Installing a cluster on AWS China

In {product-title} version {product-version}, you can install a cluster to the following Amazon Web Services (AWS) China regions:

cn-north-1 (Beijing)
cn-northwest-1 (Ningxia)

Prerequisites

You have an Internet Content Provider (ICP) license.
You reviewed details about the {product-title} installation and update processes.
You read the documentation on selecting a cluster installation method and preparing it for users.
You configured an AWS account to host the cluster.
If you use a firewall, you configured it to allow the sites that your cluster requires access to.

Important

If you have an AWS profile stored on your computer, it must not use a temporary session token that you generated while using a multi-factor authentication device. The cluster continues to use your current AWS credentials to create AWS resources for the entire life of the cluster, so you must use long-term credentials. To generate appropriate keys, see Managing Access Keys for IAM Users in the AWS documentation. You can supply the keys when you run the installation program.

modules/installation-aws-regions-with-no-ami.adoc

modules/private-clusters-default.adoc modules/private-clusters-about-aws.adoc

modules/installation-custom-aws-vpc.adoc modules/installation-aws-security-groups.adoc

modules/installation-aws-upload-custom-rhcos-ami.adoc

modules/installation-initializing-manual.adoc

Additional resources

Installation configuration parameters for AWS

modules/installation-aws-config-yaml.adoc modules/installation-minimum-resource-requirements.adoc

Additional resources

Optimizing storage

modules/installation-aws-tested-machine-types.adoc modules/installation-aws-arm-tested-machine-types.adoc

modules/installation-configure-proxy.adoc

modules/installation-applying-aws-security-groups.adoc

Alternatives to storing administrator-level secrets in the kube-system project

By default, administrator secrets are stored in the kube-system project. If you configured the credentialsMode parameter in the install-config.yaml file to Manual, you must use one of the following alternatives:

To manage long-term cloud credentials manually, follow the procedure in Manually creating long-term credentials.
To implement short-term credentials that are managed outside the cluster for individual components, follow the procedures in Configuring an AWS cluster to use short-term credentials.

modules/manually-create-identity-access-management.adoc

Configuring an AWS cluster to use short-term credentials

To install a cluster that is configured to use the AWS Security Token Service (STS), you must configure the CCO utility and create the required AWS resources for your cluster.

modules/cco-ccoctl-configuring.adoc

Creating AWS resources with the Cloud Credential Operator utility

You have the following options when creating AWS resources:

You can use the ccoctl aws create-all command to create the AWS resources automatically. This is the quickest way to create the resources. See Creating AWS resources with a single command.
If you need to review the JSON files that the ccoctl tool creates before modifying AWS resources, or if the process the ccoctl tool uses to create AWS resources automatically does not meet the requirements of your organization, you can create the AWS resources individually. See Creating AWS resources individually.