Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 1 addition & 10 deletions _topic_maps/_topic_map_rosa.yml
Original file line number Diff line number Diff line change
Expand Up @@ -233,21 +233,12 @@ Topics:
- Name: Prerequisites checklist for deploying ROSA using STS
File: rosa-cloud-expert-prereq-checklist
- Name: Detailed requirements for deploying ROSA using STS
File: rosa-classic-aws-prereqs
- Name: Detailed requirements for deploying ROSA with HCP
File: rosa-hcp-aws-prereqs
# Hiding this entry until the HCP migration is completed
# - Name: Detailed requirements for deploying ROSA using STS
# File: rosa-sts-aws-prereqs
File: rosa-sts-aws-prereqs
- Name: ROSA Classic IAM role resources
File: rosa-sts-ocm-role
- Name: ROSA with HCP IAM roles and resources
File: rosa-hcp-prepare-iam-roles-resources
##### NOTE: THE BELOW IS REMOVED AS PART OF OSDOCS-13310
# - Name: Limits and scalability
# File: rosa-limits-scalability
#- Name: ROSA with HCP limits and scalability
# File: rosa-hcp-limits-scalability
##### NOTE: THE ABOVE IS REMOVED AS PART OF OSDOCS-13310F
- Name: Planning your environment
File: rosa-planning-environment
Expand Down
9 changes: 1 addition & 8 deletions _topic_maps/_topic_map_rosa_hcp.yml
Original file line number Diff line number Diff line change
Expand Up @@ -164,15 +164,10 @@ Topics:
- Name: Prerequisites checklist for deploying ROSA with HCP
File: rosa-cloud-expert-prereq-checklist
- Name: Detailed requirements for deploying ROSA with HCP
File: rosa-hcp-aws-prereqs
# Hiding this entry until the HCP migration is completed
# - Name: Detailed requirements for deploying ROSA with HCP
# File: rosa-sts-aws-prereqs
File: rosa-sts-aws-prereqs
- Name: Required IAM roles and resources
File: rosa-hcp-prepare-iam-roles-resources
##### NOTE: THE BELOW IS REMOVED AS PART OF OSDOCS-13310
# - Name: Limits and scalability
# File: rosa-limits-scalability
#- Name: ROSA with HCP limits and scalability
# File: rosa-hcp-limits-scalability
##### NOTE: THE ABOVE IS REMOVED AS PART OF OSDOCS-13310
Expand All @@ -182,8 +177,6 @@ Topics:
File: rosa-sts-setting-up-environment
- Name: Planning resource usage in your cluster
File: rosa-planning-environment
# - Name: Preparing Terraform to install ROSA clusters
# File: rosa-understanding-terraform
---
Name: Install ROSA with HCP clusters
Dir: rosa_hcp
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -142,7 +142,7 @@ The default settings are as follows:
** 2 infrastructure nodes
** 2 worker nodes
** No autoscaling
** See the documentation on xref:../../../rosa_planning/rosa-classic-aws-prereqs.adoc#rosa-ec2-instances_rosa-classic-aws-prereqs[ec2 instances] for more details.
** See the documentation on xref:../../../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-ec2-instances_rosa-sts-aws-prereqs[ec2 instances] for more details.
// This link needs to remain hidden until the HCP migration is published
// ** See the documentation on xref:../../../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-ec2-instances_rosa-sts-aws-prereqs[ec2 instances] for more details.
* Region: As configured for the `aws` CLI
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,7 @@ echo "export PRIVATE_SUBNET_ID=$PRIVATE_SUBNET_ID"
+
[role="_additional-resources"]
.Additional resources
* For more about VPC requirements, see the xref:../../../rosa_planning/rosa-classic-aws-prereqs.adoc#rosa-vpc_rosa-classic-aws-prereqs[VPC documentation].
* For more about VPC requirements, see the xref:../../../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-vpc_rosa-sts-aws-prereqs[VPC documentation].
// This link needs to remain hidden until the HCP migration is published
// * For more about VPC requirements, see the xref:../../../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-vpc_rosa-sts-aws-prereqs[VPC documentation].

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -134,7 +134,7 @@ etcd encryption is configured the same as in OpenShift Container Platform. The a
Currently, the ROSA CLI does not accept multi-region KMS keys for EBS encryption. This feature is in our backlog for product updates. The ROSA CLI accepts single region KMS keys for EBS encryption if it is defined at cluster creation.

== Infrastructure
ROSA uses several different cloud services such as virtual machines, storage, and load balancers. You can see a defined list in the xref:../../rosa_planning/rosa-classic-aws-prereqs.adoc#rosa-aws-policy-provisioned_rosa-classic-aws-prereqs[AWS prerequisites].
ROSA uses several different cloud services such as virtual machines, storage, and load balancers. You can see a defined list in the xref:../../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-aws-policy-provisioned_rosa-sts-aws-prereqs[AWS prerequisites].
// This section needs to remain hidden until the HCP migration is published
// ROSA uses several different cloud services such as virtual machines, storage, and load balancers. You can see a defined list in the xref:../../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-aws-policy-provisioned_rosa-sts-aws-prereqs[AWS prerequisites].

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ STS roles and policies must be created for each ROSA cluster. To make this easie

[id="components-specific-to-rosa-with-sts"]
== Components specific to ROSA with STS
* *AWS infrastructure* - This provides the infrastructure required for the cluster. It contains the actual EC2 instances, storage, and networking components. See xref:../../rosa_architecture/rosa_policy_service_definition/rosa-service-definition.adoc#rosa-sdpolicy-aws-compute-types_rosa-service-definition[AWS compute types] to see supported instance types for compute nodes and xref:../../rosa_planning/rosa-classic-aws-prereqs.adoc#rosa-ec2-instances_rosa-classic-aws-prereqs[provisioned AWS infrastructure] for control plane and infrastructure node configuration.
* *AWS infrastructure* - This provides the infrastructure required for the cluster. It contains the actual EC2 instances, storage, and networking components. See xref:../../rosa_architecture/rosa_policy_service_definition/rosa-service-definition.adoc#rosa-sdpolicy-aws-compute-types_rosa-service-definition[AWS compute types] to see supported instance types for compute nodes and xref:../../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-ec2-instances_rosa-sts-aws-prereqs[provisioned AWS infrastructure] for control plane and infrastructure node configuration.
// This section needs to remain hidden until the HCP migration is done
// * *AWS infrastructure* - This provides the infrastructure required for the cluster. It contains the actual EC2 instances, storage, and networking components. See xref:../../rosa_architecture/rosa_policy_service_definition/rosa-service-definition.adoc#rosa-sdpolicy-aws-compute-types_rosa-service-definition[AWS compute types] to see supported instance types for compute nodes and xref:../../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-ec2-instances_rosa-sts-aws-prereqs[provisioned AWS infrastructure] for control plane and infrastructure node configuration.
* *AWS STS* - See the credential method section above.
Expand Down
9 changes: 1 addition & 8 deletions modules/mos-network-prereqs-min-bandwidth.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -7,13 +7,6 @@
[id="mos-network-prereqs-min-bandwidth_{context}"]
= Minimum bandwidth

During cluster deployment,
ifdef::openshift-rosa[]
{rosa-classic-short}
endif::openshift-rosa[]
ifdef::openshift-rosa-hcp[]
{rosa-short}
endif::openshift-rosa-hcp[]
requires a minimum bandwidth of 120{nbsp}Mbps between cluster infrastructure and the public internet or private network locations that provide deployment artifacts and resources. When network connectivity is slower than 120{nbsp}Mbps (for example, when connecting through a proxy) the cluster installation process times out and deployment fails.
During cluster deployment, {product-title} requires a minimum bandwidth of 120{nbsp}Mbps between cluster infrastructure and the public internet or private network locations that provide deployment artifacts and resources. When network connectivity is slower than 120{nbsp}Mbps (for example, when connecting through a proxy) the cluster installation process times out and deployment fails.

After cluster deployment, network requirements are determined by your workload. However, a minimum bandwidth of 120{nbsp}Mbps helps to ensure timely cluster and operator upgrades.
4 changes: 2 additions & 2 deletions modules/osd-aws-privatelink-firewall-prerequisites.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
:_mod-docs-content-type: PROCEDURE
ifdef::openshift-rosa[]
[id="rosa-classic-firewall-prerequisites_{context}"]
= Firewall prerequisites for {rosa-classic-short} clusters using STS
= Firewall prerequisites for {product-title} clusters using STS
endif::openshift-rosa[]
ifdef::openshift-dedicated[]
[id="osd-aws-privatelink-firewall-prerequisites_{context}"]
Expand Down Expand Up @@ -108,7 +108,7 @@ endif::[]

|`oidc.op1.openshiftapps.com`
|443
|Used by ROSA for STS implementation with managed OIDC configuration.
|Used by {product-title} for STS implementation with managed OIDC configuration.
|===
+
. Allowlist the following telemetry URLs:
Expand Down
26 changes: 3 additions & 23 deletions modules/rosa-aws-provisioned.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,7 @@
[id="rosa-aws-policy-provisioned_{context}"]
= Provisioned AWS Infrastructure

This is an overview of the provisioned {AWS} components on a deployed
ifdef::openshift-rosa[]
{rosa-classic-short}
endif::openshift-rosa[]
ifdef::openshift-rosa-hcp[]
{rosa-short}
endif::openshift-rosa-hcp[]
cluster.
This is an overview of the provisioned {AWS} components on a deployed {product-title} cluster.

[id="rosa-ec2-instances_{context}"]
== EC2 instances
Expand All @@ -22,13 +15,7 @@ AWS EC2 instances are required to deploy
ifndef::openshift-rosa-hcp[]
the control plane and data plane functions for
endif::openshift-rosa-hcp[]
ifdef::openshift-rosa[]
{rosa-classic-short}.
endif::openshift-rosa[]
ifdef::openshift-rosa-hcp[]
{rosa-short}.
endif::openshift-rosa-hcp[]

{product-title}.
ifndef::openshift-rosa-hcp[]
Instance types can vary for control plane and infrastructure nodes, depending on the worker node count.

Expand Down Expand Up @@ -213,11 +200,4 @@ can add additional custom security groups during cluster creation. Custom securi

* You must create the custom security groups in AWS before you create the cluster. For more information, see link:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html[Amazon EC2 security groups for Linux instances].
* You must associate the custom security groups with the VPC that the cluster will be installed into. Your custom security groups cannot be associated with another VPC.
* You might need to request additional quota for your VPC if you are adding additional custom security groups. For information on AWS quota requirements for
ifdef::openshift-rosa[]
{rosa-classic-short},
endif::openshift-rosa[]
ifdef::openshift-rosa-hcp[]
{rosa-short},
endif::openshift-rosa-hcp[]
see _Required AWS service quotas_ in _Prepare your environment_. For information on requesting an AWS quota increase, see link:https://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.html[Requesting a quota increase].
* You might need to request additional quota for your VPC if you are adding additional custom security groups. For information on AWS quota requirements for {product-title} see _Required AWS service quotas_ in _Prepare your environment_. For information on requesting an AWS quota increase, see link:https://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.html[Requesting a quota increase].
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ $ aws sts get-caller-identity --output text
+
. Install and configure the latest ROSA CLI (`rosa`).
.. Navigate to link:https://console.redhat.com/openshift/downloads[*Downloads*].
.. Find *Red Hat OpenShift Service on AWS command line interface (`rosa)* in the list of tools and click *Download*.
.. Find *Red Hat OpenShift Service on AWS command line interface (`rosa`)* in the list of tools and click *Download*.
+
The `rosa-linux.tar.gz` file is downloaded to your default download location.
.. Extract the `rosa` binary file from the downloaded archive. The following example extracts the binary from a Linux tar archive:
Expand Down
4 changes: 2 additions & 2 deletions modules/rosa-hcp-firewall-prerequisites.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,9 @@
//TODO OSDOCS-11789: Why is this a procedure and not a reference?

[id="rosa-hcp-firewall-prerequisites_{context}"]
= Firewall prerequisites for {rosa-short}
= Firewall prerequisites for {product-title}

* If you are using a firewall to control egress traffic from {rosa-short}, your Virtual Private Cloud (VPC) must be able to complete requests from the cluster to the Amazon S3 service, for example, via an Amazon S3 gateway.
* If you are using a firewall to control egress traffic from {product-title}, your Virtual Private Cloud (VPC) must be able to complete requests from the cluster to the Amazon S3 service, for example, via an Amazon S3 gateway.

* You must also configure your firewall to grant access to the following domain and port combinations.
//TODO OSDOCS-11789: From your deploy machine? From your cluster?
Expand Down
12 changes: 6 additions & 6 deletions modules/rosa-operator-config.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,11 @@
[id="rosa-operator-config_{context}"]
= Creating Operator roles and policies

When you deploy a {rosa-short} cluster, you must create the Operator IAM roles. The cluster Operators use the Operator roles and policies to obtain the temporary permissions required to carry out cluster operations, such as managing back-end storage and external access to a cluster.
When you deploy a {product-title} cluster, you must create the Operator IAM roles. The cluster Operators use the Operator roles and policies to obtain the temporary permissions required to carry out cluster operations, such as managing back-end storage and external access to a cluster.

.Prerequisites

* You have completed the AWS prerequisites for {rosa-short}.
* You have completed the AWS prerequisites for {product-title}.
* You have installed and configured the latest ROSA CLI (`rosa`), on your installation host.
* You created the account-wide AWS roles.

Expand All @@ -41,11 +41,11 @@ $ rosa create operator-roles --hosted-cp
+
--
<1> You must supply a prefix when creating these Operator roles. Failing to do so produces an error. See the Additional resources of this section for information on the Operator prefix.
<2> This value is the OIDC configuration ID that you created for your {rosa-short} cluster.
<2> This value is the OIDC configuration ID that you created for your {product-title} cluster.
<3> This value is the installer role ARN that you created when you created the ROSA account roles.
--
+
You must include the `--hosted-cp` parameter to create the correct roles for {rosa-short} clusters. This command returns the following information.
You must include the `--hosted-cp` parameter to create the correct roles for {product-title} clusters. This command returns the following information.
+
.Example output
+
Expand Down Expand Up @@ -77,11 +77,11 @@ I: To create a cluster with these roles, run the following command:
<2> This field requires you to select an OIDC configuration that you created for your {rosa-short} cluster.
--
+
The Operator roles are now created and ready to use for creating your {rosa-short} cluster.
The Operator roles are now created and ready to use for creating your {product-title} cluster.

.Verification

* You can list the Operator roles associated with your ROSA account. Run the following command:
* You can list the Operator roles associated with your {product-title} account. Run the following command:
+
[source,terminal]
----
Expand Down
11 changes: 2 additions & 9 deletions modules/rosa-planning-environment-application-reqs.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,7 @@
[id="planning-environment-application-requirements_{context}"]
= Planning your environment based on application requirements

This document describes how to plan your
ifdef::openshift-rosa[]
{rosa-classic-short}
endif::openshift-rosa[]
ifdef::openshift-rosa-hcp[]
{rosa-short}
endif::openshift-rosa-hcp[]
environment based on your application requirements.
This document describes how to plan your {product-title} environment based on your application requirements.

Consider an example application environment:

Expand Down Expand Up @@ -72,7 +65,7 @@ Some applications lend themselves well to overcommitted environments, and some d

The application pods can access a service either by using environment variables or DNS. If using environment variables, for each active service the variables are injected by the kubelet when a pod is run on a node. A cluster-aware DNS server watches the Kubernetes API for new services and creates a set of DNS records for each one. If DNS is enabled throughout your cluster, then all pods should automatically be able to resolve services by their DNS name. Service discovery using DNS can be used in case you must go beyond 5000 services. When using environment variables for service discovery, if the argument list exceeds the allowed length after 5000 services in a namespace, then the pods and deployments will start failing.

Disable the service links in the deployments service specification file to overcome this:
Disable the service links in the deployment's service specification file to overcome this:

.Example
[source,yaml]
Expand Down
26 changes: 6 additions & 20 deletions modules/rosa-prereq-roles-overview.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -6,33 +6,19 @@
[id="rosa-prereq-roles-overview_{context}"]
= Overview of required roles

To create and manage your
ifdef::openshift-rosa[]
{rosa-classic-short}
endif::openshift-rosa[]
ifdef::openshift-rosa-hcp[]
{rosa-short}
endif::openshift-rosa-hcp[]
cluster, you must create several account-wide and cluster-wide roles. If you intend to use {cluster-manager} to create or manage your cluster, you need some additional roles.
To create and manage your {product-title} cluster, you must create several account-wide and cluster-wide roles. If you intend to use {cluster-manager} to create or manage your cluster, you need some additional roles.

To create and manage clusters:: Several account-wide roles are required to create and manage
ifdef::openshift-rosa[]
{rosa-classic-short}
endif::openshift-rosa[]
ifdef::openshift-rosa-hcp[]
{rosa-short}
endif::openshift-rosa-hcp[]
clusters. These roles only need to be created once per AWS account, and do not need to be created fresh for each cluster. One or more AWS managed policies are attached to each role to grant that role the required capabilities. You can specify your own prefix, or use the default prefix (`ManagedOpenShift`).
To create and manage clusters:: Several account-wide roles are required to create and manage {product-title} clusters. These roles only need to be created once per AWS account, and do not need to be created fresh for each cluster. One or more AWS managed policies are attached to each role to grant that role the required capabilities. You can specify your own prefix, or use the default prefix (`ManagedOpenShift`).
+
[NOTE]
====
Role names are limited to a maximum length of 64 characters in AWS IAM. When the user-specified prefix for a cluster is longer than 20 characters, the role name is truncated to observe this 64-character maximum in AWS IAM.
====
ifdef::openshift-rosa-hcp[]
+
For {hcp-title} clusters, you must create the following account-wide roles and attach the indicated AWS managed policies:
For {product-title} clusters, you must create the following account-wide roles and attach the indicated AWS managed policies:
+
.Required account roles and AWS policies for {hcp-title}
.Required account roles and AWS policies for {product-title}
[options="header"]
|===
| Role name | AWS policy names
Expand Down Expand Up @@ -68,7 +54,7 @@ Role creation does not request your AWS access or secret keys. AWS Security Toke
To use Operator-managed cluster capabilities:: Some cluster capabilities, including several capabilities provided by default, are managed using Operators. Cluster-specific Operator roles (`operator-roles` in the ROSA CLI) are required to use these capabilities. These roles are used to obtain the temporary permissions required to carry out cluster operations such as managing back-end storage, ingress, and registry. Obtaining these permissions requires the configuration of an OpenID Connect (OIDC) provider, which connects to AWS Security Token Service (STS) to authenticate Operator access to AWS resources.
ifndef::openshift-rosa-hcp[]
+
The following Operator roles are required for {rosa-classic-short} clusters:
The following Operator roles are required for {product-title} clusters:

** `openshift-cluster-csi-drivers-ebs-cloud-credentials`
** `openshift-cloud-network-config-controller-cloud-credentials`
Expand All @@ -81,7 +67,7 @@ The following Operator roles are required for {rosa-classic-short} clusters:
endif::openshift-rosa-hcp[]
ifdef::openshift-rosa-hcp[]
+
For {rosa-short} clusters, you must create the following Operator roles and attach the indicated AWS Managed policies:
For {product-title} clusters, you must create the following Operator roles and attach the indicated AWS Managed policies:
+
.Required Operator roles and AWS Managed policies for {hcp-title}
[options="header"]
Expand Down
Loading