Chapter 1. Creating ROSA with HCP clusters using the default options

Procedure

1. Create an AWS VPC using the default CloudFormations template by running the following command:

   $ rosa create network

2. Optional: Customize your VPC by specifying additional parameters.

   You can use the --param flag to specify changes to the default VPC template. The following example command specifies custom values for region, Name, AvailabilityZoneCount and VpcCidr.

   $ rosa create network --param Region=us-east-2 --param Name=quickstart-stack --param AvailabilityZoneCount=3 --param VpcCidr=10.0.0.0/16

   The command takes about 5 minutes to run and provides regular status updates from AWS as resources are created. If there is an issue with CloudFormation, a rollback is attempted. For all other errors that are encountered, please follow the error message instructions or contact AWS support.

Procedure

1. Open a shell prompt and clone the Terraform VPC repository by running the following command:

   $ git clone https://github.com/openshift-cs/terraform-vpc-example

2. Navigate to the created directory by running the following command:

   $ cd terraform-vpc-example

3. Initiate the Terraform file by running the following command:

   $ terraform init

   A message confirming the initialization appears when this process completes.

4. To build your VPC Terraform plan based on the existing Terraform template, run the plan command. You must include your AWS region. You can choose to specify a cluster name. A rosa.tfplan file is added to the hypershift-tf directory after the terraform plan completes. For more detailed options, see the Terraform VPC repository’s README file.

   $ terraform plan -out rosa.tfplan -var region=<region>

5. Apply this plan file to build your VPC by running the following command:

   $ terraform apply rosa.tfplan

   1. Optional: You can capture the values of the Terraform-provisioned private, public, and machinepool subnet IDs as environment variables to use when creating your ROSA with HCP cluster by running the following commands:

      $ export SUBNET_IDS=$(terraform output -raw cluster-subnets-string)

   2. Verify that the variables were correctly set with the following command:

      $ echo $SUBNET_IDS

      Example output

      $ subnet-0a6a57e0f784171aa,subnet-078e84e5b10ecf5b0

Procedure

1. Tag your resources in your terminal by running the following commands:

   1. For public subnets, run:

      $ aws ec2 create-tags --resources <public-subnet-id> --region <aws_region> --tags Key=kubernetes.io/role/elb,Value=1

   2. For private subnets, run:

      $ aws ec2 create-tags --resources <private-subnet-id> --region <aws_region> --tags Key=kubernetes.io/role/internal-elb,Value=1

Procedure

1. If they do not exist in your AWS account, create the required account-wide STS roles and attach the policies by running the following command:

   $ rosa create account-roles --hosted-cp

2. Optional: Set your prefix as an environmental variable by running the following command:

   $ export ACCOUNT_ROLES_PREFIX=<account_role_prefix>

   • View the value of the variable by running the following command:

     $ echo $ACCOUNT_ROLES_PREFIX

     Example output

     ManagedOpenShift

Procedure

1. To create your OIDC configuration alongside the AWS resources, run the following command:

   $ rosa create oidc-config --mode=auto --yes

   This command returns the following information.

   Example output

   ? Would you like to create a Managed (Red Hat hosted) OIDC Configuration Yes
   I: Setting up managed OIDC configuration
   I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice:
   	rosa create operator-roles --prefix <user-defined> --oidc-config-id 13cdr6b
   If you are going to create a Hosted Control Plane cluster please include '--hosted-cp'
   I: Creating OIDC provider using 'arn:aws:iam::4540112244:user/userName'
   ? Create the OIDC provider? Yes
   I: Created OIDC provider with ARN 'arn:aws:iam::4540112244:oidc-provider/dvbwgdztaeq9o.cloudfront.net/13cdr6b'

   When creating your cluster, you must supply the OIDC config ID. The CLI output provides this value for --mode auto, otherwise you must determine these values based on aws CLI output for --mode manual.

2. Optional: you can save the OIDC configuration ID as a variable to use later. Run the following command to save the variable:

   $ export OIDC_ID=<oidc_config_id>1

   1

   In the example output above, the OIDC configuration ID is 13cdr6b.

   • View the value of the variable by running the following command:

     $ echo $OIDC_ID

     Example output

     13cdr6b

Procedure

1. Set your prefix name to an environment variable using the following command:

   $ export OPERATOR_ROLES_PREFIX=<prefix_name>

2. To create your Operator roles, run the following command:

   $ rosa create operator-roles --hosted-cp --prefix=$OPERATOR_ROLES_PREFIX --oidc-config-id=$OIDC_ID --installer-role-arn arn:aws:iam::${AWS_ACCOUNT_ID}:role/${ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role

   The following breakdown provides options for the Operator role creation.

   $ rosa create operator-roles --hosted-cp
   	--prefix=$OPERATOR_ROLES_PREFIX 1
   	--oidc-config-id=$OIDC_ID 2
   	--installer-role-arn arn:aws:iam::${AWS_ACCOUNT_ID}:role/${ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role 3

   1

   You must supply a prefix when creating these Operator roles. Failing to do so produces an error. See the Additional resources of this section for information on the Operator prefix.

   2

   This value is the OIDC configuration ID that you created for your ROSA with HCP cluster.

   3

   This value is the installer role ARN that you created when you created the ROSA account roles.

   You must include the --hosted-cp parameter to create the correct roles for ROSA with HCP clusters. This command returns the following information.

   Example output

   ? Role creation mode: auto
   ? Operator roles prefix: <pre-filled_prefix> 1
   ? OIDC Configuration ID: 23soa2bgvpek9kmes9s7os0a39i13qm4 | https://dvbwgdztaeq9o.cloudfront.net/23soa2bgvpek9kmes9s7os0a39i13qm4 2
   ? Create hosted control plane operator roles: Yes
   W: More than one Installer role found
   ? Installer role ARN: arn:aws:iam::4540112244:role/<prefix>-HCP-ROSA-Installer-Role
   ? Permissions boundary ARN (optional):
   I: Reusable OIDC Configuration detected. Validating trusted relationships to operator roles:
   I: Creating roles using 'arn:aws:iam::4540112244:user/<userName>'
   I: Created role '<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials'
   I: Created role '<prefix>-openshift-cloud-network-config-controller-cloud-credenti' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti'
   I: Created role '<prefix>-kube-system-kube-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager'
   I: Created role '<prefix>-kube-system-capa-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager'
   I: Created role '<prefix>-kube-system-control-plane-operator' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator'
   I: Created role '<prefix>-kube-system-kms-provider' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider'
   I: Created role '<prefix>-openshift-image-registry-installer-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials'
   I: Created role '<prefix>-openshift-ingress-operator-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials'
   I: To create a cluster with these roles, run the following command:
   	rosa create cluster --sts --oidc-config-id 23soa2bgvpek9kmes9s7os0a39i13qm4 --operator-roles-prefix <prefix> --hosted-cp

   1

   This field is prepopulated with the prefix that you set in the initial creation command.

   2

   This field requires you to select an OIDC configuration that you created for your ROSA with HCP cluster.

   The Operator roles are now created and ready to use for creating your ROSA with HCP cluster.