Procedure

1. Sign in to the AWS Management Console.
2. Enable ROSA in your AWS account by navigating to the ROSA service and selecting Enable OpenShift.

Procedure

1. Install and configure the latest AWS CLI (aws).

   1. Follow the AWS Command Line Interface documentation to install and configure the AWS CLI for your operating system.

      Specify your aws_access_key_id, aws_secret_access_key, and region in the .aws/credentials file. See AWS Configuration basics in the AWS documentation.

      Note

      You can alternatively use the AWS_DEFAULT_REGION environment variable to set the default AWS region.

   2. Query the AWS API to verify if the AWS CLI is installed and configured correctly:

      $ aws sts get-caller-identity

      Example output

      <aws_account_id>    arn:aws:iam::<aws_account_id>:user/<username>  <aws_user_id>

2. Install and configure the latest ROSA CLI (rosa).

   1. Download the latest version of the rosa CLI for your operating system from the Downloads page on the OpenShift Cluster Manager.

   2. Extract the rosa binary file from the downloaded archive. The following example extracts the binary from a Linux tar archive:

      $ tar xvf rosa-linux.tar.gz

   3. Add rosa to your path. In the following example, the /usr/local/bin directory is included in the path of the user:

      $ sudo mv rosa /usr/local/bin/rosa

   4. Verify if the rosa CLI tool is installed correctly by querying the rosa version:

      $ rosa version

      Example output

      1.1.7

   5. Optional: Generate the command completion scripts for the rosa CLI. The following example generates the Bash completion scripts for a Linux machine:

      $ rosa completion bash | sudo tee /etc/bash_completion.d/rosa

   6. Optional: Enable rosa command completion from your existing terminal. The following example enables Bash completion for rosa in an existing terminal on a Linux machine:

      $ source /etc/bash_completion.d/rosa

   7. Log in to your Red Hat account by using the rosa CLI:

      $ rosa login

      Example output

      To login to your Red Hat account, get an offline access token at https://console.redhat.com/openshift/token/rosa
      ? Copy the token and paste it here:

      Go to the URL listed in the command output to obtain an offline access token. Specify the token at the CLI prompt to log in.

      Note

      You can subsequently specify the offline access token by using the --token="<offline_access_token>" argument when you run the rosa login command.

   8. Verify if you are logged in successfully and check your credentials:

      $ rosa whoami

      Example output

      AWS Account ID:               <aws_account_number>
      AWS Default Region:           us-east-1
      AWS ARN:                      arn:aws:iam::<aws_account_number>:user/<aws_user_name>
      OCM API:                      https://api.openshift.com
      OCM Account ID:               <red_hat_account_id>
      OCM Account Name:             Your Name
      OCM Account Username:         you@domain.com
      OCM Account Email:            you@domain.com
      OCM Organization ID:          <org_id>
      OCM Organization Name:        Your organisation
      OCM Organization External ID: <external_org_id>

      Check that the information in the output is correct before proceeding.

3. Install and configure the latest OpenShift CLI (oc).

   1. Use the rosa CLI to download the latest version of the oc CLI:

      $ rosa download openshift-client

   2. Extract the oc binary file from the downloaded archive. The following example extracts the files from a Linux tar archive:

      $ tar xvf openshift-client-linux.tar.gz

   3. Add the oc binary to your path. In the following example, the /usr/local/bin directory is included in the path of the user:

      $ sudo mv oc /usr/local/bin/oc

   4. Verify if the oc CLI is installed correctly:

      $ rosa verify openshift-client

      Example output

      I: Verifying whether OpenShift command-line tool is available...
      I: Current OpenShift Client Version: 4.9.12

Procedure

1. Check if the AWSServiceRoleForElasticLoadBalancing role exists for your AWS account:

   $ aws iam get-role --role-name "AWSServiceRoleForElasticLoadBalancing"

   Example output

   The following example output confirms that the role exists:

   ROLE    arn:aws:iam::<aws_account_number>:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing  2018-09-27T19:49:23+00:00       Allows ELB to call AWS services on your behalf. 3600      /aws-service-role/elasticloadbalancing.amazonaws.com/   <role_id>   AWSServiceRoleForElasticLoadBalancing
   ASSUMEROLEPOLICYDOCUMENT        2012-10-17
   STATEMENT       sts:AssumeRole  Allow
   PRINCIPAL       elasticloadbalancing.amazonaws.com
   ROLELASTUSED    2022-01-06T09:27:57+00:00       us-east-1

2. If the AWS ELB service role does not exist, create it:

   $ aws iam create-service-linked-role --aws-service-name "elasticloadbalancing.amazonaws.com"

Procedure

1. Verify if the required resource quotas are available in your default region:

   $ rosa verify quota

   Example output

   I: Validating AWS quota...
   I: AWS quota ok. If cluster installation fails, validate actual AWS resource usage against https://docs.openshift.com/rosa/rosa_getting_started/rosa-required-aws-service-quotas.html

Procedure

1. Go to github.com and log in to your GitHub account.
2. If you do not have an existing GitHub organization to use for identity provisioning for your ROSA cluster, create one. Follow the steps in the GitHub documentation.

3. Configure a GitHub identity provider for your cluster that is restricted to the members of your GitHub organization.

   1. Configure an identity provider using the interactive mode:

      $ rosa create idp --cluster=<cluster_name> --interactive 1

      1

      Replace <cluster_name> with the name of your cluster.

      Example output

      I: Interactive mode enabled.
      Any optional fields can be left empty and a default will be selected.
      ? Type of identity provider: github
      ? Identity provider name: github-1
      ? Restrict to members of: organizations
      ? GitHub organizations: <github_org_name> 1
      ? To use GitHub as an identity provider, you must first register the application:
        - Open the following URL:
          https://github.com/organizations/<github_org_name>/settings/applications/new?oauth_application%5Bcallback_url%5D=https%3A%2F%2Foauth-openshift.apps.<cluster_name>/<random_string>.p1.openshiftapps.com%2Foauth2callback%2Fgithub-1&oauth_application%5Bname%5D=<cluster_name>&oauth_application%5Burl%5D=https%3A%2F%2Fconsole-openshift-console.apps.<cluster_name>/<random_string>.p1.openshiftapps.com
        - Click on 'Register application'
      ...

      1

      Replace <github_org_name> with the name of your GitHub organization.

   2. Follow the URL in the output and select Register application to register a new OAuth application in your GitHub organization. By registering the application, you enable the OAuth server that is built into ROSA to authenticate members of your GitHub organization into your cluster.

      Note

      The fields in the Register a new OAuth application GitHub form are automatically filled with the required values through the URL defined by the rosa CLI tool.

   3. Use the information from your GitHub OAuth application page to populate the remaining rosa create idp interactive prompts.

      Continued example output

      ...
      ? Client ID: <github_client_id> 1
      ? Client Secret: [? for help] <github_client_secret> 2
      ? GitHub Enterprise Hostname (optional):
      ? Mapping method: claim 3
      I: Configuring IDP for cluster '<cluster_name>'
      I: Identity Provider 'github-1' has been created.
         It will take up to 1 minute for this configuration to be enabled.
         To add cluster administrators, see 'rosa grant user --help'.
         To login into the console, open https://console-openshift-console.apps.<cluster_name>.<random_string>.p1.openshiftapps.com and click on github-1.

      1

      Replace <github_client_id> with the client ID for your GitHub OAuth application.

      2

      Replace <github_client_secret> with a client secret for your GitHub OAuth application.

      3

      Specify claim as the mapping method.

      Note

      It might take approximately two minutes for the identity provider configuration to become active. If you have configured a cluster-admin user, you can watch the OAuth pods redeploy with the updated configuration by running oc get pods -n openshift-authentication --watch.

   4. Enter the following command to verify that the identity provider has been configured correctly:

      $ rosa list idps --cluster=<cluster_name>

      Example output

      NAME        TYPE      AUTH URL
      github-1    GitHub    https://oauth-openshift.apps.<cluster_name>.<random_string>.p1.openshiftapps.com/oauth2callback/github-1

Procedure

1. Navigate to github.com and log in to your GitHub account.
2. Invite users that require access to the ROSA cluster to your GitHub organization. Follow the steps in Inviting users to join your organization in the GitHub documentation.

Procedure

1. Navigate to github.com and log in to your GitHub account.
2. Remove the user from your GitHub organization. Follow the steps in Removing a member from your organization in the GitHub documentation.