Chapter 7. Creating Red Hat OpenShift Service on AWS clusters with egress zero

Procedure

1. Set your environment variable by running the following command:

   $ export <variable_name>=<variable_value>

   Copy to Clipboard Toggle word wrap

2. You can confirm that your variable has been set by running the following command:

   $ echo <variable_name>

   Copy to Clipboard Toggle word wrap
   Expand

   Table 7.2. Suggested variables for disconnected Red Hat OpenShift Service on AWS clusters

   Variable name	Variable value	Notes
   AWS_ACCOUNT_ID	$(aws sts get-caller-identity --query Account --output text)	You must be logged in to your AWS account with rosa login.
   CLUSTER_NAME	The name you want for your cluster.	Your cluster name cannot exceed 26 characters.
   OIDC_ID	The 32-digit ID for your OpenID Connect (OIDC) configuration.	You generate this ID by running rosa create oidc-config.
   OPERATOR_ROLES_PREFIX	The Operator role prefix.	If you want to make your AWS account roles use the same prefix as your Operator roles, you can run ACCOUNT_ROLES_PREFIX=$OPERATOR_ROLES_PREFIX after setting your Operator role prefix variable.
   PRIVATE_SUBNET	The ID of your private subnets.	You must enclose this value in quotation marks (") and separate the subnet IDs with commas.
   REGION	Your AWS region.	-
   SUBNET_IDS	The IDs of all your subnets.	You must enclose this value in quotation marks (") and separate the subnet IDs with commas.

   Show more

Procedure

1. If they do not exist in your AWS account, create the required account-wide STS roles and attach the policies by running the following command:

   $ rosa create account-roles --hosted-cp

   Copy to Clipboard Toggle word wrap

2. Ensure that the your worker role has the correct AWS policy by running the following command:

   $ aws iam attach-role-policy \
   --role-name ManagedOpenShift-HCP-ROSA-Worker-Role \ 

   1

   
   --policy-arn "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"

   Copy to Clipboard Toggle word wrap

   1

   This role needs to include the prefix that was created in the previous step.

3. Optional: Set your prefix as an environmental variable by running the following command:

   $ export ACCOUNT_ROLES_PREFIX=<account_role_prefix>

   Copy to Clipboard Toggle word wrap

   • View the value of the variable by running the following command:

     $ echo $ACCOUNT_ROLES_PREFIX

     Copy to Clipboard Toggle word wrap

     Example output

     ManagedOpenShift

     Copy to Clipboard Toggle word wrap

Procedure

1. To create your OIDC configuration alongside the AWS resources, run the following command:

   $ rosa create oidc-config --mode=auto --yes

   Copy to Clipboard Toggle word wrap

   This command returns the following information.

   Example output

   ? Would you like to create a Managed (Red Hat hosted) OIDC Configuration Yes
   I: Setting up managed OIDC configuration
   I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice:
   	rosa create operator-roles --prefix <user-defined> --oidc-config-id 13cdr6b
   If you are going to create a Hosted Control Plane cluster please include '--hosted-cp'
   I: Creating OIDC provider using 'arn:aws:iam::4540112244:user/userName'
   ? Create the OIDC provider? Yes
   I: Created OIDC provider with ARN 'arn:aws:iam::4540112244:oidc-provider/dvbwgdztaeq9o.cloudfront.net/13cdr6b'

   Copy to Clipboard Toggle word wrap

   When creating your cluster, you must supply the OIDC config ID. The CLI output provides this value for --mode auto, otherwise you must determine these values based on aws CLI output for --mode manual.

2. Optional: you can save the OIDC configuration ID as a variable to use later. Run the following command to save the variable:

   $ export OIDC_ID=<oidc_config_id>

   1

   Copy to Clipboard Toggle word wrap

   1

   In the example output above, the OIDC configuration ID is 13cdr6b.

   • View the value of the variable by running the following command:

     $ echo $OIDC_ID

     Copy to Clipboard Toggle word wrap

     Example output

     13cdr6b

     Copy to Clipboard Toggle word wrap

Procedure

1. To create your Operator roles, run the following command:

   $ rosa create operator-roles --hosted-cp --prefix=$OPERATOR_ROLES_PREFIX --oidc-config-id=$OIDC_ID --installer-role-arn arn:aws:iam::$AWS_ACCOUNT_ID:role/${ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role

   Copy to Clipboard Toggle word wrap

   The following breakdown provides options for the Operator role creation.

   $ rosa create operator-roles --hosted-cp
   	--prefix=$OPERATOR_ROLES_PREFIX 

   1

   
   	--oidc-config-id=$OIDC_ID 

   2

   
   	--installer-role-arn arn:aws:iam::$AWS_ACCOUNT_ID:role/$ACCOUNT_ROLES_PREFIX-HCP-ROSA-Installer-Role 

   3

   Copy to Clipboard Toggle word wrap

   1

   You must supply a prefix when creating these Operator roles. Failing to do so produces an error. See the Additional resources of this section for information on the Operator prefix.

   2

   This value is the OIDC configuration ID that you created for your Red Hat OpenShift Service on AWS cluster.

   3

   This value is the installer role ARN that you created when you created the Red Hat OpenShift Service on AWS account roles.

   You must include the --hosted-cp parameter to create the correct roles for Red Hat OpenShift Service on AWS clusters. This command returns the following information.

   Example output

   ? Role creation mode: auto
   ? Operator roles prefix: <pre-filled_prefix> 

   1

   
   ? OIDC Configuration ID: 23soa2bgvpek9kmes9s7os0a39i13qm4 | https://dvbwgdztaeq9o.cloudfront.net/23soa2bgvpek9kmes9s7os0a39i13qm4 

   2

   
   ? Create hosted control plane operator roles: Yes
   W: More than one Installer role found
   ? Installer role ARN: arn:aws:iam::4540112244:role/<prefix>-HCP-ROSA-Installer-Role
   ? Permissions boundary ARN (optional):
   I: Reusable OIDC Configuration detected. Validating trusted relationships to operator roles:
   I: Creating roles using 'arn:aws:iam::4540112244:user/<userName>'
   I: Created role '<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials'
   I: Created role '<prefix>-openshift-cloud-network-config-controller-cloud-credenti' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti'
   I: Created role '<prefix>-kube-system-kube-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager'
   I: Created role '<prefix>-kube-system-capa-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager'
   I: Created role '<prefix>-kube-system-control-plane-operator' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator'
   I: Created role '<prefix>-kube-system-kms-provider' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider'
   I: Created role '<prefix>-openshift-image-registry-installer-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials'
   I: Created role '<prefix>-openshift-ingress-operator-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials'
   I: To create a cluster with these roles, run the following command:
   	rosa create cluster --sts --oidc-config-id 23soa2bgvpek9kmes9s7os0a39i13qm4 --operator-roles-prefix <prefix> --hosted-cp

   Copy to Clipboard Toggle word wrap

   1

   This field is prepopulated with the prefix that you set in the initial creation command.

   2

   This field requires you to select an OIDC configuration that you created for your Red Hat OpenShift Service on AWS cluster.

   The Operator roles are now created and ready to use for creating your Red Hat OpenShift Service on AWS cluster.

Procedure

1. Use one of the following commands to create your Red Hat OpenShift Service on AWS cluster:

   Note

   When creating a Red Hat OpenShift Service on AWS cluster, the default machine Classless Inter-Domain Routing (CIDR) is 10.0.0.0/16. If this does not correspond to the CIDR range for your VPC subnets, add --machine-cidr <address_block> to the following commands. To learn more about the default CIDR ranges for Red Hat OpenShift Service on AWS, see the CIDR range definitions.

   • If you did not set environment variables, run the following command:

     $ rosa create cluster --cluster-name=<cluster_name> \ 

     1

     
          --mode=auto --hosted-cp [--private] \
          --operator-roles-prefix <operator-role-prefix> \ 

     2

     
          --oidc-config-id <id-of-oidc-configuration> \
          --subnet-ids=<private-subnet-id> --region <region> \
          --machine-cidr 10.0.0.0/16 --service-cidr 172.30.0.0/16 \
          --pod-cidr 10.128.0.0/14 --host-prefix 23 \
          --billing-account <root-acct-id> \ 

     3

     
          --properties zero_egress:true

     Copy to Clipboard Toggle word wrap

     1

     Specify the name of your cluster. If your cluster name is longer than 15 characters, it will contain an autogenerated domain prefix as a subdomain for your provisioned cluster on openshiftapps.com. To customize the subdomain, use the --domain-prefix flag. The domain prefix cannot be longer than 15 characters, must be unique, and cannot be changed after cluster creation.

     2

     By default, the cluster-specific Operator role names are prefixed with the cluster name and a random 4-digit hash. You can optionally specify a custom prefix to replace <cluster_name>-<hash> in the role names. The prefix is applied when you create the cluster-specific Operator IAM roles. For information about the prefix, see About custom Operator IAM role prefixes.

     Note

     If you specified custom ARN paths when you created the associated account-wide roles, the custom path is automatically detected. The custom path is applied to the cluster-specific Operator roles when you create them in a later step.

     3

     If your billing account is different from your user account, add this argument and specify the AWS account that is responsible for all billing.

   • If you set the environment variables, create a cluster with egress zero that has a single, initial machine pool, using a privately available API, and a privately available Ingress by running the following command:

     $ rosa create cluster --private --cluster-name=$CLUSTER_NAME \
         --mode=auto --hosted-cp --operator-roles-prefix=$OPERATOR_ROLES_PREFIX \
         --oidc-config-id=$OIDC_ID --subnet-ids=$SUBNET_IDS \
         --region $REGION --machine-cidr 10.0.0.0/16 --service-cidr 172.30.0.0/16 \
         --pod-cidr 10.128.0.0/14 --host-prefix 23 \
         --private --properties zero_egress:true

     Copy to Clipboard Toggle word wrap

2. Check the status of your cluster by running the following command:

   $ rosa describe cluster --cluster=<cluster_name>

   Copy to Clipboard Toggle word wrap

   The following State field changes are listed in the output as cluster installation progresses:

   • pending (Preparing account)
   • installing (DNS setup in progress)
   • installing

   • ready

     Note

     If the installation fails or the State field does not change to ready after more than 10 minutes, check the installation troubleshooting documentation for details. For more information, see Troubleshooting installations. For steps to contact Red Hat Support for assistance, see Getting support for Red Hat OpenShift Service on AWS.

3. Track the cluster creation progress by watching the Red Hat OpenShift Service on AWS installation program logs. To check the logs, run the following command:

   $ rosa logs install --cluster=<cluster_name> --watch \ 

   1

   Copy to Clipboard Toggle word wrap

   1

   Optional: To watch for new log messages as the installation progresses, use the --watch argument.