Chapter 4. Tutorial: Deploy Red Hat OpenShift Service on AWS with a custom DNS resolver

Procedure

1. In your terminal, configure the following environment variables:

   $ export VPC_ID=<vpc_ID>
   $ export REGION=<region>
   $ export VPC_CIDR=<vpc_CIDR>

   where:

   <vpc_ID>

   Replace with the ID of the VPC you want to install your cluster into.

   <region>

   Replace with the AWS region you want to install your cluster into.

   <vpc_CIDR>

   Replace with the CIDR range of your VPC.

2. Ensure all fields output correctly before moving to the next section:

   $ echo "VPC ID: ${VPC_ID}, VPC CIDR Range: ${VPC_CIDR}, Region: ${REGION}"

Procedure

1. Create a security group and allow access to ports 53/tcp and 53/udp from the VPC:

   $ SG_ID=$(aws ec2 create-security-group --group-name rosa-inbound-resolver --description "Security group for ROSA inbound resolver" --vpc-id ${VPC_ID} --region ${REGION} --output text)
   $ aws ec2 authorize-security-group-ingress --group-id ${SG_ID} --protocol tcp --port 53 --cidr ${VPC_CIDR} --region ${REGION}
   $ aws ec2 authorize-security-group-ingress --group-id ${SG_ID} --protocol udp --port 53 --cidr ${VPC_CIDR} --region ${REGION}

2. Create an Amazon Route 53 Inbound Resolver in your VPC:

   $ RESOLVER_ID=$(aws route53resolver create-resolver-endpoint \
     --name rosa-inbound-resolver \
     --creator-request-id rosa-$(date '+%Y-%m-%d') \
     --security-group-ids ${SG_ID} \
     --direction INBOUND \
     --ip-addresses $(aws ec2 describe-subnets --filter Name=vpc-id,Values=${VPC_ID} --region ${REGION} | jq -jr '.Subnets | map("SubnetId=\(.SubnetId) ") | .[]') \
     --region ${REGION} \
     --output text \
     --query 'ResolverEndpoint.Id')

   Note

   The above command attaches Amazon Route 53 Inbound Resolver endpoints to all subnets in the provided VPC using dynamically allocated IP addresses. If you prefer to manually specify the subnets, the IP addresses, or both, run the following command instead:

   $ RESOLVER_ID=$(aws route53resolver create-resolver-endpoint \
     --name rosa-inbound-resolver \
     --creator-request-id rosa-$(date '+%Y-%m-%d') \
     --security-group-ids ${SG_ID} \
     --direction INBOUND \
     --ip-addresses SubnetId=<subnet_ID>,Ip=<endpoint_IP> SubnetId=<subnet_ID>,Ip=<endpoint_IP> \
     --region ${REGION} \
     --output text \
     --query 'ResolverEndpoint.Id')

   + where:

   <subnet_ID>

   Specifies the subnet ID you want inbound resolver endpoints added to.

   <endpoint_IP>

   Specifies the static IP addresses you want inbound resolver endpoints added to.

3. Get the IP addresses of your inbound resolver endpoints to configure in your DNS server configuration:

   $ aws route53resolver list-resolver-endpoint-ip-addresses \
     --resolver-endpoint-id ${RESOLVER_ID} \
     --region=${REGION} \
     --query 'IpAddresses[*].Ip'

   Example output

   [
       "10.0.45.253",
       "10.0.23.131",
       "10.0.148.159"
   ]

Procedure

1. Before the cluster is created, configure your DNS server to forward all DNS requests for <cluster-name>.hypershift.local to your Amazon Route 53 Inbound Resolver endpoints.

   If you use a BIND DNS server, add a new zone to the /etc/named.conf file using the following example:

   zone "<cluster-name>.hypershift.local" {
     type forward;
     forward only;
     forwarders {
       10.0.45.253;
       10.0.23.131;
       10.0.148.159;
     };
   };

   • Replace <cluster-name> with your Red Hat OpenShift Service on AWS cluster name.
   • Replace with the IP addresses of your inbound resolver endpoints collected above, ensuring that following each IP address there is a ;.
2. Create your cluster.

3. After your cluster has begun the creation process, locate the newly created private hosted zone:

   $ aws route53 list-hosted-zones-by-vpc \
     --vpc-id ${VPC_ID} \
     --vpc-region ${REGION} \
     --query 'HostedZoneSummaries[*].Name' \
     --output table

   Example output

   --------------------------------------------------
   |             ListHostedZonesByVPC               |
   +------------------------------------------------+
   |  rosa.domain-prefix.lkmb.p3.openshiftapps.com. |
   |  cluster-name.hypershift.local.                |
   +------------------------------------------------+

   Note

   It may take a few minutes for the cluster creation process to create the private hosted zones in Route 53. If you do not see a p3.openshiftapps.com domain, wait a few minutes and run the command again.

4. When you know the unique ID of the cluster domain, configure your DNS server to forward all DNS requests for rosa.<domain-prefix>.<unique-ID>.p3.openshiftapps.com to your Amazon Route 53 Inbound Resolver endpoints. If you use a BIND DNS server, add a new zone to the /etc/named.conf file using the following example:

   zone "rosa.<domain-prefix>.<unique-ID>.p3.openshiftapps.com" {
     type forward;
     forward only;
     forwarders {
       10.0.45.253;
       10.0.23.131;
       10.0.148.159;
     };
   };

   • Replace <domain-prefix> with your cluster domain prefix and <unique-ID> with your unique ID collected above.
   • Replace with the IP addresses of your inbound resolver endpoints collected above, ensuring that following each IP address there is a ;.