Skip to content

Commit 2e8e420

Browse files
jneczyporjneczypor
committed
OSDOCS-12666
1 parent 0bbcd2c commit 2e8e420

15 files changed

+421
-20
lines changed

‎_topic_maps/_topic_map_rosa.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -299,7 +299,7 @@ Topics:
299299
File: rosa-sts-interactive-mode-reference
300300
- Name: Creating an AWS PrivateLink cluster on ROSA
301301
File: rosa-aws-privatelink-creating-cluster
302-
- Name: Configuring a shared virtual private cloud for ROSA clusters
302+
- Name: Configuring a shared virtual private cloud for ROSA (classic architecture) clusters
303303
File: rosa-shared-vpc-config
304304
- Name: Accessing a ROSA cluster
305305
File: rosa-sts-accessing-cluster

‎_topic_maps/_topic_map_rosa_hcp.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,8 @@ Topics:
201201
File: rosa-hcp-creating-a-cluster-quickly-terraform
202202
- Name: Creating ROSA with HCP clusters using a custom AWS KMS encryption key
203203
File: rosa-hcp-creating-cluster-with-aws-kms-key
204+
- Name: Configuring a shared virtual private cloud for ROSA with HCP clusters
205+
File: rosa-hcp-shared-vpc-config
204206
- Name: Creating a private cluster on ROSA with HCP
205207
File: rosa-hcp-aws-private-creating-cluster
206208
- Name: Creating ROSA with HCP clusters with egress zero

‎modules/rosa-deleting-account-wide-iam-roles-and-policies.adoc‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ ManagedOpenShift-Worker-Role Worker arn:aws:iam::<aws_account_id>
7171
----
7272
endif::sts[]
7373
ifdef::hcp[]
74+
+
7475
[source,terminal]
7576
----
7677
I: Fetching account roles
@@ -80,14 +81,24 @@ ManagedOpenShift-HCP-ROSA-Support-Role Support arn:aws:iam::<aws_accou
8081
ManagedOpenShift-HCP-ROSA-Worker-Role Worker arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-HCP-ROSA-Worker-Role 4.19 Yes
8182
----
8283
endif::hcp[]
83-
.. Delete the account-wide roles:
84+
+
85+
.. Delete the account-wide roles by running one of the following commands:
86+
*** For clusters without a shared Virtual Private Cloud (VPC):
8487
+
8588
[source,terminal]
8689
----
8790
$ rosa delete account-roles --prefix <prefix> --mode auto <1>
8891
----
8992
<1> You must include the `--<prefix>` argument. Replace `<prefix>` with the prefix of the account-wide roles to delete. If you did not specify a custom prefix when you created the account-wide roles, specify the default prefix, `ManagedOpenShift`.
9093
+
94+
*** For clusters with a shared VPC:
95+
+
96+
[source,terminal]
97+
----
98+
$ rosa delete account-roles --prefix <prefix> --delete-hosted-shared-vpc-policies --mode auto <1>
99+
----
100+
<1> You must include the `--<prefix>` argument. Replace `<prefix>` with the prefix of the account-wide roles to delete. If you did not specify a custom prefix when you created the account-wide roles, specify the default prefix, `ManagedOpenShift`.
101+
+
91102
[IMPORTANT]
92103
====
93104
The account-wide IAM roles might be used by other ROSA clusters in the same AWS account. Only remove the roles if they are not required by other clusters.
@@ -108,8 +119,8 @@ I: Deleting account role 'delete-rosa-HCP-ROSA-Worker-Role'
108119
I: Successfully deleted the hosted CP account roles
109120
----
110121
endif::hcp[]
111-
+
112-
. Delete the account-wide and Operator policies:
122+
123+
. Delete the account-wide in-line and Operator policies:
113124
.. Under the *Policies* page in the link:https://console.aws.amazon.com/iamv2/home#/policies[AWS IAM Console], filter the list of policies by the prefix that you specified when you created the account-wide roles and policies.
114125
+
115126
[NOTE]

‎modules/rosa-hcp-aws-private-security-groups.adoc‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,13 @@
66
:_mod-docs-content-type: PROCEDURE
77
= Adding additional AWS security groups to the AWS PrivateLink endpoint
88

9-
With {hcp-title} clusters, the AWS PrivateLink endpoint exposed in the customer's VPC has a security group that limits access to requests that originate from within the cluster's Machine CIDR range. In order to grant access to the cluster's API to any entities outside of the VPC, through VPC peering, transit gateways, or other network connectivity, you must create and attach another security group to the PrivateLink endpoint to grant the necessary access.
9+
ifdef::openshift-rosa[]
10+
With {hcp-title} clusters, the AWS PrivateLink endpoint exposed in the customer's Virtual Private Cloud (VPC) has a security group that limits access to requests that originate from within the cluster's Machine CIDR range. You must create and attach another security group to the PrivateLink endpoint to grant API access to entities outside of the VPC through VPC peering, transit gateways, or other network connectivity.
11+
endif::openshift-rosa[]
12+
13+
ifdef::openshift-rosa-hcp[]
14+
With {hcp-title} clusters, the AWS PrivateLink endpoint exposed in the host's Virtual Private Cloud (VPC) has a security group that limits access to requests that originate from within the cluster's Machine CIDR range. You must create and attach another security group to the PrivateLink endpoint to grant API access to entities outside of the VPC through VPC peering, transit gateways, or other network connectivity.
15+
endif::openshift-rosa-hcp[]
1016

1117
[IMPORTANT]
1218
====
@@ -27,7 +33,7 @@ Adding additional AWS security groups to the AWS PrivateLink endpoint is only su
2733
$ export CLUSTER_NAME=<cluster_name>
2834
----
2935
+
30-
You can verify that the variable has been set by running the following command:
36+
Verify that the variable exists by running the following command:
3137
+
3238
[source,terminal]
3339
----
@@ -75,4 +81,4 @@ $ aws ec2 authorize-security-group-ingress --group-id $SG_ID --ip-permissions Fr
7581
$ aws ec2 modify-vpc-endpoint --vpc-endpoint-id $VPCE_ID --add-security-group-ids $SG_ID
7682
----
7783

78-
You now can access the API of your {hcp-title} private cluster from the specified CIDR block.
84+
You can now access the API of your {hcp-title} private cluster from the specified CIDR block.

‎modules/rosa-hcp-deleting-cluster.adoc‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,12 +113,20 @@ $ rosa delete cluster --cluster=<cluster_name> --watch
113113
You must wait for cluster deletion to complete before you remove the Operator roles and the OIDC provider.
114114
====
115115

116-
. Delete the cluster-specific Operator IAM roles by running the following command:
116+
. Delete the cluster-specific Operator IAM roles by running one of the following commands:
117+
** For clusters without a shared Virtual Private Cloud (VPC):
117118
+
118119
[source,terminal]
119120
----
120121
$ rosa delete operator-roles --prefix <operator_role_prefix>
121122
----
123+
+
124+
** For clusters with a shared VPC:
125+
+
126+
[source,terminal]
127+
----
128+
$ rosa delete operator-roles --prefix <operator_role_prefix> --delete-hosted-shared-vpc-policies
129+
----
122130

123131
. Delete the OIDC provider by running the following command:
124132
+

‎modules/rosa-hcp-sharing-vpc-cluster-creation.adoc‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/rosa-hcp-shared-vpc-config.adoc
4+
:_mod-docs-content-type: PROCEDURE
5+
[id="rosa-hcp-sharing-vpc-cluster-creation_{context}"]
6+
= Step Four - Cluster Creator: Creating your cluster in a shared VPC
7+
To create a cluster in a shared VPC, complete the following steps.
8+
9+
[NOTE]
10+
====
11+
Installing a cluster in a shared VPC is supported only for OpenShift 4.17.9 and later.
12+
====
13+
14+
image::372_OpenShift_on_AWS_persona_worflows_0923_4.png[]
15+
.Prerequisites
16+
17+
* You have the hosted zone IDs from the *VPC Owner*.
18+
* You have the AWS region from the *VPC Owner*.
19+
* You have the subnet IDs from the *VPC Owner*.
20+
* You have the `Route 53 role` ARN from the *VPC Owner*.
21+
* You have the `VPC endpoint role` ARN from the *VPC Owner*.
22+
23+
.Procedure
24+
* In a terminal, enter the following command to create the shared VPC:
25+
+
26+
[source,terminal]
27+
----
28+
$ rosa create cluster --cluster-name <cluster_name> --sts --operator-roles-prefix <prefix> --oidc-config-id <oidc_config_id> --region us-east-1 --subnet-ids <subnet_ids> --hcp-internal-communication-hosted-zone-id <local_hosted_zone_ID> --ingress-private-hosted-zone-id <private_hosted_zone_ID> --route53-role-arn <route_53_role_arn> vpc-endpoint-role-arn <vpc_endpoint_role_arn> --base-domain <dns-domain> --additional-allowed-principals <route53-role-arn>,<vpc-endpoint-role-arn> --hosted-cp
29+
----

‎modules/rosa-hcp-sharing-vpc-creation-and-sharing.adoc‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/rosa-hcp-shared-vpc-config.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="rosa-hcp-sharing-vpc-creation-and-sharing_{context}"]
7+
= Step One - VPC Owner: Configuring a VPC to share within your AWS organization
8+
9+
You can share subnets within a VPC with another AWS account in your AWS organization.
10+
11+
image::522-shared-vpc-step-1.png[]
12+
.Procedure
13+
14+
. Create or modify a VPC to your specifications in the link:https://us-east-1.console.aws.amazon.com/vpc/[VPC section of the AWS console]. Make sure you have selected the correct region.
15+
. Create the `Route 53 role`.
16+
+
17+
[NOTE]
18+
====
19+
You must create the `Route 53 role` in the same account where you plan to create the Amazon Route 53 hosted zones (which are created in Step 3). For example, if you want to create the hosted zones in the centrally-managed VPC account, you must create the `Route 53 role` in the *VPC Owner* account. If you want to create the hosted zones in the workload account, you must create the `Route 53 role` in the *Cluster Creator* account.
20+
====
21+
+
22+
.. Create a custom trust policy file that grants permission to assume roles:
23+
+
24+
[source,terminal]
25+
----
26+
$ cat <<EOF > /tmp/route53-role.json
27+
{
28+
"Version": "2012-10-17",
29+
"Statement": [
30+
{
31+
"Effect": "Allow",
32+
"Principal": {
33+
"AWS": "arn:aws:iam::<Account-ID>:root" <1>
34+
},
35+
"Action": "sts:AssumeRole"
36+
}
37+
]
38+
}
39+
EOF
40+
----
41+
+
42+
--
43+
<1> The trust policy principals may be scoped down to the ingress Operator role and installer account role rather than `root`.
44+
--
45+
+
46+
.. Create the IAM role for the AWS managed policy link:https://docs.aws.amazon.com/rosa/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-rosasharedvpcroute53policy[`ROSASharedVPCRoute53Policy`].
47+
+
48+
[source,terminal]
49+
----
50+
$ aws iam create-role --role-name <role_name> \ <1>
51+
--assume-role-policy-document file:///tmp/route53-role.json
52+
----
53+
+
54+
--
55+
<1> Replace _<role_name>_ with the name of the role you want to create.
56+
--
57+
+
58+
.. Attach the AWS managed policy `ROSASharedVPCRoute53Policy` to allow for necessary shared VPC permissions.
59+
+
60+
[source,terminal]
61+
----
62+
$ aws iam attach-role-policy --role-name <role_name> \ <1>
63+
--policy-arn arn:aws:iam::aws:policy/ROSASharedVPCRoute53Policy
64+
----
65+
+
66+
--
67+
<1> Replace _<role_name>_ with the name of the role you created.
68+
--
69+
+
70+
. Create the `VPC endpoint role`.
71+
.. Create a custom trust policy file that grants permission to assume roles:
72+
+
73+
[source,terminal]
74+
----
75+
$ cat <<EOF > /tmp/shared-vpc-role.json
76+
{
77+
"Version": "2012-10-17",
78+
"Statement": [
79+
{
80+
"Effect": "Allow",
81+
"Principal": {
82+
"AWS": "arn:aws:iam::<Account-ID>:root" <1>
83+
},
84+
"Action": "sts:AssumeRole"
85+
}
86+
]
87+
}
88+
EOF
89+
----
90+
+
91+
--
92+
<1> The trust policy principals may be scoped down to the ingress Operator role and installer account role rather than `root`.
93+
--
94+
+
95+
.. Create the IAM role for the AWS managed policy link:https://docs.aws.amazon.com/rosa/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-rosasharedvpcendpointpolicy[`ROSASharedVPCEndpointPolicy`]:
96+
+
97+
[source,terminal]
98+
----
99+
$ aws iam create-role --role-name <role_name> \ <1>
100+
--assume-role-policy-document file:///tmp/vpce-role.json
101+
----
102+
+
103+
--
104+
<1> Replace _<role_name>_ with the name of the role you want to create.
105+
--
106+
+
107+
.. Attach the AWS managed policy `ROSASharedVPCEndpointPolicy` to allow for necessary shared VPC permissions.
108+
+
109+
[source,terminal]
110+
----
111+
$ aws iam attach-role-policy --role-name <role_name> \ <1>
112+
--policy-arn arn:aws:iam::aws:policy/ROSASharedVPCEndpointPolicy
113+
----
114+
+
115+
--
116+
<1> Replace _<role_name>_ with the name of the role you created.
117+
--
118+
+
119+
. Provide the `Route 53 role` ARN and the `VPC endpoint role` ARN to the *Cluster Creator* to continue configuration.

‎modules/rosa-hcp-sharing-vpc-dns-and-roles.adoc‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/rosa-hcp-shared-vpc-config.adoc
4+
:_mod-docs-content-type: PROCEDURE
5+
[id="rosa-hcp-sharing-vpc-dns-and-roles_{context}"]
6+
= Step Two - Cluster Creator: Reserving your DNS entries and creating cluster Operator roles
7+
8+
After the *VPC Owner* creates a virtual private cloud (VPC), subnets, and an IAM role for sharing the VPC resources, reserve an `openshiftapps.com` DNS domain and create Operator roles to communicate back to the *VPC Owner*.
9+
10+
[NOTE]
11+
====
12+
For shared VPC clusters, you can choose to create the Operator roles after the cluster creation steps. The cluster will be in a `waiting` state until the Ingress Operator role ARN is added to the shared VPC role trusted relationships.
13+
====
14+
15+
image::522-shared-vpc-step-2.png[]
16+
.Prerequisites
17+
18+
* You have the `Route 53 role` ARN for the IAM role from the *VPC Owner*.
19+
* You have the `VPC endpoint role` ARN for the IAM role from the *VPC Owner*.
20+
21+
.Procedure
22+
23+
. Reserve an `openshiftapps.com` DNS domain with the following command:
24+
+
25+
[source,terminal]
26+
----
27+
$ rosa create dns-domain --hosted-cp
28+
----
29+
+
30+
The command creates a reserved `openshiftapps.com` DNS domain.
31+
+
32+
[source,terminal]
33+
----
34+
I: DNS domain '14eo.p3.openshiftapps.com' has been created.
35+
I: To view all DNS domains, run 'rosa list dns-domains'
36+
----
37+
. Create an OIDC configuration.
38+
+
39+
Review this article for more information on the link:https://access.redhat.com/articles/7031018[OIDC configuration process]. The following command produces the OIDC configuration ID that you need:
40+
+
41+
[source,terminal]
42+
----
43+
$ rosa create oidc-config
44+
----
45+
+
46+
You receive confirmation that the command created an OIDC configuration:
47+
+
48+
[source,terminal]
49+
----
50+
I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice:
51+
rosa create operator-roles --prefix <user-defined> --oidc-config-id 25tu67hq45rto1am3slpf5lq6jargg
52+
----
53+
54+
. Create the account roles by entering the following command:
55+
+
56+
[source,terminal]
57+
----
58+
$ rosa create account-roles
59+
--route53-role-arn <Created_Route_53_Role_Arn> <1>
60+
--vpc-endpoint-role-arn <Created_VPC_Endpoint_Role_Arn> <2>
61+
--prefix <user_defined_account_role_prefix> <3>
62+
--hosted-cp
63+
----
64+
+
65+
--
66+
<1> Provide the ARN for the Route 53 role that the *VPC Owner* created.
67+
<2> Provide the ARN for the VPC endpoint role that the *VPC Owner* created.
68+
<3> Provide a prefix for the Operator roles.
69+
--
70+
71+
. Create the Operator roles by entering the following command:
72+
+
73+
[source,terminal]
74+
----
75+
$ rosa create operator-roles --oidc-config-id <oidc-config-ID> <1>
76+
--installer-role-arn <Installer_Role> <2>
77+
--route53-role-arn <Created_Route_53_Role_Arn> <3>
78+
--vpc-endpoint-role-arn <Created_VPC_Endpoint_Role_Arn> <4>
79+
--prefix <operator-prefix> <5>
80+
--hosted-cp
81+
----
82+
+
83+
--
84+
<1> Provide the OIDC configuration ID that you created in the previous step.
85+
<2> Provide your installer ARN that was created as part of the `rosa create account-roles` process.
86+
<3> Provide the ARN for the Route 53 role that the *VPC Owner* created.
87+
<4> Provide the ARN for the VPC endpoint role that the *VPC Owner* created.
88+
<5> Provide a prefix for the Operator roles.
89+
--
90+
+
91+
[NOTE]
92+
====
93+
The Installer account role and the shared VPC roles must have a one-to-one relationship. If you want to create multiple shared VPC roles, you should create one set of account roles per shared VPC role.
94+
====
95+
96+
. After you create the Operator roles, share your _Ingress Operator Cloud Credentials_ role's ARN, your _Installer_ role's ARN, and your _Control plane Operator Cloud Credentials_ role's ARN with the *VPC Owner* to continue configuration.
97+
+
98+
The shared information resembles these examples:
99+
+
100+
* ``my-rosa-cluster.14eo.p1.openshiftapps.com``
101+
* ``arn:aws:iam::111122223333:role/ManagedOpenShift-Installer-Role``
102+
* ``arn:aws:iam::111122223333:role/my-rosa-cluster-openshift-ingress-operator-cloud-credentials``
103+
* ``arn:aws:iam::111122223333:role/my-rosa-cluster-control-plane-operator``

0 commit comments

Comments
 (0)