Install ROSA with HCP clusters

Procedure

1. Open a shell prompt and clone the Terraform VPC repository by running the following command:

   $ git clone https://github.com/openshift-cs/terraform-vpc-example

2. Navigate to the created directory by running the following command:

   $ cd terraform-vpc-example

3. Initiate the Terraform file by running the following command:

   $ terraform init

   A message confirming the initialization appears when this process completes.

4. To build your VPC Terraform plan based on the existing Terraform template, run the plan command. You must include your AWS region. You can choose to specify a cluster name. A rosa.tfplan file is added to the hypershift-tf directory after the terraform plan completes. For more detailed options, see the Terraform VPC repository’s README file.

   $ terraform plan -out rosa.tfplan -var region=<region>

5. Apply this plan file to build your VPC by running the following command:

   $ terraform apply rosa.tfplan

   1. Optional: You can capture the values of the Terraform-provisioned private, public, and machinepool subnet IDs as environment variables to use when creating your ROSA with HCP cluster by running the following commands:

      $ export SUBNET_IDS=$(terraform output -raw cluster-subnets-string)

   2. Verify that the variables were correctly set with the following command:

      $ echo $SUBNET_IDS

      Example output

      $ subnet-0a6a57e0f784171aa,subnet-078e84e5b10ecf5b0

Procedure

1. Tag your resources in your terminal by running the following commands:

   1. For public subnets, run:

      $ aws ec2 create-tags --resources <public-subnet-id> --tags Key=kubernetes.io/role/elb,Value=1

   2. For private subnets, run:

      $ aws ec2 create-tags --resources <private-subnet-id> --tags Key=kubernetes.io/role/internal-elb,Value=1

Procedure

1. If they do not exist in your AWS account, create the required account-wide STS roles and attach the policies by running the following command:

   $ rosa create account-roles --hosted-cp

2. Optional: Set your prefix as an environmental variable by running the following command:

   $ export ACCOUNT_ROLES_PREFIX=<account_role_prefix>

   • View the value of the variable by running the following command:

     $ echo $ACCOUNT_ROLES_PREFIX

     Example output

     ManagedOpenShift

Procedure

1. To create your OIDC configuration alongside the AWS resources, run the following command:

   $ rosa create oidc-config --mode=auto --yes

   This command returns the following information.

   Example output

   ? Would you like to create a Managed (Red Hat hosted) OIDC Configuration Yes
   I: Setting up managed OIDC configuration
   I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice:
   	rosa create operator-roles --prefix <user-defined> --oidc-config-id 13cdr6b
   If you are going to create a Hosted Control Plane cluster please include '--hosted-cp'
   I: Creating OIDC provider using 'arn:aws:iam::4540112244:user/userName'
   ? Create the OIDC provider? Yes
   I: Created OIDC provider with ARN 'arn:aws:iam::4540112244:oidc-provider/dvbwgdztaeq9o.cloudfront.net/13cdr6b'

   When creating your cluster, you must supply the OIDC config ID. The CLI output provides this value for --mode auto, otherwise you must determine these values based on aws CLI output for --mode manual.

2. Optional: you can save the OIDC configuration ID as a variable to use later. Run the following command to save the variable:

   $ export OIDC_ID=<oidc_config_id>1

   1

   In the example output above, the OIDC configuration ID is 13cdr6b.

   • View the value of the variable by running the following command:

     $ echo $OIDC_ID

     Example output

     13cdr6b

Procedure

1. Set your prefix name to an environment variable using the following command:

   $ export OPERATOR_ROLES_PREFIX=<prefix_name>

2. To create your Operator roles, run the following command:

   $ rosa create operator-roles --hosted-cp --prefix=$OPERATOR_ROLES_PREFIX --oidc-config-id=$OIDC_ID --installer-role-arn arn:aws:iam::${AWS_ACCOUNT_ID}:role/${ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role

   The following breakdown provides options for the Operator role creation.

   $ rosa create operator-roles --hosted-cp
   	--prefix=$OPERATOR_ROLES_PREFIX 1
   	--oidc-config-id=$OIDC_ID 2
   	--installer-role-arn arn:aws:iam::${AWS_ACCOUNT_ID}:role/${ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role 3

   1

   You must supply a prefix when creating these Operator roles. Failing to do so produces an error. See the Additional resources of this section for information on the Operator prefix.

   2

   This value is the OIDC configuration ID that you created for your ROSA with HCP cluster.

   3

   This value is the installer role ARN that you created when you created the ROSA account roles.

   You must include the --hosted-cp parameter to create the correct roles for ROSA with HCP clusters. This command returns the following information.

   Example output

   ? Role creation mode: auto
   ? Operator roles prefix: <pre-filled_prefix> 1
   ? OIDC Configuration ID: 23soa2bgvpek9kmes9s7os0a39i13qm4 | https://dvbwgdztaeq9o.cloudfront.net/23soa2bgvpek9kmes9s7os0a39i13qm4 2
   ? Create hosted control plane operator roles: Yes
   W: More than one Installer role found
   ? Installer role ARN: arn:aws:iam::4540112244:role/<prefix>-HCP-ROSA-Installer-Role
   ? Permissions boundary ARN (optional):
   I: Reusable OIDC Configuration detected. Validating trusted relationships to operator roles:
   I: Creating roles using 'arn:aws:iam::4540112244:user/<userName>'
   I: Created role '<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials'
   I: Created role '<prefix>-openshift-cloud-network-config-controller-cloud-credenti' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti'
   I: Created role '<prefix>-kube-system-kube-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager'
   I: Created role '<prefix>-kube-system-capa-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager'
   I: Created role '<prefix>-kube-system-control-plane-operator' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator'
   I: Created role '<prefix>-kube-system-kms-provider' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider'
   I: Created role '<prefix>-openshift-image-registry-installer-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials'
   I: Created role '<prefix>-openshift-ingress-operator-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials'
   I: To create a cluster with these roles, run the following command:
   	rosa create cluster --sts --oidc-config-id 23soa2bgvpek9kmes9s7os0a39i13qm4 --operator-roles-prefix <prefix> --hosted-cp

   1

   This field is prepopulated with the prefix that you set in the initial creation command.

   2

   This field requires you to select an OIDC configuration that you created for your ROSA with HCP cluster.

   The Operator roles are now created and ready to use for creating your ROSA with HCP cluster.

Procedure

1. Open a shell prompt and clone the Terraform VPC repository by running the following command:

   $ git clone https://github.com/openshift-cs/terraform-vpc-example

2. Navigate to the created directory by running the following command:

   $ cd terraform-vpc-example

3. Initiate the Terraform file by running the following command:

   $ terraform init

   A message confirming the initialization appears when this process completes.

4. To build your VPC Terraform plan based on the existing Terraform template, run the plan command. You must include your AWS region. You can choose to specify a cluster name. A rosa.tfplan file is added to the hypershift-tf directory after the terraform plan completes. For more detailed options, see the Terraform VPC repository’s README file.

   $ terraform plan -out rosa.tfplan -var region=<region>

5. Apply this plan file to build your VPC by running the following command:

   $ terraform apply rosa.tfplan

   1. Optional: You can capture the values of the Terraform-provisioned private, public, and machinepool subnet IDs as environment variables to use when creating your ROSA with HCP cluster by running the following commands:

      $ export SUBNET_IDS=$(terraform output -raw cluster-subnets-string)

   2. Verify that the variables were correctly set with the following command:

      $ echo $SUBNET_IDS

      Example output

      $ subnet-0a6a57e0f784171aa,subnet-078e84e5b10ecf5b0

Procedure

1. If they do not exist in your AWS account, create the required account-wide STS roles and attach the policies by running the following command:

   $ rosa create account-roles --hosted-cp

2. Optional: Set your prefix as an environmental variable by running the following command:

   $ export ACCOUNT_ROLES_PREFIX=<account_role_prefix>

   • View the value of the variable by running the following command:

     $ echo $ACCOUNT_ROLES_PREFIX

     Example output

     ManagedOpenShift

Procedure

1. To create your OIDC configuration alongside the AWS resources, run the following command:

   $ rosa create oidc-config --mode=auto --yes

   This command returns the following information.

   Example output

   ? Would you like to create a Managed (Red Hat hosted) OIDC Configuration Yes
   I: Setting up managed OIDC configuration
   I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice:
   	rosa create operator-roles --prefix <user-defined> --oidc-config-id 13cdr6b
   If you are going to create a Hosted Control Plane cluster please include '--hosted-cp'
   I: Creating OIDC provider using 'arn:aws:iam::4540112244:user/userName'
   ? Create the OIDC provider? Yes
   I: Created OIDC provider with ARN 'arn:aws:iam::4540112244:oidc-provider/dvbwgdztaeq9o.cloudfront.net/13cdr6b'

   When creating your cluster, you must supply the OIDC config ID. The CLI output provides this value for --mode auto, otherwise you must determine these values based on aws CLI output for --mode manual.

2. Optional: you can save the OIDC configuration ID as a variable to use later. Run the following command to save the variable:

   $ export OIDC_ID=<oidc_config_id>1

   1

   In the example output above, the OIDC configuration ID is 13cdr6b.

   • View the value of the variable by running the following command:

     $ echo $OIDC_ID

     Example output

     13cdr6b

Procedure

1. Set your prefix name to an environment variable using the following command:

   $ export OPERATOR_ROLES_PREFIX=<prefix_name>

2. To create your Operator roles, run the following command:

   $ rosa create operator-roles --hosted-cp --prefix=$OPERATOR_ROLES_PREFIX --oidc-config-id=$OIDC_ID --installer-role-arn arn:aws:iam::${AWS_ACCOUNT_ID}:role/${ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role

   The following breakdown provides options for the Operator role creation.

   $ rosa create operator-roles --hosted-cp
   	--prefix=$OPERATOR_ROLES_PREFIX 1
   	--oidc-config-id=$OIDC_ID 2
   	--installer-role-arn arn:aws:iam::${AWS_ACCOUNT_ID}:role/${ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role 3

   1

   You must supply a prefix when creating these Operator roles. Failing to do so produces an error. See the Additional resources of this section for information on the Operator prefix.

   2

   This value is the OIDC configuration ID that you created for your ROSA with HCP cluster.

   3

   This value is the installer role ARN that you created when you created the ROSA account roles.

   You must include the --hosted-cp parameter to create the correct roles for ROSA with HCP clusters. This command returns the following information.

   Example output

   ? Role creation mode: auto
   ? Operator roles prefix: <pre-filled_prefix> 1
   ? OIDC Configuration ID: 23soa2bgvpek9kmes9s7os0a39i13qm4 | https://dvbwgdztaeq9o.cloudfront.net/23soa2bgvpek9kmes9s7os0a39i13qm4 2
   ? Create hosted control plane operator roles: Yes
   W: More than one Installer role found
   ? Installer role ARN: arn:aws:iam::4540112244:role/<prefix>-HCP-ROSA-Installer-Role
   ? Permissions boundary ARN (optional):
   I: Reusable OIDC Configuration detected. Validating trusted relationships to operator roles:
   I: Creating roles using 'arn:aws:iam::4540112244:user/<userName>'
   I: Created role '<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials'
   I: Created role '<prefix>-openshift-cloud-network-config-controller-cloud-credenti' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti'
   I: Created role '<prefix>-kube-system-kube-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager'
   I: Created role '<prefix>-kube-system-capa-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager'
   I: Created role '<prefix>-kube-system-control-plane-operator' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator'
   I: Created role '<prefix>-kube-system-kms-provider' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider'
   I: Created role '<prefix>-openshift-image-registry-installer-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials'
   I: Created role '<prefix>-openshift-ingress-operator-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials'
   I: To create a cluster with these roles, run the following command:
   	rosa create cluster --sts --oidc-config-id 23soa2bgvpek9kmes9s7os0a39i13qm4 --operator-roles-prefix <prefix> --hosted-cp

   1

   This field is prepopulated with the prefix that you set in the initial creation command.

   2

   This field requires you to select an OIDC configuration that you created for your ROSA with HCP cluster.

   The Operator roles are now created and ready to use for creating your ROSA with HCP cluster.

Procedure

1. Create a custom AWS customer-managed KMS key by running the following command:

   $ KMS_ARN=$(aws kms create-key --region $AWS_REGION --description 'Custom ROSA Encryption Key' --tags TagKey=red-hat,TagValue=true --query KeyMetadata.Arn --output text)

   This command saves the Amazon Resource Name (ARN) output of this custom key for further steps.

   Note

   Customers must provide the --tags TagKey=red-hat,TagValue=true argument that is required for a customer KMS key.

2. Verify the KMS key has been created by running the following command:

   $ echo $KMS_ARN

3. Set your AWS account ID to an environment variable.

   $ AWS_ACCOUNT_ID=<aws_account_id>

4. Add the ARN for the account-wide installer role and operator roles that you created in the preceding step to the Statement.Principal.AWS section in the file. In the following example, the ARN for the default ManagedOpenShift-HCP-ROSA-Installer-Role role is added:

   {
     "Version": "2012-10-17",
     "Id": "key-rosa-policy-1",
     "Statement": [
     {
                 "Sid": "Enable IAM User Permissions",
                 "Effect": "Allow",
                 "Principal": {
                     "AWS": "arn:aws:iam::${AWS_ACCOUNT_ID}:root"
                 },
                 "Action": "kms:*",
                 "Resource": "*"
             },
           {
                 "Sid": "Installer Permissions",
                 "Effect": "Allow",
                 "Principal": {
                     "AWS": "arn:aws:iam::${AWS_ACCOUNT_ID}:role/ManagedOpenShift-HCP-ROSA-Installer-Role"
                 },
                 "Action": [
                     "kms:CreateGrant",
                     "kms:DescribeKey",
                     "kms:GenerateDataKeyWithoutPlaintext"
                 ],
                 "Resource": "*"
             },
             {
                 "Sid": "ROSA KubeControllerManager Permissions",
                 "Effect": "Allow",
                 "Principal": {
                     "AWS": "arn:aws:iam::${AWS_ACCOUNT_ID}:role/<operator_role_prefix>-kube-system-kube-controller-manager"
   
                 },
                 "Action": "kms:DescribeKey",
                 "Resource": "*"
             },
             {
                 "Sid": "ROSA KMS Provider Permissions",
                 "Effect": "Allow",
                 "Principal": {
                     "AWS": "arn:aws:iam::${AWS_ACCOUNT_ID}:role/<operator_role_prefix>-kube-system-kms-provider"
                 },
                 "Action": [
                     "kms:Encrypt",
                     "kms:Decrypt",
                     "kms:DescribeKey"
                 ],
                 "Resource": "*"
             },
             {
                 "Sid": "ROSA NodeManager Permissions",
                 "Effect": "Allow",
                 "Principal": {
                     "AWS": "arn:aws:iam::${AWS_ACCOUNT_ID}:role/<operator_role_prefix>-kube-system-capa-controller-manager"
                 },
                 "Action": [
                     "kms:DescribeKey",
                     "kms:GenerateDataKeyWithoutPlaintext",
                     "kms:CreateGrant"
                 ],
                 "Resource": "*"
             }
         ]
     }

5. Confirm the details of the policy file created by running the following command:

   $ cat rosa-key-policy.json

6. Apply the newly generated key policy to the custom KMS key by running the following command:

   $ aws kms put-key-policy --key-id $KMS_ARN \
   --policy file://rosa-key-policy.json \
   --policy-name default

7. Create the cluster by running the following command:

   Note

   If your cluster name is longer than 15 characters, it will contain an autogenerated domain prefix as a sub-domain for your provisioned cluster on *.openshiftapps.com.

   To customize the subdomain, use the --domain-prefix flag. The domain prefix cannot be longer than 15 characters, must be unique, and cannot be changed after cluster creation.

   $ rosa create cluster --cluster-name <cluster_name> \
   --subnet-ids <private_subnet_id>,<public_subnet_id> \
   --sts \
   --mode auto \
   --machine-cidr 10.0.0.0/16 \
   --compute-machine-type m5.xlarge \
   --hosted-cp \
   --region <aws_region> \
   --oidc-config-id $OIDC_ID \
   --kms-key-arn $KMS_ARN \ 1
   --etcd-encryption-kms-arn $KMS_ARN \ 2
   --operator-roles-prefix $OPERATOR_ROLES_PREFIX

   1

   This KMS key ARN is used to encrypt all worker node root volumes. It is not required if only etcd database encryption is needed.

   2

   This KMS key ARN is used to encrypt the etcd database. The etcd database is always encrypted by default with an AES cipher block, but can be encrypted instead with a KMS key. It is not required if only node root volume encryption is needed.

1. Navigate to OpenShift Cluster Manager and select Instances.
2. Select your instance.
3. Click the Storage tab.
4. Copy the KMS key ID.
5. Search and select Key Management Service.
6. Enter your copied KMS key ID in the Filter field.

Procedure

1. Add the --additional-allowed-principals argument to the rosa create cluster command, similar to the following:

   $ rosa create cluster [...] --additional-allowed-principals <arn_string>

   You can use arn:aws:iam::account_id:role/role_name to approve a specific role.

2. When the cluster creation command runs, you receive a summary of your cluster with the --additional-allowed-principals specified:

   Example output

   Name:                       mycluster
   Domain Prefix:              mycluster
   Display Name:               mycluster
   ID:                         <cluster-id>
   External ID:                <cluster-id>
   Control Plane:              ROSA Service Hosted
   OpenShift Version:          4.15.17
   Channel Group:              stable
   DNS:                        Not ready
   AWS Account:                <aws_id>
   AWS Billing Account:        <aws_id>
   API URL:
   Console URL:
   Region:                     us-east-2
   Availability:
    - Control Plane:           MultiAZ
    - Data Plane:              SingleAZ
   
   Nodes:
    - Compute (desired):       2
    - Compute (current):       0
   Network:
    - Type:                    OVNKubernetes
    - Service CIDR:            172.30.0.0/16
    - Machine CIDR:            10.0.0.0/16
    - Pod CIDR:                10.128.0.0/14
    - Host Prefix:             /23
    - Subnets:                 subnet-453e99d40, subnet-666847ce827
   EC2 Metadata Http Tokens:   optional
   Role (STS) ARN:             arn:aws:iam::<aws_id>:role/mycluster-HCP-ROSA-Installer-Role
   Support Role ARN:           arn:aws:iam::<aws_id>:role/mycluster-HCP-ROSA-Support-Role
   Instance IAM Roles:
    - Worker:                  arn:aws:iam::<aws_id>:role/mycluster-HCP-ROSA-Worker-Role
   Operator IAM Roles:
    - arn:aws:iam::<aws_id>:role/mycluster-kube-system-control-plane-operator
    - arn:aws:iam::<aws_id>:role/mycluster-openshift-cloud-network-config-controller-cloud-creden
    - arn:aws:iam::<aws_id>:role/mycluster-openshift-image-registry-installer-cloud-credentials
    - arn:aws:iam::<aws_id>:role/mycluster-openshift-ingress-operator-cloud-credentials
    - arn:aws:iam::<aws_id>:role/mycluster-openshift-cluster-csi-drivers-ebs-cloud-credentials
    - arn:aws:iam::<aws_id>:role/mycluster-kube-system-kms-provider
    - arn:aws:iam::<aws_id>:role/mycluster-kube-system-kube-controller-manager
    - arn:aws:iam::<aws_id>:role/mycluster-kube-system-capa-controller-manager
   Managed Policies:           Yes
   State:                      waiting (Waiting for user action)
   Private:                    No
   Delete Protection:          Disabled
   Created:                    Jun 25 2024 13:36:37 UTC
   User Workload Monitoring:   Enabled
   Details Page:               https://console.redhat.com/openshift/details/s/Bvbok4O79q1Vg8
   OIDC Endpoint URL:          https://oidc.op1.openshiftapps.com/vhufi5lap6vbl3jlq20e (Managed)
   Audit Log Forwarding:       Disabled
   External Authentication:    Disabled
   Additional Principals:      arn:aws:iam::<aws_id>:role/additional-user-role

Procedure

1. If they do not exist in your AWS account, create the required account-wide STS roles and attach the policies by running the following command:

   $ rosa create account-roles --hosted-cp

2. Optional: Set your prefix as an environmental variable by running the following command:

   $ export ACCOUNT_ROLES_PREFIX=<account_role_prefix>

   • View the value of the variable by running the following command:

     $ echo $ACCOUNT_ROLES_PREFIX

     Example output

     ManagedOpenShift

Procedure

1. To create your OIDC configuration alongside the AWS resources, run the following command:

   $ rosa create oidc-config --mode=auto --yes

   This command returns the following information.

   Example output

   ? Would you like to create a Managed (Red Hat hosted) OIDC Configuration Yes
   I: Setting up managed OIDC configuration
   I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice:
   	rosa create operator-roles --prefix <user-defined> --oidc-config-id 13cdr6b
   If you are going to create a Hosted Control Plane cluster please include '--hosted-cp'
   I: Creating OIDC provider using 'arn:aws:iam::4540112244:user/userName'
   ? Create the OIDC provider? Yes
   I: Created OIDC provider with ARN 'arn:aws:iam::4540112244:oidc-provider/dvbwgdztaeq9o.cloudfront.net/13cdr6b'

   When creating your cluster, you must supply the OIDC config ID. The CLI output provides this value for --mode auto, otherwise you must determine these values based on aws CLI output for --mode manual.

2. Optional: you can save the OIDC configuration ID as a variable to use later. Run the following command to save the variable:

   $ export OIDC_ID=<oidc_config_id>1

   1

   In the example output above, the OIDC configuration ID is 13cdr6b.

   • View the value of the variable by running the following command:

     $ echo $OIDC_ID

     Example output

     13cdr6b

Procedure

1. Set your prefix name to an environment variable using the following command:

   $ export OPERATOR_ROLES_PREFIX=<prefix_name>

2. To create your Operator roles, run the following command:

   $ rosa create operator-roles --hosted-cp --prefix=$OPERATOR_ROLES_PREFIX --oidc-config-id=$OIDC_ID --installer-role-arn arn:aws:iam::${AWS_ACCOUNT_ID}:role/${ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role

   The following breakdown provides options for the Operator role creation.

   $ rosa create operator-roles --hosted-cp
   	--prefix=$OPERATOR_ROLES_PREFIX 1
   	--oidc-config-id=$OIDC_ID 2
   	--installer-role-arn arn:aws:iam::${AWS_ACCOUNT_ID}:role/${ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role 3

   1

   You must supply a prefix when creating these Operator roles. Failing to do so produces an error. See the Additional resources of this section for information on the Operator prefix.

   2

   This value is the OIDC configuration ID that you created for your ROSA with HCP cluster.

   3

   This value is the installer role ARN that you created when you created the ROSA account roles.

   You must include the --hosted-cp parameter to create the correct roles for ROSA with HCP clusters. This command returns the following information.

   Example output

   ? Role creation mode: auto
   ? Operator roles prefix: <pre-filled_prefix> 1
   ? OIDC Configuration ID: 23soa2bgvpek9kmes9s7os0a39i13qm4 | https://dvbwgdztaeq9o.cloudfront.net/23soa2bgvpek9kmes9s7os0a39i13qm4 2
   ? Create hosted control plane operator roles: Yes
   W: More than one Installer role found
   ? Installer role ARN: arn:aws:iam::4540112244:role/<prefix>-HCP-ROSA-Installer-Role
   ? Permissions boundary ARN (optional):
   I: Reusable OIDC Configuration detected. Validating trusted relationships to operator roles:
   I: Creating roles using 'arn:aws:iam::4540112244:user/<userName>'
   I: Created role '<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials'
   I: Created role '<prefix>-openshift-cloud-network-config-controller-cloud-credenti' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti'
   I: Created role '<prefix>-kube-system-kube-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager'
   I: Created role '<prefix>-kube-system-capa-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager'
   I: Created role '<prefix>-kube-system-control-plane-operator' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator'
   I: Created role '<prefix>-kube-system-kms-provider' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider'
   I: Created role '<prefix>-openshift-image-registry-installer-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials'
   I: Created role '<prefix>-openshift-ingress-operator-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials'
   I: To create a cluster with these roles, run the following command:
   	rosa create cluster --sts --oidc-config-id 23soa2bgvpek9kmes9s7os0a39i13qm4 --operator-roles-prefix <prefix> --hosted-cp

   1

   This field is prepopulated with the prefix that you set in the initial creation command.

   2

   This field requires you to select an OIDC configuration that you created for your ROSA with HCP cluster.

   The Operator roles are now created and ready to use for creating your ROSA with HCP cluster.

Procedure

1. Delete the account-wide roles:

   1. List the account-wide roles in your AWS account by using the ROSA CLI (rosa):

      $ rosa list account-roles

      Example output

      I: Fetching account roles
      ROLE NAME                                 ROLE TYPE      ROLE ARN                                                                 OPENSHIFT VERSION  AWS Managed
      ManagedOpenShift-HCP-ROSA-Installer-Role  Installer      arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-HCP-ROSA-Installer-Role  4.17               Yes
      ManagedOpenShift-HCP-ROSA-Support-Role    Support        arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-HCP-ROSA-Support-Role    4.17               Yes
      ManagedOpenShift-HCP-ROSA-Worker-Role     Worker         arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-HCP-ROSA-Worker-Role     4.17               Yes

   2. Delete the account-wide roles:

      $ rosa delete account-roles --prefix <prefix> --mode auto 1

      1

      You must include the --<prefix> argument. Replace <prefix> with the prefix of the account-wide roles to delete. If you did not specify a custom prefix when you created the account-wide roles, specify the default prefix, ManagedOpenShift.

      Important

      The account-wide IAM roles might be used by other ROSA clusters in the same AWS account. Only remove the roles if they are not required by other clusters.

      Example output

      W: There are no classic account roles to be deleted
      I: Deleting hosted CP account roles
      ? Delete the account role 'delete-rosa-HCP-ROSA-Installer-Role'? Yes
      I: Deleting account role 'delete-rosa-HCP-ROSA-Installer-Role'
      ? Delete the account role 'delete-rosa-HCP-ROSA-Support-Role'? Yes
      I: Deleting account role 'delete-rosa-HCP-ROSA-Support-Role'
      ? Delete the account role 'delete-rosa-HCP-ROSA-Worker-Role'? Yes
      I: Deleting account role 'delete-rosa-HCP-ROSA-Worker-Role'
      I: Successfully deleted the hosted CP account roles

2. Delete the account-wide in-line and Operator policies:

   1. Under the Policies page in the AWS IAM Console, filter the list of policies by the prefix that you specified when you created the account-wide roles and policies.

      Note

      If you did not specify a custom prefix when you created the account-wide roles, search for the default prefix, ManagedOpenShift.

   2. Delete the account-wide in-line policies and Operator policies by using the AWS IAM Console. For more information about deleting IAM policies by using the AWS IAM Console, see Deleting IAM policies in the AWS documentation.

      Important

      The account-wide in-line and Operator IAM policies might be used by other ROSA with HCP in the same AWS account. Only remove the roles if they are not required by other clusters.

Procedure

1. Unlink the OpenShift Cluster Manager IAM role from your Red Hat organization and delete the role:

   1. List the OpenShift Cluster Manager IAM roles in your AWS account:

      $ rosa list ocm-roles

      Example output

      I: Fetching ocm roles
      ROLE NAME                                                     ROLE ARN                                                                                         LINKED  ADMIN  AWS Managed
      ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>  arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>  Yes      Yes     Yes

   2. If your OpenShift Cluster Manager IAM role is listed as linked in the output of the preceding command, unlink the role from your Red Hat organization by running the following command:

      $ rosa unlink ocm-role --role-arn <arn> 1

      1

      Replace <arn> with the Amazon Resource Name (ARN) for your OpenShift Cluster Manager IAM role. The ARN is specified in the output of the preceding command. In the preceding example, the ARN is in the format arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>.

      Example output

      I: Unlinking OCM role
      ? Unlink the 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>' role from organization '<red_hat_organization_id>'? Yes
      I: Successfully unlinked role-arn 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>' from organization account '<red_hat_organization_id>'

   3. Delete the OpenShift Cluster Manager IAM role and policies:

      $ rosa delete ocm-role --role-arn <arn>

      Example output

      I: Deleting OCM role
      ? OCM Role ARN: arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>
      ? Delete 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>' ocm role? Yes
      ? OCM role deletion mode: auto 1
      I: Successfully deleted the OCM role

      1

      Specifies the deletion mode. You can use auto mode to automatically delete the OpenShift Cluster Manager IAM role and policies. In manual mode, the ROSA CLI generates the aws commands needed to delete the role and policies. manual mode enables you to review the details before running the aws commands manually.

2. Unlink the user IAM role from your Red Hat organization and delete the role:

   1. List the user IAM roles in your AWS account:

      $ rosa list user-roles

      Example output

      I: Fetching user roles
      ROLE NAME                                  ROLE ARN                                                                  LINKED
      ManagedOpenShift-User-<ocm_user_name>-Role  arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role  Yes

   2. If your user IAM role is listed as linked in the output of the preceding command, unlink the role from your Red Hat organization:

      $ rosa unlink user-role --role-arn <arn> 1

      1

      Replace <arn> with the Amazon Resource Name (ARN) for your user IAM role. The ARN is specified in the output of the preceding command. In the preceding example, the ARN is in the format arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role.

      Example output

      I: Unlinking user role
      ? Unlink the 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role' role from the current account '<ocm_user_account_id>'? Yes
      I: Successfully unlinked role ARN 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role' from account '<ocm_user_account_id>'

   3. Delete the user IAM role:

      $ rosa delete user-role --role-arn <arn>

      Example output

      I: Deleting user role
      ? User Role ARN: arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role
      ? Delete the 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role' role from the AWS account? Yes
      ? User role deletion mode: auto 1
      I: Successfully deleted the user role

      1

      Specifies the deletion mode. You can use auto mode to automatically delete the user IAM role. In manual mode, the ROSA CLI generates the aws command needed to delete the role. manual mode enables you to review the details before running the aws command manually.