- Documentation
- Red Hat OpenShift Service on AWS
- Install ROSA Classic clusters
- Deploying ROSA without AWS STS
- Required AWS service quotas history bug_report picture_as_pdf
- About
- What's new
- Introduction to ROSA
- Architecture
- Tutorials
- Tutorials overview
- ROSA with HCP activation and account linking
- ROSA with HCP private offer acceptance and sharing
- Verifying Permissions for a ROSA STS Deployment
- Deploying ROSA with a Custom DNS Resolver
- Using AWS WAF and Amazon CloudFront to protect ROSA workloads
- Using AWS WAF and AWS ALBs to protect ROSA workloads
- Deploying OpenShift API for Data Protection on a ROSA cluster
- AWS Load Balancer Operator on ROSA
- Configuring Microsoft Entra ID (formerly Azure Active Directory) as an identity provider
- Using AWS Secrets Manager CSI on ROSA with STS
- Using AWS Controllers for Kubernetes on ROSA
- Deploying the External DNS Operator on ROSA
- Dynamically issuing certificates using the cert-manager Operator on ROSA
- Assigning consistent egress IP for external traffic
- Updating component routes with custom domains and TLS certificates
- Getting started with ROSA
- Deploying an application
- Getting started
- Prepare your environment
- Install ROSA with HCP clusters
- Creating ROSA with HCP clusters using the default options
- Creating a ROSA cluster using Terraform
- Creating ROSA with HCP clusters using a custom AWS KMS encryption key
- Creating a private cluster on ROSA with HCP
- Creating ROSA with HCP clusters with external authentication
- Creating ROSA with HCP clusters without a CNI plugin
- Deleting a ROSA with HCP cluster
- Install ROSA Classic clusters
- Creating a ROSA cluster with STS using the default options
- Creating a ROSA cluster with STS using customizations
- Creating a ROSA (classic architecture) cluster using Terraform
- Interactive cluster creation mode reference
- Creating an AWS PrivateLink cluster on ROSA
- Configuring a shared virtual private cloud for ROSA clusters
- Accessing a ROSA cluster
- Configuring identity providers using Red Hat OpenShift Cluster Manager
- Revoking access to a ROSA cluster
- Deleting a ROSA cluster
- Deploying ROSA without AWS STS
- AWS prerequisites for ROSA
- Understanding the ROSA deployment workflow
- Required AWS service quotas
- Configuring your AWS account
- Installing the ROSA CLI
- Creating a ROSA cluster without AWS STS
- Configuring a private cluster
- Deleting access to a ROSA cluster
- Deleting a ROSA cluster
- Command quick reference for creating clusters and users
- Support
- Support overview
- Managing your cluster resources
- Approved Access
- Getting support
- Remote health monitoring with connected clusters
- Gathering data about your cluster
- Summarizing cluster specifications
- Troubleshooting
- Troubleshooting ROSA installations
- Troubleshooting networking
- Verifying node health
- Troubleshooting Operator issues
- Investigating pod issues
- Troubleshooting storage issues
- Investigating monitoring issues
- Diagnosing OpenShift CLI (oc) issues
- Troubleshooting expired offline access tokens
- Troubleshooting IAM roles
- Troubleshooting cluster deployments
- Red Hat OpenShift Service on AWS managed resources
- Web console
- CLI tools
- Red Hat OpenShift Cluster Manager
- Cluster administration
- Security and compliance
- Authentication and authorization
- Authentication and authorization overview
- Understanding authentication
- Managing user-owned OAuth access tokens
- Configuring identity providers
- Using RBAC to define and apply permissions
- Understanding and creating service accounts
- Using service accounts in applications
- Using a service account as an OAuth client
- Assuming an AWS IAM role for a service account
- Scoping tokens
- Using bound service account tokens
- Managing security context constraints
- Understanding and managing pod security admission
- Syncing LDAP groups
- Upgrading
- CI/CD
- Images
- Overview of images
- Overview of the Cluster Samples Operator
- Using the Cluster Samples Operator with an alternate registry
- Creating images
- Managing images
- Managing image streams
- Using image streams with Kubernetes resources
- Triggering updates on image stream changes
- Image configuration resources (Classic)
- Image configuration resources (HCP)
- Using templates
- Using Ruby on Rails
- Using images
- Add-on services
- Storage
- Registry
- Operators
- Operators overview
- Understanding Operators
- User tasks
- Administrator tasks
- Developing Operators
- About the Operator SDK
- Installing the Operator SDK CLI
- Go-based Operators
- Ansible-based Operators
- Helm-based Operators
- Defining cluster service versions (CSVs)
- Working with bundle images
- Complying with pod security admission
- Validating Operators using the scorecard
- Validating Operator bundles
- High-availability or single-node cluster detection and support
- Configuring built-in monitoring with Prometheus
- Configuring leader election
- Object pruning utility
- Migrating package manifest projects to bundle format
- Operator SDK CLI reference
- Migrating to Operator SDK v0.1.0
- Networking
- About networking
- Networking Operators
- Understanding the DNS Operator
- Understanding the Ingress Operator
- Network verification
- Configuring a cluster-wide proxy during installation
- CIDR range definitions
- Network security
- OVN-Kubernetes network plugin
- OpenShift SDN network plugin
- Configuring Routes
- Building applications
- Building applications overview
- Projects
- Creating applications
- Viewing application composition using the Topology view
- Working with Helm charts
- Deployments
- Quotas
- Using config maps with applications
- Monitoring project and application metrics using the Developer perspective
- Monitoring application health
- Editing applications
- Working with quotas
- Pruning objects to reclaim resources
- Idling applications
- Deleting applications
- Using the Red Hat Marketplace
- Backing up and restoring applications
- Nodes
- Overview of nodes
- Working with pods
- Automatically scaling pods with the Custom Metrics Autoscaler Operator
- Release notes
- Custom Metrics Autoscaler Operator overview
- Installing the custom metrics autoscaler
- Understanding the custom metrics autoscaler triggers
- Understanding the custom metrics autoscaler trigger authentications
- Pausing the custom metrics autoscaler
- Gathering audit logs
- Gathering debugging data
- Viewing Operator metrics
- Understanding how to add custom metrics autoscalers
- Removing the Custom Metrics Autoscaler Operator
- Controlling pod placement onto nodes (scheduling)
- About pod placement using the scheduler
- Placing pods relative to other pods using pod affinity and anti-affinity rules
- Controlling pod placement on nodes using node affinity rules
- Placing pods onto overcommited nodes
- Placing pods on specific nodes using node selectors
- Controlling pod placement using pod topology spread constraints
- Using jobs and daemon sets
- Working with nodes
- Working with containers
- Understanding containers
- Using Init Containers to perform tasks before a pod is deployed
- Using volumes to persist container data
- Mapping volumes using projected volumes
- Allowing containers to consume API objects
- Copying files to or from a container
- Executing remote commands in a container
- Using port forwarding to access applications in a container
- Working with clusters
- Observability
- Observability overview
- Monitoring
- Monitoring overview
- Accessing monitoring for user-defined projects
- Configuring the monitoring stack
- Disabling monitoring for user-defined projects
- Enabling alert routing for user-defined projects
- Managing metrics
- Managing alerts
- Reviewing monitoring dashboards
- Accessing third-party monitoring APIs
- Troubleshooting monitoring issues
- Config map reference for the Cluster Monitoring Operator
- Logging
- Release notes
- Support
- Troubleshooting logging
- About Logging
- Installing Logging
- Updating Logging
- Visualizing logs
- Configuring your Logging deployment
- Log collection and forwarding
- Log storage
- Logging alerts
- Performance and reliability tuning
- Scheduling resources
- Uninstalling Logging
- Exported fields
- API reference
- Glossary
- Service Mesh
- Service Mesh 2.x
- About OpenShift Service Mesh
- Service Mesh 2.x release notes
- Service Mesh architecture
- Service Mesh deployment models
- Service Mesh and Istio differences
- Preparing to install Service Mesh
- Installing the Operators
- Creating the ServiceMeshControlPlane
- Adding workloads to a service mesh
- Enabling sidecar injection
- Upgrading Service Mesh
- Managing users and profiles
- Security
- Traffic management
- Metrics, logs, and traces
- Performance and scalability
- Deploying to production
- Federation
- Extensions
- 3scale WebAssembly for 2.1
- 3scale Istio adapter for 2.0
- Troubleshooting Service Mesh
- Control plane configuration reference
- Kiali configuration reference
- Jaeger configuration reference
- Uninstalling Service Mesh
- Service Mesh 2.x
- Serverless
- Virtualization
- About
- Getting started
- Installing
- Post-installation configuration
- Updating
- Virtual machines
- Creating VMs from Red Hat images
- Creating VMs from custom images
- Connecting to VM consoles
- Configuring SSH access to VMs
- Editing virtual machines
- Editing boot order
- Deleting virtual machines
- Exporting virtual machines
- Managing virtual machine instances
- Controlling virtual machine states
- Using virtual Trusted Platform Module devices
- Managing virtual machines with OpenShift Pipelines
- Advanced virtual machine management
- Working with resource quotas for virtual machines
- Specifying nodes for virtual machines
- Configuring certificate rotation
- Configuring the default CPU model
- UEFI mode for virtual machines
- Configuring PXE booting for virtual machines
- Scheduling virtual machines
- About high availability for virtual machines
- Control plane tuning
- VM disks
- Networking
- Networking configuration overview
- Connecting a VM to the default pod network
- Exposing a VM by using a service
- Connecting a VM to an OVN-Kubernetes secondary network
- Connecting a VM to a service mesh
- Configuring a dedicated network for live migration
- Configuring and viewing IP addresses
- Managing MAC address pools for network interfaces
- Storage
- Storage configuration overview
- Configuring storage profiles
- Managing automatic boot source updates
- Reserving PVC space for file system overhead
- Configuring local storage by using HPP
- Enabling user permissions to clone data volumes across namespaces
- Configuring CDI to override CPU and memory quotas
- Preparing CDI scratch space
- Using preallocation for data volumes
- Managing data volume annotations
- Live migration
- Nodes
- Monitoring
- Support
- Backup and restore
Required AWS service quotas
Review this list of the required Amazon Web Service (AWS) service quotas that are required to run an Red Hat OpenShift Service on AWS cluster.
|
AWS Security Token Service (STS) is the recommended credential mode for installing and interacting with clusters on Red Hat OpenShift Service on AWS (ROSA) because it provides enhanced security. |
Required AWS service quotas
The table below describes the AWS service quotas and levels required to create and run one Red Hat OpenShift Service on AWS cluster. Although most default values are suitable for most workloads, you might need to request additional quota for the following cases:
-
ROSA (classic architecture) clusters require a minimum AWS EC2 service quota of 100 vCPUs to provide for cluster creation, availability, and upgrades. The default maximum value for vCPUs assigned to Running On-Demand Standard Amazon EC2 instances is
5. Therefore if you have not created a ROSA cluster using the same AWS account previously, you must request additional EC2 quota forRunning On-Demand Standard (A, C, D, H, I, M, R, T, Z) instances. -
Some optional cluster configuration features, such as custom security groups, might require you to request additional quota. For example, because ROSA associates 1 security group with network interfaces in worker machine pools by default, and the default quota for
Security groups per network interfaceis5, if you want to add 5 custom security groups, you must request additional quota, because this would bring the total number of security groups on worker network interfaces to 6.
|
The AWS SDK allows ROSA to check quotas, but the AWS SDK calculation does not account for your existing usage. Therefore, it is possible that the quota check can pass in the AWS SDK yet the cluster creation can fail. To fix this issue, increase your quota. |
If you need to modify or increase a specific quota, see Amazon’s documentation on requesting a quota increase. Large quota requests are submitted to Amazon Support for review, and take some time to be approved. If your quota request is urgent, contact AWS Support.
| Quota name | Service code | Quota code | AWS default | Minimum required | Description |
|---|---|---|---|---|---|
Running On-Demand Standard (A, C, D, H, I, M, R, T, Z) instances |
ec2 |
L-1216C47A |
5 |
100 |
Maximum number of vCPUs assigned to the Running On-Demand Standard (A, C, D, H, I, M, R, T, Z) instances. The default value of 5 vCPUs is not sufficient to create ROSA clusters. ROSA has a minimum requirement of 100 vCPUs for cluster creation. |
Storage for General Purpose SSD (gp2) volume storage in TiB |
ebs |
L-D18FCD1D |
50 |
300 |
The maximum aggregated amount of storage, in TiB, that can be provisioned across General Purpose SSD (gp2) volumes in this Region. |
Storage for General Purpose SSD (gp3) volume storage in TiB |
ebs |
L-7A658B76 |
50 |
300 |
The maximum aggregated amount of storage, in TiB, that can be provisioned across General Purpose SSD (gp3) volumes in this Region. 300 TiB of storage is the required minimum for optimal performance. |
Storage for Provisioned IOPS SSD (io1) volumes in TiB |
ebs |
L-FD252861 |
50 |
300 |
The maximum aggregated amount of storage, in TiB, that can be provisioned across Provisioned IOPS SSD (io1) volumes in this Region. 300 TiB of storage is the required minimum for optimal performance. |
| Quota name | Service code | Quota code | AWS default | Minimum required | Description |
|---|---|---|---|---|---|
EC2-VPC Elastic IPs |
ec2 |
L-0263D0A3 |
5 |
5 |
The maximum number of Elastic IP addresses that you can allocate for EC2-VPC in this Region. |
VPCs per Region |
vpc |
L-F678F1CE |
5 |
5 |
The maximum number of VPCs per Region. This quota is directly tied to the maximum number of internet gateways per Region. |
Internet gateways per Region |
vpc |
L-A4707A72 |
5 |
5 |
The maximum number of internet gateways per Region. This quota is directly tied to the maximum number of VPCs per Region. To increase this quota, increase the number of VPCs per Region. |
Network interfaces per Region |
vpc |
L-DF5E4CA3 |
5,000 |
5,000 |
The maximum number of network interfaces per Region. |
Security groups per network interface |
vpc |
L-2AFB9258 |
5 |
5 |
The maximum number of security groups per network interface. This quota, multiplied by the quota for rules per security group, cannot exceed 1000. |
Snapshots per Region |
ebs |
L-309BACF6 |
10,000 |
10,000 |
The maximum number of snapshots per Region |
IOPS for Provisioned IOPS SSD (Io1) volumes |
ebs |
L-B3A130E6 |
300,000 |
300,000 |
The maximum aggregated number of IOPS that can be provisioned across Provisioned IOPS SDD (io1) volumes in this Region. |
Application Load Balancers per Region |
elasticloadbalancing |
L-53DA6B97 |
50 |
50 |
The maximum number of Application Load Balancers that can exist in each region. |
Classic Load Balancers per Region |
elasticloadbalancing |
L-E9E9831D |
20 |
20 |
The maximum number of Classic Load Balancers that can exist in each region. |