Procedure

1. Navigate to OpenShift Cluster Manager and select Create cluster.
2. On the Create an OpenShift cluster page, select Create cluster in the Red Hat OpenShift Service on AWS (ROSA) row.
3. Review and complete the Prerequisites listed on the Accounts and roles page. Select the checkbox to acknowledge that you have read and completed all of the prerequisites.

4. Select an AWS account from the Associated AWS account drop-down menu. If no associated AWS accounts are found, click Associate AWS account and follow these steps:

   1. On the Authenticate page, click the copy button next to the rosa login command. The provided command includes your ROSA API login token.

      Note

      You can also load your API token on the OpenShift Cluster Manager API Token page on OpenShift Cluster Manager.

   2. Run the copied command in the CLI to log in to your ROSA account:

      $ rosa login --token=<api_login_token> 1

      1

      Replace <api_login_token> with the token that is provided in the copied command.

      Example output

      I: Logged in as '<username>' on 'https://api.openshift.com'

   3. On the Authenticate page in OpenShift Cluster Manager, click Next.
   4. On the OCM role page, click the copy button next to the Admin OCM role command. The admin role enables automatic deployment of the cluster-specific Operator roles and the OpenID Connect (OIDC) provider by using OpenShift Cluster Manager.

   5. Run the copied command in the CLI and follow the prompts to create the OpenShift Cluster Manager IAM role.

      The following example creates an admin OpenShift Cluster Manager IAM role using the default options and auto mode for immediate STS resource creation. The example also links the OpenShift Cluster Manager IAM role to a Red Hat organization:

      $ rosa create ocm-role --admin

      Example output

      I: Creating ocm role
      ? Role prefix: ManagedOpenShift 1
      ? Permissions boundary ARN (optional):  2
      ? Role creation mode: auto 3
      I: Creating role using 'arn:aws:iam::<aws_account_id>:user/<aws_username>'
      ? Create the 'ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>' role? Yes
      I: Created role 'ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>' with ARN 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>'
      I: Linking OCM role
      ? OCM Role ARN: arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>
      ? Link the 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>' role with organization '<red_hat_organization_id>'? Yes 4
      I: Successfully linked role-arn 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>' with organization account '<red_hat_organization_id>'

      1

      Specifies the prefix to include in the OpenShift Cluster Manager IAM role name. The default is ManagedOpenShift.

      2

      Optional: Specifies a permissions boundary Amazon Resource Name (ARN) for the role. For more information, see Permissions boundaries for IAM entities in the AWS documentation.

      3

      Selects the role creation mode. You can use auto mode to automatically create the OpenShift Cluster Manager IAM role and link it to your Red Hat organization account.

      4

      Links the OpenShift Cluster Manager IAM role to your Red Hat organization account.

   6. Select Next on the OpenShift Cluster Manager OCM role page.

   7. On the User role page, click the copy button for the User role command and run the command in the CLI. Follow the prompts to create the user role:

      $ rosa create user-role

      Example output

      I: Creating User role
      ? Role prefix: ManagedOpenShift 1
      ? Permissions boundary ARN (optional): 2
      ? Role creation mode: auto 3
      I: Creating ocm user role using 'arn:aws:iam::<aws_account_id>:user/<aws_username>'
      ? Create the 'ManagedOpenShift-User-<ocm_username>-Role' role? Yes
      I: Created role 'ManagedOpenShift-User-<ocm_username>-Role' with ARN 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_username>-Role'
      I: Linking User role
      ? User Role ARN: arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_username>-Role
      ? Link the 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_username>-Role' role with account '<ocm_user_account_id>'? Yes 4
      I: Successfully linked role ARN 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_username>-Role' with account '<ocm_user_account_id>'

      1

      Specifies the prefix to include in the user role name. The default is ManagedOpenShift.

      2

      Optional: Specifies a permissions boundary Amazon Resource Name (ARN) for the role. For more information, see Permissions boundaries for IAM entities in the AWS documentation.

      3

      Selects the role creation mode. You can use auto mode to automatically create the user role and link it to your OpenShift Cluster Manager user account.

      4

      Links the user role to your OpenShift Cluster Manager user account.

   8. On the OpenShift Cluster Manager User role page, select Ok.
   9. Under the Accounts and roles page, verify that your AWS account is listed as an Associated AWS account.

5. If the required AWS IAM Account roles are not automatically detected and listed on the Accounts and roles page, create the roles and policies:

   1. Click the copy buffer next to the rosa create account-roles command. Run the command in the CLI to create the required AWS account-wide roles and policies, including the Operator policies::

      $ rosa create account-roles

      Example output

      I: Logged in as '<ocm_username>' on 'https://api.openshift.com'
      I: Validating AWS credentials...
      I: AWS credentials are valid!
      I: Validating AWS quota...
      I: AWS quota ok. If cluster installation fails, validate actual AWS resource usage against https://docs.openshift.com/rosa/rosa_getting_started/rosa-required-aws-service-quotas.html
      I: Verifying whether OpenShift command-line tool is available...
      I: Current OpenShift Client Version: 4.9.12
      I: Creating account roles
      ? Role prefix: ManagedOpenShift 1
      ? Permissions boundary ARN (optional): 2
      ? Role creation mode: auto 3
      I: Creating roles using 'arn:aws:iam::<aws_account_number>:user/<aws_username>'
      ? Create the 'ManagedOpenShift-Installer-Role' role? Yes 4
      I: Created role 'ManagedOpenShift-Installer-Role' with ARN 'arn:aws:iam::<aws_account_number>:role/ManagedOpenShift-Installer-Role'
      ? Create the 'ManagedOpenShift-ControlPlane-Role' role? Yes 5
      I: Created role 'ManagedOpenShift-ControlPlane-Role' with ARN 'arn:aws:iam::<aws_account_number>:role/ManagedOpenShift-ControlPlane-Role'
      ? Create the 'ManagedOpenShift-Worker-Role' role? Yes 6
      I: Created role 'ManagedOpenShift-Worker-Role' with ARN 'arn:aws:iam::<aws_account_number>:role/ManagedOpenShift-Worker-Role'
      ? Create the 'ManagedOpenShift-Support-Role' role? Yes 7
      I: Created role 'ManagedOpenShift-Support-Role' with ARN 'arn:aws:iam::<aws_account_number>:role/ManagedOpenShift-Support-Role'
      ? Create the operator policies? Yes 8
      I: Created policy with ARN 'arn:aws:iam::<aws_account_number>:policy/ManagedOpenShift-openshift-cloud-credential-operator-cloud-crede'
      I: Created policy with ARN 'arn:aws:iam::<aws_account_number>:policy/ManagedOpenShift-openshift-image-registry-installer-cloud-creden'
      I: Created policy with ARN 'arn:aws:iam::<aws_account_number>:policy/ManagedOpenShift-openshift-ingress-operator-cloud-credentials'
      I: Created policy with ARN 'arn:aws:iam::<aws_account_number>:policy/ManagedOpenShift-openshift-cluster-csi-drivers-ebs-cloud-credent'
      I: Created policy with ARN 'arn:aws:iam::<aws_account_number>:policy/ManagedOpenShift-openshift-cloud-network-config-controller-cloud'
      I: Created policy with ARN 'arn:aws:iam::<aws_account_number>:policy/ManagedOpenShift-openshift-machine-api-aws-cloud-credentials'
      I: To create a cluster with these roles, run the following command:
      rosa create cluster --sts

      1

      Specifies the prefix to include in the account-wide role and policy names. The default is ManagedOpenShift.

      2

      Optional: Specifies a permissions boundary Amazon Resource Name (ARN) for the roles. For more information, see Permissions boundaries for IAM entities in the AWS documentation.

      3

      Selects the role creation mode. You can use auto mode to automatically create the account wide roles and policies.

      4 5 6 7

      Creates the account-wide installer, control plane, worker and support roles and corresponding inline IAM policies. For more information, see Account-wide IAM role and policy reference.

      8

      Creates the cluster-specific Operator IAM roles that permit the ROSA cluster Operators to carry out core OpenShift functionality. For more information, see Account-wide IAM role and policy reference.

   2. On the Accounts and roles page, click Refresh ARNs and verify that the installer, support, worker, and control plane account roles are detected.
6. Select Next.

7. On the Cluster details page, provide a name for your cluster and specify the cluster details:

   1. Add a Cluster name.
   2. Select a cluster version from the Version drop-down menu.
   3. Select a cloud provider region from the Region drop-down menu.
   4. Select a Single zone or Multi-zone configuration.
   5. Leave Enable user workload monitoring selected to monitor your own projects in isolation from Red Hat Site Reliability Engineer (SRE) platform metrics. This option is enabled by default.

   6. Optional: Select Enable additional etcd encryption if you require etcd key value encryption. With this option, the etcd key values are encrypted, but not the keys. This option is in addition to the control plane storage encryption that encrypts the etcd volumes in Red Hat OpenShift Service on AWS clusters by default.

      Note

      By enabling etcd encryption for the key values in etcd, you will incur a performance overhead of approximately 20%. The overhead is a result of introducing this second layer of encryption, in addition to the default control plane storage encryption that encrypts the etcd volumes. Consider enabling etcd encryption only if you specifically require it for your use case.

   7. Optional: Select Encrypt persistent volumes with customer keys if you want to provide your own AWS Key Management Service (KMS) key Amazon Resource Name (ARN). The key is used for encryption of persistent volumes in your cluster.
   8. Click Next.

8. On the Default machine pool page, select a Compute node instance type.

   Note

   After your cluster is created, you can change the number of compute nodes in your cluster, but you cannot change the compute node instance type in the default machine pool. The number and types of nodes available to you depend on whether you use single or multiple availability zones. They also depend on what is enabled and available in your AWS account and the selected region.

9. Optional: Configure autoscaling for the default machine pool:

   1. Select Enable autoscaling to automatically scale the number of machines in your default machine pool to meet the deployment needs.

   2. Set the minimum and maximum node count limits for autoscaling. The cluster autoscaler does not reduce or increase the default machine pool node count beyond the limits that you specify.

      • If you deployed your cluster using a single availability zone, set the Minimum node count and Maximum node count. This defines the minimum and maximum compute node limits in the availability zone.
      • If you deployed your cluster using multiple availability zones, set the Minimum nodes per zone and Maximum nodes per zone. This defines the minimum and maximum compute node limits per zone.
      Note

      Alternatively, you can set your autoscaling preferences for the default machine pool after the machine pool is created.

10. If you did not enable autoscaling, select a compute node count for your default machine pool:

    • If you deployed your cluster using a single availability zone, select a Compute node count from the drop-down menu. This defines the number of compute nodes to provision to the machine pool for the zone.
    • If you deployed your cluster using multiple availability zones, select a Compute node count (per zone) from the drop-down menu. This defines the number of compute nodes to provision to the machine pool per zone.
11. Optional: Expand Edit node labels to add labels to your nodes. Click Add label to add more node labels and select Next.

12. In the Cluster privacy section of the Network configuration page, select Public or Private to use either public or private API endpoints and application routes for your cluster.

    Important

    If you are using private API endpoints, you cannot access your cluster until you update the network settings in your cloud provider account.

13. Optional: If you opted to use public API endpoints, you can select Install into an existing VPC to install your cluster into an existing VPC.

    Note

    If you opted to use private API endpoints, you must use an existing VPC and PrivateLink and the Install into an existing VPC and Use a PrivateLink options are automatically selected. With these options, the Red Hat Site Reliability Engineering (SRE) team can connect to the cluster to assist with support by using only AWS PrivateLink endpoints.

14. Optional: If you are installing your cluster into an existing VPC, select Configure a cluster-wide proxy to enable an HTTP or HTTPS proxy to deny direct access to the internet from your cluster.
15. Click Next.

16. If you opted to install the cluster in an existing AWS VPC, provide your Virtual Private Cloud (VPC) subnet settings.

    Note

    You must ensure that your VPC is configured with a public and a private subnet for each availability zone that you want the cluster installed into. If you opted to use PrivateLink, only private subnets are required.

17. In the CIDR ranges dialog, configure custom classless inter-domain routing (CIDR) ranges or use the defaults that are provided and click Next.

    Note

    If you are installing into a VPC, the Machine CIDR range must match the VPC subnets.

    Important

    CIDR configurations cannot be changed later. Confirm your selections with your network administrator before proceeding.

18. Under the Cluster roles and policies page, select Auto mode. With this mode, you can automatically create the cluster-specific Operator IAM roles and OIDC provider.

    Note

    To enable Auto mode, the OpenShift Cluster Manager IAM role must have administrator capabilities.

    If you alternatively want to create the cluster-specific IAM roles and the OIDC provider by using Manual mode, see Creating a cluster using customizations.

19. Optional: Specify a Custom operator roles prefix for your cluster-specific Operator roles.

    Note

    By default, the cluster-specific Operator role names are prefixed with the cluster name and random 4-digit hash. You can optionally specify a custom prefix to replace <cluster_name>-<hash> in the role names. The prefix is applied when you create the cluster-specific Operator IAM roles. For information about the prefix, see About custom Operator IAM role prefixes.

20. Select Next.

21. On the Cluster update strategy page, configure your update preferences:

    1. Choose a cluster update method:

       • Select Individual updates if you want to schedule each update individually. This is the default option.

       • Select Recurring updates to update your cluster on your preferred day and start time, when updates are available.

         Important

         Even when you opt for recurring updates, you must update the account-wide and cluster-specific IAM resources before you upgrade your cluster between minor releases.

         Note

         You can review the end-of-life dates in the update life cycle documentation for Red Hat OpenShift Service on AWS. For more information, see Red Hat OpenShift Service on AWS update life cycle.

    2. If you opted for recurring updates, select a preferred day of the week and upgrade start time in UTC from the drop-down menus.
    3. Optional: You can set a grace period for Node draining during cluster upgrades. A 1 hour grace period is set by default.

    4. Click Next.

       Note

       In the event of critical security concerns that significantly impact the security or stability of a cluster, Red Hat Site Reliability Engineering (SRE) might schedule automatic updates to the latest z-stream version that is not impacted. The updates are applied within 48 hours after customer notifications are provided. For a description of the critical impact security rating, see Understanding Red Hat security ratings.

22. Review the summary of your selections and click Create cluster to start the cluster installation.

Procedure

1. Create the required account-wide roles and policies, including the Operator policies:

   $ rosa create account-roles --mode auto

   Note

   When using auto mode, you can optionally specify the -y argument to bypass the interactive prompts and automatically confirm operations.

2. Create a cluster with STS using the defaults. When you use the defaults, the latest stable OpenShift version is installed:

   $ rosa create cluster --cluster-name <cluster_name> --sts --mode auto 1

   1

   Replace <cluster_name> with the name of your cluster.

   Note

   When you specify --mode auto, the rosa create cluster command creates the cluster-specific Operator IAM roles and the OIDC provider automatically. The Operators use the OIDC provider to authenticate.

3. Check the status of your cluster:

   $ rosa describe cluster --cluster <cluster_name|cluster_id>

   The following State field changes are listed in the output as the cluster installation progresses:

   • waiting (Waiting for OIDC configuration)
   • pending (Preparing account)
   • installing (DNS setup in progress)
   • installing

   • ready

     Note

     If the installation fails or the State field does not change to ready after about 40 minutes, check the installation troubleshooting documentation for details. For more information, see Troubleshooting installations. For steps to contact Red Hat Support for assistance, see Getting support for Red Hat OpenShift Service on AWS.

4. Track the progress of the cluster creation by watching the OpenShift installer logs:

   $ rosa logs install --cluster <cluster_name|cluster_id> --watch 1

   1

   Specify the --watch flag to watch for new log messages as the installation progresses. This argument is optional.

Procedure

1. Navigate to OpenShift Cluster Manager and select Create cluster.
2. On the Create an OpenShift cluster page, select Create cluster in the Red Hat OpenShift Service on AWS (ROSA) row.
3. Review and complete the Prerequisites listed on the Accounts and roles page. Select the checkbox to acknowledge that you have read and completed all of the prerequisites.

4. Select an AWS account from the Associated AWS account drop-down menu. If no associated AWS accounts are found, click Associate AWS account and follow these steps:

   1. On the Authenticate page, click the copy button next to the rosa login command. The provided command includes your ROSA API login token.

      Note

      You can also load your API token on the OpenShift Cluster Manager API Token page on OpenShift Cluster Manager.

   2. Run the copied command in the CLI to log in to your ROSA account.

      $ rosa login --token=<api_login_token> 1

      1

      Replace <api_login_token> with the token that is provided in the copied command.

      Example output

      I: Logged in as '<username>' on 'https://api.openshift.com'

   3. On the Authenticate page in OpenShift Cluster Manager, click Next.

   4. On the OCM role page, click the copy button next to the Basic OCM role or the Admin OCM role commands.

      The basic role enables OpenShift Cluster Manager to detect the AWS IAM roles and policies required by ROSA. The admin role also enables the detection of the roles and policies. In addition, the admin role enables automatic deployment of the cluster-specific Operator roles and the OpenID Connect (OIDC) provider by using OpenShift Cluster Manager.

   5. Run the copied command in the CLI and follow the prompts to create the OpenShift Cluster Manager IAM role. The following example creates a basic OpenShift Cluster Manager IAM role using the default options:

      $ rosa create ocm-role

      Example output

      I: Creating ocm role
      ? Role prefix: ManagedOpenShift 1
      ? Enable admin capabilities for the OCM role (optional): No 2
      ? Permissions boundary ARN (optional):  3
      ? Role creation mode: auto 4
      I: Creating role using 'arn:aws:iam::<aws_account_id>:user/<aws_username>'
      ? Create the 'ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>' role? Yes
      I: Created role 'ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>' with ARN 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>'
      I: Linking OCM role
      ? OCM Role ARN: arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>
      ? Link the 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>' role with organization '<red_hat_organization_id>'? Yes 5
      I: Successfully linked role-arn 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>' with organization account '<red_hat_organization_id>'

      1

      Specifies the prefix to include in the OpenShift Cluster Manager IAM role name. The default is ManagedOpenShift.

      2

      Enables the admin OpenShift Cluster Manager IAM role, which is equivalent to specifying the --admin argument. The admin role is required if you want to use Auto mode to automatically provision the cluster-specific Operator roles and the OIDC provider by using OpenShift Cluster Manager.

      3

      Optional: Specifies a permissions boundary Amazon Resource Name (ARN) for the role. For more information, see Permissions boundaries for IAM entities in the AWS documentation.

      4

      Selects the role creation mode. You can use auto mode to automatically create the OpenShift Cluster Manager IAM role and link it to your Red Hat organization account. In manual mode, the rosa CLI generates the aws commands needed to create and link the role. In manual mode, the corresponding policy JSON files are also saved to the current directory. manual mode enables you to review the details before running the aws commands manually.

      5

      Links the OpenShift Cluster Manager IAM role to your Red Hat organization account.

   6. If you opted not to link the OpenShift Cluster Manager IAM role to your Red Hat organization account in the preceding command, copy the rosa link command from the OpenShift Cluster Manager OCM role page and run it:

      $ rosa link ocm-role <arn> 1

      1

      Replace <arn> with the ARN of the OpenShift Cluster Manager IAM role that is included in the output of the preceding command.

   7. Select Next on the OpenShift Cluster Manager OCM role page.

   8. On the User role page, click the copy button for the User role command and run the command in the CLI. Follow the prompts to create the user role:

      $ rosa create user-role

      Example output

      I: Creating User role
      ? Role prefix: ManagedOpenShift 1
      ? Permissions boundary ARN (optional): 2
      ? Role creation mode: auto 3
      I: Creating ocm user role using 'arn:aws:iam::<aws_account_id>:user/<aws_username>'
      ? Create the 'ManagedOpenShift-User-<ocm_username>-Role' role? Yes
      I: Created role 'ManagedOpenShift-User-<ocm_username>-Role' with ARN 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_username>-Role'
      I: Linking User role
      ? User Role ARN: arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_username>-Role
      ? Link the 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_username>-Role' role with account '<ocm_user_account_id>'? Yes 4
      I: Successfully linked role ARN 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_username>-Role' with account '<ocm_user_account_id>'

      1

      Specifies the prefix to include in the user role name. The default is ManagedOpenShift.

      2

      Optional: Specifies a permissions boundary Amazon Resource Name (ARN) for the role. For more information, see Permissions boundaries for IAM entities in the AWS documentation.

      3

      Selects the role creation mode. You can use auto mode to automatically create the user role and link it to your OpenShift Cluster Manager user account. In manual mode, the rosa CLI generates the aws commands needed to create and link the role. In manual mode, the corresponding policy JSON files are also saved to the current directory. manual mode enables you to review the details before running the aws commands manually.

      4

      Links the user role to your OpenShift Cluster Manager user account.

   9. If you opted not to link the user role to your OpenShift Cluster Manager user account in the preceding command, copy the rosa link command from the OpenShift Cluster Manager User role page and run it:

      $ rosa link user-role <arn> 1

      1

      Replace <arn> with the ARN of the user role that is included in the output of the preceding command.

   10. On the OpenShift Cluster Manager User role page, select Ok.
   11. Under the Accounts and roles page, verify that your AWS account is listed as an Associated AWS account.

5. If the required AWS IAM Account roles are not automatically detected and listed on the Accounts and roles page, create the roles and policies:

   1. Click the copy buffer next to the rosa create account-roles command. Run the command in the CLI to create the required AWS account-wide roles and policies, including the Operator policies::

      $ rosa create account-roles

      Example output

      I: Logged in as '<ocm_username>' on 'https://api.openshift.com'
      I: Validating AWS credentials...
      I: AWS credentials are valid!
      I: Validating AWS quota...
      I: AWS quota ok. If cluster installation fails, validate actual AWS resource usage against https://docs.openshift.com/rosa/rosa_getting_started/rosa-required-aws-service-quotas.html
      I: Verifying whether OpenShift command-line tool is available...
      I: Current OpenShift Client Version: 4.9.12
      I: Creating account roles
      ? Role prefix: ManagedOpenShift 1
      ? Permissions boundary ARN (optional): 2
      ? Role creation mode: auto 3
      I: Creating roles using 'arn:aws:iam::<aws_account_number>:user/<aws_username>'
      ? Create the 'ManagedOpenShift-Installer-Role' role? Yes 4
      I: Created role 'ManagedOpenShift-Installer-Role' with ARN 'arn:aws:iam::<aws_account_number>:role/ManagedOpenShift-Installer-Role'
      ? Create the 'ManagedOpenShift-ControlPlane-Role' role? Yes 5
      I: Created role 'ManagedOpenShift-ControlPlane-Role' with ARN 'arn:aws:iam::<aws_account_number>:role/ManagedOpenShift-ControlPlane-Role'
      ? Create the 'ManagedOpenShift-Worker-Role' role? Yes 6
      I: Created role 'ManagedOpenShift-Worker-Role' with ARN 'arn:aws:iam::<aws_account_number>:role/ManagedOpenShift-Worker-Role'
      ? Create the 'ManagedOpenShift-Support-Role' role? Yes 7
      I: Created role 'ManagedOpenShift-Support-Role' with ARN 'arn:aws:iam::<aws_account_number>:role/ManagedOpenShift-Support-Role'
      ? Create the operator policies? Yes 8
      I: Created policy with ARN 'arn:aws:iam::<aws_account_number>:policy/ManagedOpenShift-openshift-cloud-credential-operator-cloud-crede'
      I: Created policy with ARN 'arn:aws:iam::<aws_account_number>:policy/ManagedOpenShift-openshift-image-registry-installer-cloud-creden'
      I: Created policy with ARN 'arn:aws:iam::<aws_account_number>:policy/ManagedOpenShift-openshift-ingress-operator-cloud-credentials'
      I: Created policy with ARN 'arn:aws:iam::<aws_account_number>:policy/ManagedOpenShift-openshift-cluster-csi-drivers-ebs-cloud-credent'
      I: Created policy with ARN 'arn:aws:iam::<aws_account_number>:policy/ManagedOpenShift-openshift-cloud-network-config-controller-cloud'
      I: Created policy with ARN 'arn:aws:iam::<aws_account_number>:policy/ManagedOpenShift-openshift-machine-api-aws-cloud-credentials'
      I: To create a cluster with these roles, run the following command:
      rosa create cluster --sts

      1

      Specifies the prefix to include in the OpenShift Cluster Manager IAM role name. The default is ManagedOpenShift.

      2

      Optional: Specifies a permissions boundary Amazon Resource Name (ARN) for the role. For more information, see Permissions boundaries for IAM entities in the AWS documentation.

      3

      Selects the role creation mode. You can use auto mode to automatically create the account wide roles and policies. In manual mode, the rosa CLI generates the aws commands needed to create the roles and policies. In manual mode, the corresponding policy JSON files are also saved to the current directory. manual mode enables you to review the details before running the aws commands manually.

      4 5 6 7

      Creates the account-wide installer, control plane, worker and support roles and corresponding inline IAM policies. For more information, see Account-wide IAM role and policy reference.

      8

      Creates the cluster-specific Operator IAM roles that permit the ROSA cluster Operators to carry out core OpenShift functionality. For more information, see Account-wide IAM role and policy reference.

   2. On the Accounts and roles page, click Refresh ARNs and verify that the installer, support, worker, and control plane account roles are detected.
6. Select Next.

7. On the Cluster details page, provide a name for your cluster and specify the cluster details:

   1. Add a Cluster name.
   2. Select a cluster version from the Version drop-down menu.
   3. Select a cloud provider region from the Region drop-down menu.
   4. Select a Single zone or Multi-zone configuration.
   5. Leave Enable user workload monitoring selected to monitor your own projects in isolation from Red Hat Site Reliability Engineer (SRE) platform metrics. This option is enabled by default.

   6. Optional: Select Enable additional etcd encryption if you require etcd key value encryption. With this option, the etcd key values are encrypted, but not the keys. This option is in addition to the control plane storage encryption that encrypts the etcd volumes in Red Hat OpenShift Service on AWS clusters by default.

      Note

      By enabling etcd encryption for the key values in etcd, you will incur a performance overhead of approximately 20%. The overhead is a result of introducing this second layer of encryption, in addition to the default control plane storage encryption that encrypts the etcd volumes. Consider enabling etcd encryption only if you specifically require it for your use case.

   7. Optional: Select Encrypt persistent volumes with customer keys if you want to provide your own AWS Key Management Service (KMS) key Amazon Resource Name (ARN). The key is used for encryption of persistent volumes in your cluster.
   8. Click Next.

8. On the Default machine pool page, select a Compute node instance type.

   Note

   After your cluster is created, you can change the number of compute nodes in your cluster, but you cannot change the compute node instance type in the default machine pool. The number and types of nodes available to you depend on whether you use single or multiple availability zones. They also depend on what is enabled and available in your AWS account and the selected region.

9. Optional: Configure autoscaling for the default machine pool:

   1. Select Enable autoscaling to automatically scale the number of machines in your default machine pool to meet the deployment needs.

   2. Set the minimum and maximum node count limits for autoscaling. The cluster autoscaler does not reduce or increase the default machine pool node count beyond the limits that you specify.

      • If you deployed your cluster using a single availability zone, set the Minimum node count and Maximum node count. This defines the minimum and maximum compute node limits in the availability zone.
      • If you deployed your cluster using multiple availability zones, set the Minimum nodes per zone and Maximum nodes per zone. This defines the minimum and maximum compute node limits per zone.
      Note

      Alternatively, you can set your autoscaling preferences for the default machine pool after the machine pool is created.

10. If you did not enable autoscaling, select a compute node count for your default machine pool:

    • If you deployed your cluster using a single availability zone, select a Compute node count from the drop-down menu. This defines the number of compute nodes to provision to the machine pool for the zone.
    • If you deployed your cluster using multiple availability zones, select a Compute node count (per zone) from the drop-down menu. This defines the number of compute nodes to provision to the machine pool per zone.
11. Optional: Expand Edit node labels to add labels to your nodes. Click Add label to add more node labels and select Next.

12. In the Cluster privacy section of the Network configuration page, select Public or Private to use either public or private API endpoints and application routes for your cluster.

    Important

    If you are using private API endpoints, you cannot access your cluster until you update the network settings in your cloud provider account.

13. Optional: If you opted to use public API endpoints, you can select Install into an existing VPC to install your cluster into an existing VPC.

    Note

    If you opted to use private API endpoints, you must use an existing VPC and PrivateLink and the Install into an existing VPC and Use a PrivateLink options are automatically selected. With these options, the Red Hat Site Reliability Engineering (SRE) team can connect to the cluster to assist with support by using only AWS PrivateLink endpoints.

14. Optional: If you are installing your cluster into an existing VPC, select Configure a cluster-wide proxy to enable an HTTP or HTTPS proxy to deny direct access to the internet from your cluster.
15. Click Next.

16. If you opted to install the cluster in an existing AWS VPC, provide your Virtual Private Cloud (VPC) subnet settings.

    Note

    You must ensure that your VPC is configured with a public and a private subnet for each availability zone that you want the cluster installed into. If you opted to use PrivateLink, only private subnets are required.

17. In the CIDR ranges dialog, configure custom classless inter-domain routing (CIDR) ranges or use the defaults that are provided and click Next.

    Note

    If you are installing into a VPC, the Machine CIDR range must match the VPC subnets.

    Important

    CIDR configurations cannot be changed later. Confirm your selections with your network administrator before proceeding.

18. Under the Cluster roles and policies page, select your preferred cluster-specific Operator IAM role and OIDC provider creation mode.

    With Manual mode, you can use either rosa CLI commands or aws CLI commands to generate the required Operator roles and OIDC provider for your cluster. Manual mode enables you to review the details before using your preferred option to create the IAM resources manually and complete your cluster installation.

    Alternatively, you can use Auto mode to automatically create the Operator roles and OIDC provider.

    Note

    To enable Auto mode, the OpenShift Cluster Manager IAM role must have administrator capabilities.

19. Optional: Specify a Custom operator roles prefix for your cluster-specific Operator IAM roles.

    Note

    By default, the cluster-specific Operator role names are prefixed with the cluster name and random 4-digit hash. You can optionally specify a custom prefix to replace <cluster_name>-<hash> in the role names. The prefix is applied when you create the cluster-specific Operator IAM roles. For information about the prefix, see About custom Operator IAM role prefixes.

20. Select Next.

21. On the Cluster update strategy page, configure your update preferences:

    1. Choose a cluster update method:

       • Select Individual updates if you want to schedule each update individually. This is the default option.

       • Select Recurring updates to update your cluster on your preferred day and start time, when updates are available.

         Important

         Even when you opt for recurring updates, you must update the account-wide and cluster-specific IAM resources before you upgrade your cluster between minor releases.

         Note

         You can review the end-of-life dates in the update life cycle documentation for Red Hat OpenShift Service on AWS. For more information, see Red Hat OpenShift Service on AWS update life cycle.

    2. If you opted for recurring updates, select a preferred day of the week and upgrade start time in UTC from the drop-down menus.
    3. Optional: You can set a grace period for Node draining during cluster upgrades. A 1 hour grace period is set by default.

    4. Click Next.

       Note

       In the event of critical security concerns that significantly impact the security or stability of a cluster, Red Hat Site Reliability Engineering (SRE) might schedule automatic updates to the latest z-stream version that is not impacted. The updates are applied within 48 hours after customer notifications are provided. For a description of the critical impact security rating, see Understanding Red Hat security ratings.

22. Review the summary of your selections and click Create cluster to start the cluster installation.

23. If you opted to use Manual mode, create the cluster-specific Operator roles and OIDC provider manually to continue the installation:

    1. In the Action required to continue installation dialog, select either the AWS CLI or ROSA CLI tab and manually create the resources:

       • If you opted to use the AWS CLI method, click Download .zip, save the file, and then extract the AWS CLI command and policy files. Then, run the provided aws commands in the CLI.

         Note

         You must run the aws commands in the directory that contains the policy files.

       • If you opted to use the ROSA CLI method, click the copy button next to the rosa create commands and run them in the CLI.
    2. In the Action required to continue installation dialog, click x to return to the Overview page for your cluster.
    3. Verify that the cluster Status in the Details section of the Overview page for your cluster has changed from Waiting to Installing. There might be a short delay of approximately two minutes before the status changes.
    Note

    If you opted to use Auto mode, OpenShift Cluster Manager creates the Operator roles and the OIDC provider automatically.

Procedure

1. Create the required account-wide roles and policies, including the Operator policies:

   1. Generate the IAM policy JSON files in the current working directory and output the aws CLI commands for review:

      $ rosa create account-roles --mode manual 1

      1

      manual mode generates the aws CLI commands and JSON files needed to create the account-wide roles and policies. After review, you must run the commands manually to create the resources.

   2. After review, run the aws commands manually to create the roles and policies. Alternatively, you can run the preceding command using --mode auto to run the aws commands immediately.

2. Optional: If you are using your own AWS KMS key to encrypt the control plane, infrastructure, and worker node root volumes, add the ARN for the account-wide installer role to your KMS key policy.

   1. Save the key policy for your KMS key to a file on your local machine. The following example saves the output to kms-key-policy.json in the current working directory:

      $ aws kms get-key-policy --key-id <key_id_or_arn> --policy-name default --output text > kms-key-policy.json 1

      1

      Replace <key_id_or_arn> with the ID or ARN of your KMS key.

   2. Add the ARN for the account-wide installer role that you created in the preceding step to the Statement.Principal.AWS section in the file. In the following example, the ARN for the default ManagedOpenShift-Installer-Role role is added:

      {
          "Version": "2012-10-17",
          "Id": "key-rosa-policy-1",
          "Statement": [
              {
                  "Sid": "Enable IAM User Permissions",
                  "Effect": "Allow",
                  "Principal": {
                      "AWS": "arn:aws:iam::<aws-account-id>:root"
                  },
                  "Action": "kms:*",
                  "Resource": "*"
              },
              {
                  "Sid": "Allow ROSA use of the key",
                  "Effect": "Allow",
                  "Principal": {
                      "AWS": [
                          "arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-Support-Role", 1
                          "arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-Installer-Role",
                          "arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-Worker-Role",
                          "arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-ControlPlane-Role"
                      ]
                  },
                  "Action": [
                      "kms:Encrypt",
                      "kms:Decrypt",
                      "kms:ReEncrypt*",
                      "kms:GenerateDataKey*",
                      "kms:DescribeKey"
                  ],
                  "Resource": "*"
              },
              {
                  "Sid": "Allow attachment of persistent resources",
                  "Effect": "Allow",
                  "Principal": {
                      "AWS": [
                          "arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-Support-Role", 2
                          "arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-Installer-Role",
                          "arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-Worker-Role",
                          "arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-ControlPlane-Role"
                      ]
                  },
                  "Action": [
                      "kms:CreateGrant",
                      "kms:ListGrants",
                      "kms:RevokeGrant"
                  ],
                  "Resource": "*",
                  "Condition": {
                      "Bool": {
                          "kms:GrantIsForAWSResource": "true"
                      }
                  }
              }
          ]
      }

      1 2

      You must specify the ARN for the account-wide role that will be used when you create the ROSA cluster. The ARNs listed in the section must be comma-separated.

   3. Apply the changes to your KMS key policy:

      $ aws kms put-key-policy --key-id <key_id_or_arn> \ 1
          --policy file://kms-key-policy.json \ 2
          --policy-name default

      1

      Replace <key_id_or_arn> with the ID or ARN of your KMS key.

      2

      You must include the file:// prefix when referencing a key policy in a local file.

      You can reference the ARN of your KMS key when you create the cluster in the next step.

3. Create a cluster with STS using custom installation options. You can use the --interactive mode to interactively specify custom settings:

   $ rosa create cluster --interactive --sts

   Example output

   I: Interactive mode enabled.
   Any optional fields can be left empty and a default will be selected.
   ? Cluster name: <cluster_name>
   ? OpenShift version: 4.8.9 1
   I: Using arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-Installer-Role for the Installer role 2
   I: Using arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-ControlPlane-Role for the ControlPlane role
   I: Using arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-Worker-Role for the Worker role
   I: Using arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-Support-Role for the Support role
   ? External ID (optional):
   ? Operator roles prefix: <cluster_name>-<random_string> 3
   ? Multiple availability zones (optional): No 4
   ? AWS region: us-east-1
   ? PrivateLink cluster (optional): No
   ? Install into an existing VPC (optional): No
   ? Enable Customer Managed key (optional): No 5
   ? Compute nodes instance type (optional):
   ? Enable autoscaling (optional): No
   ? Compute nodes: 2
   ? Machine CIDR: 10.0.0.0/16
   ? Service CIDR: 172.30.0.0/16
   ? Pod CIDR: 10.128.0.0/14
   ? Host prefix: 23
   ? Encrypt etcd data (optional): No 6
   ? Disable Workload monitoring (optional): No
   I: Creating cluster '<cluster_name>'
   I: To create this cluster again in the future, you can run:
      rosa create cluster --cluster-name <cluster_name> --role-arn arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-Installer-Role --support-role-arn arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-Support-Role --master-iam-role arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-ControlPlane-Role --worker-iam-role arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-Worker-Role --operator-roles-prefix <cluster_name>-<random_string> --region us-east-1 --version 4.8.9 --compute-nodes 2 --machine-cidr 10.0.0.0/16 --service-cidr 172.30.0.0/16 --pod-cidr 10.128.0.0/14 --host-prefix 23 7
   I: To view a list of clusters and their status, run 'rosa list clusters'
   I: Cluster '<cluster_name>' has been created.
   I: Once the cluster is installed you will need to add an Identity Provider before you can login into the cluster. See 'rosa create idp --help' for more information.
   I: To determine when your cluster is Ready, run 'rosa describe cluster -c <cluster_name>'.
   I: To watch your cluster installation logs, run 'rosa logs install -c <cluster_name> --watch'.

   1

   When creating the cluster, the listed OpenShift version options include the major, minor, and patch versions, for example 4.8.9.

   2

   If more than one matching set of account-wide roles are available in your account for a cluster version, an interactive list of options is provided.

   3

   Optional: By default, the cluster-specific Operator role names are prefixed with the cluster name and random 4-digit hash. You can optionally specify a custom prefix to replace <cluster_name>-<hash> in the role names. The prefix is applied when you create the cluster-specific Operator IAM roles. For information about the prefix, see Defining an Operator IAM role prefix.

   4

   Multiple availability zones are recommended for production workloads. The default is a single availability zone.

   5

   Enable this option if you are using your own AWS KMS key to encrypt the control plane, infrastructure, and worker node root volumes. Specify the ARN for the KMS key that you added to the account-wide role ARN to in the preceding step.

   6

   Enable this option only if your use case requires etcd key value encryption in addition to the control plane storage encryption that encrypts the etcd volumes by default. With this option, the etcd key values are encrypted, but not the keys.

   Important

   By enabling etcd encryption for the key values in etcd, you will incur a performance overhead of approximately 20%. The overhead is a result of introducing this second layer of encryption, in addition to the default control plane storage encryption that encrypts the etcd volumes. Red Hat recommends that you enable etcd encryption only if you specifically require it for your use case.

   7

   The output includes a custom command that you can run to create a cluster with the same configuration in the future.

   As an alternative to using the --interactive mode, you can specify the customization options directly when you run rosa create cluster. Run rosa create cluster --help to view a list of available CLI options.

   Important

   You must complete the following steps to create the Operator IAM roles and the OpenID Connect (OIDC) provider to move the state of the cluster to ready.

4. Create the cluster-specific Operator IAM roles:

   1. Generate the Operator IAM policy JSON files in the current working directory and output the aws CLI commands for review:

      $ rosa create operator-roles --mode manual --cluster <cluster_name|cluster_id> 1

      1

      manual mode generates the aws CLI commands and JSON files needed to create the Operator roles. After review, you must run the commands manually to create the resources.

   2. After review, run the aws commands manually to create the Operator IAM roles and attach the managed Operator policies to them. Alternatively, you can run the preceding command again using --mode auto to run the aws commands immediately.

      Note

      A custom prefix is applied to the Operator role names if you specified the prefix in the preceding step.

5. Create the OpenID Connect (OIDC) provider that the cluster Operators use to authenticate:

   $ rosa create oidc-provider --mode auto --cluster <cluster_name|cluster_id> 1

   1

   auto mode immediately runs the aws CLI command that creates the OIDC provider.

6. Check the status of your cluster:

   $ rosa describe cluster --cluster <cluster_name|cluster_id>

   Example output

   Name:                       <cluster_name>
   ID:                         <cluster_id>
   External ID:                <external_id>
   OpenShift Version:          <version>
   Channel Group:              stable
   DNS:                        <cluster_name>.xxxx.p1.openshiftapps.com
   AWS Account:                <aws_account_id>
   API URL:                    https://api.<cluster_name>.xxxx.p1.openshiftapps.com:6443
   Console URL:                https://console-openshift-console.apps.<cluster_name>.xxxx.p1.openshiftapps.com
   Region:                     <aws_region>
   Multi-AZ:                   false
   Nodes:
    - Master:                  3
    - Infra:                   2
    - Compute:                 2
   Network:
    - Service CIDR:            172.30.0.0/16
    - Machine CIDR:            10.0.0.0/16
    - Pod CIDR:                10.128.0.0/14
    - Host Prefix:             /23
   STS Role ARN:               arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-Installer-Role
   Support Role ARN:           arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-Support-Role
   Instance IAM Roles:
    - Master:                  arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-ControlPlane-Role
    - Worker:                  arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-Worker-Role
   Operator IAM Roles:
    - arn:aws:iam::<aws_account_id>:role/<cluster_name>-xxxx-openshift-ingress-operator-cloud-credentials
    - arn:aws:iam::<aws_account_id>:role/<cluster_name-xxxx-openshift-cluster-csi-drivers-ebs-cloud-credent
    - arn:aws:iam::<aws_account_id>:role/<cluster_name-xxxx-openshift-machine-api-aws-cloud-credentials
    - arn:aws:iam::<aws_account_id>:role/<cluster_name-xxxx-openshift-cloud-credential-operator-cloud-crede
    - arn:aws:iam::<aws_account_id>:role/<cluster_name-xxxx-openshift-image-registry-installer-cloud-creden
   State:                      ready
   Private:                    No
   Created:                    Oct  1 2021 08:12:25 UTC
   Details Page:               https://console.redhat.com/openshift/details/s/<subscription_id>
   OIDC Endpoint URL:          https://rh-oidc.s3.<aws_region>.amazonaws.com/<cluster_id>

   The following State field changes are listed in the output as the cluster installation progresses:

   • waiting (Waiting for OIDC configuration)
   • pending (Preparing account)
   • installing (DNS setup in progress)
   • installing

   • ready

     Note

     If the installation fails or the State field does not change to ready after about 40 minutes, check the installation troubleshooting documentation for details. For more information, see Troubleshooting installations. For steps to contact Red Hat Support for assistance, see Getting support for Red Hat OpenShift Service on AWS.

7. Track the progress of the cluster creation by watching the OpenShift installer logs:

   $ rosa logs install --cluster <cluster_name|cluster_id> --watch 1

   1

   Specify the --watch flag to watch for new log messages as the installation progresses. This argument is optional.

Procedure

1. Enter the following command to revoke the dedicated-admin access of a user:

   $ rosa revoke user dedicated-admin --user=<idp_user_name> --cluster=<cluster_name>

2. Enter the following command to verify that your user no longer has dedicated-admin access. The output does not list the revoked user.

   $ oc get groups dedicated-admins

Procedure

1. Enter the following command to revoke the cluster-admin access of a user:

   $ rosa revoke user cluster-admins --user=myusername --cluster=mycluster

2. Enter the following command to verify that the user no longer has cluster-admin access. The output does not list the revoked user.

   $ oc get groups cluster-admins

Procedure

1. Delete the account-wide roles:

   1. List the account-wide roles in your AWS account by using the ROSA CLI (rosa):

      $ rosa list account-roles

      Example output

      I: Fetching account roles
      ROLE NAME                           ROLE TYPE      ROLE ARN                                                           OPENSHIFT VERSION
      ManagedOpenShift-ControlPlane-Role  Control plane  arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-ControlPlane-Role  4.10
      ManagedOpenShift-Installer-Role     Installer      arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-Installer-Role     4.10
      ManagedOpenShift-Support-Role       Support        arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-Support-Role       4.10
      ManagedOpenShift-Worker-Role        Worker         arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-Worker-Role        4.10

   2. Delete the account-wide roles:

      $ rosa delete account-roles --prefix <prefix> --mode auto 1

      1

      You must include the --<prefix> argument. Replace <prefix> with the prefix of the account-wide roles to delete. If you did not specify a custom prefix when you created the account-wide roles, specify the default prefix, ManagedOpenShift.

      Important

      The account-wide IAM roles might be used by other ROSA clusters in the same AWS account. You must only remove the roles if they are not required by other clusters.

2. Delete the account-wide in-line and Operator policies:

   1. Under the Policies page in the AWS IAM Console, filter the list of policies by the prefix that you specified when you created the account-wide roles and policies.

      Note

      If you did not specify a custom prefix when you created the account-wide roles, search for the default prefix, ManagedOpenShift.

   2. Delete the account-wide in-line policies and Operator policies by using the AWS IAM Console. For more information about deleting IAM policies by using the AWS IAM Console, see Deleting IAM policies in the AWS documentation.

      Important

      The account-wide in-line and Operator IAM policies might be used by other ROSA clusters in the same AWS account. You must only remove the roles if they are not required by other clusters.

Procedure

1. Unlink the OpenShift Cluster Manager IAM role from your Red Hat organization and delete the role:

   1. List the OpenShift Cluster Manager IAM roles in your AWS account:

      $ rosa list ocm-roles

      Example output

      I: Fetching ocm roles
      ROLE NAME                           ROLE ARN                                                                      LINKED  ADMIN
      ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>  arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>  Yes     Yes

   2. If your OpenShift Cluster Manager IAM role is listed as linked in the output of the preceding command, unlink the role from your Red Hat organization:

      $ rosa unlink ocm-role --role-arn <arn> 1

      1

      Replace <arn> with the Amazon Resource Name (ARN) for your OpenShift Cluster Manager IAM role. The ARN is specified in the output of the preceding command. In the preceding example, the ARN is in the format arn:aws:iam::<aws_account_external_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>.

      Example output

      I: Unlinking OCM role
      ? Unlink the 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>' role from organization '<red_hat_organization_id>'? Yes
      I: Successfully unlinked role-arn 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>' from organization account '<red_hat_organization_id>'

   3. Delete the OpenShift Cluster Manager IAM role and policies:

      $ rosa delete ocm-role --role-arn <arn>

      Example output

      I: Deleting OCM role
      ? OCM Role ARN: arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>
      ? Delete 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-OCM-Role-<red_hat_organization_external_id>' ocm role? Yes
      ? OCM role deletion mode: auto 1
      I: Successfully deleted the OCM role

      1

      Specifies the deletion mode. You can use auto mode to automatically delete the OpenShift Cluster Manager IAM role and policies. In manual mode, the rosa CLI generates the aws commands needed to delete the role and policies. manual mode enables you to review the details before running the aws commands manually.

2. Unlink the user IAM role from your Red Hat organization and delete the role:

   1. List the user IAM roles in your AWS account:

      $ rosa list user-roles

      Example output

      I: Fetching user roles
      ROLE NAME                                  ROLE ARN                                                                  LINKED
      ManagedOpenShift-User-<ocm_user_name>-Role  arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role  Yes

   2. If your user IAM role is listed as linked in the output of the preceding command, unlink the role from your Red Hat organization:

      $ rosa unlink user-role --role-arn <arn> 1

      1

      Replace <arn> with the Amazon Resource Name (ARN) for your user IAM role. The ARN is specified in the output of the preceding command. In the preceding example, the ARN is in the format arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role.

      Example output

      I: Unlinking user role
      ? Unlink the 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role' role from the current account '<ocm_user_account_id>'? Yes
      I: Successfully unlinked role ARN 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role' from account '<ocm_user_account_id>'

   3. Delete the user IAM role:

      $ rosa delete user-role --role-arn <arn>

      Example output

      I: Deleting user role
      ? User Role ARN: arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role
      ? Delete the 'arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-User-<ocm_user_name>-Role' role from the AWS account? Yes
      ? User role deletion mode: auto 1
      I: Successfully deleted the user role

      1

      Specifies the deletion mode. You can use auto mode to automatically delete the user IAM role. In manual mode, the rosa CLI generates the aws command needed to delete the role. manual mode enables you to review the details before running the aws command manually.

Procedure

1. If you, as the customer, are utilizing AWS Organizations, then you must use an AWS account within your organization or create a new one.
2. To ensure that Red Hat can perform necessary actions, you must either create a service control policy (SCP) or ensure that none is applied to the AWS account.
3. Attach the SCP to the AWS account.
4. Follow the ROSA procedures for setting up the environment.

Procedure

1. Allowlist the following URLs that are used to install and download packages and tools:

   Domain	Port	Function
   registry.redhat.io	443	Provides core container images.
   quay.io	443	Provides core container images.
   *.quay.io	443	Provides core container images.
   sso.redhat.com	443, 80	Required. The https://console.redhat.com/openshift site uses authentication from sso.redhat.com to download the pull secret and use Red Hat SaaS solutions to facilitate monitoring of your subscriptions, cluster inventory, chargeback reporting, and so on.
   quay-registry.s3.amazonaws.com	443	Provides core container images.
   cm-quay-production-s3.s3.amazonaws.com	443	Provides core container images.
   cart-rhcos-ci.s3.amazonaws.com	443	Provides Red Hat Enterprise Linux CoreOS (RHCOS) images.
   openshift.org	443	Provides Red Hat Enterprise Linux CoreOS (RHCOS) images.
   registry.access.redhat.com	443	Provides access to the odo CLI tool that helps developers build on OpenShift and Kubernetes.
   console.redhat.com	443, 80	Required. Allows interactions between the cluster and OpenShift Console Manager to enable functionality, such as scheduling upgrades.
   sso.redhat.com	443	The https://console.redhat.com/openshift site uses authentication from sso.redhat.com.
   pull.q1w2.quay.rhcloud.com	443	Provides core container images as a fallback when quay.io is not available.
   .q1w2.quay.rhcloud.com	443	Provides core container images as a fallback when quay.io is not available.

   When you add a site such as quay.io to your allowlist, do not add a wildcard entry such as *.quay.io to your denylist. In most cases, image registries use a content delivery network (CDN) to serve images. If a firewall blocks access, then image downloads are denied when the initial download request is redirected to a host name such as cdn01.quay.io.

   CDN host names, such as cdn01.quay.io, are covered when you add a wildcard entry, such as .quay.io, in your allowlist.

2. Allowlist the following telemetry URLs:

   Domain	Port	Function
   cert-api.access.redhat.com	443	Required for telemetry.
   api.access.redhat.com	443	Required for telemetry.
   infogw.api.openshift.com	443	Required for telemetry.
   console.redhat.com	443	Required for telemetry and Red Hat Insights.
   observatorium.api.openshift.comm	443	Required for managed OpenShift-specific telemetry.

   Managed clusters require enabling telemetry to allow Red Hat to react more quickly to problems, better support the customers, and better understand how product upgrades impact clusters. See About remote health monitoring for more information about how remote health monitoring data is used by Red Hat.

3. Allowlist the following Amazon Web Services (AWS) API URls:

   Domain	Port	Function
   .amazonaws.com	443	Required to access AWS services and resources.

   Alternatively, if you choose to not use a wildcard for Amazon Web Services (AWS) APIs, you must allowlist the following URLs:

   Domain	Port	Function
   ec2.amazonaws.com	443	Used to install and manage clusters in an AWS environment.
   events.amazonaws.com	443	Used to install and manage clusters in an AWS environment.
   iam.amazonaws.com	443	Used to install and manage clusters in an AWS environment.
   route53.amazonaws.com	443	Used to install and manage clusters in an AWS environment.
   sts.amazonaws.com	443	Used to install and manage clusters in an AWS environment.
   tagging.us-east-1.amazonaws.com	443	Used to install and manage clusters in an AWS environment. This endpoint is always us-east-1, regardless of the region the cluster is deployed in.
   ec2.<aws_region>.amazonaws.com	443	Used to install and manage clusters in an AWS environment.
   elasticloadbalancing.<aws_region>.amazonaws.com	443	Used to install and manage clusters in an AWS environment.
   servicequotas.<aws region>.amazonaws.com	443, 80	Required. Used to confirm quotas for deploying the service.
   tagging.<region>.amazonaws.com	443, 80	Allows the assignment of metadata about AWS resources in the form of tags.

4. Allowlist the following OpenShift URLs:

   Domain	Port	Function
   mirror.openshift.com	443	Used to access mirrored installation content and images. This site is also a source of release image signatures, although the Cluster Version Operator (CVO) needs only a single functioning source.
   storage.googleapis.com/openshift-release (Recommended)	443	Alternative site to mirror.openshift.com/. Used to download platform release signatures that are used by the cluster to know what images to pull from quay.io.
   api.openshift.com	443	Used to check if updates are available for the cluster.

5. Allowlist the following site reliability engineering (SRE) and management URLs:

   Domain	Port	Function
   api.pagerduty.com	443	This alerting service is used by the in-cluster alertmanager to send alerts notifying Red Hat SRE of an event to take action on.
   events.pagerduty.com	443	This alerting service is used by the in-cluster alertmanager to send alerts notifying Red Hat SRE of an event to take action on.
   api.deadmanssnitch.com	443	Alerting service used by Red Hat OpenShift Service on AWS to send periodic pings that indicate whether the cluster is available and running.
   nosnch.in	443	Alerting service used by Red Hat OpenShift Service on AWS to send periodic pings that indicate whether the cluster is available and running.
   *.osdsecuritylogs.splunkcloud.com OR inputs1.osdsecuritylogs.splunkcloud.cominputs2.osdsecuritylogs.splunkcloud.cominputs4.osdsecuritylogs.splunkcloud.cominputs5.osdsecuritylogs.splunkcloud.cominputs6.osdsecuritylogs.splunkcloud.cominputs7.osdsecuritylogs.splunkcloud.cominputs8.osdsecuritylogs.splunkcloud.cominputs9.osdsecuritylogs.splunkcloud.cominputs10.osdsecuritylogs.splunkcloud.cominputs11.osdsecuritylogs.splunkcloud.cominputs12.osdsecuritylogs.splunkcloud.cominputs13.osdsecuritylogs.splunkcloud.cominputs14.osdsecuritylogs.splunkcloud.cominputs15.osdsecuritylogs.splunkcloud.com	9997	Used by the splunk-forwarder-operator as a logging forwarding endpoint to be used by Red Hat SRE for log-based alerting.
   http-inputs-osdsecuritylogs.splunkcloud.com	443	Required. Used by the splunk-forwarder-operator as a logging forwarding endpoint to be used by Red Hat SRE for log-based alerting.
   sftp.access.redhat.com (Recommended)	22	The SFTP server used by must-gather-operator to upload diagnostic logs to help troubleshoot issues with the cluster.

6. If you did not allow a wildcard for Amazon Web Services (AWS) APIs, you must also allow the S3 bucket used for the internal OpenShift registry. To retrieve that endpoint, run the following command after the cluster is successfully provisioned:

   $ oc -n openshift-image-registry get pod -l docker-registry=default -o json | jq '.items[].spec.containers[].env[] | select(.name=="REGISTRY_STORAGE_S3_BUCKET")'

   The S3 endpoint should be in the following format: '<cluster-name>-<random-string>-image-registry-<cluster-region>-<random-string>.s3.dualstack.<cluster-region>.amazonaws.com'.

7. Allowlist any site that provides resources for a language or framework that your builds require.
8. Allowlist any outbound URLs that depend on the languages and frameworks used in OpenShift. See OpenShift Outbound URLs to Allow for a list of recommended URLs to be allowed on the firewall or proxy.

1. Perform the AWS prerequisites. To deploy a ROSA cluster, your AWS account must meet the prerequisite requirements.
2. Review the required AWS service quotas. To prepare for your cluster deployment, review the AWS service quotas that are required to run a ROSA cluster.
3. Configure your AWS account. Before you create a ROSA cluster, you must enable ROSA in your AWS account, install and configure the AWS CLI (aws) tool, and verify the AWS CLI tool configuration.
4. Install the ROSA and OpenShift CLI tools and verify the AWS servce quotas. Install and configure the ROSA CLI (rosa) and the OpenShift CLI (oc). You can verify if the required AWS resource quotas are available by using the ROSA CLI.
5. Create a ROSA cluster or Create a ROSA cluster using AWS PrivateLink. Use the ROSA CLI (rosa) to create a cluster. You can optionally create a ROSA cluster with AWS PrivateLink.
6. Access a cluster. You can configure an identity provider and grant cluster administrator privileges to the identity provider users as required. You can also access a newly deployed cluster quickly by configuring a cluster-admin user.
7. Revoke access to a ROSA cluster for a user. You can revoke access to a ROSA cluster from a user by using the ROSA CLI or the web console.
8. Delete a ROSA cluster. You can delete a ROSA cluster by using the ROSA CLI (rosa).

Procedure

1. Log in to the Amazon Web Services (AWS) account that you want to use.

   A dedicated AWS account is recommended to run production clusters. If you are using AWS Organizations, you can use an AWS account within your organization or create a new one.

   If you are using AWS Organizations and you need to have a service control policy (SCP) applied to the AWS account you plan to use, see AWS Prerequisites for details on the minimum required SCP.

   As part of the cluster creation process, rosa establishes an osdCcsAdmin IAM user. This user uses the IAM credentials you provide when configuring the AWS CLI.

   Note

   This user has Programmatic access enabled and the AdministratorAccess policy attached to it.

2. Enable the ROSA service in the AWS Console.

   1. Sign in to your AWS account.
   2. To enable ROSA, go to the ROSA service and select Enable OpenShift.

3. Install and configure the AWS CLI.

   1. Follow the AWS command-line interface documentation to install and configure the AWS CLI for your operating system.

      Specify the correct aws_access_key_id and aws_secret_access_key in the .aws/credentials file. See AWS Configuration basics in the AWS documentation.

   2. Set a default AWS region.

      Note

      It is recommended to set the default AWS region by using the environment variable.

      The ROSA service evaluates regions in the following priority order:

      1. The region specified when running a rosa command with the --region flag.
      2. The region set in the AWS_DEFAULT_REGION environment variable. See Environment variables to configure the AWS CLI in the AWS documentation.
      3. The default region set in your AWS configuration file. See Quick configuration with aws configure in the AWS documentation.

   3. Optional: Configure your AWS CLI settings and credentials by using an AWS named profile. rosa evaluates AWS named profiles in the following priority order:

      1. The profile specified when running a rosa command with the --profile flag.
      2. The profile set in the AWS_PROFILE environment variable. See Named profiles in the AWS documentation.

   4. Verify the AWS CLI is installed and configured correctly by running the following command to query the AWS API:

      $ aws sts get-caller-identity

      Example output

      ---------------------------------------------------------------------------------
      |                                GetCallerIdentity                              |
      +-------------------------------------------------------------------------------+
      |+-----------------------------------+-----------------------+-----------------+|
      ||      Account        |                Arn              |       UserID        ||
      |+-----------------------------------+-----------------------+-----------------+|
      ||  <account_name>     |  arn:aws:iam<string>:user:name  |      <userID>       ||
      |+-----------------------------------+-----------------------+-----------------+|

      After completing these steps, install ROSA.

Procedure

1. Install rosa, the Red Hat OpenShift Service on AWS command-line interface (CLI).

   1. Download the latest release of the rosa CLI for your operating system.
   2. Optional: Rename the executable file you downloaded to rosa. This documentation uses rosa to refer to the executable file.

   3. Optional: Add rosa to your path.

      Example

      $ mv rosa /usr/local/bin/rosa

   4. Enter the following command to verify your installation:

      $ rosa

      Example output

      Command line tool for ROSA.
      
      Usage:
        rosa [command]
      
      Available Commands:
        completion  Generates bash completion scripts
        create      Create a resource from stdin
        delete      Delete a specific resource
        describe    Show details of a specific resource
        edit        Edit a specific resource
        help        Help about any command
        init        Applies templates to support Managed OpenShift on AWS clusters
        list        List all resources of a specific type
        login       Log in to your Red Hat account
        logout      Log out
        logs        Show logs of a specific resource
        verify      Verify resources are configured correctly for cluster install
        version     Prints the version of the tool
      
      Flags:
            --debug     Enable debug mode.
        -h, --help      help for rosa
        -v, --v Level   log level for V logs
      
      Use "rosa [command] --help" for more information about a command.

   5. Optional: Generate the command completion scripts for the rosa CLI. The following example generates the Bash completion scripts for a Linux machine:

      $ rosa completion bash | sudo tee /etc/bash_completion.d/rosa

   6. Optional: Enable rosa command completion from your existing terminal. The following example enables Bash completion for rosa in an existing terminal on a Linux machine:

      $ source /etc/bash_completion.d/rosa

2. Enter the following command to verify that your AWS account has the necessary permissions.

   $ rosa verify permissions

   Example output

   I: Validating SCP policies...
   I: AWS SCP policies ok

   Note

   This command verifies permissions only for ROSA clusters that do not use the AWS Security Token Service (STS).

3. Log in to your Red Hat account with rosa.

   1. Enter the following command.

      $ rosa login

   2. Replace <my_offline_access_token> with your token.

      Example output

      To login to your Red Hat account, get an offline access token at https://console.redhat.com/openshift/token/rosa
      ? Copy the token and paste it here: <my-offline-access-token>

      Example output continued

      I: Logged in as 'rh-rosa-user' on 'https://api.openshift.com'

4. Verify that your AWS account has the necessary quota to deploy an Red Hat OpenShift Service on AWS cluster.

   $ rosa verify quota --region=us-west-2

   Example output

   I: Validating AWS quota...
   I: AWS quota ok

   Note

   Sometimes your AWS quota varies by region. If you receive any errors, try a different region.

   If you need to increase your quota, go to your AWS console, and request a quota increase for the service that failed.

   After both the permissions and quota checks pass, proceed to the next step.

5. Prepare your AWS account for cluster deployment:

   1. Run the following command to verify your Red Hat and AWS credentials are setup correctly. Check that your AWS Account ID, Default Region and ARN match what you expect. You can safely ignore the rows beginning with OCM for now.

      $ rosa whoami

      Example output

      AWS Account ID:               000000000000
      AWS Default Region:           us-east-2
      AWS ARN:                      arn:aws:iam::000000000000:user/hello
      OCM API:                      https://api.openshift.com
      OCM Account ID:               1DzGIdIhqEWyt8UUXQhSoWaaaaa
      OCM Account Name:             Your Name
      OCM Account Username:         you@domain.com
      OCM Account Email:            you@domain.com
      OCM Organization ID:          1HopHfA2hcmhup5gCr2uH5aaaaa
      OCM Organization Name:        Red Hat
      OCM Organization External ID: 0000000

   2. Initialize your AWS account. This step runs a CloudFormation template that prepares your AWS account for cluster deployment and management. This step typically takes 1-2 minutes to complete.

      $ rosa init

      Example output

      I: Logged in as 'rh-rosa-user' on 'https://api.openshift.com'
      I: Validating AWS credentials...
      I: AWS credentials are valid!
      I: Validating SCP policies...
      I: AWS SCP policies ok
      I: Validating AWS quota...
      I: AWS quota ok
      I: Ensuring cluster administrator user 'osdCcsAdmin'...
      I: Admin user 'osdCcsAdmin' created successfully!
      I: Verifying whether OpenShift command-line tool is available...
      E: OpenShift command-line tool is not installed.
      Run 'rosa download oc' to download the latest version, then add it to your PATH.

6. Install the OpenShift CLI (oc) from the rosa CLI.

   1. Enter this command to download the latest version of the oc CLI:

      $ rosa download oc

   2. After downloading the oc CLI, unzip it and add it to your path.

   3. Enter this command to verify that the oc CLI is installed correctly:

      $ rosa verify oc

Procedure

1. You can create a cluster using the default settings or by specifying custom settings using the interactive mode. To view other options when creating a cluster, enter rosa create cluster --help.

   Creating a cluster can take up to 40 minutes.

   Note

   Multiple availability zones (AZ) are recommended for production workloads. The default is a single availability zone. Use --help for an example of how to set this option manually or use interactive mode to be prompted for this setting.

   • To create your cluster with the default cluster settings:

     $ rosa create cluster --cluster-name=<cluster_name>

     Example output

     I: Creating cluster with identifier '1de87g7c30g75qechgh7l5b2bha6r04e' and name 'rh-rosa-test-cluster1'
     I: To view list of clusters and their status, run `rosa list clusters`
     I: Cluster 'rh-rosa-test-cluster1' has been created.
     I: Once the cluster is 'Ready' you will need to add an Identity Provider and define the list of cluster administrators. See `rosa create idp --help` and `rosa create user --help` for more information.
     I: To determine when your cluster is Ready, run `rosa describe cluster rh-rosa-test-cluster1`.

   • To create a cluster using interactive prompts:

     $ rosa create cluster --interactive

   • To configure your networking IP ranges, you can use the following default ranges. For more information when using manual mode, use rosa create cluster --help | grep cidr. In interactive mode, you are prompted for the settings.

     • Node CIDR: 10.0.0.0/16
     • Service CIDR: 172.30.0.0/16
     • Pod CIDR: 10.128.0.0/14

2. Enter the following command to check the status of your cluster. During cluster creation, the State field from the output will transition from pending to installing, and finally to ready.

   $ rosa describe cluster --cluster=<cluster_name>

   Example output

   Name: rh-rosa-test-cluster1
   OpenShift Version: 4.6.8
   DNS: *.example.com
   ID: uniqueidnumber
   External ID: uniqueexternalidnumber
   AWS Account: 123456789101
   API URL: https://api.rh-rosa-test-cluster1.example.org:6443
   Console URL: https://console-openshift-console.apps.rh-rosa-test-cluster1.example.or
   Nodes: Master: 3, Infra: 2, Compute: 2
   Region: us-west-2
   Multi-AZ: false
   State: ready
   Channel Group: stable
   Private: No
   Created: Jan 15 2021 16:30:55 UTC
   Details Page: https://console.redhat.com/examplename/details/idnumber

   Note

   If installation fails or the State field does not change to ready after 40 minutes, check the installation troubleshooting documentation for more details.

3. Track the progress of the cluster creation by watching the OpenShift installer logs:

   $ rosa logs install --cluster=<cluster_name> --watch

Procedure

1. Enter the following command to revoke the dedicated-admin access of a user:

   $ rosa revoke user dedicated-admin --user=<idp_user_name> --cluster=<cluster_name>

2. Enter the following command to verify that your user no longer has dedicated-admin access. The output does not list the revoked user.

   $ oc get groups dedicated-admins

Procedure

1. Enter the following command to revoke the cluster-admin access of a user:

   $ rosa revoke user cluster-admins --user=myusername --cluster=mycluster

2. Enter the following command to verify that the user no longer has cluster-admin access. The output does not list the revoked user.

   $ oc get groups cluster-admins

Procedure

1. Obtain the cluster ID, the Amazon Resource Names (ARNs) for the cluster-specific Operator roles and the endpoint URL for the OIDC provider:

   $ rosa describe cluster --cluster=<cluster_name> 1

   1

   Replace <cluster_name> with the name of your cluster.

   Example output

   Name:                       mycluster
   ID:                         1s3v4x39lhs8sm49m90mi0822o34544a 1
   ...
   Operator IAM Roles: 2
    - arn:aws:iam::<aws_account_id>:role/mycluster-x4q9-openshift-machine-api-aws-cloud-credentials
    - arn:aws:iam::<aws_account_id>:role/mycluster-x4q9-openshift-cloud-credential-operator-cloud-crede
    - arn:aws:iam::<aws_account_id>:role/mycluster-x4q9-openshift-image-registry-installer-cloud-creden
    - arn:aws:iam::<aws_account_id>:role/mycluster-x4q9-openshift-ingress-operator-cloud-credentials
    - arn:aws:iam::<aws_account_id>:role/mycluster-x4q9-openshift-cluster-csi-drivers-ebs-cloud-credent
    - arn:aws:iam::<aws_account_id>:role/mycluster-x4q9-openshift-cloud-network-config-controller-cloud
   State:                      ready
   Private:                    No
   Created:                    May 13 2022 11:26:15 UTC
   Details Page:               https://console.redhat.com/openshift/details/s/296kyEFwzoy1CREQicFRdZybrc0
   OIDC Endpoint URL:          https://rh-oidc.s3.us-east-1.amazonaws.com/1s5v4k39lhm8sm59m90mi0822o31844a 3

   1

   Lists the cluster ID.

   2

   Specifies the ARNs for the cluster-specific Operator roles. For example, in the sample output the ARN for the role required by the Machine Config Operator is arn:aws:iam::<aws_account_id>:role/mycluster-x4q9-openshift-machine-api-aws-cloud-credentials.

   3

   Specifies the endpoint URL for the cluster-specific OIDC provider.

   Important

   You require the cluster ID to delete the cluster-specific STS resources using the ROSA CLI (rosa) after the cluster is deleted.

2. Delete the cluster:

   • To delete the cluster by using Red Hat OpenShift Cluster Manager:

     1. Navigate to OpenShift Cluster Manager.
     2. Click the Options menu next to your cluster and select Delete cluster.
     3. Type the name of your cluster at the prompt and click Delete.

   • To delete the cluster using the ROSA CLI (rosa):

     1. Enter the following command to delete the cluster and watch the logs, replacing <cluster_name> with the name or ID of your cluster:

        $ rosa delete cluster --cluster=<cluster_name> --watch

        Important

        You must wait for the cluster deletion to complete before you remove the Operator roles and the OIDC provider. The cluster-specific Operator roles are required to clean-up the resources created by the OpenShift Operators. The Operators use the OIDC provider to authenticate.

3. Delete the OIDC provider that the cluster Operators use to authenticate:

   $ rosa delete oidc-provider -c <cluster_id> --mode auto 1

   1

   Replace <cluster_id> with the ID of the cluster.

   Note

   You can use the -y option to automatically answer yes to the prompts.

4. Delete the cluster-specific Operator IAM roles:

   $ rosa delete operator-roles -c <cluster_id> --mode auto 1

   1

   Replace <cluster_id> with the ID of the cluster.