Skip to content

Commit 8f82392

Browse files
tinaafitztinaafitz
committed
Remove SSO Offline token references and update directions to reflect recent changes.
1 parent f3440f3 commit 8f82392

1 file changed

Lines changed: 147 additions & 106 deletions

File tree

‎docs/book/src/topics/rosa/creating-a-cluster.md‎

Lines changed: 147 additions & 106 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,41 @@
11
# Creating a ROSA HCP cluster
22

3+
## Prerequisites
4+
5+
1. Create a management cluster using the [Quick Start Guide.](https://cluster-api-aws.sigs.k8s.io/quick-start)
6+
7+
8+
2. Install the required tools and set up the prerequisite infrastructure using the [ROSA Setup guide](https://docs.aws.amazon.com/rosa/latest/userguide/set-up.html).
9+
10+
Once these steps are complete, you are ready to create a ROSA HCP cluster.
11+
12+
13+
## Authentication
14+
The CAPA controller requires service account credentials to provision ROSA HCP clusters.
15+
If you already have a service account, you can skip these steps.
16+
1. Create a service account by visiting [https://console.redhat.com/iam/service-accounts](https://console.redhat.com/iam/service-accounts).
17+
18+
19+
2. For every newly created service account, make sure to activate the account using the [ROSA command line tool](https://github.com/openshift/rosa).
20+
First, log in using your newly created service account:
21+
```shell
22+
rosa login --client-id ... --client-secret ...
23+
```
24+
3. Then activate your service account:
25+
```shell
26+
rosa whoami
27+
```
328
## Permissions
4-
### Authentication using service account credentials
5-
CAPA controller requires service account credentials to be able to provision ROSA HCP clusters:
6-
1. Visit [https://console.redhat.com/iam/service-accounts](https://console.redhat.com/iam/service-accounts) and create a service account. If you already have a service account, you can skip this step.
7-
8-
For every newly created service account, make sure to activate the account using the [ROSA command line tool](https://github.com/openshift/rosa). First, log in using your newly created service account
9-
```shell
10-
rosa login --client-id ... --client-secret ...
11-
```
12-
Then activate your service account
13-
```shell
14-
rosa whoami
15-
```
16-
17-
1. Create a new kubernetes secret with the service account credentials to be referenced later by `ROSAControlPlane`
29+
30+
31+
1. Create a new kubernetes secret with the service account credentials to be referenced later by the `ROSAControlPlane`
1832
```shell
1933
kubectl create secret generic rosa-creds-secret \
2034
--from-literal=ocmClientID='....' \
2135
--from-literal=ocmClientSecret='eyJhbGciOiJIUzI1NiIsI....' \
2236
--from-literal=ocmApiUrl='https://api.openshift.com'
2337
```
24-
Note: to consume the secret without the need to reference it from your `ROSAControlPlane`, name your secret as `rosa-creds-secret` and create it in the CAPA manager namespace (usually `capa-system`)
38+
Note: to consume the secret without the need to reference it from your `ROSAControlPlane`, name your secret `rosa-creds-secret` and create it in the CAPA manager namespace (usually `capa-system`)
2539
```shell
2640
kubectl -n capa-system create secret generic rosa-creds-secret \
2741
--from-literal=ocmClientID='....' \
@@ -30,132 +44,136 @@ CAPA controller requires service account credentials to be able to provision ROS
3044
```
3145

3246

33-
### Authentication using SSO offline token (DEPRECATED)
34-
The SSO offline token is being deprecated and it is recommended to use service account credentials instead, as described above.
47+
## Creating the cluster
3548

36-
1. Visit https://console.redhat.com/openshift/token to retrieve your SSO offline authentication token
49+
1. Save the following to a file `rosa-role-network.yaml`:
3750

38-
1. Create a credentials secret within the target namespace with the token to be referenced later by `ROSAControlePlane`
39-
```shell
40-
kubectl create secret generic rosa-creds-secret \
41-
--from-literal=ocmToken='eyJhbGciOiJIUzI1NiIsI....' \
42-
--from-literal=ocmApiUrl='https://api.openshift.com'
43-
```
44-
Alternatively, you can edit the CAPA controller deployment to provide the credentials
45-
```shell
46-
kubectl edit deployment -n capa-system capa-controller-manager
47-
```
48-
and add the following environment variables to the manager container
4951
```yaml
50-
env:
51-
- name: OCM_TOKEN
52-
value: "<token>"
53-
- name: OCM_API_URL
54-
value: "https://api.openshift.com" # or https://api.stage.openshift.com
52+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
53+
kind: ROSARoleConfig
54+
metadata:
55+
name: "role-config"
56+
spec:
57+
accountRoleConfig:
58+
prefix: "rosa"
59+
version: "4.19.0"
60+
operatorRoleConfig:
61+
prefix: "rosa"
62+
credentialsSecretRef:
63+
name: rosa-creds-secret
64+
oidcProviderType: Managed
65+
---
66+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
67+
kind: ROSANetwork
68+
metadata:
69+
name: "rosa-vpc"
70+
spec:
71+
region: "us-west-2"
72+
stackName: "rosa-hcp-net"
73+
availabilityZones:
74+
- "us-west-2a"
75+
- "us-west-2b"
76+
- "us-west-2c"
77+
cidrBlock: 10.0.0.0/16
78+
identityRef:
79+
kind: AWSClusterControllerIdentity
80+
name: default
5581
```
5682

57-
### Migration from offline token to service account authentication
83+
Apply the manifest:
5884

59-
1. Visit [https://console.redhat.com/iam/service-accounts](https://console.redhat.com/iam/service-accounts) and create a new service account.
60-
61-
1. If you previously used kubernetes secret to specify the OCM credentials secret, edit the secret:
6285
```shell
63-
kubectl edit secret rosa-creds-secret
64-
```
65-
where you will remove the `ocmToken` credentials and add base64 encoded `ocmClientID` and `ocmClientSecret` credentials like so:
66-
```yaml
67-
apiVersion: v1
68-
data:
69-
ocmApiUrl: aHR0cHM6Ly9hcGkub3BlbnNoaWZ0LmNvbQ==
70-
ocmClientID: Y2xpZW50X2lk...
71-
ocmClientSecret: Y2xpZW50X3NlY3JldA==...
72-
kind: Secret
73-
type: Opaque
86+
kubectl apply -f rosa-role-network.yaml
7487
```
7588

76-
1. If you previously used capa manager deployment to specify the OCM offline token as environment variable, edit the manager deployment
77-
```shell
78-
kubectl -n capa-system edit deployment capa-controller-manager
79-
```
80-
and remove the `OCM_TOKEN` and `OCM_API_URL` variables, followed by `kubectl -n capa-system rollout restart deploy capa-controller-manager`. Then create the new default secret in the `capa-system` namespace with
81-
```shell
82-
kubectl -n capa-system create secret generic rosa-creds-secret \
83-
--from-literal=ocmClientID='....' \
84-
--from-literal=ocmClientSecret='eyJhbGciOiJIUzI1NiIsI....' \
85-
--from-literal=ocmApiUrl='https://api.openshift.com'
86-
```
89+
Verify the `ROSARoleConfig` was successfully created. The status should contain the `accountRolesRef`, `oidcID`, `oidcProviderARN` and `operatorRolesRef`:
8790

88-
## Prerequisites
89-
90-
Follow the guide [here](https://docs.aws.amazon.com/ROSA/latest/userguide/getting-started-hcp.html) up until ["Create a ROSA with HCP Cluster"](https://docs.aws.amazon.com/ROSA/latest/userguide/getting-started-hcp.html#create-hcp-cluster-cli) to install the required tools and setup the prerequisite infrastructure. Once Step 3 is done, you will be ready to proceed with creating a ROSA HCP cluster using cluster-api.
91-
92-
Note; Skip the "Create the required IAM roles and OpenID Connect configuration" step from the prerequisites url above and use the templates/cluster-template-rosa-role-config.yaml to generate a ROSARoleConfig CR to create the required account roles, operator roles & managed OIDC provider.
93-
94-
## Creating the cluster
95-
96-
1. Prepare the environment:
97-
```bash
98-
export OPENSHIFT_VERSION="4.19.0"
99-
export AWS_REGION="us-west-2"
100-
export AWS_AVAILABILITY_ZONE="us-west-2a"
101-
export AWS_ACCOUNT_ID="<account_id>"
102-
export AWS_CREATOR_ARN="<user_arn>" # can be retrieved e.g. using `aws sts get-caller-identity`
103-
104-
# Note: if using templates/cluster-template-rosa.yaml set the below env variables
105-
export OIDC_CONFIG_ID="<oidc_id>" # OIDC config id creating previously with `rosa create oidc-config`
106-
export ACCOUNT_ROLES_PREFIX="ManagedOpenShift-HCP" # prefix used to create account IAM roles with `rosa create account-roles`
107-
export OPERATOR_ROLES_PREFIX="capi-rosa-quickstart" # prefix used to create operator roles with `rosa create operator-roles --prefix <PREFIX_NAME>`
108-
109-
# Note: if using templates/cluster-template-rosa-role-config.yaml set the below env variables
110-
export ACCOUNT_ROLES_PREFIX="capa" # prefix can be change to preferable prefix with max 4 chars
111-
export OPERATOR_ROLES_PREFIX="capa" # prefix can be change to preferable prefix with max 4 chars
112-
113-
# subnet IDs created earlier
114-
export PUBLIC_SUBNET_ID="subnet-0b54a1111111111111"
115-
export PRIVATE_SUBNET_ID="subnet-05e72222222222222"
116-
```
117-
118-
1. Render the cluster manifest using the ROSA HCP cluster template:
119-
120-
a. Using templates/cluster-template-rosa.yaml
121-
122-
Note: The AWS role name must be no more than 64 characters in length. Otherwise an error will be returned. Truncate values exceeding 64 characters.
12391
```shell
124-
clusterctl generate cluster <cluster-name> --from templates/cluster-template-rosa.yaml > rosa-capi-cluster.yaml
92+
kubectl get rosaroleconfig role-config -o yaml
12593
```
12694

127-
b. Using templates/cluster-template-rosa-role-config.yaml
95+
Verify the `ROSANetwork` was successfully created. The status should contain the created subnets:
96+
12897
```shell
129-
clusterctl generate cluster <cluster-name> --from templates/cluster-template-rosa-role-config.yaml > rosa-capi-cluster.yaml
98+
kubectl get rosanetwork rosa-vpc -o yaml
13099
```
131100

101+
1. Save the following to a file `rosa-cluster.yaml`:
132102

133-
1. If a credentials secret was created earlier, edit `ROSAControlPlane` to reference it:
134103
```yaml
104+
apiVersion: cluster.x-k8s.io/v1beta1
105+
kind: Cluster
106+
metadata:
107+
name: "rosa-hcp-1"
108+
spec:
109+
clusterNetwork:
110+
pods:
111+
cidrBlocks: ["192.168.0.0/16"]
112+
infrastructureRef:
113+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
114+
kind: ROSACluster
115+
name: "rosa-hcp-1"
116+
controlPlaneRef:
117+
apiVersion: controlplane.cluster.x-k8s.io/v1beta2
118+
kind: ROSAControlPlane
119+
name: "rosa-hcp-1-control-plane"
120+
---
121+
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
122+
kind: ROSACluster
123+
metadata:
124+
name: "rosa-hcp-1"
125+
spec: {}
126+
---
135127
apiVersion: controlplane.cluster.x-k8s.io/v1beta2
136128
kind: ROSAControlPlane
137129
metadata:
138-
name: "capi-rosa-quickstart-control-plane"
130+
name: "rosa-hcp-1-control-plane"
139131
spec:
140132
credentialsSecretRef:
141133
name: rosa-creds-secret
142-
...
134+
rosaClusterName: rosa-hcp-1
135+
domainPrefix: rosa-hcp
136+
rosaRoleConfigRef:
137+
name: role-config
138+
version: "4.19.0"
139+
region: "us-west-2"
140+
rosaNetworkRef:
141+
name: "rosa-vpc"
142+
network:
143+
machineCIDR: "10.0.0.0/16"
144+
podCIDR: "10.128.0.0/14"
145+
serviceCIDR: "172.30.0.0/16"
146+
defaultMachinePoolSpec:
147+
instanceType: "m5.xlarge"
148+
autoscaling:
149+
maxReplicas: 6
150+
minReplicas: 3
151+
additionalTags:
152+
env: "demo"
153+
```
154+
155+
Apply the manifest:
156+
157+
```shell
158+
kubectl apply -f rosa-cluster.yaml
143159
```
144160

145-
1. Provide an AWS identity reference
161+
1. Provide an AWS identity reference by adding an `identityRef` to the `ROSAControlPlane` spec:
162+
146163
```yaml
147164
apiVersion: controlplane.cluster.x-k8s.io/v1beta2
148165
kind: ROSAControlPlane
149166
metadata:
150-
name: "capi-rosa-quickstart-control-plane"
167+
name: "rosa-hcp-1-control-plane"
151168
spec:
152169
identityRef:
153170
kind: <IdentityType>
154171
name: <IdentityName>
155172
...
156173
```
157174

158-
Otherwise, make sure the following `AWSClusterControllerIdentity` singleton exists in your management cluster:
175+
Otherwise, make sure the following `AWSClusterControllerIdentity` singleton exists in your management cluster. Save it to a file and apply it:
176+
159177
```yaml
160178
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
161179
kind: AWSClusterControllerIdentity
@@ -165,11 +183,34 @@ Note; Skip the "Create the required IAM roles and OpenID Connect configuration"
165183
allowedNamespaces: {} # matches all namespaces
166184
```
167185

186+
```shell
187+
kubectl apply -f <filename>.yaml
188+
```
189+
168190
see [Multi-tenancy](../multitenancy.md) for more details
169191

170-
1. Finally apply the manifest to create your ROSA cluster:
192+
1. Check the `ROSAControlPlane` status:
193+
171194
```shell
172-
kubectl apply -f rosa-capi-cluster.yaml
195+
kubectl get ROSAControlPlane rosa-hcp-1-control-plane
196+
197+
NAME CLUSTER READY
198+
rosa-hcp-1-control-plane rosa-hcp-1 true
173199
```
174200

201+
The ROSA HCP cluster can take around 40 minutes to be fully provisioned.
202+
203+
1. After provisioning has completed, verify the `ROSAMachinePool` resources were successfully created:
204+
205+
```shell
206+
kubectl get ROSAMachinePool
207+
208+
NAME READY REPLICAS
209+
workers-0 true 1
210+
workers-1 true 1
211+
workers-2 true 1
212+
```
213+
214+
**Note:** The number of default `ROSAMachinePool` resources corresponds to the number of availability zones configured.
215+
175216
see [ROSAControlPlane CRD Reference](https://cluster-api-aws.sigs.k8s.io/crd/#controlplane.cluster.x-k8s.io/v1beta2.ROSAControlPlane) for all possible configurations.

0 commit comments

Comments
 (0)