Chapter 4. Creating ROSA with HCP clusters using a custom AWS KMS encryption key

Procedure

1. If they do not exist in your AWS account, create the required account-wide STS roles and attach the policies by running the following command:

   $ rosa create account-roles --hosted-cp

   Copy to Clipboard Toggle word wrap

2. Optional: Set your prefix as an environmental variable by running the following command:

   $ export ACCOUNT_ROLES_PREFIX=<account_role_prefix>

   Copy to Clipboard Toggle word wrap

   • View the value of the variable by running the following command:

     $ echo $ACCOUNT_ROLES_PREFIX

     Copy to Clipboard Toggle word wrap

     Example output

     ManagedOpenShift

     Copy to Clipboard Toggle word wrap

Procedure

1. To create your OIDC configuration alongside the AWS resources, run the following command:

   $ rosa create oidc-config --mode=auto --yes

   Copy to Clipboard Toggle word wrap

   This command returns the following information.

   Example output

   ? Would you like to create a Managed (Red Hat hosted) OIDC Configuration Yes
   I: Setting up managed OIDC configuration
   I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice:
   	rosa create operator-roles --prefix <user-defined> --oidc-config-id 13cdr6b
   If you are going to create a Hosted Control Plane cluster please include '--hosted-cp'
   I: Creating OIDC provider using 'arn:aws:iam::4540112244:user/userName'
   ? Create the OIDC provider? Yes
   I: Created OIDC provider with ARN 'arn:aws:iam::4540112244:oidc-provider/dvbwgdztaeq9o.cloudfront.net/13cdr6b'

   Copy to Clipboard Toggle word wrap

   When creating your cluster, you must supply the OIDC config ID. The CLI output provides this value for --mode auto, otherwise you must determine these values based on aws CLI output for --mode manual.

2. Optional: you can save the OIDC configuration ID as a variable to use later. Run the following command to save the variable:

   $ export OIDC_ID=<oidc_config_id>

   1

   Copy to Clipboard Toggle word wrap

   1

   In the example output above, the OIDC configuration ID is 13cdr6b.

   • View the value of the variable by running the following command:

     $ echo $OIDC_ID

     Copy to Clipboard Toggle word wrap

     Example output

     13cdr6b

     Copy to Clipboard Toggle word wrap

Procedure

1. To create your Operator roles, run the following command:

   $ rosa create operator-roles --hosted-cp --prefix=$OPERATOR_ROLES_PREFIX --oidc-config-id=$OIDC_ID --installer-role-arn arn:aws:iam::$AWS_ACCOUNT_ID:role/${ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role

   Copy to Clipboard Toggle word wrap

   The following breakdown provides options for the Operator role creation.

   $ rosa create operator-roles --hosted-cp
   	--prefix=$OPERATOR_ROLES_PREFIX 

   1

   
   	--oidc-config-id=$OIDC_ID 

   2

   
   	--installer-role-arn arn:aws:iam::$AWS_ACCOUNT_ID:role/$ACCOUNT_ROLES_PREFIX-HCP-ROSA-Installer-Role 

   3

   Copy to Clipboard Toggle word wrap

   1

   You must supply a prefix when creating these Operator roles. Failing to do so produces an error. See the Additional resources of this section for information on the Operator prefix.

   2

   This value is the OIDC configuration ID that you created for your Red Hat OpenShift Service on AWS cluster.

   3

   This value is the installer role ARN that you created when you created the Red Hat OpenShift Service on AWS account roles.

   You must include the --hosted-cp parameter to create the correct roles for Red Hat OpenShift Service on AWS clusters. This command returns the following information.

   Example output

   ? Role creation mode: auto
   ? Operator roles prefix: <pre-filled_prefix> 

   1

   
   ? OIDC Configuration ID: 23soa2bgvpek9kmes9s7os0a39i13qm4 | https://dvbwgdztaeq9o.cloudfront.net/23soa2bgvpek9kmes9s7os0a39i13qm4 

   2

   
   ? Create hosted control plane operator roles: Yes
   W: More than one Installer role found
   ? Installer role ARN: arn:aws:iam::4540112244:role/<prefix>-HCP-ROSA-Installer-Role
   ? Permissions boundary ARN (optional):
   I: Reusable OIDC Configuration detected. Validating trusted relationships to operator roles:
   I: Creating roles using 'arn:aws:iam::4540112244:user/<userName>'
   I: Created role '<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials'
   I: Created role '<prefix>-openshift-cloud-network-config-controller-cloud-credenti' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti'
   I: Created role '<prefix>-kube-system-kube-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager'
   I: Created role '<prefix>-kube-system-capa-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager'
   I: Created role '<prefix>-kube-system-control-plane-operator' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator'
   I: Created role '<prefix>-kube-system-kms-provider' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider'
   I: Created role '<prefix>-openshift-image-registry-installer-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials'
   I: Created role '<prefix>-openshift-ingress-operator-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials'
   I: To create a cluster with these roles, run the following command:
   	rosa create cluster --sts --oidc-config-id 23soa2bgvpek9kmes9s7os0a39i13qm4 --operator-roles-prefix <prefix> --hosted-cp

   Copy to Clipboard Toggle word wrap

   1

   This field is prepopulated with the prefix that you set in the initial creation command.

   2

   This field requires you to select an OIDC configuration that you created for your Red Hat OpenShift Service on AWS cluster.

   The Operator roles are now created and ready to use for creating your Red Hat OpenShift Service on AWS cluster.

Procedure

1. Create a custom AWS customer-managed KMS key by running the following command:

   $ KMS_ARN=$(aws kms create-key --region $AWS_REGION --description 'Custom ROSA Encryption Key' --tags TagKey=red-hat,TagValue=true --query KeyMetadata.Arn --output text)

   Copy to Clipboard Toggle word wrap

   This command saves the Amazon Resource Name (ARN) output of this custom key for further steps.

   Note

   Customers must provide the --tags TagKey=red-hat,TagValue=true argument that is required for a customer KMS key.

2. Verify the KMS key has been created by running the following command:

   $ echo $KMS_ARN

   Copy to Clipboard Toggle word wrap

3. Set your AWS account ID to an environment variable.

   $ AWS_ACCOUNT_ID=<aws_account_id>

   Copy to Clipboard Toggle word wrap

4. Add the ARN for the account-wide installer role and operator roles that you created in the preceding step to the Statement.Principal.AWS section in the file. In the following example, the ARN for the default ManagedOpenShift-HCP-ROSA-Installer-Role role is added:

   {
     "Version": "2012-10-17",
     "Id": "key-rosa-policy-1",
     "Statement": [
     {
                 "Sid": "Enable IAM User Permissions",
                 "Effect": "Allow",
                 "Principal": {
                     "AWS": "arn:aws:iam::${AWS_ACCOUNT_ID}:root"
                 },
                 "Action": "kms:*",
                 "Resource": "*"
             },
           {
                 "Sid": "Installer Permissions",
                 "Effect": "Allow",
                 "Principal": {
                     "AWS": "arn:aws:iam::${AWS_ACCOUNT_ID}:role/ManagedOpenShift-HCP-ROSA-Installer-Role"
                 },
                 "Action": [
                     "kms:CreateGrant",
                     "kms:DescribeKey",
                     "kms:GenerateDataKeyWithoutPlaintext"
                 ],
                 "Resource": "*"
             },
             {
                 "Sid": "ROSA KubeControllerManager Permissions",
                 "Effect": "Allow",
                 "Principal": {
                     "AWS": "arn:aws:iam::${AWS_ACCOUNT_ID}:role/<operator_role_prefix>-kube-system-kube-controller-manager"
   
                 },
                 "Action": "kms:DescribeKey",
                 "Resource": "*"
             },
             {
                 "Sid": "ROSA KMS Provider Permissions",
                 "Effect": "Allow",
                 "Principal": {
                     "AWS": "arn:aws:iam::${AWS_ACCOUNT_ID}:role/<operator_role_prefix>-kube-system-kms-provider"
                 },
                 "Action": [
                     "kms:Encrypt",
                     "kms:Decrypt",
                     "kms:DescribeKey"
                 ],
                 "Resource": "*"
             },
             {
                 "Sid": "ROSA NodeManager Permissions",
                 "Effect": "Allow",
                 "Principal": {
                     "AWS": "arn:aws:iam::${AWS_ACCOUNT_ID}:role/<operator_role_prefix>-kube-system-capa-controller-manager"
                 },
                 "Action": [
                     "kms:DescribeKey",
                     "kms:GenerateDataKeyWithoutPlaintext",
                     "kms:CreateGrant"
                 ],
                 "Resource": "*"
             }
         ]
     }

   Copy to Clipboard Toggle word wrap

5. Confirm the details of the policy file created by running the following command:

   $ cat rosa-key-policy.json

   Copy to Clipboard Toggle word wrap

6. Apply the newly generated key policy to the custom KMS key by running the following command:

   $ aws kms put-key-policy --key-id $KMS_ARN \
   --policy file://rosa-key-policy.json \
   --policy-name default

   Copy to Clipboard Toggle word wrap

7. Create the cluster by running the following command:

   Note

   If your cluster name is longer than 15 characters, it will contain an autogenerated domain prefix as a sub-domain for your provisioned cluster on *.openshiftapps.com.

   To customize the subdomain, use the --domain-prefix flag. The domain prefix cannot be longer than 15 characters, must be unique, and cannot be changed after cluster creation.

   $ rosa create cluster --cluster-name <cluster_name> \
   --subnet-ids <private_subnet_id>,<public_subnet_id> \
   --sts \
   --mode auto \
   --machine-cidr 10.0.0.0/16 \
   --compute-machine-type m5.xlarge \
   --hosted-cp \
   --region <aws_region> \
   --oidc-config-id $OIDC_ID \
   --kms-key-arn $KMS_ARN \ 

   1

   
   --etcd-encryption-kms-arn $KMS_ARN \ 

   2

   
   --operator-roles-prefix $OPERATOR_ROLES_PREFIX

   Copy to Clipboard Toggle word wrap

   1

   This KMS key ARN is used to encrypt all worker node root volumes. It is not required if only etcd database encryption is needed.

   2

   This KMS key ARN is used to encrypt the etcd database. The etcd database is always encrypted by default with an AES cipher block, but can be encrypted instead with a KMS key. It is not required if only node root volume encryption is needed.

1. Navigate to OpenShift Cluster Manager and select Instances.
2. Select your instance.
3. Click the Storage tab.
4. Copy the KMS key ID.
5. Search and select Key Management Service.
6. Enter your copied KMS key ID in the Filter field.