Chapter 5. Deploying Red Hat OpenShift Service on AWS clusters using FIPS encryption

Procedure

1. If they do not exist in your AWS account, create the required account-wide STS roles and attach the policies by running the following command:

   $ export PREFIX=<custom_prefix>; rosa create account-roles --hosted-cp --prefix $PREFIX

   When using FIPS encryption, you need to set a custom prefix instead of using the default ManagedOpenShift prefix.

Procedure

1. Create an AWS VPC using the default CloudFormations template by running the following command:

   $ rosa create network

2. Optional: Customize your VPC by specifying additional parameters.

   You can use the --param flag to specify changes to the default VPC template. The following example command specifies custom values for region, Name, AvailabilityZoneCount and VpcCidr.

   $ rosa create network --param Region=us-east-2 --param Name=quickstart-stack --param AvailabilityZoneCount=3 --param VpcCidr=10.0.0.0/16

   The command takes about 5 minutes to run and provides regular status updates from AWS as resources are created. If there is an issue with CloudFormation, a rollback is attempted. For all other errors that are encountered, please follow the error message instructions or contact AWS support.

Procedure

1. To create your OIDC configuration alongside the AWS resources, run the following command:

   $ rosa create oidc-config --mode=auto --yes

   This command returns the following information.

   For example:

   ? Would you like to create a Managed (Red Hat hosted) OIDC Configuration Yes
   I: Setting up managed OIDC configuration
   I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice:
   	rosa create operator-roles --prefix <user-defined> --oidc-config-id 13cdr6b
   If you are going to create a Hosted Control Plane cluster please include '--hosted-cp'
   I: Creating OIDC provider using 'arn:aws:iam::4540112244:user/userName'
   ? Create the OIDC provider? Yes
   I: Created OIDC provider with ARN 'arn:aws:iam::4540112244:oidc-provider/dvbwgdztaeq9o.cloudfront.net/13cdr6b'

   When creating your cluster, you must supply the OIDC config ID. The CLI output provides this value for --mode auto, otherwise you must determine these values based on aws CLI output for --mode manual.

2. Optional: you can save the OIDC configuration ID as a variable to use later. Run the following command to save the variable:

   $ export OIDC_ID=<oidc_config_id>

   <oidc_config_id>

   In this example output, the OIDC configuration ID is 13cdr6b.

   • View the value of the variable by running the following command:

     $ echo $OIDC_ID

     For example:

     13cdr6b

Procedure

1. To create your Operator roles, run the following command:

   $ rosa create operator-roles --hosted-cp --prefix=$PREFIX --oidc-config-id=$OIDC_ID

   The Operator roles are now created and ready to use for creating your Red Hat OpenShift Service on AWS cluster.

Procedure

1. Set the AWS region where you installed your VPC by running the following command:

   Note

   You should use the same region where you installed your VPC.

   $ AWS_REGION=<aws_region>

2. Create a custom AWS customer-managed KMS key by running the following command:

   $ KMS_ARN=$(aws kms create-key --region $AWS_REGION --description 'Custom ROSA Encryption Key' --tags TagKey=red-hat,TagValue=true --query KeyMetadata.Arn --output text)

   This command saves the Amazon Resource Name (ARN) output of this custom key for further steps.

   Note

   Customers must provide the --tags TagKey=red-hat,TagValue=true argument that is required for a customer KMS key.

3. Verify the KMS key has been created by running the following command:

   $ echo $KMS_ARN

4. Set your AWS account ID to an environment variable by running the following command:

   $ AWS_ACCOUNT=$(aws sts get-caller-identity --query Account --output text)

5. Create your AWS key policy by running the following command.

   Note

   If you use the default prefix, you need to modify the following code sample where you see {PREFIX}- to ManagedOpenShift-.

   cat << EOF > rosa-key-policy.json
   {
       "Version": "2012-10-17",
       "Id": "key-rosa-policy-1",
       "Statement": [
           {
               "Sid": "Enable IAM User Permissions",
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::${AWS_ACCOUNT}:root"
               },
               "Action": "kms:*",
               "Resource": "*"
           },
           {
               "Sid": "Allow ROSA use of the key",
               "Effect": "Allow",
               "Principal": {
                   "AWS": [
                       "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Support-Role",
                       "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Installer-Role",
                       "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Worker-Role",
                       "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-openshift-cluster-csi-drivers-ebs-cloud-credentials",
                       "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-kube-system-kms-provider"
                   ]
               },
               "Action": [
                   "kms:Encrypt",
                   "kms:Decrypt",
                   "kms:ReEncrypt*",
                   "kms:GenerateDataKey*",
                   "kms:DescribeKey"
               ],
               "Resource": "*"
           },
           {
               "Sid": "Allow attachment of persistent resources",
               "Effect": "Allow",
               "Principal": {
                   "AWS": [
                       "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Support-Role",
                       "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Installer-Role",
                       "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Worker-Role",
                       "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-openshift-cluster-csi-drivers-ebs-cloud-credentials"
                   ]
               },
               "Action": [
                   "kms:CreateGrant",
                   "kms:ListGrants",
                   "kms:RevokeGrant"
               ],
               "Resource": "*",
               "Condition": {
                   "Bool": {
                       "kms:GrantIsForAWSResource": "true"
                   }
               }
           }
       ]
   }
   EOF

6. Confirm the details of the policy file created by running the following command:

   $ cat rosa-key-policy.json

7. Apply the newly generated key policy to the custom KMS key by running the following command:

   aws kms put-key-policy --key-id $KMS_ARN --policy file://rosa-key-policy.json --policy-name default

   You can now create your cluster using this AWS KMS encryption key.

Procedure

1. Verify the KMS key has been created by running the following command:

   $ echo $KMS_ARN

2. Confirm the details of the policy file created by running the following command:

   $ cat rosa-key-policy.json

3. Create the cluster by running the following command:

   Note

   If your cluster name is longer than 15 characters, it will contain an autogenerated domain prefix as a sub-domain for your provisioned cluster on *.openshiftapps.com.

   To customize the subdomain, use the --domain-prefix flag. The domain prefix cannot be longer than 15 characters, must be unique, and cannot be changed after cluster creation.

   $ rosa create cluster \
   --cluster-name ${PREFIX}-test \
   --hosted-cp \
   --machine-cidr 10.0.0.0/16 \
   --oidc-config-id $OIDC_CONFIG \
   --mode auto \
   --region $AWS_REGION \
   --replicas 2 \
   --operator-roles-prefix $PREFIX \
   --installer-role-arn "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Installer-Role" \
   --support-role-arn "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Support-Role" \
   --worker-iam-role-arn "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Worker-Role" \
   --subnet-ids <subnet-ids> \
   --etcd-encryption \
   --etcd-encryption-kms-arn $KMS_ARN \
   --fips

   where:

   --subnet-ids

   These subnet IDs should be at least one private subnet ID and public subnet ID.

   --kms-key-arn

   This KMS key ARN is used to encrypt all worker node root volumes. It is not required if only etcd database encryption is needed.

   --etcd-encryption-kms-arn

   This KMS key ARN is used to encrypt the etcd database. The etcd database is always encrypted by default with an AES cipher block, but can be encrypted instead with a KMS key. It is not required if only node root volume encryption is needed.

Verification

1. Log in to your cluster as an admin user.

2. Set the node name as a variable by running the following command:

   $ NODE=$(oc get nodes --no-headers | awk '$2=="Ready"{print $1; exit}')

3. Check your cluster’s FIPS status by running the following command:

   $ oc debug node/${NODE} --to-namespace=default -- chroot /host bash -c 'set -x; \
   fips-mode-setup --check; \
   update-crypto-policies --show; \
   cat /etc/system-fips; \
   cat /proc/sys/crypto/fips_enabled; \
   sysctl crypto.fips_enabled'

   Example output

   Starting pod/ip-10-0-1-162us-east-2computeinternal-debug-86cnb ...
   To use host binaries, run `chroot /host`
   + fips-mode-setup --check
   FIPS mode is enabled.
   + update-crypto-policies --show
   FIPS
   + cat /etc/system-fips
   # FIPS module installation complete
   + cat /proc/sys/crypto/fips_enabled
   1
   + sysctl crypto.fips_enabled
   crypto.fips_enabled = 1
   
   Removing debug pod ...