You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: cloud_experts_tutorials/cloud-experts-custom-dns-resolver.adoc
+6-1Lines changed: 6 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,7 +20,12 @@ This tutorial uses the open-source BIND DNS server (`named`) to demonstrate the
20
20
21
21
* ROSA CLI (`rosa`)
22
22
* AWS CLI (`aws`)
23
-
* A xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-hcp-vpc-manual_rosa-hcp-sts-creating-a-cluster-quickly[manually created AWS VPC]
23
+
ifdef::openshift-rosa[]
24
+
* A manually created AWS VPC
25
+
endif::openshift-rosa[]
26
+
ifdef::openshift-rosa-hcp[]
27
+
* A xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-hcp-creating-vpc_rosa-hcp-sts-creating-a-cluster-quickly[manually created AWS VPC]
28
+
endif::openshift-rosa-hcp[]
24
29
* A DHCP option set configured to point to a custom DNS server and set as the default for your VPC
* The detailed cluster deployment steps are beyond the scope of this tutorial. See xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-hcp-sts-creating-a-cluster-quickly[Creating {product-title} clusters using the default options] for more details about how to complete the {product-title} cluster deployment using the CLI.
170
+
endif::openshift-rosa-hcp[]
171
+
ifdef::openshift-rosa[]
172
+
* The detailed cluster deployment steps are beyond the scope of this tutorial.
173
+
endif::openshift-rosa[]
169
174
170
175
== Selecting the AWS billing account for {product-title} during cluster deployment using the web console
171
176
@@ -215,4 +220,4 @@ The following steps past the billing AWS account selection are beyond the scope
215
220
.Additional resources
216
221
217
222
* For information on using the CLI to create a cluster, see xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-hcp-sts-creating-a-cluster-cli_rosa-hcp-sts-creating-a-cluster-quickly[Creating a {product-title} cluster using the CLI].
218
-
* See link:https://cloud.redhat.com/learning/learn:getting-started-red-hat-openshift-service-aws-rosa/resource/resources:how-deploy-cluster-red-hat-openshift-service-aws-using-console-ui[this learning path] for more details on how to complete cluster deployment using the web console.
223
+
* See link:https://cloud.redhat.com/learning/learn:getting-started-red-hat-openshift-service-aws-rosa/resource/resources:how-deploy-cluster-red-hat-openshift-service-aws-using-console-ui[this learning path] for more details on how to complete cluster deployment using the web console.
Copy file name to clipboardExpand all lines: modules/creating-cluster-with-aws-kms-key.adoc
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,13 +4,13 @@
4
4
5
5
:_mod-docs-content-type: PROCEDURE
6
6
[id="creating-cluster-with-aws-kms-key"]
7
-
= Creating a ROSA cluster using a custom AWS KMS key
7
+
= Creating a {product-title} cluster using a custom AWS KMS key
8
8
9
-
You can create a {product-title}(ROSA) cluster with a customer-provided KMS key that is used to encrypt either node root volumes, the etcd database, or both. A different KMS key ARN can be provided for each option.
9
+
You can create a {product-title} cluster with a customer-provided KMS key that is used to encrypt either node root volumes, the etcd database, or both. A different KMS key ARN can be provided for each option.
10
10
11
11
[NOTE]
12
12
====
13
-
{hcp-title} does not automatically configure the `default` storage class to encrypt persistent volumes with the customer-provided KMS key. This is something that can be configured in-cluster after installation.
13
+
{product-title} does not automatically configure the `default` storage class to encrypt persistent volumes with the customer-provided KMS key. This is something that can be configured in-cluster after installation.
= Additional principals on your {hcp-title} cluster
7
+
= Additional principals on your {product-title} cluster
8
8
9
9
You can allow AWS Identity and Access Management (IAM) roles as additional principals to connect to your cluster's private API server endpoint.
10
10
11
-
You can access your {hcp-title} cluster's API Server endpoint from either the public internet or the interface endpoint that was created within the VPC private subnets. By default, you can privately access your {hcp-title} API Server by using the `-kube-system-kube-controller-manager` Operator role. To be able to access ROSA with HCP API server from another account directly without using the primary account where cluster is installed, you must include cross-account IAM roles as additional principals. This feature allows you to simplify your network architecture and reduce data transfer costs by avoiding peering or attaching cross-account VPCs to cluster's VPC.
11
+
You can access your {product-title} cluster's API Server endpoint from either the public internet or the interface endpoint that was created within the VPC private subnets. By default, you can privately access your {product-title} API Server by using the `-kube-system-kube-controller-manager` Operator role. To be able to access {product-title} API server from another account directly without using the primary account where cluster is installed, you must include cross-account IAM roles as additional principals. This feature allows you to simplify your network architecture and reduce data transfer costs by avoiding peering or attaching cross-account VPCs to cluster's VPC.
12
12
13
13
image::AWS_cross_account_access.png[Overview of AWS cross account access]
14
14
15
15
In this diagram, the cluster creating account is designated as Account A. This account designates that another account, Account B, should have access to the API server.
16
16
17
17
[NOTE]
18
18
====
19
-
After you have configured additional allowed principals, you must create the interface VPC endpoint in the VPC from where you want to access the cross-account {hcp-title} API server. Then, create a private hosted zone in Route53 to route calls made to cross-account {hcp-title} API server to pass through the created VPC endpoint.
19
+
After you have configured additional allowed principals, you must create the interface VPC endpoint in the VPC from where you want to access the cross-account {product-title} API server. Then, create a private hosted zone in Route53 to route calls made to cross-account {product-title} API server to pass through the created VPC endpoint.
= Deleting the account-wide IAM roles and policies
17
17
18
-
This section provides steps to delete the account-wide IAM roles and policies that you created for
19
-
ifdef::sts[]
20
-
{rosa-classic-short} with STS
21
-
endif::sts[]
22
-
ifdef::hcp[]
23
-
{rosa-short}
24
-
endif::hcp[]
25
-
deployments, along with the account-wide Operator policies. You can delete the account-wide AWS Identity and Access Management (IAM) roles and policies only after deleting all of the
26
-
ifdef::sts[]
27
-
{rosa-classic-short} with AWS Security Token Services (STS)
28
-
endif::sts[]
29
-
ifdef::hcp[]
30
-
{rosa-short}
31
-
endif::hcp[]
32
-
clusters that depend on them.
18
+
This section provides steps to delete the account-wide IAM roles and policies that you created for {product-title} deployments, along with the account-wide Operator policies. You can delete the account-wide AWS Identity and Access Management (IAM) roles and policies only after deleting all of the {product-title} clusters that depend on them.
33
19
34
20
[IMPORTANT]
35
21
====
36
-
The account-wide IAM roles and policies might be used by other
37
-
ifdef::sts[]
38
-
{rosa-classic-short}
39
-
endif::sts[]
40
-
ifdef::hcp[]
41
-
{rosa-short}
42
-
endif::hcp[]
43
-
clusters in the same AWS account. Only remove the roles if they are not required by other clusters.
22
+
The account-wide IAM roles and policies might be used by other {product-title} clusters in the same AWS account. Only remove the roles if they are not required by other clusters.
The account-wide IAM roles might be used by other ROSA clusters in the same AWS account. Only remove the roles if they are not required by other clusters.
83
+
The account-wide IAM roles might be used by other {product-title} clusters in the same AWS account. Only remove the roles if they are not required by other clusters.
105
84
====
106
85
+
107
86
ifdef::hcp[]
@@ -132,12 +111,5 @@ If you did not specify a custom prefix when you created the account-wide roles,
132
111
+
133
112
[IMPORTANT]
134
113
====
135
-
The account-wide and Operator IAM policies might be used by other
136
-
ifdef::sts[]
137
-
{rosa-classic-short}
138
-
endif::sts[]
139
-
ifdef::hcp[]
140
-
{rosa-short}
141
-
endif::hcp[]
142
-
clusters in the same AWS account. Only remove the roles if they are not required by other clusters.
114
+
The account-wide and Operator IAM policies might be used by other {product-title} clusters in the same AWS account. Only remove the roles if they are not required by other clusters.
{product-title} (ROSA) with AWS Security Token Services (STS)
17
-
endif::hcp[]
18
-
ifdef::hcp[]
19
-
{rosa-short}
20
-
endif::hcp[]
21
-
clusters that depend on the account-wide AWS Identity and Access Management (IAM) resources, you can delete the account-wide resources.
14
+
After you have deleted all {product-title} clusters that depend on the account-wide AWS Identity and Access Management (IAM) resources, you can delete the account-wide resources.
22
15
23
-
If you no longer need to install a
24
-
ifndef::hcp[]
25
-
{rosa-classic-short} with STS
26
-
endif::hcp[]
27
-
ifdef::hcp[]
28
-
{rosa-short}
29
-
endif::hcp[]
30
-
cluster by using {cluster-manager-first}, you can also delete the {cluster-manager} and user IAM roles.
16
+
If you no longer need to install a {product-title} cluster by using {cluster-manager-first}, you can also delete the {cluster-manager} and user IAM roles.
31
17
32
18
[IMPORTANT]
33
19
====
34
-
The account-wide IAM roles and policies might be used by other
35
-
ifndef::hcp[]
36
-
{rosa-classic-short}
37
-
endif::hcp[]
38
-
ifdef::hcp[]
39
-
{rosa-short}
40
-
endif::hcp[]
41
-
clusters in the same AWS account. Only remove the resources if they are not required by other clusters.
20
+
The account-wide IAM roles and policies might be used by other {product-title} clusters in the same AWS account. Only remove the resources if they are not required by other clusters.
42
21
43
-
The {cluster-manager} and user IAM roles are required if you want to install, manage, and delete other
44
-
ifndef::hcp[]
45
-
{rosa-classic-short}
46
-
endif::hcp[]
47
-
ifdef::hcp[]
48
-
{rosa-short}
49
-
endif::hcp[]
50
-
clusters in the same AWS account by using {cluster-manager}. Only remove the roles if you no longer need to install
51
-
ifndef::hcp[]
52
-
{rosa-classic-short}
53
-
endif::hcp[]
54
-
ifdef::hcp[]
55
-
{rosa-short}
56
-
endif::hcp[]
57
-
clusters in your account by using {cluster-manager}. For more information about repairing your cluster if these roles are removed before deletion, see "Repairing a cluster that cannot be deleted" in _Troubleshooting cluster deployments_.
22
+
The {cluster-manager} and user IAM roles are required if you want to install, manage, and delete other {product-title} clusters in the same AWS account by using {cluster-manager}. Only remove the roles if you no longer need to install {product-title} clusters in your account by using {cluster-manager}. For more information about repairing your cluster if these roles are removed before deletion, see "Repairing a cluster that cannot be deleted" in _Troubleshooting cluster deployments_.
0 commit comments