
368+
<13> The custom CA certificate. This is required when deploying to the AWS C2S Top Secret Region because the AWS API requires a custom CA trust bundle.
367369
endif::openshift-origin[]
368370
endif::secret[]
369371
ifdef::restricted[]

‎modules/installation-aws-regions-with-no-ami.adoc

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,14 @@
22
//
33
// * installing/installing_aws/installing-aws-china.adoc
44
// * installing/installing_aws/installing-aws-user-infra.adoc
5-
// * installing/installing_aws/installing-aws-secret.adoc
5+
// * installing/installing_aws/installing-aws-secret-region.adoc
66

77
ifeval::["{context}" == "installing-aws-china-region"]
88
:aws-china:
99
endif::[]
1010
ifeval::["{context}" == "installing-aws-secret-region"]
1111
:aws-secret:
1212
endif::[]
13-
// ifeval::["{context}" == "installing-aws-government-region"]
14-
// :aws-gov:
15-
// endif::[]
1613

1714
[id="installation-aws-regions-with-no-ami_{context}"]
1815
ifndef::aws-china,aws-secret[]
@@ -46,7 +43,7 @@ endif::aws-china,aws-secret[]
4643

4744
ifdef::aws-china,aws-secret[]
4845
ifdef::aws-china[Red Hat does not publish a {op-system-first} Amazon Machine Image (AMI) for the AWS China regions.]
49-
ifdef::aws-secret[Red Hat does not publish a {op-system-first} Amzaon Machine Image for the AWS secret region.]
46+
ifdef::aws-secret[Red Hat does not publish a {op-system-first} Amzaon Machine Image for the AWS Top Secret Region.]
5047

5148
Before you can install the cluster, you must:
5249

@@ -59,7 +56,7 @@ You cannot use the {product-title} installation program to create the installati
5956
ifdef::aws-secret[]
6057
[IMPORTANT]
6158
====
62-
If you are deploying to the C2S Secret Region, you must also define a custom CA certificate in the `additionalTrustBundle` field of the `install-config.yaml` file because the AWS API requires a custom CA trust bundle. To allow the installation program to access the AWS API, the CA certificates must also be defined on the machine that runs the installation program. You must add the CA bundle to the trust store on the machine, use the `AWS_CA_BUNDLE` environment variable, or define the CA bundle in the link:https://docs.aws.amazon.com/credref/latest/refdocs/setting-global-ca_bundle.html[`ca_bundle`] field of the AWS config file.
59+
You must also define a custom CA certificate in the `additionalTrustBundle` field of the `install-config.yaml` file because the AWS API requires a custom CA trust bundle. To allow the installation program to access the AWS API, the CA certificates must also be defined on the machine that runs the installation program. You must add the CA bundle to the trust store on the machine, use the `AWS_CA_BUNDLE` environment variable, or define the CA bundle in the link:https://docs.aws.amazon.com/credref/latest/refdocs/setting-global-ca_bundle.html[`ca_bundle`] field of the AWS config file.
6360
====
6461
endif::aws-secret[]
6562

@@ -71,6 +68,3 @@ endif::[]
7168
ifeval::["{context}" == "installing-aws-secret-region"]
7269
:!aws-secret:
7370
endif::[]
74-
// ifeval::["{context}" == "installing-aws-government-region"]
75-
// :!aws-gov:
76-
// endif::[]

‎modules/installation-aws-upload-custom-rhcos-ami.adoc

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
// Module included in the following assemblies:
22
//
3-
// * installing/installing_aws/installing-aws-government-region.adoc
3+
// * installing/installing_aws/installing-aws-secret-region.adoc
4+
// * installing/installing_aws/installing-aws-china.adoc
45

56
ifeval::["{context}" == "installing-aws-china-region"]
67
:aws-china:

0 commit comments

Comments
 (0)