Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 0 additions & 25 deletions _topic_maps/_topic_map_rosa.yml
Original file line number Diff line number Diff line change
Expand Up @@ -241,31 +241,6 @@ Topics:
- Name: Setting up your environment
File: rosa-sts-setting-up-environment
---
Name: Install ROSA with HCP clusters
Dir: rosa_hcp
Distros: openshift-rosa
Topics:
- Name: Creating ROSA with HCP clusters using the default options
File: rosa-hcp-sts-creating-a-cluster-quickly
- Name: Creating a ROSA cluster using Terraform
Dir: terraform
Distros: openshift-rosa
Topics:
- Name: Creating a default ROSA cluster using Terraform
File: rosa-hcp-creating-a-cluster-quickly-terraform
- Name: Creating ROSA with HCP clusters using a custom AWS KMS encryption key
File: rosa-hcp-creating-cluster-with-aws-kms-key
- Name: Creating a private cluster on ROSA with HCP
File: rosa-hcp-aws-private-creating-cluster
- Name: Creating ROSA with HCP clusters with egress zero
File: rosa-hcp-egress-zero-install
- Name: Creating a ROSA with HCP cluster that uses direct authentication with an external OIDC identity provider
File: rosa-hcp-sts-creating-a-cluster-ext-auth
- Name: Creating ROSA with HCP clusters without a CNI plugin
File: rosa-hcp-cluster-no-cni
- Name: Deleting a ROSA with HCP cluster
File: rosa-hcp-deleting-cluster
---
Name: Install ROSA Classic clusters
Dir: rosa_install_access_delete_clusters
Distros: openshift-rosa
Expand Down
15 changes: 1 addition & 14 deletions _topic_maps/_topic_map_rosa_hcp.yml
Original file line number Diff line number Diff line change
Expand Up @@ -145,17 +145,6 @@ Topics:
# File: cloud-experts-dynamic-certificate-custom-domain
- Name: Assigning consistent egress IP for external traffic
File: cloud-experts-consistent-egress-ip
# ---
# Name: Getting started
# Dir: rosa_getting_started
# Distros: openshift-rosa-hcp
# Topics:
# - Name: ROSA quickstart guide
# File: rosa-quickstart-guide-ui
# - Name: Comprehensive guide to getting started with ROSA
# File: rosa-getting-started
# - Name: Understanding the ROSA with STS deployment workflow
# File: rosa-sts-getting-started-workflow
---
Name: Prepare your environment
Dir: rosa_planning
Expand All @@ -178,7 +167,7 @@ Topics:
- Name: Planning resource usage in your cluster
File: rosa-planning-environment
---
Name: Install ROSA clusters
Name: Install clusters
Dir: rosa_hcp
Distros: openshift-rosa-hcp
Topics:
Expand Down Expand Up @@ -397,8 +386,6 @@ Topics:
# File: troubleshooting-installations
- Name: Review your cluster notifications
File: mos-tshoot-cluster-notifications
# - Name: Troubleshooting ROSA installations
# File: rosa-troubleshooting-installations
- Name: Troubleshooting Red Hat OpenShift Service on AWS installations
File: rosa-troubleshooting-installations-hcp
- Name: Troubleshooting networking
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,12 @@ This tutorial uses the open-source BIND DNS server (`named`) to demonstrate the

* ROSA CLI (`rosa`)
* AWS CLI (`aws`)
* A xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-hcp-vpc-manual_rosa-hcp-sts-creating-a-cluster-quickly[manually created AWS VPC]
ifdef::openshift-rosa[]
* A manually created AWS VPC
endif::openshift-rosa[]
ifdef::openshift-rosa-hcp[]
* A xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-hcp-creating-vpc_rosa-hcp-sts-creating-a-cluster-quickly[manually created AWS VPC]
endif::openshift-rosa-hcp[]
* A DHCP option set configured to point to a custom DNS server and set as the default for your VPC

[id="cloud-experts-custom-dns-resolver-environment-setup"]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -165,7 +165,12 @@ image::rosa-create-cli-billing-17.png[]

.Additional resources

ifdef::openshift-rosa-hcp[]
* The detailed cluster deployment steps are beyond the scope of this tutorial. See xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-hcp-sts-creating-a-cluster-quickly[Creating {product-title} clusters using the default options] for more details about how to complete the {product-title} cluster deployment using the CLI.
endif::openshift-rosa-hcp[]
ifdef::openshift-rosa[]
* The detailed cluster deployment steps are beyond the scope of this tutorial.
endif::openshift-rosa[]

== Selecting the AWS billing account for {product-title} during cluster deployment using the web console

Expand Down Expand Up @@ -215,4 +220,4 @@ The following steps past the billing AWS account selection are beyond the scope
.Additional resources

* For information on using the CLI to create a cluster, see xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-hcp-sts-creating-a-cluster-cli_rosa-hcp-sts-creating-a-cluster-quickly[Creating a {product-title} cluster using the CLI].
* See link:https://cloud.redhat.com/learning/learn:getting-started-red-hat-openshift-service-aws-rosa/resource/resources:how-deploy-cluster-red-hat-openshift-service-aws-using-console-ui[this learning path] for more details on how to complete cluster deployment using the web console.
* See link:https://cloud.redhat.com/learning/learn:getting-started-red-hat-openshift-service-aws-rosa/resource/resources:how-deploy-cluster-red-hat-openshift-service-aws-using-console-ui[this learning path] for more details on how to complete cluster deployment using the web console.
6 changes: 3 additions & 3 deletions modules/creating-cluster-with-aws-kms-key.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,13 @@

:_mod-docs-content-type: PROCEDURE
[id="creating-cluster-with-aws-kms-key"]
= Creating a ROSA cluster using a custom AWS KMS key
= Creating a {product-title} cluster using a custom AWS KMS key

You can create a {product-title} (ROSA) cluster with a customer-provided KMS key that is used to encrypt either node root volumes, the etcd database, or both. A different KMS key ARN can be provided for each option.
You can create a {product-title} cluster with a customer-provided KMS key that is used to encrypt either node root volumes, the etcd database, or both. A different KMS key ARN can be provided for each option.

[NOTE]
====
{hcp-title} does not automatically configure the `default` storage class to encrypt persistent volumes with the customer-provided KMS key. This is something that can be configured in-cluster after installation.
{product-title} does not automatically configure the `default` storage class to encrypt persistent volumes with the customer-provided KMS key. This is something that can be configured in-cluster after installation.
====


Expand Down
2 changes: 1 addition & 1 deletion modules/rosa-additional-principals-create.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@

:_mod-docs-content-type: PROCEDURE
[id="rosa-additional-principals-create_{context}"]
= Adding additional principals while creating your {hcp-title} cluster
= Adding additional principals while creating your {product-title} cluster

Use the `--additional-allowed-principals` argument to permit access through other roles.

Expand Down
2 changes: 1 addition & 1 deletion modules/rosa-additional-principals-edit.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@

:_mod-docs-content-type: PROCEDURE
[id="rosa-additional-principals-edit_{context}"]
= Adding additional principals to your existing {hcp-title} cluster
= Adding additional principals to your existing {product-title} cluster

You can add additional principals to your cluster by using the command-line interface (CLI).

Expand Down
6 changes: 3 additions & 3 deletions modules/rosa-additional-principals-overview.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -4,17 +4,17 @@

:_mod-docs-content-type: CONCEPT
[id="rosa-additional-principals-overview_{context}"]
= Additional principals on your {hcp-title} cluster
= Additional principals on your {product-title} cluster

You can allow AWS Identity and Access Management (IAM) roles as additional principals to connect to your cluster's private API server endpoint.

You can access your {hcp-title} cluster's API Server endpoint from either the public internet or the interface endpoint that was created within the VPC private subnets. By default, you can privately access your {hcp-title} API Server by using the `-kube-system-kube-controller-manager` Operator role. To be able to access ROSA with HCP API server from another account directly without using the primary account where cluster is installed, you must include cross-account IAM roles as additional principals. This feature allows you to simplify your network architecture and reduce data transfer costs by avoiding peering or attaching cross-account VPCs to cluster's VPC.
You can access your {product-title} cluster's API Server endpoint from either the public internet or the interface endpoint that was created within the VPC private subnets. By default, you can privately access your {product-title} API Server by using the `-kube-system-kube-controller-manager` Operator role. To be able to access {product-title} API server from another account directly without using the primary account where cluster is installed, you must include cross-account IAM roles as additional principals. This feature allows you to simplify your network architecture and reduce data transfer costs by avoiding peering or attaching cross-account VPCs to cluster's VPC.

image::AWS_cross_account_access.png[Overview of AWS cross account access]

In this diagram, the cluster creating account is designated as Account A. This account designates that another account, Account B, should have access to the API server.

[NOTE]
====
After you have configured additional allowed principals, you must create the interface VPC endpoint in the VPC from where you want to access the cross-account {hcp-title} API server. Then, create a private hosted zone in Route53 to route calls made to cross-account {hcp-title} API server to pass through the created VPC endpoint.
After you have configured additional allowed principals, you must create the interface VPC endpoint in the VPC from where you want to access the cross-account {product-title} API server. Then, create a private hosted zone in Route53 to route calls made to cross-account {product-title} API server to pass through the created VPC endpoint.
====
36 changes: 4 additions & 32 deletions modules/rosa-deleting-account-wide-iam-roles-and-policies.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -15,32 +15,11 @@ endif::[]
[id="rosa-deleting-account-wide-iam-roles-and-policies_{context}"]
= Deleting the account-wide IAM roles and policies

This section provides steps to delete the account-wide IAM roles and policies that you created for
ifdef::sts[]
{rosa-classic-short} with STS
endif::sts[]
ifdef::hcp[]
{rosa-short}
endif::hcp[]
deployments, along with the account-wide Operator policies. You can delete the account-wide AWS Identity and Access Management (IAM) roles and policies only after deleting all of the
ifdef::sts[]
{rosa-classic-short} with AWS Security Token Services (STS)
endif::sts[]
ifdef::hcp[]
{rosa-short}
endif::hcp[]
clusters that depend on them.
This section provides steps to delete the account-wide IAM roles and policies that you created for {product-title} deployments, along with the account-wide Operator policies. You can delete the account-wide AWS Identity and Access Management (IAM) roles and policies only after deleting all of the {product-title} clusters that depend on them.

[IMPORTANT]
====
The account-wide IAM roles and policies might be used by other
ifdef::sts[]
{rosa-classic-short}
endif::sts[]
ifdef::hcp[]
{rosa-short}
endif::hcp[]
clusters in the same AWS account. Only remove the roles if they are not required by other clusters.
The account-wide IAM roles and policies might be used by other {product-title} clusters in the same AWS account. Only remove the roles if they are not required by other clusters.
====

.Prerequisites
Expand Down Expand Up @@ -101,7 +80,7 @@ $ rosa delete account-roles --prefix <prefix> --delete-hosted-shared-vpc-policie
+
[IMPORTANT]
====
The account-wide IAM roles might be used by other ROSA clusters in the same AWS account. Only remove the roles if they are not required by other clusters.
The account-wide IAM roles might be used by other {product-title} clusters in the same AWS account. Only remove the roles if they are not required by other clusters.
====
+
ifdef::hcp[]
Expand Down Expand Up @@ -132,12 +111,5 @@ If you did not specify a custom prefix when you created the account-wide roles,
+
[IMPORTANT]
====
The account-wide and Operator IAM policies might be used by other
ifdef::sts[]
{rosa-classic-short}
endif::sts[]
ifdef::hcp[]
{rosa-short}
endif::hcp[]
clusters in the same AWS account. Only remove the roles if they are not required by other clusters.
The account-wide and Operator IAM policies might be used by other {product-title} clusters in the same AWS account. Only remove the roles if they are not required by other clusters.
====
43 changes: 4 additions & 39 deletions modules/rosa-deleting-sts-iam-resources-account-wide.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -11,48 +11,13 @@ endif::[]
[id="rosa-deleting-sts-resources-account-wide_{context}"]
= Deleting the account-wide IAM resources

After you have deleted all
ifndef::hcp[]
{product-title} (ROSA) with AWS Security Token Services (STS)
endif::hcp[]
ifdef::hcp[]
{rosa-short}
endif::hcp[]
clusters that depend on the account-wide AWS Identity and Access Management (IAM) resources, you can delete the account-wide resources.
After you have deleted all {product-title} clusters that depend on the account-wide AWS Identity and Access Management (IAM) resources, you can delete the account-wide resources.

If you no longer need to install a
ifndef::hcp[]
{rosa-classic-short} with STS
endif::hcp[]
ifdef::hcp[]
{rosa-short}
endif::hcp[]
cluster by using {cluster-manager-first}, you can also delete the {cluster-manager} and user IAM roles.
If you no longer need to install a {product-title} cluster by using {cluster-manager-first}, you can also delete the {cluster-manager} and user IAM roles.

[IMPORTANT]
====
The account-wide IAM roles and policies might be used by other
ifndef::hcp[]
{rosa-classic-short}
endif::hcp[]
ifdef::hcp[]
{rosa-short}
endif::hcp[]
clusters in the same AWS account. Only remove the resources if they are not required by other clusters.
The account-wide IAM roles and policies might be used by other {product-title} clusters in the same AWS account. Only remove the resources if they are not required by other clusters.

The {cluster-manager} and user IAM roles are required if you want to install, manage, and delete other
ifndef::hcp[]
{rosa-classic-short}
endif::hcp[]
ifdef::hcp[]
{rosa-short}
endif::hcp[]
clusters in the same AWS account by using {cluster-manager}. Only remove the roles if you no longer need to install
ifndef::hcp[]
{rosa-classic-short}
endif::hcp[]
ifdef::hcp[]
{rosa-short}
endif::hcp[]
clusters in your account by using {cluster-manager}. For more information about repairing your cluster if these roles are removed before deletion, see "Repairing a cluster that cannot be deleted" in _Troubleshooting cluster deployments_.
The {cluster-manager} and user IAM roles are required if you want to install, manage, and delete other {product-title} clusters in the same AWS account by using {cluster-manager}. Only remove the roles if you no longer need to install {product-title} clusters in your account by using {cluster-manager}. For more information about repairing your cluster if these roles are removed before deletion, see "Repairing a cluster that cannot be deleted" in _Troubleshooting cluster deployments_.
====
6 changes: 3 additions & 3 deletions modules/rosa-getting-started-access-cluster-web-console.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -14,15 +14,15 @@ ifeval::["{context}" == "rosa-quickstart"]
:quickstart:
endif::[]

After you have created a cluster administrator user or added a user to your configured identity provider, you can log into your {product-title} (ROSA) cluster through the web console.
After you have created a cluster administrator user or added a user to your configured identity provider, you can log into your {product-title} cluster through the web console.

ifdef::getting-started[]
.Prerequisites

* You have an AWS account.
* You installed and configured the latest {product-title} (ROSA) CLI, `rosa`, on your workstation.
* You installed and configured the latest ROSA CLI, `rosa`, on your workstation.
* You logged in to your Red{nbsp}Hat account using the ROSA CLI (`rosa`).
* You created a ROSA cluster.
* You created a {product-title} cluster.
* You have created a cluster administrator user or added your user account to the configured identity provider.
endif::[]

Expand Down
32 changes: 10 additions & 22 deletions modules/rosa-getting-started-deleting-a-cluster.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -13,38 +13,26 @@ endif::[]
:_mod-docs-content-type: PROCEDURE
[id="rosa-getting-started-deleting-a-cluster_{context}"]

ifdef::openshift-rosa[]
= Deleting a {rosa-classic-short} cluster and the AWS IAM STS resources
endif::openshift-rosa[]
ifdef::openshift-rosa-hcp[]
= Deleting a {rosa-short} cluster and the AWS IAM STS resources
endif::openshift-rosa-hcp[]
= Deleting a {product-title} cluster and the AWS IAM STS resources

ifdef::openshift-rosa-hcp[]
You can delete a {rosa-short} cluster by using the ROSA CLI, `rosa`. You can also use the ROSA CLI to delete the AWS Identity and Access Management (IAM) account-wide roles, the cluster-specific Operator roles, and the OpenID Connect (OIDC) provider. To delete the account-wide and Operator policies, you can use the AWS IAM Console or the AWS CLI.
You can delete a {product-title} cluster by using the ROSA CLI, `rosa`. You can also use the {rosa-cli} to delete the AWS Identity and Access Management (IAM) account-wide roles, the cluster-specific Operator roles, and the OpenID Connect (OIDC) provider. To delete the account-wide and Operator policies, you can use the AWS IAM Console or the AWS CLI.
endif::openshift-rosa-hcp[]
ifdef::openshift-rosa[]
You can delete a {rosa-classic-short} cluster that uses the AWS Security Token Service (STS) by using the ROSA CLI, `rosa`. You can also use the ROSA CLI to delete the AWS Identity and Access Management (IAM) account-wide roles, the cluster-specific Operator roles, and the OpenID Connect (OIDC) provider. To delete the account-wide inline and Operator policies, you can use the AWS IAM Console or the AWS CLI.
You can delete a {product-title} cluster that uses the AWS Security Token Service (STS) by using the {rosa-cli}. You can also use the ROSA CLI to delete the AWS Identity and Access Management (IAM) account-wide roles, the cluster-specific Operator roles, and the OpenID Connect (OIDC) provider. To delete the account-wide inline and Operator policies, you can use the AWS IAM Console or the AWS CLI.
endif::openshift-rosa[]

[IMPORTANT]
====
Account-wide IAM roles and policies might be used by other
ifdef::openshift-rosa[]
{rosa-classic-short}
endif::openshift-rosa[]
ifdef::openshift-rosa-hcp[]
{rosa-short}
endif::openshift-rosa-hcp[]
clusters in the same AWS account. You must only remove the resources if they are not required by other clusters.
Account-wide IAM roles and policies might be used by other {product-title} clusters in the same AWS account. You must only remove the resources if they are not required by other clusters.
====

ifdef::getting-started[]
.Prerequisites

* You installed and configured the latest ROSA CLI, `rosa`, on your workstation.
* You logged in to your Red{nbsp}Hat account using the ROSA CLI (`rosa`).
* You created a {rosa-classic} cluster.
* You installed and configured the latest {rosa-cli} on your workstation.
* You logged in to your Red{nbsp}Hat account using the {rosa-cli}.
* You created a {product-title} cluster.
endif::[]

.Procedure
Expand Down Expand Up @@ -86,7 +74,7 @@ $ rosa delete operator-roles -c <cluster_id> --mode auto <1>
+
[IMPORTANT]
====
Account-wide IAM roles and policies might be used by other ROSA clusters in the same AWS account. You must only remove the resources if they are not required by other clusters.
Account-wide IAM roles and policies might be used by other {product-title} clusters in the same AWS account. You must only remove the resources if they are not required by other clusters.
====
+
[source,terminal]
Expand All @@ -96,10 +84,10 @@ $ rosa delete account-roles --prefix <prefix> --mode auto <1>
<1> You must include the `--<prefix>` argument. Replace `<prefix>` with the prefix of the account-wide roles to delete. If you did not specify a custom prefix when you created the account-wide roles, specify the default prefix, depending on how they were created, `HCP-ROSA` or `ManagedOpenShift`.

ifdef::openshift-rosa-hcp[]
. Delete the account-wide and Operator IAM policies that you created for {rosa-short} deployments:
. Delete the account-wide and Operator IAM policies that you created for {product-title} deployments:
endif::openshift-rosa-hcp[]
ifdef::openshift-rosa[]
. Delete the account-wide and Operator IAM policies that you created for {rosa-classic-short} deployments that use STS:
. Delete the account-wide and Operator IAM policies that you created for {product-title} deployments that use STS:
endif::openshift-rosa[]
+
.. Log in to the link:https://console.aws.amazon.com/iamv2/home#/home[AWS IAM Console].
Expand Down
Loading