Chapter 1. Red Hat OpenShift Service on AWS classic architecture quick start guide

Procedure

1. Create an OpenShift Cluster Manager role and link it to your Red Hat organization:

   Note

   To enable automatic deployment of the cluster-specific Operator roles and the OpenID Connect (OIDC) provider using the OpenShift Cluster Manager Hybrid Cloud Console, you must apply the administrative privileges to the role by choosing the Admin OCM role command in the Accounts and roles step of creating a ROSA cluster. For more information about the basic and administrative privileges for the OpenShift Cluster Manager role, see Understanding AWS account association.

   Note

   If you choose the Basic OCM role command in the Accounts and roles step of creating a ROSA cluster in the OpenShift Cluster Manager Hybrid Cloud Console, you must deploy a ROSA cluster using manual mode. You will be prompted to configure the cluster-specific Operator roles and the OpenID Connect (OIDC) provider in a later step.

   $ rosa create ocm-role

   Select the default values at the prompts to quickly create and link the role.

2. Create a user role and link it to your Red Hat user account:

   $ rosa create user-role

   Select the default values at the prompts to quickly create and link the role.

   Note

   The Red Hat user account must exist in the Red Hat organization that is linked to your OpenShift Cluster Manager role.

Procedure

1. If they do not exist in your AWS account, create the required account-wide AWS IAM STS roles and policies:

   $ rosa create account-roles

   Select the default values at the prompts to quickly create the roles and policies.

Procedure

1. Navigate to OpenShift Cluster Manager and select Create cluster.
2. On the Create an OpenShift cluster page, select Create cluster in the Red Hat OpenShift Service on AWS classic architecture (ROSA) row.

3. Verify that your AWS account ID is listed in the Associated AWS accounts drop-down menu and that the installer, support, worker, and control plane account role Amazon Resource Names (ARNs) are listed on the Accounts and roles page.

   Note

   If your AWS account ID is not listed, check that you have successfully associated your AWS account with your Red Hat organization. If your account role ARNs are not listed, check that the required account-wide STS roles exist in your AWS account.

4. Click Next.

5. On the Cluster details page, provide a name for your cluster in the Cluster name field. Leave the default values in the remaining fields and click Next.

   Note

   Cluster creation generates a domain prefix as a subdomain for your provisioned cluster on openshiftapps.com. If the cluster name is less than or equal to 15 characters, that name is used for the domain prefix. If the cluster name is longer than 15 characters, the domain prefix is randomly generated as a 15-character string. To customize the subdomain, select the Create custom domain prefix checkbox, and enter your domain prefix name in the Domain prefix field.

6. To deploy a cluster quickly, leave the default options in the Cluster settings, Networking, Cluster roles and policies, and Cluster updates pages and click Next on each page.
7. On the Review your Red Hat OpenShift Service on AWS classic architecture cluster page, review the summary of your selections and click Create cluster to start the installation.

8. Optional: On the Overview tab, you can enable the delete protection feature by selecting Enable, which is located directly under Delete Protection: Disabled. This will prevent your cluster from being deleted. To disable delete protection, select Disable. By default, clusters are created with the delete protection feature disabled.

   Verification

   • You can check the progress of the installation in the Overview page for your cluster. You can view the installation logs on the same page. Your cluster is ready when the Status in the Details section of the page is listed as Ready.

     Note

     If the installation fails or the cluster State does not change to Ready after about 40 minutes, check the installation troubleshooting documentation for details. For more information, see Troubleshooting installations. For steps to contact Red Hat Support for assistance, see Getting support for Red Hat OpenShift Service on AWS.

Procedure

1. Create a cluster administrator user, replacing <cluster_name> with the name of your cluster:

   $ rosa create admin --cluster=<cluster_name>

   Example output

   W: It is recommended to add an identity provider to login to this cluster. See 'rosa create idp --help' for more information.
   I: Admin account has been added to cluster '<cluster_name>'.
   I: Please securely store this generated password. If you lose this password you can delete and recreate the cluster admin user.
   I: To login, run the following command:
   
      oc login https://api.example-cluster.wxyz.p1.openshiftapps.com:6443 --username cluster-admin --password d7Rca-Ba4jy-YeXhs-WU42J
   
   I: It may take up to a minute for the account to become active.

   Note

   It might take approximately one minute for the cluster-admin user to become active.

Procedure

1. Obtain the console URL for your cluster:

   $ rosa describe cluster -c <cluster_name> | grep Console

   Example output

   Console URL:                https://console-openshift-console.apps.example-cluster.wxyz.p1.openshiftapps.com

2. Go to the console URL in the output of the preceding step and log in.

   • If you created a cluster-admin user, log in by using the provided credentials.
   • If you configured an identity provider for your cluster, select the identity provider name in the Log in with…​ dialog and complete any authorization requests from your provider.

Procedure

1. Go to the Cluster List page in OpenShift Cluster Manager.
2. Click the options icon (⋮) next to the cluster you want to view.
3. Click Open console.
4. Your cluster console opens in a new browser window. Log in to your Red Hat account with your configured identity provider credentials.
5. In the Administrator perspective, select Home Projects Create Project.
6. Enter a name for your project and optionally add a Display Name and Description.
7. Click Create to create the project.
8. Switch to the Developer perspective and select +Add. Verify that the selected Project is the one that you created.
9. In the Developer Catalog dialog, select All services.
10. In the Developer Catalog page, select Languages JavaScript from the menu.

11. Click Node.js, and then click Create to open the Create Source-to-Image application page.

    Note

    You might need to click Clear All Filters to display the Node.js option.

12. In the Git section, click Try sample.
13. Add a unique name in the Name field. The value is used to name the associated resources.
14. Confirm that Deployment and Create a route are selected.
15. Click Create to deploy the application. It takes a few minutes for the pods to deploy.
16. Optional: Check the status of the pods in the Topology pane by selecting your Node.js app and reviewing its sidebar. You must wait for the nodejs build to complete and for the nodejs pod to be in a Running state before continuing.

17. When the deployment is complete, click the route URL for the application, which has a format similar to the following:

    https://nodejs-<project>.<cluster_name>.<hash>.<region>.openshiftapps.com/

    A new tab in your browser opens with a message similar to the following:

    Welcome to your Node.js application on OpenShift

18. Optional: Delete the application and clean up the resources that you created:

    1. In the Administrator perspective, navigate to Home Projects.
    2. Click the action menu for your project and select Delete Project.

Procedure

1. Delete a cluster and watch the logs, replacing <cluster_name> with the name or ID of your cluster:

   $ rosa delete cluster --cluster=<cluster_name> --watch

   Important

   You must wait for the cluster deletion to complete before you remove the IAM roles, policies, and OIDC provider. The account-wide roles are required to delete the resources created by the installation program. The cluster-specific Operator roles are required to clean-up the resources created by the OpenShift Operators. The Operators use the OIDC provider to authenticate with AWS APIs.

2. After the cluster is deleted, delete the OIDC provider that the cluster Operators use to authenticate:

   $ rosa delete oidc-provider -c <cluster_id> --mode auto

   Note

   You can use the -y option to automatically answer yes to the prompts.

3. Delete the cluster-specific Operator IAM roles:

   $ rosa delete operator-roles -c <cluster_id> --mode auto

4. Delete the account-wide roles:

   Important

   Account-wide IAM roles and policies might be used by other Red Hat OpenShift Service on AWS classic architecture clusters in the same AWS account. You must only remove the resources if they are not required by other clusters.

   $ rosa delete account-roles --prefix <prefix> --mode auto

   Replace <prefix> with the prefix of the account-wide roles to delete. If you did not specify a custom prefix when you created the account-wide roles, specify the default prefix, depending on how they were created, HCP-ROSA or ManagedOpenShift.

5. Delete the account-wide and Operator IAM policies that you created for Red Hat OpenShift Service on AWS classic architecture deployments that use STS:

   1. Log in to the AWS IAM Console.
   2. Navigate to Access management Policies and select the checkbox for one of the account-wide policies.
   3. With the policy selected, click Actions Delete to open the delete policy dialog.
   4. Enter the policy name to confirm the deletion and select Delete to delete the policy.
   5. Repeat this step to delete each of the account-wide and Operator policies for the cluster.