Red Hat Summit Red Hat SummitSupportKonsoleEntwicklerDemo startenKontakt

Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.

Chapter 1. Prerequisites checklist for deploying Red Hat OpenShift Service on AWS

This is a high level checklist of prerequisites needed to create a Red Hat OpenShift Service on AWS cluster.

The machine that you run the installation process from must have access to the following:

  • Amazon Web Services API and authentication service endpoints
  • Red Hat OpenShift API and authentication service endpoints (api.openshift.com and sso.redhat.com)
  • Internet connectivity to obtain installation artifacts during deployment

1.1. Accounts and permissions
Link kopieren

Ensure that you have the following accounts, credentials, and permissions.

1.1.1. AWS account
Link kopieren

  • Create an AWS account if you do not already have one.
  • Gather the credentials required to log in to your AWS account.
  • Ensure that your AWS account has sufficient permissions to use the ROSA CLI: Least privilege permissions for common ROSA CLI commands

  • Enable Red Hat OpenShift Service on AWS for your AWS account on the AWS console.

  • Ensure you have not enabled restrictive tag policies. For more information, see Tag policies in the AWS documentation.

1.1.2. Red Hat account
Link kopieren

  • Create a Red Hat account for the Red Hat Hybrid Cloud Console if you do not already have one.
  • Gather the credentials required to log in to your Red Hat account.

1.2. CLI requirements
Link kopieren

You need to download and install several CLI (command-line interface) tools to be able to deploy a cluster.

1.2.1. AWS CLI (aws)
Link kopieren

  1. Install the AWS Command Line Interface.
  2. Log in to your AWS account using the AWS CLI: Sign in through the AWS CLI

  3. Verify your account identity: 

     $ aws sts get-caller-identity
    Copy to Clipboard Toggle word wrap

  4. Check whether the service role for ELB (Elastic Load Balancing) exists: 

    $ aws iam get-role --role-name "AWSServiceRoleForElasticLoadBalancing"
    Copy to Clipboard Toggle word wrap

    If the role does not exist, create it by running the following command: 

    $ aws iam create-service-linked-role --aws-service-name "elasticloadbalancing.amazonaws.com"
    Copy to Clipboard Toggle word wrap

1.2.2. ROSA CLI (rosa)
Link kopieren

  1. Install the ROSA CLI from the web console.

  2. Log in to your Red Hat account by running rosa login and following the instructions in the command output: 

    $ rosa login
To login to your Red{nbsp}Hat account, get an offline access token at https://console.redhat.com/openshift/token/rosa
? Copy the token and paste it here:
    Copy to Clipboard Toggle word wrap

    Alternatively, you can copy the full $ rosa login --token=abc…​ command and paste that in the terminal: 

    $ rosa login --token=<abc..>
    Copy to Clipboard Toggle word wrap

  3. Confirm you are logged in using the correct account and credentials: 

    $ rosa whoami
    Copy to Clipboard Toggle word wrap

1.2.3. OpenShift CLI (oc)
Link kopieren

The OpenShift CLI (oc) is not required to deploy a Red Hat OpenShift Service on AWS cluster, but is a useful tool for interacting with your cluster after it is deployed.

  1. Download and install oc from the OpenShift Cluster Manager Command-line interface (CLI) tools page, or follow the instructions in Getting started with the OpenShift CLI.

  2. Verify that the OpenShift CLI has been installed correctly by running the following command: 

    $ rosa verify openshift-client
    Copy to Clipboard Toggle word wrap

1.3. AWS infrastructure prerequisites
Link kopieren

  • Optionally, ensure that your AWS account has sufficient quota available to deploy a cluster. 

    $ rosa verify quota
    Copy to Clipboard Toggle word wrap

    This command only checks the total quota allocated to your account; it does not reflect the amount of quota already consumed from that quota. Running this command is optional because your quota is verified during cluster deployment. However, Red Hat recommends running this command to confirm your quota ahead of time so that deployment is not interrupted by issues with quota availability.

  • For more information about resources provisioned during Red Hat OpenShift Service on AWS cluster deployment, see Provisioned AWS Infrastructure.
  • For more information about the required AWS service quotas, see Required AWS service quotas.

1.4. Service Control Policy (SCP) prerequisites
Link kopieren

Red Hat OpenShift Service on AWS clusters are hosted in an AWS account within an AWS organizational unit. A service control policy (SCP) is created and applied to the AWS organizational unit that manages what services the AWS sub-accounts are permitted to access.

  • Ensure that your organization’s SCPs are not more restrictive than the roles and policies required by the cluster. For more information, see the Minimum set of effective permissions for SCPs.
  • When you create a Red Hat OpenShift Service on AWS cluster, an associated AWS OpenID Connect (OIDC) identity provider is created.

1.5. Networking prerequisites
Link kopieren

Prerequisites needed from a networking standpoint.

1.5.1. Minimum bandwidth
Link kopieren

During cluster deployment, Red Hat OpenShift Service on AWS requires a minimum bandwidth of 120 Mbps between cluster infrastructure and the public internet or private network locations that provide deployment artifacts and resources. When network connectivity is slower than 120 Mbps (for example, when connecting through a proxy) the cluster installation process times out and deployment fails.

After cluster deployment, network requirements are determined by your workload. However, a minimum bandwidth of 120 Mbps helps to ensure timely cluster and operator upgrades.

1.5.2. Firewall
Link kopieren

1.5.3. Create VPC before cluster deployment
Link kopieren

Red Hat OpenShift Service on AWS clusters must be deployed into an existing AWS Virtual Private Cloud (VPC).

Note

Installing a new Red Hat OpenShift Service on AWS cluster into a VPC that was automatically created by the installer for a different cluster is not supported.

Your VPC must meet the requirements shown in the following table.

Expand
Table 1.1. Requirements for your VPC
RequirementDetails

VPC name

You need to have the specific VPC name and ID when creating your cluster.

CIDR range

Your VPC CIDR range should match your machine CIDR.

Availability zone

You need one availability zone for a single zone, and you need three for availability zones for multi-zone.

Public subnet

You must have one public subnet with a NAT gateway for public clusters. Private clusters do not need a public subnet.

DNS hostname and resolution

You must ensure that the DNS hostname and resolution are enabled.

1.5.4. Additional custom security groups
Link kopieren

During cluster creation, you can add additional custom security groups to a cluster that has an existing non-managed VPC. To do so, complete these prerequisites before you create the cluster:

  • Create the custom security groups in AWS before you create the cluster.
  • Associate the custom security groups with the VPC that you are using to create the cluster. Do not associate the custom security groups with any other VPC.
  • You may need to request additional AWS quota for Security groups per network interface.

For more details see the detailed requirements for Security groups.

1.5.5. Custom DNS and domains
Link kopieren

You can configure a custom domain name server and custom domain name for your cluster. To do so, complete the following prerequisites before you create the cluster:

  • By default, Red Hat OpenShift Service on AWS clusters require you to set the domain name servers option to AmazonProvidedDNS to ensure successful cluster creation and operation.
  • To use a custom DNS server and domain name for your cluster, the Red Hat OpenShift Service on AWS installer must be able to use VPC DNS with default DHCP options so that it can resolve internal IPs and services. This means that you must create a custom DHCP option set to forward DNS lookups to your DNS server, and associate this option set with your VPC before you create the cluster.

  • Confirm that your VPC is using VPC Resolver by running the following command: 

    $ aws ec2 describe-dhcp-options
    Copy to Clipboard Toggle word wrap
Nach oben
Red Hat logoGithubredditYoutubeTwitter

Lernen

Testen, kaufen und verkaufen

Communitys

Über Red Hat Dokumentation

Wir helfen Red Hat Benutzern, mit unseren Produkten und Diensten innovativ zu sein und ihre Ziele zu erreichen – mit Inhalten, denen sie vertrauen können. Entdecken Sie unsere neuesten Updates.

Mehr Inklusion in Open Source

Red Hat hat sich verpflichtet, problematische Sprache in unserem Code, unserer Dokumentation und unseren Web-Eigenschaften zu ersetzen. Weitere Einzelheiten finden Sie in Red Hat Blog.

Über Red Hat

Wir liefern gehärtete Lösungen, die es Unternehmen leichter machen, plattform- und umgebungsübergreifend zu arbeiten, vom zentralen Rechenzentrum bis zum Netzwerkrand.

Theme

© 2025 Red Hat