Skip to content

Commit f6ab5cf

Browse files
EricPonvelleEricPonvelle
committed
OSDOCS-9614: Created documentation to create a ROSA with HCP cluster that uses external auth for OIDC
1 parent 8381361 commit f6ab5cf

File tree

3 files changed

+124
-0
lines changed

3 files changed

+124
-0
lines changed

‎_topic_maps/_topic_map_rosa.yml

+2
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,8 @@ Topics:
216216
File: rosa-hcp-creating-cluster-with-aws-kms-key
217217
- Name: Creating a private cluster on ROSA with HCP
218218
File: rosa-hcp-aws-private-creating-cluster
219+
- Name: Creating ROSA with HCP clusters with external authentication
220+
File: rosa-hcp-sts-creating-a-cluster-ext-auth
219221
- Name: Using the Node Tuning Operator on ROSA with HCP
220222
File: rosa-tuning-config
221223
---

‎modules/rosa-hcp-sts-creating-a-cluster-ext-auth-cli.adoc

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="rosa-hcp-sts-creating-a-cluster-external-auth-cli_{context}"]
7+
= Creating a {hcp-title} cluster using the CLI
8+
9+
Use the ROSA CLI's `--external-auth-providers-enabled` flag to create your cluster that uses an external authentication service.
10+
11+
.Procedure
12+
13+
. You can create your {hcp-title} cluster with the following command:
14+
+
15+
[NOTE]
16+
====
17+
When creating a {hcp-title} cluster, the default machine Classless Inter-Domain Routing (CIDR) is `10.0.0.0/16`. If this does not correspond to the CIDR range for your VPC subnets, add `--machine-cidr <address_block>` to the following commands. To learn more about the default CIDR ranges for {product-title}, see xref:../networking/cidr-range-definitions.adoc#cidr-range-definitions[CIDR range definitions].
18+
====
19+
+
20+
[source,terminal]
21+
----
22+
$ rosa create cluster --cluster-name=<cluster_name> \
23+
--sts --mode=auto --hosted-cp --operator-roles-prefix <operator-role-prefix> \
24+
--oidc-config-id <ID-of-OIDC-configuration> --external-auth-providers-enabled \
25+
--subnet-ids=<public-subnet-id>,<private-subnet-id>
26+
----
27+
28+
** If you used the `OIDC_ID`, `SUBNET_IDS`, and `OPERATOR_ROLES_PREFIX` variables to prepare your environment, you can continue to use those variables when creating your cluster. For example, run the following command:
29+
+
30+
[source,terminal]
31+
----
32+
$ rosa create cluster --hosted-cp --subnet-ids=$SUBNET_IDS --oidc-config-id=$OIDC_ID --cluster-name=<cluster_name> --operator-roles-prefix=$OPERATOR_ROLES_PREFIX --external-auth-providers-enabled
33+
----
34+
35+
. Check the status of your cluster by running the following command:
36+
+
37+
[source,terminal]
38+
----
39+
$ rosa describe cluster --cluster=<cluster_name>
40+
----
41+
+
42+
The following `State` field changes are listed in the output as the cluster installation progresses:
43+
+
44+
* `pending (Preparing account)`
45+
* `installing (DNS setup in progress)`
46+
* `installing`
47+
* `ready`
48+
+
49+
[NOTE]
50+
====
51+
If the installation fails or the `State` field does not change to `ready` after more than 10 minutes, check the installation troubleshooting documentation for details. For more information, see _Troubleshooting installations_. For steps to contact Red Hat Support for assistance, see _Getting support for Red Hat OpenShift Service on AWS_.
52+
====
53+
54+
. Track the progress of the cluster creation by watching the {product-title} installation program logs. To check the logs, run the following command:
55+
+
56+
[source,terminal]
57+
----
58+
$ rosa logs install --cluster=<cluster_name> --watch <1>
59+
----
60+
<1> Optional: To watch for new log messages as the installation progresses, use the `--watch` argument.

‎rosa_hcp/rosa-hcp-sts-creating-a-cluster-ext-auth.adoc

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="rosa-hcp-sts-creating-a-cluster-ext-auth"]
3+
= Creating ROSA with HCP clusters with external authentication
4+
include::_attributes/attributes-openshift-dedicated.adoc[]
5+
:context: rosa-hcp-sts-creating-a-cluster-ext-auth
6+
7+
toc::[]
8+
9+
You can create {hcp-title-first} clusters that use an external authentication to issue your access tokens.
10+
11+
[IMPORTANT]
12+
====
13+
Since it is not possible to upgrade or convert existing ROSA clusters to a {hcp} architecture, you must create a new cluster to use {hcp-title} functionality.
14+
====
15+
16+
[NOTE]
17+
====
18+
{hcp-title} clusters only support AWS Security Token Service (STS) authentication.
19+
====
20+
21+
.Further reading
22+
* For a comparison between {hcp-title} and ROSA Classic, see the xref:../rosa_architecture/rosa_architecture_sub/rosa-architecture-models.adoc#rosa-hcp-classic-comparison_rosa-architecture-models[Comparing architecture models] documentation.
23+
* See the AWS documentation for information about link:https://docs.aws.amazon.com/rosa/latest/userguide/getting-started-hcp.html[Getting started with ROSA with HCP using the ROSA CLI in auto mode].
24+
25+
.Additional resources
26+
27+
For a full list of the supported certificates, see the xref:../rosa_architecture/rosa_policy_service_definition/rosa-policy-process-security.adoc#rosa-policy-compliance_rosa-policy-process-security[Compliance] section of "Understanding process and security for Red Hat OpenShift Service on AWS".
28+
29+
[id="next-steps-hcp-ext-auth_{context}"]
30+
.Next steps
31+
32+
* Ensure that you have completed the xref:../rosa_planning/rosa-sts-aws-prereqs.adoc[AWS prerequisites].
33+
34+
[id="rosa-hcp-external-auth-prereqs"]
35+
== {hcp-title} Prerequisites
36+
37+
To create a {hcp-title} cluster, you must have the following items:
38+
39+
* A xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-hcp-creating-vpc[configured virtual private cloud (VPC)]
40+
* xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-sts-creating-account-wide-sts-roles-and-policies_rosa-hcp-sts-creating-a-cluster-quickly[Account-wide roles]
41+
* An xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-sts-byo-oidc_rosa-hcp-sts-creating-a-cluster-quickly[OIDC configuration]
42+
* xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-operator-config_rosa-hcp-sts-creating-a-cluster-quickly[Operator roles]
43+
44+
include::modules/rosa-hcp-sts-creating-a-cluster-ext-auth-cli.adoc[leveloffset=+1]
45+
46+
[id="next-steps-2_{context}"]
47+
== Next steps
48+
49+
* xref:../rosa_install_access_delete_clusters/rosa-sts-accessing-cluster.adoc#rosa-sts-accessing-cluster[Accessing a ROSA cluster]
50+
51+
[role="_additional-resources"]
52+
[id="additional-resources_rosa-sts-creating-a-cluster-ext-auth"]
53+
== Additional resources
54+
55+
* For steps to deploy a ROSA cluster using manual mode, see xref:../rosa_install_access_delete_clusters/rosa-sts-creating-a-cluster-with-customizations.adoc#rosa-sts-creating-cluster-using-customizations_rosa-sts-creating-a-cluster-with-customizations[Creating a cluster using customizations].
56+
* For more information about the AWS Identity Access Management (IAM) resources required to deploy {product-title} with STS, see xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-sts-about-iam-resources[About IAM resources for clusters that use STS].
57+
* For details about optionally setting an Operator role name prefix, see xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-sts-about-operator-role-prefixes_rosa-sts-about-iam-resources[About custom Operator IAM role prefixes].
58+
* For information about the prerequisites to installing ROSA with STS, see xref:../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-sts-aws-prereqs[AWS prerequisites for ROSA with STS].
59+
* For details about using the `auto` and `manual` modes to create the required STS resources, see xref:../rosa_install_access_delete_clusters/rosa-sts-creating-a-cluster-with-customizations.adoc#rosa-understanding-deployment-modes_rosa-sts-creating-a-cluster-with-customizations[Understanding the auto and manual deployment modes].
60+
* For more information about using OpenID Connect (OIDC) identity providers in AWS IAM, see link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html[Creating OpenID Connect (OIDC) identity providers] in the AWS documentation.
61+
* For more information about troubleshooting ROSA cluster installations, see xref:../support/troubleshooting/rosa-troubleshooting-installations.adoc#rosa-troubleshooting-installations[Troubleshooting installations].
62+
* For steps to contact Red Hat Support for assistance, see xref:../support/getting-support.adoc#getting-support[Getting support for Red Hat OpenShift Service on AWS].

0 commit comments

Comments
 (0)