Chapter 6. Creating a private cluster on Red Hat OpenShift Service on AWS

1. Create a VPC with at least one private subnet. Ensure that your machine’s classless inter-domain routing (CIDR) matches your virtual private cloud’s CIDR. For more information, see Requirements for using your own VPC and VPC Validation.

   Important

   If you use a firewall, you must configure it so that ROSA can access the sites that required to function.

   For more information, see the "AWS PrivateLink firewall prerequisites" section.

2. Create the account-wide IAM roles by running the following command:

   $ rosa create account-roles --hosted-cp

   Copy to Clipboard Toggle word wrap

3. Create the OIDC configuration by running the following command:

   $ rosa create oidc-config --mode=auto --yes

   Copy to Clipboard Toggle word wrap

   Save the OIDC configuration ID because you need it to create the Operator roles.

   Example output

   I: Setting up managed OIDC configuration
   I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice:
   	rosa create operator-roles --prefix <user-defined> --oidc-config-id 28s4avcdt2l318r1jbk3ifmimkurk384
   If you are going to create a Hosted Control Plane cluster please include '--hosted-cp'
   I: Creating OIDC provider using 'arn:aws:iam::46545644412:user/user'
   I: Created OIDC provider with ARN 'arn:aws:iam::46545644412:oidc-provider/oidc.op1.openshiftapps.com/28s4avcdt2l318r1jbk3ifmimkurk384'

   Copy to Clipboard Toggle word wrap

4. Create the Operator roles by running the following command:

   $ rosa create operator-roles --hosted-cp --prefix <operator_roles_prefix> --oidc-config-id <oidc_config_id> --installer-role-arn arn:aws:iam::$<account_roles_prefix>:role/$<account_roles_prefix>-HCP-ROSA-Installer-Role

   Copy to Clipboard Toggle word wrap

5. Create a private Red Hat OpenShift Service on AWS cluster by running the following command:

   $ rosa create cluster --private --cluster-name=<cluster-name> --sts --mode=auto --hosted-cp --operator-roles-prefix <operator_role_prefix> --oidc-config-id <oidc_config_id> [--machine-cidr=<VPC CIDR>/16] --subnet-ids=<private-subnet-id1>[,<private-subnet-id2>,<private-subnet-id3>]

   Copy to Clipboard Toggle word wrap

6. Enter the following command to check the status of your cluster. During cluster creation, the State field from the output will transition from pending to installing, and finally, to ready.

   $ rosa describe cluster --cluster=<cluster_name>

   Copy to Clipboard Toggle word wrap
   Note

   If installation fails or the State field does not change to ready after 10 minutes, see the "Troubleshooting Red Hat OpenShift Service on AWS installations" documentation in the Additional resources section.

7. Enter the following command to follow the OpenShift installer logs to track the progress of your cluster:

   $ rosa logs install --cluster=<cluster_name> --watch

   Copy to Clipboard Toggle word wrap

Procedure

1. Set your cluster name as an environmental variable by running the following command:

   $ export CLUSTER_NAME=<cluster_name>

   Copy to Clipboard Toggle word wrap

   Verify that the variable exists by running the following command:

   $ echo $CLUSTER_NAME

   Copy to Clipboard Toggle word wrap

   Example output

   hcp-private

   Copy to Clipboard Toggle word wrap

2. Find the VPC endpoint (VPCE) ID and VPC ID by running the following command:

   $ read -r VPCE_ID VPC_ID <<< $(aws ec2 describe-vpc-endpoints --filters "Name=tag:api.openshift.com/id,Values=$(rosa describe cluster -c ${CLUSTER_NAME} -o yaml | grep '^id: ' | cut -d' ' -f2)" --query 'VpcEndpoints[].[VpcEndpointId,VpcId]' --output text)

   Copy to Clipboard Toggle word wrap
   Warning

   Modifying or removing the default AWS PrivateLink endpoint security group is not supported and might result in unexpected behavior.

3. Create an additional security group by running the following command:

   $ export SG_ID=$(aws ec2 create-security-group --description "Granting API access to ${CLUSTER_NAME} from outside of VPC" --group-name "${CLUSTER_NAME}-api-sg" --vpc-id $VPC_ID --output text)

   Copy to Clipboard Toggle word wrap

4. Add an inbound (ingress) rule to the security group by running the following command:

   $ aws ec2 authorize-security-group-ingress --group-id $SG_ID --ip-permissions FromPort=443,ToPort=443,IpProtocol=tcp,IpRanges=[{CidrIp=<cidr-to-allow>}] \ 

   1

   Copy to Clipboard Toggle word wrap

   1

   Specify the CIDR block you want to allow access from.

5. Add the new security group to the VPCE by running the following command:

   $ aws ec2 modify-vpc-endpoint --vpc-endpoint-id $VPCE_ID --add-security-group-ids $SG_ID

   Copy to Clipboard Toggle word wrap