Chapter 3. Installing a Red Hat OpenShift Service on AWS cluster in AWS GovCloud

Procedure

1. Navigate to https://console.openshiftusgov.com/openshift/token.
2. Sign in with your Red Hat FedRAMP account credentials where you will see a screen with your token.
3. Copy your token for the next step.

4. In your terminal:

   1. Run rosa login and paste your copied token to log in to the service.

      $ rosa login --govcloud --token=<TOKEN>

      Note

      Depending on your AWS CLI configuration, you might need to add a government region to the end of the command string, such as --region us-gov-west-1.

   2. Run rosa whoami to confirm all information is correct ensuring that you are using the AWS Gov region and the Red Hat OpenShift Cluster Manager API is “https://api.openshiftusgov.com”..

      $ rosa whoami

      Example output

      AWS ARN:                                 arn:aws-us-gov:iam::00000000000:user/rosa-gov-user
      AWS Account ID:                       00000000000
      AWS Default Region:                 us-gov-east-1
      OCM API:                                   https://api.openshiftusgov.com
      OCM Account Email:                  rosa-gov-user@redhat.com
      OCM Account ID:                       3ZXXXXXXXXXXXXXXXXXXXXXXXXX
      OCM Account Name:                 Rosa Gov
      OCM Account Username:          rosa-gov-user
      OCM Organization External ID:  rosa-gov-user
      OCM Organization ID:                3ZXXXXXXXXXXXXXXXXXXXXXXXXX
      OCM Organization Name:          rosa-gov-user

5. You must create a VPC where Red Hat OpenShift Service on AWS will be deployed. For instructions on setting up a VPC, see Amazon VPC architecture for the AWS PrivateLink use case.

Procedure

1. With AWS PrivateLink, you can create a cluster with a single availability zone (Single-AZ) or many availability zones (Multi-AZ). In either case, your machine’s classless inter-domain routing (CIDR) must match your virtual private cloud’s CIDR. See Requirements for using your own VPC and VPC validation for more information.

   Important

   If you use a firewall, you must configure it so that Red Hat OpenShift Service on AWS can access the sites that it requires to function.

   For more information, see the AWS PrivateLink firewall prerequisites section.

   Note

   If your cluster name is longer than 15 characters, it will contain an automatically generated domain prefix as a sub-domain for your provisioned cluster on *.openshiftapps.com.

   To customize the subdomain, use the --domain-prefix flag. The domain prefix cannot be longer than 15 characters, must be unique, and cannot be changed after cluster creation.

   • To create a Single-AZ cluster:

     $ rosa create cluster --private-link --cluster-name=<cluster-name> [--machine-cidr=<VPC CIDR>/16] --subnet-ids=<private-subnet-id>

   • To create a Multi-AZ cluster:

     $ rosa create cluster --private-link --multi-az --cluster-name=<cluster-name> [--machine-cidr=<VPC CIDR>/16] --subnet-ids=<private-subnet-id1>,<private-subnet-id2>,<private-subnet-id3>

2. Enter the following command to check the status of your cluster. During cluster creation, the State field from the output changesfrom pending to installing, and finally to ready.

   $ rosa describe cluster --cluster=<cluster_name>

   Note

   If installation fails or the State field does not change to ready after 40 minutes, check the installation troubleshooting documentation for more details.

3. Enter the following command to follow the OpenShift installer logs to track the progress of your cluster:

   $ rosa logs install --cluster=<cluster_name> --watch