Setting up the environment

Complete the following steps to set up your environment before creating your cluster.

Prerequisites
  • Review and complete the deployment prerequisites and policies.

  • Create a Red Hat account, if you do not already have one. Then, check your email for a verification link. You will need these credentials to install ROSA.

Procedure
  1. Login to the Amazon Web Services (AWS) account that you want to use.

    It is recommended to use a dedicated AWS account to run production clusters. If you are using AWS Organizations, you can use an AWS account within your organization or create a new one.

    If you are using AWS Organizations and you need to have a Service Control Policy (SCP) applied to the AWS account you plan to use, see the prerequisites for details on the minimum required SCP.

    As part of the cluster creation process, rosa creates an osdCcsAdmin IAM user. This user uses the IAM credentials you provide when configuring the AWS CLI.

    This user has Programmatic access enabled and the AdministratorAccess policy attached to it.

  2. Enable the ROSA service in the AWS Console.

    1. Sign in to your AWS account.

    2. To enable ROSA, go to the ROSA service and select Enable OpenShift.

  3. Install and configure the AWS CLI.

    1. Follow the AWS command-line interface documentation to install and configure the AWS CLI for your operating system.

      Specify the correct aws_access_key_id and aws_secret_access_key in the .aws/credentials file. See AWS Configuration basics in the AWS documentation.

    2. Optional: Set a default AWS region.

      It is recommended to set the default AWS region by using the environment variable.

      The ROSA service evaluates regions in the following priority order:

      1. The region specified when running a rosa command with the --region flag.

      2. The region set in the AWS_DEFAULT_REGION environment variable. See Environment variables to configure the AWS CLI in the AWS documentation.

      3. The default region set in your AWS configuration file. See Quick configuration with aws configure in the AWS documentation.

    3. Optional: Configure your AWS CLI settings and credentials by using an AWS named profile. rosa evaluates AWS named profiles in the following priority order:

      1. The profile specified when running a rosa command with the --profile flag.

      2. The profile set in the AWS_PROFILE environment variable. See Named profiles in the AWS documentation.

    4. Verify the AWS CLI is installed and configured correctly by running the following command to query the AWS API:

      $ aws sts get-caller-identity
      Example output
      ---------------------------------------------------------------------------------
      |                                GetCallerIdentity                              |
      +-------------------------------------------------------------------------------+
      |+-----------------------------------+-----------------------+-----------------+|
      ||      Account        |                Arn              |       UserID        ||
      |+-----------------------------------+-----------------------+-----------------+|
      ||  <account_name>     |  arn:aws:iam<string>:user:name  |      <userID>       ||
      |+-----------------------------------+-----------------------+-----------------+|
  4. Install rosa, the Red Hat OpenShift Service on AWS command-line interface (CLI).

    1. Download the latest release of the rosa CLI for your operating system.

    2. Optional: Rename the executable file you downloaded to rosa. This documentation uses rosa to refer to the executable file.

    3. Optional: Add rosa to your path.

    4. Enter the following command to verify your installation:

      $ rosa
      Example output
      Command line tool for ROSA.
      
      Usage:
        rosa [command]
      
      Available Commands:
        completion  Generates bash completion scripts
        create      Create a resource from stdin
        delete      Delete a specific resource
        describe    Show details of a specific resource
        edit        Edit a specific resource
        help        Help about any command
        init        Applies templates to support Managed OpenShift on AWS clusters
        list        List all resources of a specific type
        login       Log in to your Red Hat account
        logout      Log out
        logs        Show logs of a specific resource
        verify      Verify resources are configured correctly for cluster install
        version     Prints the version of the tool
      
      Flags:
            --debug     Enable debug mode.
        -h, --help      help for rosa
        -v, --v Level   log level for V logs
      
      Use "rosa [command] --help" for more information about a command.
    5. Optional: You can run the rosa completion command to generate a bash completion file.

      $ rosa completion > /etc/bash_completion.d/rosa

      Add this file to the correct location for your operating system. For example, on a Linux machine, run the following command to enable rosa bash completion:

      $ source /etc/bash_completion.d/rosa
  5. Enter the following command to verify that your AWS account has the necessary permissions.

    $ rosa verify permissions
    Example output
    I: Validating SCP policies...
    I: AWS SCP policies ok
  6. Log in to your Red Hat account with rosa.

    1. Enter the following command.

      $ rosa login
    2. Replace <my_offline_access_token> with your token.

      Example output
      To login to your Red Hat account, get an offline access token at https://cloud.redhat.com/openshift/token/rosa
      ? Copy the token and paste it here: <my-offline-access-token>
      Example output continued
      I: Logged in as 'rh-rosa-user' on 'https://api.openshift.com'
  7. Verify that your AWS account has the necessary quota to deploy an Red Hat OpenShift Service on AWS cluster.

    $ rosa verify quota --region=us-west-2
    Example output
    I: Validating AWS quota...
    I: AWS quota ok

    Sometimes your AWS quota varies by region. If you receive any errors, try a different region.

    If you need to increase your quota, go to your AWS console, and request a quota increase for the service that failed.

    After both the permissions and quota checks pass, proceed to the next step.

  8. Prepare your AWS account for cluster deployment:

    1. Run the following command to verify your Red Hat and AWS credentials are setup correctly. Check that your AWS Account ID, Default Region and ARN match what you expect. You can safely ignore the rows beginning with OCM for now (OCM stands for OpenShift Cluster Manager).

      $ rosa whoami
      Example output
      AWS Account ID:               000000000000
      AWS Default Region:           us-east-2
      AWS ARN:                      arn:aws:iam::000000000000:user/hello
      OCM API:                      https://api.openshift.com
      OCM Account ID:               1DzGIdIhqEWyt8UUXQhSoWaaaaa
      OCM Account Name:             Your Name
      OCM Account Username:         you@domain.com
      OCM Account Email:            you@domain.com
      OCM Organization ID:          1HopHfA2hcmhup5gCr2uH5aaaaa
      OCM Organization Name:        Red Hat
      OCM Organization External ID: 0000000
    2. Initialize your AWS account. This step runs a CloudFormation template that prepares your AWS account for cluster deployment and management. This step typically takes 1-2 minutes to complete.

      $ rosa init
      Example output
      I: Logged in as 'rh-rosa-user' on 'https://api.openshift.com'
      I: Validating AWS credentials...
      I: AWS credentials are valid!
      I: Validating SCP policies...
      I: AWS SCP policies ok
      I: Validating AWS quota...
      I: AWS quota ok
      I: Ensuring cluster administrator user 'osdCcsAdmin'...
      I: Admin user 'osdCcsAdmin' created successfully!
      I: Verifying whether OpenShift command-line tool is available...
      E: OpenShift command-line tool is not installed.
      Run 'rosa download oc' to download the latest version, then add it to your PATH.
  9. Install the OpenShift CLI (oc) from the rosa CLI.

    1. Enter this command to download the latest version of the oc CLI:

      $ rosa download oc
    2. After downloading the oc CLI, unzip it and add it to your path.

    3. Enter this command to verify that the oc CLI is installed correctly:

      $ rosa verify oc

After completing these prerequisite steps, you are ready to create a Red Hat OpenShift Service on AWS cluster.

Next steps

Additional resources