Chapter 7. ROSA with HCP clusters without a CNI plugin You can use your own Container Network Interface (CNI) plugin when creating a Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) cluster. You can create a ROSA with HCP cluster without a CNI and install your own CNI plugin after cluster creation. Important For customers who choose to use their own CNI, the responsibility of CNI plugin support belongs to the customer in coordination with their chosen CNI vendor. The default plugin for ROSA with HCP is the OVN-Kubernetes network plugin . This plugin is the only Red Hat supported CNI plugin for ROSA with HCP. If you choose to use your own CNI for ROSA with HCP clusters, it is strongly recommended that you obtain commercial support from the plugin vendor before creating your clusters. Red Hat support cannot assist with CNI-related issues such as pod to pod traffic for customers who choose to use their own CNI. Red Hat still provides support for all non-CNI issues. If you want CNI-related support from Red Hat, you must install the cluster with the default OVN-Kubernetes network plugin. For more information, see the responsibility matrix . 7.1. Creating a ROSA with HCP cluster without a CNI plugin 7.1.1. Prerequisites Ensure that you have completed the AWS prerequisites . Ensure that you have a configured virtual private cloud (VPC). 7.1.2. Creating the account-wide STS roles and policies Before using the Red Hat OpenShift Service on AWS (ROSA) CLI ( rosa ) to create Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) clusters, create the required account-wide roles and policies, including the Operator policies. Note ROSA with HCP clusters require account and Operator roles with AWS managed policies attached. Customer managed policies are not supported. For more information regarding AWS managed policies for ROSA with HCP clusters, see AWS managed policies for ROSA account roles . Prerequisites You have completed the AWS prerequisites for ROSA with HCP. You have available AWS service quotas. You have enabled the ROSA service in the AWS Console. You have installed and configured the latest ROSA CLI ( rosa ) on your installation host. You have logged in to your Red Hat account by using the ROSA CLI. Procedure If they do not exist in your AWS account, create the required account-wide STS roles and attach the policies by running the following command: USD rosa create account-roles --hosted-cp Optional: Set your prefix as an environmental variable by running the following command: USD export ACCOUNT_ROLES_PREFIX=<account_role_prefix> View the value of the variable by running the following command: USD echo USDACCOUNT_ROLES_PREFIX Example output ManagedOpenShift For more information regarding AWS managed IAM policies for ROSA, see AWS managed IAM policies for ROSA . 7.1.3. Creating an OpenID Connect configuration When using a Red Hat OpenShift Service on AWS cluster, you can create the OpenID Connect (OIDC) configuration prior to creating your cluster. This configuration is registered to be used with OpenShift Cluster Manager. Prerequisites You have completed the AWS prerequisites for Red Hat OpenShift Service on AWS. You have installed and configured the latest Red Hat OpenShift Service on AWS (ROSA) CLI, rosa , on your installation host. Procedure To create your OIDC configuration alongside the AWS resources, run the following command: USD rosa create oidc-config --mode=auto --yes This command returns the following information. Example output ? Would you like to create a Managed (Red Hat hosted) OIDC Configuration Yes I: Setting up managed OIDC configuration I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice: rosa create operator-roles --prefix <user-defined> --oidc-config-id 13cdr6b If you are going to create a Hosted Control Plane cluster please include '--hosted-cp' I: Creating OIDC provider using 'arn:aws:iam::4540112244:user/userName' ? Create the OIDC provider? Yes I: Created OIDC provider with ARN 'arn:aws:iam::4540112244:oidc-provider/dvbwgdztaeq9o.cloudfront.net/13cdr6b' When creating your cluster, you must supply the OIDC config ID. The CLI output provides this value for --mode auto , otherwise you must determine these values based on aws CLI output for --mode manual . Optional: you can save the OIDC configuration ID as a variable to use later. Run the following command to save the variable: USD export OIDC_ID=<oidc_config_id> 1 1 In the example output above, the OIDC configuration ID is 13cdr6b. View the value of the variable by running the following command: USD echo USDOIDC_ID Example output 13cdr6b Verification You can list the possible OIDC configurations available for your clusters that are associated with your user organization. Run the following command: USD rosa list oidc-config Example output ID MANAGED ISSUER URL SECRET ARN 2330dbs0n8m3chkkr25gkkcd8pnj3lk2 true https://dvbwgdztaeq9o.cloudfront.net/2330dbs0n8m3chkkr25gkkcd8pnj3lk2 233hvnrjoqu14jltk6lhbhf2tj11f8un false https://oidc-r7u1.s3.us-east-1.amazonaws.com aws:secretsmanager:us-east-1:242819244:secret:rosa-private-key-oidc-r7u1-tM3MDN 7.1.4. Creating Operator roles and policies When using a ROSA with HCP cluster, you must create the Operator IAM roles that are required for Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) deployments. The cluster Operators use the Operator roles to obtain the temporary permissions required to carry out cluster operations, such as managing back-end storage, cloud provider credentials, and external access to a cluster. Prerequisites You have completed the AWS prerequisites for ROSA with HCP. You have installed and configured the latest Red Hat OpenShift Service on AWS ROSA CLI ( rosa ), on your installation host. You created the account-wide AWS roles. Procedure Set your prefix name to an environment variable using the following command: USD export OPERATOR_ROLES_PREFIX=<prefix_name> To create your Operator roles, run the following command: USD rosa create operator-roles --hosted-cp --prefix=USDOPERATOR_ROLES_PREFIX --oidc-config-id=USDOIDC_ID --installer-role-arn arn:aws:iam::USD{AWS_ACCOUNT_ID}:role/USD{ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role The following breakdown provides options for the Operator role creation. USD rosa create operator-roles --hosted-cp --prefix=USDOPERATOR_ROLES_PREFIX 1 --oidc-config-id=USDOIDC_ID 2 --installer-role-arn arn:aws:iam::USD{AWS_ACCOUNT_ID}:role/USD{ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role 3 1 You must supply a prefix when creating these Operator roles. Failing to do so produces an error. See the Additional resources of this section for information on the Operator prefix. 2 This value is the OIDC configuration ID that you created for your ROSA with HCP cluster. 3 This value is the installer role ARN that you created when you created the ROSA account roles. You must include the --hosted-cp parameter to create the correct roles for ROSA with HCP clusters. This command returns the following information. Example output ? Role creation mode: auto ? Operator roles prefix: <pre-filled_prefix> 1 ? OIDC Configuration ID: 23soa2bgvpek9kmes9s7os0a39i13qm4 | https://dvbwgdztaeq9o.cloudfront.net/23soa2bgvpek9kmes9s7os0a39i13qm4 2 ? Create hosted control plane operator roles: Yes W: More than one Installer role found ? Installer role ARN: arn:aws:iam::4540112244:role/<prefix>-HCP-ROSA-Installer-Role ? Permissions boundary ARN (optional): I: Reusable OIDC Configuration detected. Validating trusted relationships to operator roles: I: Creating roles using 'arn:aws:iam::4540112244:user/<userName>' I: Created role '<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials' I: Created role '<prefix>-openshift-cloud-network-config-controller-cloud-credenti' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti' I: Created role '<prefix>-kube-system-kube-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager' I: Created role '<prefix>-kube-system-capa-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager' I: Created role '<prefix>-kube-system-control-plane-operator' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator' I: Created role '<prefix>-kube-system-kms-provider' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider' I: Created role '<prefix>-openshift-image-registry-installer-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials' I: Created role '<prefix>-openshift-ingress-operator-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials' I: To create a cluster with these roles, run the following command: rosa create cluster --sts --oidc-config-id 23soa2bgvpek9kmes9s7os0a39i13qm4 --operator-roles-prefix <prefix> --hosted-cp 1 This field is prepopulated with the prefix that you set in the initial creation command. 2 This field requires you to select an OIDC configuration that you created for your ROSA with HCP cluster. The Operator roles are now created and ready to use for creating your ROSA with HCP cluster. Verification You can list the Operator roles associated with your ROSA account. Run the following command: USD rosa list operator-roles Example output I: Fetching operator roles ROLE PREFIX AMOUNT IN BUNDLE <prefix> 8 ? Would you like to detail a specific prefix Yes 1 ? Operator Role Prefix: <prefix> ROLE NAME ROLE ARN VERSION MANAGED <prefix>-kube-system-capa-controller-manager arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager 4.13 No <prefix>-kube-system-control-plane-operator arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator 4.13 No <prefix>-kube-system-kms-provider arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider 4.13 No <prefix>-kube-system-kube-controller-manager arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager 4.13 No <prefix>-openshift-cloud-network-config-controller-cloud-credenti arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti 4.13 No <prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials 4.13 No <prefix>-openshift-image-registry-installer-cloud-credentials arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials 4.13 No <prefix>-openshift-ingress-operator-cloud-credentials arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials 4.13 No 1 After the command runs, it displays all the prefixes associated with your AWS account and notes how many roles are associated with this prefix. If you need to see all of these roles and their details, enter "Yes" on the detail prompt to have these roles listed out with specifics. Additional resources See About custom Operator IAM role prefixes for information on the Operator prefixes. 7.2. Creating the cluster When using the Red Hat OpenShift Service on AWS (ROSA) command line interface (CLI), rosa , to create a cluster, you can add an optional flag --no-cni to create a cluster without a CNI plugin. Prerequisites You have completed the AWS prerequisites for ROSA with HCP. You have available AWS service quotas. You have enabled the ROSA service in the AWS Console. You have installed and configured the latest ROSA CLI ( rosa ) on your installation host. Run rosa version to see your currently installed version of the ROSA CLI. If a newer version is available, the CLI provides a link to download this upgrade. You have logged in to your Red Hat account by using the ROSA CLI. You have created an OIDC configuration. You have verified that the AWS Elastic Load Balancing (ELB) service role exists in your AWS account. Procedure You can create your ROSA with HCP cluster with one of the following commands. Note When creating a ROSA with HCP cluster, the default machine Classless Inter-Domain Routing (CIDR) is 10.0.0.0/16 . If this does not correspond to the CIDR range for your VPC subnets, add --machine-cidr <address_block> to the following commands. To learn more about the default CIDR ranges for Red Hat OpenShift Service on AWS, see CIDR range definitions . Create a cluster with a single, initial machine pool, publicly available API, publicly available Ingress, and no CNI plugin by running the following command: USD rosa create cluster --cluster-name=<cluster_name> \ --sts --mode=auto --hosted-cp --operator-roles-prefix <operator-role-prefix> \ --oidc-config-id <ID-of-OIDC-configuration> --subnet-ids=<public-subnet-id>,<private-subnet-id> --no-cni Create a cluster with a single, initial machine pool, privately available API, privately available Ingress, and no CNI plugin by running the following command: USD rosa create cluster --private --cluster-name=<cluster_name> \ --sts --mode=auto --hosted-cp --subnet-ids=<private-subnet-id> --no-cni If you used the OIDC_ID , SUBNET_IDS , and OPERATOR_ROLES_PREFIX variables to prepare your environment, you can continue to use those variables when creating your cluster without a CNI plugin. For example, run the following command: USD rosa create cluster --hosted-cp --subnet-ids=USDSUBNET_IDS --oidc-config-id=USDOIDC_ID --cluster-name=<cluster_name> --operator-roles-prefix=USDOPERATOR_ROLES_PREFIX --no-cni Check the status of your cluster by running the following command: USD rosa describe cluster --cluster=<cluster_name> Important When you first log in to the cluster after it reaches ready status, the nodes will still be in the not ready state until you install your own CNI plugin. After CNI installation, the nodes will change to ready . The following State field changes are listed in the output as the cluster installation progresses: pending (Preparing account) installing (DNS setup in progress) installing ready Note If the installation fails or the State field does not change to ready after more than 10 minutes, check the installation troubleshooting documentation for details. For more information, see Troubleshooting installations . For steps to contact Red Hat Support for assistance, see Getting support for Red Hat OpenShift Service on AWS . Track the progress of the cluster creation by watching the Red Hat OpenShift Service on AWS installation program logs. To check the logs, run the following command: USD rosa logs install --cluster=<cluster_name> --watch 1 1 Optional: To watch for new log messages as the installation progresses, use the --watch argument. 7.2.1. Expected behavior for clusters without a CNI plugin Although ROSA with HCP cluster installation is complete, the cluster cannot operate without a CNI plugin. Because the nodes are not ready, the workloads cannot deploy. For example, the Red Hat OpenShift Service on AWS cluster web console is not available, so you must use the OpenShift CLI ( oc ) to log in to the cluster. Additionally, other OpenShift components such as the HAProxy-based Ingress Controller, image registry, and prometheus-based monitoring stack are not running. This is expected behavior until you install a CNI provider. 7.3. steps Install your CNI plugin. The nodes will then change from the not ready to ready state. Access your ROSA cluster with the Accessing a ROSA cluster documentation.

Commands:
rosa create account-roles --hosted-cp
export ACCOUNT_ROLES_PREFIX=<account_role_prefix>
echo USDACCOUNT_ROLES_PREFIX
ManagedOpenShift
rosa create oidc-config --mode=auto --yes
? Would you like to create a Managed (Red Hat hosted) OIDC Configuration Yes I: Setting up managed OIDC configuration I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice: rosa create operator-roles --prefix <user-defined> --oidc-config-id 13cdr6b If you are going to create a Hosted Control Plane cluster please include '--hosted-cp' I: Creating OIDC provider using 'arn:aws:iam::4540112244:user/userName' ? Create the OIDC provider? Yes I: Created OIDC provider with ARN 'arn:aws:iam::4540112244:oidc-provider/dvbwgdztaeq9o.cloudfront.net/13cdr6b'
export OIDC_ID=<oidc_config_id> 1
echo USDOIDC_ID
13cdr6b
rosa list oidc-config
ID MANAGED ISSUER URL SECRET ARN 2330dbs0n8m3chkkr25gkkcd8pnj3lk2 true https://dvbwgdztaeq9o.cloudfront.net/2330dbs0n8m3chkkr25gkkcd8pnj3lk2 233hvnrjoqu14jltk6lhbhf2tj11f8un false https://oidc-r7u1.s3.us-east-1.amazonaws.com aws:secretsmanager:us-east-1:242819244:secret:rosa-private-key-oidc-r7u1-tM3MDN
export OPERATOR_ROLES_PREFIX=<prefix_name>
rosa create operator-roles --hosted-cp --prefix=USDOPERATOR_ROLES_PREFIX --oidc-config-id=USDOIDC_ID --installer-role-arn arn:aws:iam::USD{AWS_ACCOUNT_ID}:role/USD{ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role
rosa create operator-roles --hosted-cp --prefix=USDOPERATOR_ROLES_PREFIX 1 --oidc-config-id=USDOIDC_ID 2 --installer-role-arn arn:aws:iam::USD{AWS_ACCOUNT_ID}:role/USD{ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role 3
? Role creation mode: auto ? Operator roles prefix: <pre-filled_prefix> 1 ? OIDC Configuration ID: 23soa2bgvpek9kmes9s7os0a39i13qm4 | https://dvbwgdztaeq9o.cloudfront.net/23soa2bgvpek9kmes9s7os0a39i13qm4 2 ? Create hosted control plane operator roles: Yes W: More than one Installer role found ? Installer role ARN: arn:aws:iam::4540112244:role/<prefix>-HCP-ROSA-Installer-Role ? Permissions boundary ARN (optional): I: Reusable OIDC Configuration detected. Validating trusted relationships to operator roles: I: Creating roles using 'arn:aws:iam::4540112244:user/<userName>' I: Created role '<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials' I: Created role '<prefix>-openshift-cloud-network-config-controller-cloud-credenti' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti' I: Created role '<prefix>-kube-system-kube-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager' I: Created role '<prefix>-kube-system-capa-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager' I: Created role '<prefix>-kube-system-control-plane-operator' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator' I: Created role '<prefix>-kube-system-kms-provider' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider' I: Created role '<prefix>-openshift-image-registry-installer-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials' I: Created role '<prefix>-openshift-ingress-operator-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials' I: To create a cluster with these roles, run the following command: rosa create cluster --sts --oidc-config-id 23soa2bgvpek9kmes9s7os0a39i13qm4 --operator-roles-prefix <prefix> --hosted-cp
rosa list operator-roles
I: Fetching operator roles ROLE PREFIX AMOUNT IN BUNDLE <prefix> 8 ? Would you like to detail a specific prefix Yes 1 ? Operator Role Prefix: <prefix> ROLE NAME ROLE ARN VERSION MANAGED <prefix>-kube-system-capa-controller-manager arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager 4.13 No <prefix>-kube-system-control-plane-operator arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator 4.13 No <prefix>-kube-system-kms-provider arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider 4.13 No <prefix>-kube-system-kube-controller-manager arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager 4.13 No <prefix>-openshift-cloud-network-config-controller-cloud-credenti arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti 4.13 No <prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials 4.13 No <prefix>-openshift-image-registry-installer-cloud-credentials arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials 4.13 No <prefix>-openshift-ingress-operator-cloud-credentials arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials 4.13 No
rosa create cluster --cluster-name=<cluster_name> --sts --mode=auto --hosted-cp --operator-roles-prefix <operator-role-prefix> --oidc-config-id <ID-of-OIDC-configuration> --subnet-ids=<public-subnet-id>,<private-subnet-id> --no-cni
rosa create cluster --private --cluster-name=<cluster_name> --sts --mode=auto --hosted-cp --subnet-ids=<private-subnet-id> --no-cni
rosa create cluster --hosted-cp --subnet-ids=USDSUBNET_IDS --oidc-config-id=USDOIDC_ID --cluster-name=<cluster_name> --operator-roles-prefix=USDOPERATOR_ROLES_PREFIX --no-cni
rosa describe cluster --cluster=<cluster_name>
rosa logs install --cluster=<cluster_name> --watch 1