• Home
• Red Hat OpenShift Service on AWS
• Creating a ROSA cluster with PrivateLink enabled

Creating a ROSA cluster with PrivateLink enabled

Prerequisites

• AWS CLI
• Rosa CLI v1.0.8
• jq

Create VPC and Subnets

The following instructions use the AWS CLI to create the necessary networking to deploy a PrivateLink ROSA cluster into a Single AZ and are intended to be a guide. Ideally you would use an Automation tool like Ansible or Terraform to manage your VPCs.

When creating subnets, make sure that subnet(s) are created to an availability zone that has ROSA instances types available. If AZ is not “forced”, subnet is created to random AZ in the region. Force the AZ using --availability-zone argument in create-subnet command.

Use rosa list instance-types to list ROSA instance types and check available types availability in AZ with the following

As an example, you cannot install ROSA to us-east-1e AZ, but us-east-1b works fine.

Option 1 - VPC with a private subnet and AWS Site-to-Site VPN access.

Todo

Option 2 - VPC with public and private subnets and AWS Site-to-Site VPN access

Todo

Option 3 - VPC with public and private subnets (NAT)

This will create both a Private and Public subnet. All cluster resources will live in the private subnet, the public subnet only exists to NAT the egress traffic to the Internet.

1. Set a Cluster name

2. Create a VPC to install a ROSA cluster into

3. Create a Public Subnet for the cluster to NAT egress traffic out of

4. Create a Private Subnet for the cluster machines to live in

5. Create an Internet Gateway for NAT egress traffic

6. Create a Route Table for NAT egress traffic

7. Create a NAT Gateway for the Private network

8. Create a Route Table for the Private subnet to the NAT

Deploy ROSA

1. Create ROSA cluster in the private subnet

Test Connectivity

1. Create an Instance to use as a jump host

   TODO: CLI instructions

   Through the GUI:

   1. Navigate to the EC2 console and launch a new instance

   2. Select the AMI for your instance, if you don’t have a standard, the Amazon Linux 2 AMI works just fine

   3. Choose your instance type, the t2.micro/free tier is sufficient for our needs, and click Next: Configure Instance Details

   4. Change the Network settings to setup this host inside your private-link VPC

   5. Change the Subnet setting to use the private-link-public subnet

   6. Change Auto-assign Public IP to Enable

   7. Default settings for Storage and Tags are OK, if you do not need to change them for your own reasons, select 6. Configure Security Group from the top navigation or click through using the Next buttons

   8. If you already have a security group created to allow access from your computer to AWS, choose Select an existing security group and choose that group from the list and skip to Review and Launch. Otherwise, select Create a new security group and continue.

   9. To allow access only from your current public IP, change the Source heading to use My IP

   10. Click Review and Launch, verify all settings are correct and follow the standard AWS instructions for finalizing the setup and selecting/creating the security keys.

   11. Once launched, open the instance summary for the jump host instance and note the public IP address.

2. Create a ROSA admin user and save the login command for use later

3. Note the DNS name of your private cluster, use the rosa describe command if needed

1. update /etc/hosts to point the openshift domains to localhost. Use the DNS of your openshift cluster as described in the previous step in place of $YOUR_OPENSHIFT_DNS below

2. SSH to that instance, tunneling traffic for the appropriate hostnames. Be sure to use your new/existing private key, the OpenShift DNS for $YOUR_OPENSHIFT_DNS and your jump host IP for $YOUR_EC2_IP

3. Log into the cluster using oc login command from the create admin command above. ex.

4. Check that you can access the Console by opening the console url in your browser.

Cleanup

1. Delete ROSA

2. Delete AWS resources

Adding a Public Ingress endpoint to a ROSA PrivateLink Cluster