Chapter 2. Configuring private connections

1. Get started with configuring AWS infrastructure access for your OpenShift Dedicated cluster. By creating an AWS user and account and providing that user with access to the OpenShift Dedicated AWS account.

2. After you have access to the OpenShift Dedicated AWS account, use one or more of the following methods to establish a private connection to your cluster:

   • Configuring AWS VPC peering: Enable VPC peering to route network traffic between two private IP addresses.
   • Configuring AWS VPN: Establish a Virtual Private Network to securely connect your private network to your Amazon Virtual Private Cloud.
   • Configuring AWS Direct Connect: Configure AWS Direct Connect to establish a dedicated network connection between your private network and an AWS Direct Connect location.

Procedure

1. Log in to your AWS account. If necessary, you can create a new AWS account by following the AWS documentation.

2. Create an IAM user with STS:AllowAssumeRole permissions within the AWS account.

   1. Open the IAM dashboard of the AWS Management Console.
   2. In the Policies section, click Create Policy.

   3. Select the JSON tab and replace the existing text with the following:

      {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": "sts:AssumeRole",
                "Resource": "*"
            }
        ]
      }

   4. Click Next:Tags.
   5. Optional: Add tags. Click Next:Review
   6. Provide an appropriate name and description, then click Create Policy.
   7. In the Users section, click Add user.
   8. Provide an appropriate user name.
   9. Select AWS Management Console access as the AWS access type.
   10. Adjust the password requirements as necessary for your organization, then click Next:Permissions.

   11. Click the Attach existing policies directly option. Search for and check the policy created in previous steps.

       Note

       It is not recommended to set a permissions boundary.

   12. Click Next: Tags, then click Next: Review. Confirm the configuration is correct.
   13. Click Create user, a success page appears.
   14. Gather the IAM user’s Amazon Resource Name (ARN). The ARN will have the following format: arn:aws:iam::000111222333:user/username. Click Close.
3. Open OpenShift Cluster Manager in your browser and select the cluster you want to allow AWS infrastructure access.
4. Select the Access control tab, and scroll to the AWS Infrastructure Access section.
5. Paste the AWS IAM ARN and select Network Management or Read-only permissions, then click Grant role.
6. Copy the AWS OSD console URL to your clipboard.
7. Sign in to your AWS account with your Account ID or alias, IAM user name, and password.
8. In a new browser tab, paste the AWS OSD Console URL that will be used to route to the AWS Switch Role page.
9. Your account number and role will be filled in already. Choose a display name if necessary, then click Switch Role.

Procedure

1. Initiate the VPC peering request.
2. Accept the VPC peering request.
3. Update your Route tables for the VPC peering connection.

Procedure

1. Create a customer gateway to configure the VPN connection.
2. If you do not already have a Virtual Private Gateway attached to the intended VPC, create and attach a Virtual Private Gateway.
3. Configure routing and enable VPN route propagation.
4. Update your security group.

5. Establish the Site-to-Site VPN connection.

   Note

   Note the VPC subnet information, which you must add to your configuration as the remote network.

Procedure

1. Create a VIF or view your existing VIFs to determine the type of direct connection you need to create.

2. Create your gateway.

   1. If the Direct Connect VIF type is Private, create a virtual private gateway.
   2. If the Direct Connect VIF is Public, create a Direct Connect gateway.

3. If you have an existing gateway you want to use, create an association proposal and send the proposal to the DXGateway owner for approval.

   Warning

   When connecting to an existing DXGateway, you are responsible for the costs.

Procedure

1. Log in to OpenShift Cluster Manager.
2. Click Create cluster OpenShift Dedicated Create cluster.
3. Configure your cluster details.
4. When selecting your preferred network configuration, select Advanced.

5. Select Private.

   Warning

   When set to Private, you cannot access your cluster unless you have configured the private connections in your cloud provider as outlined in the prerequisites.

6. Click Create cluster. The cluster creation process begins and takes about 30-40 minutes to complete.

Procedure

1. Log in to OpenShift Cluster Manager.
2. Select the public cluster you would like to make private.

3. On the Networking tab, select Make API private under Control Plane API endpoint.

   Warning

   When set to Private, you cannot access your cluster unless you have configured the private connections in your cloud provider as outlined in the prerequisites.

4. Click Change settings.

   Note

   Transitioning your cluster between private and public can take several minutes to complete.

Procedure

1. Log in to OpenShift Cluster Manager.
2. Select the private cluster you would like to make public.
3. On the Networking tab, deselect Make API private under Control Plane API endpoint.

4. Click Change settings.

   Note

   Transitioning your cluster between private and public can take several minutes to complete.