Chapter 2. Creating Red Hat OpenShift Service on AWS clusters using the default options

• Create a VPC using the ROSA CLI
• Create a VPC by using a Terraform template
• Manually create the VPC resources in the AWS console

• Ensure your DHCP option set includes a domain name, and ensure that the domain name does not include any spaces or capital letters.
• If your VPC uses a custom DNS resolver (the domain name servers field is not AmazonProvideDNS), ensure that it can resolve the private hosted zones in Route53.

Prerequisites

• You have an AWS account.
• You have Red Hat Organization Administrator privileges in the OpenShift Cluster Manager organization.
• You have the permissions required to install AWS account-wide roles.
• You have installed and configured the latest ROSA CLI, rosa, on your installation host.

Procedure

• Run one of the following commands to create the required ocm-role IAM resource:

  Important

  The process to change your ocm-role IAM resource profile requires you to unlink and delete the current ocm-role IAM resource and create a new one with the required profile.

  • To create an ocm-role IAM role with standard privileges, run the following command:

    $ rosa create ocm-role

  • To create an ocm-role IAM role with admin privileges, run the following command:

    Important

    The admin profile supports "auto" mode configuration for Red Hat OpenShift Service on AWS clusters which provisions OIDC Configuration and Operator roles automatically. To achieve this automatic flow, the profile has a wider set of permissions than the standard profile.

    $ rosa create ocm-role --admin

    This command allows you to create the role by specifying specific attributes. The following example output shows the "auto mode" selected, which lets the ROSA CLI (rosa) create your Operator roles and policies. See "Methods of account-wide role creation" for more information. The following example shows what your creation flow might look like.

    I: Creating ocm role
    ? Role prefix: ManagedOpenShift
    ? Enable admin capabilities for the OCM role (optional): No
    ? Permissions boundary ARN (optional):
    ? Role Path (optional):
    ? Role creation mode: auto
    I: Creating role using 'arn:aws:iam::<ARN>:user/<UserName>'
    ? Create the 'ManagedOpenShift-OCM-Role-182' role? Yes
    I: Created role 'ManagedOpenShift-OCM-Role-182' with ARN  'arn:aws:iam::<ARN>:role/ManagedOpenShift-OCM-Role-182'
    I: Linking OCM role
    ? OCM Role ARN: arn:aws:iam::<ARN>:role/ManagedOpenShift-OCM-Role-182
    ? Link the 'arn:aws:iam::<ARN>:role/ManagedOpenShift-OCM-Role-182' role with organization '<AWS ARN>'? Yes
    I: Successfully linked role-arn 'arn:aws:iam::<ARN>:role/ManagedOpenShift-OCM-Role-182' with organization account '<AWS ARN>'

    where:

    Role prefix

    A prefix value for all of the created AWS resources. In this example, ManagedOpenShift prepends all of the AWS resources.

    Enable admin capabilities for the OCM role (optional)

    Choose if you want this role to have the additional admin permissions.

    Note

    You do not see this prompt if you used the --admin option.

    Permissions boundary ARN (optional)

    The Amazon Resource Name (ARN) of the policy to set permission boundaries.

    Role Path (optional)

    Specify an IAM path for the user name.

    Role creation mode

    Choose the method to create your AWS roles. By using auto, the ROSA CLI generates and links the roles and policies. In the auto mode, you receive some different prompts to create the AWS roles.

    Create the 'ManagedOpenShift-OCM-Role-182' role?

    The auto method asks if you want to create a specific ocm-role by using your prefix.

    OCM Role ARN

    Confirm that you want to associate your IAM role with your OpenShift Cluster Manager.

    Link the 'arn:aws:iam::<ARN>:role/ManagedOpenShift-OCM-Role-182' role with organization '<AWS ARN>'?

    Links the created role with your AWS organization.

  • To create an ocm-role IAM role with the minimum required privileges, run the following command:

    Note

    While the no-console profile offers the minimum permissions policy that can still create Red Hat OpenShift Service on AWS clusters, the permissions are insufficient if you want to use OpenShift Cluster Manager for cluster creation.

    $ rosa create ocm-role --no-console

Prerequisites

• You have completed the AWS prerequisites for Red Hat OpenShift Service on AWS.
• You have available AWS service quotas.
• You have enabled the Red Hat OpenShift Service on AWS in the AWS Console.
• You have installed and configured the latest ROSA command-line interface (CLI) (rosa) on your installation host.
• You have logged in to your Red Hat account by using the ROSA CLI.

Prerequisites

• You have completed the AWS prerequisites for Red Hat OpenShift Service on AWS.
• You have installed and configured the latest ROSA command-line interface (CLI) (rosa) on your installation host.

Verification

• You can list the possible OIDC configurations available for your clusters that are associated with your user organization. Run the following command:

  $ rosa list oidc-config

  For example:

  ID                                MANAGED  ISSUER URL                                                             SECRET ARN
  2330dbs0n8m3chkkr25gkkcd8pnj3lk2  true     https://dvbwgdztaeq9o.cloudfront.net/2330dbs0n8m3chkkr25gkkcd8pnj3lk2
  233hvnrjoqu14jltk6lhbhf2tj11f8un  false    https://oidc-r7u1.s3.us-east-1.amazonaws.com                           aws:secretsmanager:us-east-1:242819244:secret:rosa-private-key-oidc-r7u1-tM3MDN

Prerequisites

• You have completed the AWS prerequisites for Red Hat OpenShift Service on AWS.
• You have installed and configured the latest ROSA command-line interface (CLI) (rosa) on your installation host.
• You created the account-wide AWS roles.

Verification

• You can list the Operator roles associated with your Red Hat OpenShift Service on AWS account. Run the following command:

  $ rosa list operator-roles

  For example:

  I: Fetching operator roles
  ROLE PREFIX  AMOUNT IN BUNDLE
  <prefix>      8
  ? Would you like to detail a specific prefix Yes
  ? Operator Role Prefix: <prefix>
  ROLE NAME                                                         ROLE ARN                                                                                         VERSION  MANAGED
  <prefix>-kube-system-capa-controller-manager                       arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager                       4.13     No
  <prefix>-kube-system-control-plane-operator                        arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator                        4.13     No
  <prefix>-kube-system-kms-provider                                  arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider                                  4.13     No
  <prefix>-kube-system-kube-controller-manager                       arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager                       4.13     No
  <prefix>-openshift-cloud-network-config-controller-cloud-credenti  arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti  4.13     No
  <prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials       arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials       4.13     No
  <prefix>-openshift-image-registry-installer-cloud-credentials      arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials      4.13     No
  <prefix>-openshift-ingress-operator-cloud-credentials              arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials              4.13     No

  After the command runs, it displays all the prefixes associated with your AWS account and notes how many roles are associated with this prefix. If you need to see all of these roles and their details, enter "Yes" on the detail prompt to have these roles listed out with specifics.

• Support role: when Red Hat Site Reliability Engineers (SREs) need to perform diagnostic, maintenance or any other support function, they assume this role.

  Example support trust policy with an external ID sts_hcp_support_trust_policy.json

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::710019948333:role/RH-Technical-Support-15234082"
              },
              "Action": "sts:AssumeRole",
              "Condition": {
                "StringEquals": {
                  "sts:ExternalID": "<external_id>"
                }
             }
          }
      ]
  }

• Installer role: when Red Hat OpenShift Cluster Manager (OCM) automation needs to provision, scale or delete core cluster infrastructure, it assumes this role.

  Example installer trust policy with an external ID sts_hcp_installer_trust_policy.json

  {
      "Version": "2012-10-17",
      "Statement": [
          {
             "Effect": "Allow",
             "Principal": {
                 "AWS": "arn:aws:iam::710019948333:role/RH-Managed-OpenShift-Installer"
             },
             "Action": "sts:AssumeRole",
             "Condition": {
               "StringEquals": {
                 "sts:ExternalID": "<external_id>"
               }
            }
          }
      ]
  }

Additional resources

• Example scenario using an external ID
• Securely using external ID for accessing AWS accounts owned by others