Chapter 3. Installing a Red Hat OpenShift Service on AWS cluster in AWS GovCloud

Procedure

1. Navigate to https://console.openshiftusgov.com/openshift/token.
2. Sign in with your Red Hat FedRAMP account credentials where you will see a screen with your token.
3. Copy your token for the next step.

4. In your terminal:

   1. Run rosa login and paste your copied token in order to log into the service.

      $ rosa login --govcloud --token=<TOKEN>

      Copy to Clipboard Toggle word wrap
      Note

      Depending on your AWS CLI configuration, you may need to add a government region to the end of the command string like --region us-gov-west-1.

   2. Run rosa whoami to confirm all information is correct ensuring that you are using the AWS Gov region and the OCM API is “https://api.openshiftusgov.com”..

      $ rosa whoami

      Copy to Clipboard Toggle word wrap

      Example output

      AWS ARN:                                 arn:aws-us-gov:iam::00000000000:user/rosa-gov-user
      AWS Account ID:                       00000000000
      AWS Default Region:                 us-gov-east-1
      OCM API:                                   https://api.openshiftusgov.com
      OCM Account Email:                  rosa-gov-user@redhat.com
      OCM Account ID:                       3ZXXXXXXXXXXXXXXXXXXXXXXXXX
      OCM Account Name:                 Rosa Gov
      OCM Account Username:          rosa-gov-user
      OCM Organization External ID:  rosa-gov-user
      OCM Organization ID:                3ZXXXXXXXXXXXXXXXXXXXXXXXXX
      OCM Organization Name:          rosa-gov-user

      Copy to Clipboard Toggle word wrap

5. You must create a VPC where Red Hat OpenShift Service on AWS will be deployed. For instructions on setting up a VPC, see Amazon VPC architecture for the AWS PrivateLink use case.

1. With AWS PrivateLink, you can create a cluster with a single availability zone (Single-AZ) or multiple availability zones (Multi-AZ). In either case, your machine’s classless inter-domain routing (CIDR) must match your virtual private cloud’s CIDR. See Requirements for using your own VPC and VPC validation for more information.

   Important

   If you use a firewall, you must configure it so that Red Hat OpenShift Service on AWS can access the sites that it requires to function.

   For more information, see the AWS PrivateLink firewall prerequisites section.

   Note

   If your cluster name is longer than 15 characters, it will contain an autogenerated domain prefix as a sub-domain for your provisioned cluster on *.openshiftapps.com.

   To customize the subdomain, use the --domain-prefix flag. The domain prefix cannot be longer than 15 characters, must be unique, and cannot be changed after cluster creation.

   • To create a Single-AZ cluster:

     $ rosa create cluster --private-link --cluster-name=<cluster-name> [--machine-cidr=<VPC CIDR>/16] --subnet-ids=<private-subnet-id>

     Copy to Clipboard Toggle word wrap

   • To create a Multi-AZ cluster:

     $ rosa create cluster --private-link --multi-az --cluster-name=<cluster-name> [--machine-cidr=<VPC CIDR>/16] --subnet-ids=<private-subnet-id1>,<private-subnet-id2>,<private-subnet-id3>

     Copy to Clipboard Toggle word wrap

2. Enter the following command to check the status of your cluster. During cluster creation, the State field from the output will transition from pending to installing, and finally to ready.

   $ rosa describe cluster --cluster=<cluster_name>

   Copy to Clipboard Toggle word wrap
   Note

   If installation fails or the State field does not change to ready after 40 minutes, check the installation troubleshooting documentation for more details.

3. Enter the following command to follow the OpenShift installer logs to track the progress of your cluster:

   $ rosa logs install --cluster=<cluster_name> --watch

   Copy to Clipboard Toggle word wrap