Chapter 1. Red Hat OpenShift Service on AWS quick start guide

Procedure

1. To create your OIDC configuration alongside the AWS resources, run the following command:

   $ rosa create oidc-config --mode=auto --yes

   This command returns the following information.

   For example:

   ? Would you like to create a Managed (Red Hat hosted) OIDC Configuration Yes
   I: Setting up managed OIDC configuration
   I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice:
   	rosa create operator-roles --prefix <user-defined> --oidc-config-id 13cdr6b
   If you are going to create a Hosted Control Plane cluster please include '--hosted-cp'
   I: Creating OIDC provider using 'arn:aws:iam::4540112244:user/userName'
   ? Create the OIDC provider? Yes
   I: Created OIDC provider with ARN 'arn:aws:iam::4540112244:oidc-provider/dvbwgdztaeq9o.cloudfront.net/13cdr6b'

   When creating your cluster, you must supply the OIDC config ID. The CLI output provides this value for --mode auto, otherwise you must determine these values based on aws CLI output for --mode manual.

2. Optional: you can save the OIDC configuration ID as a variable to use later. Run the following command to save the variable:

   $ export OIDC_ID=<oidc_config_id>

   <oidc_config_id>

   In this example output, the OIDC configuration ID is 13cdr6b.

   • View the value of the variable by running the following command:

     $ echo $OIDC_ID

     For example:

     13cdr6b

Procedure

1. To create your Operator roles, run the following command:

   $ rosa create operator-roles --hosted-cp --prefix=$OPERATOR_ROLES_PREFIX --oidc-config-id=$OIDC_ID --installer-role-arn arn:aws:iam::$AWS_ACCOUNT_ID:role/${ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role

   The following breakdown provides options for the Operator role creation.

   $ rosa create operator-roles --hosted-cp
   	--prefix=$OPERATOR_ROLES_PREFIX
   	--oidc-config-id=$OIDC_ID
   	--installer-role-arn arn:aws:iam::$AWS_ACCOUNT_ID:role/$ACCOUNT_ROLES_PREFIX-HCP-ROSA-Installer-Role

   where:

   --prefix=

   You must supply a prefix when creating these Operator roles. Failing to do so produces an error. See the Additional resources of this section for information on the Operator prefix.

   --oidc-config-id=

   This value is the OIDC configuration ID that you created for your Red Hat OpenShift Service on AWS cluster.

   --installer-role-arn

   This value is the installer role ARN that you created when you created the Red Hat OpenShift Service on AWS account roles.

   You must include the --hosted-cp parameter to create the correct roles for Red Hat OpenShift Service on AWS clusters. This command returns the following information.

   For example:

   ? Role creation mode: auto
   ? Operator roles prefix: <pre-filled_prefix>
   ? OIDC Configuration ID: 23soa2bgvpek9kmes9s7os0a39i13qm4 | https://dvbwgdztaeq9o.cloudfront.net/23soa2bgvpek9kmes9s7os0a39i13qm4
   ? Create hosted control plane operator roles: Yes
   W: More than one Installer role found
   ? Installer role ARN: arn:aws:iam::4540112244:role/<prefix>-HCP-ROSA-Installer-Role
   ? Permissions boundary ARN (optional):
   I: Reusable OIDC Configuration detected. Validating trusted relationships to operator roles:
   I: Creating roles using 'arn:aws:iam::4540112244:user/<userName>'
   I: Created role '<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials'
   I: Created role '<prefix>-openshift-cloud-network-config-controller-cloud-credenti' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti'
   I: Created role '<prefix>-kube-system-kube-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager'
   I: Created role '<prefix>-kube-system-capa-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager'
   I: Created role '<prefix>-kube-system-control-plane-operator' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator'
   I: Created role '<prefix>-kube-system-kms-provider' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider'
   I: Created role '<prefix>-openshift-image-registry-installer-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials'
   I: Created role '<prefix>-openshift-ingress-operator-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials'
   I: To create a cluster with these roles, run the following command:
   	rosa create cluster --sts --oidc-config-id 23soa2bgvpek9kmes9s7os0a39i13qm4 --operator-roles-prefix <prefix> --hosted-cp

   where:

   Operator roles prefix

   This field is prepopulated with the prefix that you set in the initial creation command.

   OIDC Configuration ID

   This field requires you to select an OIDC configuration that you created for your Red Hat OpenShift Service on AWS cluster.

   The Operator roles are now created and ready to use for creating your Red Hat OpenShift Service on AWS cluster.

Procedure

1. Use one of the following commands to create your Red Hat OpenShift Service on AWS cluster:

   Note

   When creating a Red Hat OpenShift Service on AWS cluster, the default machine Classless Inter-Domain Routing (CIDR) is 10.0.0.0/16. If this does not correspond to the CIDR range for your VPC subnets, add --machine-cidr <address_block> to the following commands. To learn more about the default CIDR ranges for Red Hat OpenShift Service on AWS, see CIDR range definitions.

   • If you did not set environmental variables, run the following command:

     $ rosa create cluster --cluster-name=<cluster_name> \
         --mode=auto --hosted-cp [--private] \
         --operator-roles-prefix <operator-role-prefix> \
         --external-id <external-id> \
         --oidc-config-id <id-of-oidc-configuration> \
         --subnet-ids=<public-subnet-id>,<private-subnet-id>

     where:

     <cluster_name>

     Specify the name of your cluster. If your cluster name is longer than 15 characters, it will contain an autogenerated domain prefix as a subdomain for your provisioned cluster on openshiftapps.com. To customize the subdomain, use the --domain-prefix flag. The domain prefix cannot be longer than 15 characters, must be unique, and cannot be changed after cluster creation.

     --private

     Optional. The --private argument is used to create private Red Hat OpenShift Service on AWS clusters. If you use this argument, ensure that you only use your private subnet ID for --subnet-ids.

     <operator-role-prefix>

     By default, the cluster-specific Operator role names are prefixed with the cluster name and a random 4-digit hash. You can optionally specify a custom prefix to replace <cluster_name>-<hash> in the role names. The prefix is applied when you create the cluster-specific Operator IAM roles. For information about the prefix, see About custom Operator IAM role prefixes.

     <external-id>

     Optional. A unique identifier that might be required when you assume a role in another account.

     Note

     If you specified custom ARN paths when you created the associated account-wide roles, the custom path is automatically detected. The custom path is applied to the cluster-specific Operator roles when you create them in a later step.

   • If you set the environmental variables, create a cluster with a single, initial machine pool, using either a publicly or privately available API, and a publicly or privately available Ingress by running the following command:

     $ rosa create cluster --private --cluster-name=<cluster_name> \
         --mode=auto --hosted-cp --operator-roles-prefix=$OPERATOR_ROLES_PREFIX \
         --oidc-config-id=$OIDC_ID --subnet-ids=$SUBNET_IDS

   • If you set the environmental variables, create a cluster with a single, initial machine pool, a publicly available API, and a publicly available Ingress by running the following command:

     $ rosa create cluster --cluster-name=<cluster_name> --mode=auto \
         --hosted-cp --operator-roles-prefix=$OPERATOR_ROLES_PREFIX \
         --oidc-config-id=$OIDC_ID --subnet-ids=$SUBNET_IDS

2. Check the status of your cluster by running the following command:

   $ rosa describe cluster --cluster=<cluster_name>

   The following State field changes are listed in the output as the cluster installation progresses:

   • pending (Preparing account)
   • installing (DNS setup in progress)
   • installing

   • ready

     Note

     If the installation fails or the State field does not change to ready after more than 10 minutes, check the installation troubleshooting documentation for details. For more information, see Troubleshooting installations. For steps to contact Red Hat Support for assistance, see Getting support for Red Hat OpenShift Service on AWS.

3. Track the progress of the cluster creation by watching the Red Hat OpenShift Service on AWS installation program logs. To check the logs, run the following command:

   $ rosa logs install --cluster=<cluster_name> --watch

   Optional: To watch for new log messages as the installation progresses, use the --watch argument.

Procedure

1. Navigate to github.com and log in to your GitHub account.
2. Invite users that require access to the Red Hat OpenShift Service on AWS cluster to your GitHub organization. Follow the steps in Inviting users to join your organization in the GitHub documentation.

Procedure

1. Obtain the console URL for your cluster:

   $ rosa describe cluster -c <cluster_name> | grep Console

   Example output

   Console URL:                https://console-openshift-console.apps.example-cluster.wxyz.p1.openshiftapps.com

2. Go to the console URL in the output of the preceding step and log in.

   • If you created a cluster-admin user, log in by using the provided credentials.
   • If you configured an identity provider for your cluster, select the identity provider name in the Log in with…​ dialog and complete any authorization requests that are presented by your provider.

Procedure

1. Go to the Cluster List page in OpenShift Cluster Manager.
2. Click the options icon (⋮) next to the cluster you want to view.
3. Click Open console.
4. Your cluster console opens in a new browser window. Log in to your Red Hat account with your configured identity provider credentials.
5. In the Administrator perspective, select Home Projects Create Project.
6. Enter a name for your project and optionally add a Display Name and Description.
7. Click Create to create the project.
8. Switch to the Developer perspective and select +Add. Verify that the selected Project is the one that you just created.
9. In the Developer Catalog dialog, select All services.
10. In the Developer Catalog page, select Languages JavaScript from the menu.

11. Click Node.js, and then click Create to open the Create Source-to-Image application page.

    Note

    You might need to click Clear All Filters to display the Node.js option.

12. In the Git section, click Try sample.
13. Add a unique name in the Name field. The value will be used to name the associated resources.
14. Confirm that Deployment and Create a route are selected.
15. Click Create to deploy the application. It will take a few minutes for the pods to deploy.
16. Optional: Check the status of the pods in the Topology pane by selecting your Node.js app and reviewing its sidebar. You must wait for the nodejs build to complete and for the nodejs pod to be in a Running state before continuing.

17. When the deployment is complete, click the route URL for the application, which has a format similar to the following:

    https://nodejs-<project>.<cluster_name>.<hash>.<region>.openshiftapps.com/

    A new tab in your browser opens with a message similar to the following:

    Welcome to your Node.js application on OpenShift

18. Optional: Delete the application and clean up the resources that you created:

    1. In the Administrator perspective, navigate to Home Projects.
    2. Click the action menu for your project and select Delete Project.

Procedure

1. Delete a cluster and watch the logs, replacing <cluster_name> with the name or ID of your cluster:

   $ rosa delete cluster --cluster=<cluster_name> --watch

   Important

   You must wait for the cluster deletion to complete before you remove the IAM roles, policies, and OIDC provider. The account-wide roles are required to delete the resources created by the installer. The cluster-specific Operator roles are required to clean-up the resources created by the OpenShift Operators. The Operators use the OIDC provider to authenticate with AWS APIs.

2. After the cluster is deleted, delete the OIDC provider that the cluster Operators use to authenticate:

   $ rosa delete oidc-provider -c <cluster_id> --mode auto

   Note

   You can use the -y option to automatically answer yes to the prompts.

3. Delete the cluster-specific Operator IAM roles:

   $ rosa delete operator-roles -c <cluster_id> --mode auto

4. Delete the account-wide roles:

   Important

   Account-wide IAM roles and policies might be used by other Red Hat OpenShift Service on AWS clusters in the same AWS account. You must only remove the resources if they are not required by other clusters.

   $ rosa delete account-roles --prefix <prefix> --mode auto

   Replace <prefix> with the prefix of the account-wide roles to delete. If you did not specify a custom prefix when you created the account-wide roles, specify the default prefix, depending on how they were created, HCP-ROSA or ManagedOpenShift.

5. Delete the account-wide and Operator IAM policies that you created for Red Hat OpenShift Service on AWS deployments:

   1. Log in to the AWS IAM Console.
   2. Navigate to Access management Policies and select the checkbox for one of the account-wide policies.
   3. With the policy selected, click on Actions Delete to open the delete policy dialog.
   4. Enter the policy name to confirm the deletion and select Delete to delete the policy.
   5. Repeat this step to delete each of the account-wide and Operator policies for the cluster.