Chapter 3. Creating ROSA with HCP clusters using a custom AWS KMS encryption key Create a Red Hat OpenShift Service on AWS (ROSA) with a hosted control planes (HCP) cluster using a custom AWS Key Management Service (KMS) key. 3.1. ROSA with HCP Prerequisites To create a ROSA with HCP cluster, you must have the following items: A configured virtual private cloud (VPC) Account-wide roles An OIDC configuration Operator roles 3.1.1. Creating a Virtual Private Cloud for your ROSA with HCP clusters You must have a Virtual Private Cloud (VPC) to create ROSA with HCP cluster. You can use the following methods to create a VPC: Create a VPC by using a Terraform template Manually create the VPC resources in the AWS console Note The Terraform instructions are for testing and demonstration purposes. Your own installation requires some modifications to the VPC for your own use. You should also ensure that when you use this Terraform script it is in the same region that you intend to install your cluster. In these examples, use us-east-2 . Important Sharing VPCs across multiple AWS accounts is not currently supported for ROSA with HCP. Do not install a ROSA with HCP cluster into subnets shared from another AWS account. See "Are multiple ROSA clusters in a single VPC supported?" for more information. Creating a Virtual Private Cloud using Terraform Terraform is a tool that allows you to create various resources using an established template. The following process uses the default options as required to create a ROSA with HCP cluster. For more information about using Terraform, see the additional resources. Prerequisites You have installed Terraform version 1.4.0 or newer on your machine. You have installed Git on your machine. Procedure Open a shell prompt and clone the Terraform VPC repository by running the following command: USD git clone https://github.com/openshift-cs/terraform-vpc-example Navigate to the created directory by running the following command: USD cd terraform-vpc-example Initiate the Terraform file by running the following command: USD terraform init A message confirming the initialization appears when this process completes. To build your VPC Terraform plan based on the existing Terraform template, run the plan command. You must include your AWS region. You can choose to specify a cluster name. A rosa.tfplan file is added to the hypershift-tf directory after the terraform plan completes. For more detailed options, see the Terraform VPC repository's README file . USD terraform plan -out rosa.tfplan -var region=<region> Apply this plan file to build your VPC by running the following command: USD terraform apply rosa.tfplan Optional: You can capture the values of the Terraform-provisioned private, public, and machinepool subnet IDs as environment variables to use when creating your ROSA with HCP cluster by running the following commands: USD export SUBNET_IDS=USD(terraform output -raw cluster-subnets-string) Verify that the variables were correctly set with the following command: USD echo USDSUBNET_IDS Example output USD subnet-0a6a57e0f784171aa,subnet-078e84e5b10ecf5b0 Additional resources See the Terraform VPC repository for a detailed list of all options available when customizing the VPC for your needs. Creating a Virtual Private Cloud manually If you choose to manually create your Virtual Private Cloud (VPC) instead of using Terraform, go to the VPC page in the AWS console . Your VPC must meet the requirements shown in the following table. Table 3.1. Requirements for your VPC Requirement Details VPC name You need to have the specific VPC name and ID when creating your cluster. CIDR range Your VPC CIDR range should match your machine CIDR. Availability zone You need one availability zone for a single zone, and you need three for availability zones for multi-zone. Public subnet You must have one public subnet with a NAT gateway for public clusters. Private clusters do not need a public subnet. DNS hostname and resolution You must ensure that the DNS hostname and resolution are enabled. Additional resources Get Started with Amazon VPC HashiCorp Terraform documentation 3.1.2. Creating the account-wide STS roles and policies Before using the Red Hat OpenShift Service on AWS (ROSA) CLI ( rosa ) to create Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) clusters, create the required account-wide roles and policies, including the Operator policies. Note ROSA with HCP clusters require account and Operator roles with AWS managed policies attached. Customer managed policies are not supported. For more information regarding AWS managed policies for ROSA with HCP clusters, see AWS managed policies for ROSA account roles . Prerequisites You have completed the AWS prerequisites for ROSA with HCP. You have available AWS service quotas. You have enabled the ROSA service in the AWS Console. You have installed and configured the latest ROSA CLI ( rosa ) on your installation host. You have logged in to your Red Hat account by using the ROSA CLI. Procedure If they do not exist in your AWS account, create the required account-wide STS roles and attach the policies by running the following command: USD rosa create account-roles --hosted-cp Optional: Set your prefix as an environmental variable by running the following command: USD export ACCOUNT_ROLES_PREFIX=<account_role_prefix> View the value of the variable by running the following command: USD echo USDACCOUNT_ROLES_PREFIX Example output ManagedOpenShift For more information regarding AWS managed IAM policies for ROSA, see AWS managed IAM policies for ROSA . 3.1.3. Creating an OpenID Connect configuration When using a Red Hat OpenShift Service on AWS cluster, you can create the OpenID Connect (OIDC) configuration prior to creating your cluster. This configuration is registered to be used with OpenShift Cluster Manager. Prerequisites You have completed the AWS prerequisites for Red Hat OpenShift Service on AWS. You have installed and configured the latest Red Hat OpenShift Service on AWS (ROSA) CLI, rosa , on your installation host. Procedure To create your OIDC configuration alongside the AWS resources, run the following command: USD rosa create oidc-config --mode=auto --yes This command returns the following information. Example output ? Would you like to create a Managed (Red Hat hosted) OIDC Configuration Yes I: Setting up managed OIDC configuration I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice: rosa create operator-roles --prefix <user-defined> --oidc-config-id 13cdr6b If you are going to create a Hosted Control Plane cluster please include '--hosted-cp' I: Creating OIDC provider using 'arn:aws:iam::4540112244:user/userName' ? Create the OIDC provider? Yes I: Created OIDC provider with ARN 'arn:aws:iam::4540112244:oidc-provider/dvbwgdztaeq9o.cloudfront.net/13cdr6b' When creating your cluster, you must supply the OIDC config ID. The CLI output provides this value for --mode auto , otherwise you must determine these values based on aws CLI output for --mode manual . Optional: you can save the OIDC configuration ID as a variable to use later. Run the following command to save the variable: USD export OIDC_ID=<oidc_config_id> 1 1 1 In the example output above, the OIDC configuration ID is 13cdr6b. View the value of the variable by running the following command: USD echo USDOIDC_ID Example output 13cdr6b Verification You can list the possible OIDC configurations available for your clusters that are associated with your user organization. Run the following command: USD rosa list oidc-config Example output ID MANAGED ISSUER URL SECRET ARN 2330dbs0n8m3chkkr25gkkcd8pnj3lk2 true https://dvbwgdztaeq9o.cloudfront.net/2330dbs0n8m3chkkr25gkkcd8pnj3lk2 233hvnrjoqu14jltk6lhbhf2tj11f8un false https://oidc-r7u1.s3.us-east-1.amazonaws.com aws:secretsmanager:us-east-1:242819244:secret:rosa-private-key-oidc-r7u1-tM3MDN 3.1.4. Creating Operator roles and policies When using a ROSA with HCP cluster, you must create the Operator IAM roles that are required for Red Hat OpenShift Service on AWS (ROSA) with hosted control planes (HCP) deployments. The cluster Operators use the Operator roles to obtain the temporary permissions required to carry out cluster operations, such as managing back-end storage, cloud provider credentials, and external access to a cluster. Prerequisites You have completed the AWS prerequisites for ROSA with HCP. You have installed and configured the latest Red Hat OpenShift Service on AWS ROSA CLI ( rosa ), on your installation host. You created the account-wide AWS roles. Procedure Set your prefix name to an environment variable using the following command: USD export OPERATOR_ROLES_PREFIX=<prefix_name> To create your Operator roles, run the following command: USD rosa create operator-roles --hosted-cp --prefix=USDOPERATOR_ROLES_PREFIX --oidc-config-id=USDOIDC_ID --installer-role-arn arn:aws:iam::USD{AWS_ACCOUNT_ID}:role/USD{ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role The following breakdown provides options for the Operator role creation. USD rosa create operator-roles --hosted-cp --prefix=USDOPERATOR_ROLES_PREFIX 1 --oidc-config-id=USDOIDC_ID 2 --installer-role-arn arn:aws:iam::USD{AWS_ACCOUNT_ID}:role/USD{ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role 3 1 You must supply a prefix when creating these Operator roles. Failing to do so produces an error. See the Additional resources of this section for information on the Operator prefix. 2 This value is the OIDC configuration ID that you created for your ROSA with HCP cluster. 3 This value is the installer role ARN that you created when you created the ROSA account roles. You must include the --hosted-cp parameter to create the correct roles for ROSA with HCP clusters. This command returns the following information. Example output ? Role creation mode: auto ? Operator roles prefix: <pre-filled_prefix> 1 ? OIDC Configuration ID: 23soa2bgvpek9kmes9s7os0a39i13qm4 | https://dvbwgdztaeq9o.cloudfront.net/23soa2bgvpek9kmes9s7os0a39i13qm4 2 ? Create hosted control plane operator roles: Yes W: More than one Installer role found ? Installer role ARN: arn:aws:iam::4540112244:role/<prefix>-HCP-ROSA-Installer-Role ? Permissions boundary ARN (optional): I: Reusable OIDC Configuration detected. Validating trusted relationships to operator roles: I: Creating roles using 'arn:aws:iam::4540112244:user/<userName>' I: Created role '<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials' I: Created role '<prefix>-openshift-cloud-network-config-controller-cloud-credenti' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti' I: Created role '<prefix>-kube-system-kube-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager' I: Created role '<prefix>-kube-system-capa-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager' I: Created role '<prefix>-kube-system-control-plane-operator' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator' I: Created role '<prefix>-kube-system-kms-provider' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider' I: Created role '<prefix>-openshift-image-registry-installer-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials' I: Created role '<prefix>-openshift-ingress-operator-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials' I: To create a cluster with these roles, run the following command: rosa create cluster --sts --oidc-config-id 23soa2bgvpek9kmes9s7os0a39i13qm4 --operator-roles-prefix <prefix> --hosted-cp 1 This field is prepopulated with the prefix that you set in the initial creation command. 2 This field requires you to select an OIDC configuration that you created for your ROSA with HCP cluster. The Operator roles are now created and ready to use for creating your ROSA with HCP cluster. Verification You can list the Operator roles associated with your ROSA account. Run the following command: USD rosa list operator-roles Example output I: Fetching operator roles ROLE PREFIX AMOUNT IN BUNDLE <prefix> 8 ? Would you like to detail a specific prefix Yes 1 ? Operator Role Prefix: <prefix> ROLE NAME ROLE ARN VERSION MANAGED <prefix>-kube-system-capa-controller-manager arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager 4.13 No <prefix>-kube-system-control-plane-operator arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator 4.13 No <prefix>-kube-system-kms-provider arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider 4.13 No <prefix>-kube-system-kube-controller-manager arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager 4.13 No <prefix>-openshift-cloud-network-config-controller-cloud-credenti arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti 4.13 No <prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials 4.13 No <prefix>-openshift-image-registry-installer-cloud-credentials arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials 4.13 No <prefix>-openshift-ingress-operator-cloud-credentials arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials 4.13 No 1 After the command runs, it displays all the prefixes associated with your AWS account and notes how many roles are associated with this prefix. If you need to see all of these roles and their details, enter "Yes" on the detail prompt to have these roles listed out with specifics. 3.1.5. Creating a ROSA cluster using a custom AWS KMS key You can create a Red Hat OpenShift Service on AWS (ROSA) cluster with a customer-provided KMS key that is used to encrypt either node root volumes, the etcd database, or both. A different KMS key ARN can be provided for each option. Note ROSA with HCP does not automatically configure the default storage class to encrypt persistent volumes with the customer-provided KMS key. This is something that can be configured in-cluster after installation. Procedure Create a custom AWS customer-managed KMS key by running the following command: USD KMS_ARN=USD(aws kms create-key --region USDAWS_REGION --description 'Custom ROSA Encryption Key' --tags TagKey=red-hat,TagValue=true --query KeyMetadata.Arn --output text) This command saves the Amazon Resource Name (ARN) output of this custom key for further steps. Note Customers must provide the --tags TagKey=red-hat,TagValue=true argument that is required for a customer KMS key. Verify the KMS key has been created by running the following command: USD echo USDKMS_ARN Set your AWS account ID to an environment variable. USD AWS_ACCOUNT_ID=<aws_account_id> Add the ARN for the account-wide installer role and operator roles that you created in the preceding step to the Statement.Principal.AWS section in the file. In the following example, the ARN for the default ManagedOpenShift-HCP-ROSA-Installer-Role role is added: { "Version": "2012-10-17", "Id": "key-rosa-policy-1", "Statement": [ { "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::USD{AWS_ACCOUNT_ID}:root" }, "Action": "kms:*", "Resource": "*" }, { "Sid": "Installer Permissions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::USD{AWS_ACCOUNT_ID}:role/ManagedOpenShift-HCP-ROSA-Installer-Role" }, "Action": [ "kms:CreateGrant", "kms:DescribeKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*" }, { "Sid": "ROSA KubeControllerManager Permissions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::USD{AWS_ACCOUNT_ID}:role/<operator_role_prefix>-kube-system-kube-controller-manager" }, "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "ROSA KMS Provider Permissions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::USD{AWS_ACCOUNT_ID}:role/<operator_role_prefix>-kube-system-kms-provider" }, "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:DescribeKey" ], "Resource": "*" }, { "Sid": "ROSA NodeManager Permissions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::USD{AWS_ACCOUNT_ID}:role/<operator_role_prefix>-kube-system-capa-controller-manager" }, "Action": [ "kms:DescribeKey", "kms:GenerateDataKeyWithoutPlaintext", "kms:CreateGrant" ], "Resource": "*" } ] } Confirm the details of the policy file created by running the following command: USD cat rosa-key-policy.json Apply the newly generated key policy to the custom KMS key by running the following command: USD aws kms put-key-policy --key-id USDKMS_ARN \ --policy file://rosa-key-policy.json \ --policy-name default Create the cluster by running the following command: Note If your cluster name is longer than 15 characters, it will contain an autogenerated domain prefix as a sub-domain for your provisioned cluster on *.openshiftapps.com . To customize the subdomain, use the --domain-prefix flag. The domain prefix cannot be longer than 15 characters, must be unique, and cannot be changed after cluster creation. USD rosa create cluster --cluster-name <cluster_name> \ --subnet-ids <private_subnet_id>,<public_subnet_id> \ --sts \ --mode auto \ --machine-cidr 10.0.0.0/16 \ --compute-machine-type m5.xlarge \ --hosted-cp \ --region <aws_region> \ --oidc-config-id USDOIDC_ID \ --kms-key-arn USDKMS_ARN \ 1 --etcd-encryption-kms-arn USDKMS_ARN \ 2 --operator-roles-prefix USDOPERATOR_ROLES_PREFIX 1 This KMS key ARN is used to encrypt all worker node root volumes. It is not required if only etcd database encryption is needed. 2 This KMS key ARN is used to encrypt the etcd database. The etcd database is always encrypted by default with an AES cipher block, but can be encrypted instead with a KMS key. It is not required if only node root volume encryption is needed. Verification You can verify that your KMS key works by using OpenShift Cluster Manager . Navigate to OpenShift Cluster Manager and select Instances . Select your instance. Click the Storage tab. Copy the KMS key ID . Search and select Key Management Service . Enter your copied KMS key ID in the Filter field. 3.2. steps Accessing a ROSA cluster 3.3. Additional resources For information on using the CLI to create a cluster, see Creating a ROSA with HCP cluster using the CLI . For steps to deploy a ROSA cluster using manual mode, see Creating a cluster using customizations . For more information about the AWS Identity Access Management (IAM) resources required to deploy Red Hat OpenShift Service on AWS with STS, see About IAM resources for clusters that use STS . For details about optionally setting an Operator role name prefix, see About custom Operator IAM role prefixes . For information about the prerequisites to installing ROSA with STS, see AWS prerequisites for ROSA with STS . For details about using the auto and manual modes to create the required STS resources, see Understanding the auto and manual deployment modes . For more information about using OpenID Connect (OIDC) identity providers in AWS IAM, see Creating OpenID Connect (OIDC) identity providers . For more information about troubleshooting ROSA cluster installations, see Troubleshooting ROSA with HCP cluster installations . For steps to contact Red Hat Support for assistance, see Getting support for Red Hat OpenShift Service on AWS .

Commands:
git clone https://github.com/openshift-cs/terraform-vpc-example
cd terraform-vpc-example
terraform init
terraform plan -out rosa.tfplan -var region=<region>
terraform apply rosa.tfplan
export SUBNET_IDS=USD(terraform output -raw cluster-subnets-string)
echo USDSUBNET_IDS
subnet-0a6a57e0f784171aa,subnet-078e84e5b10ecf5b0
rosa create account-roles --hosted-cp
export ACCOUNT_ROLES_PREFIX=<account_role_prefix>
echo USDACCOUNT_ROLES_PREFIX
ManagedOpenShift
rosa create oidc-config --mode=auto --yes
? Would you like to create a Managed (Red Hat hosted) OIDC Configuration Yes I: Setting up managed OIDC configuration I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice: rosa create operator-roles --prefix <user-defined> --oidc-config-id 13cdr6b If you are going to create a Hosted Control Plane cluster please include '--hosted-cp' I: Creating OIDC provider using 'arn:aws:iam::4540112244:user/userName' ? Create the OIDC provider? Yes I: Created OIDC provider with ARN 'arn:aws:iam::4540112244:oidc-provider/dvbwgdztaeq9o.cloudfront.net/13cdr6b'
export OIDC_ID=<oidc_config_id> 1
echo USDOIDC_ID
13cdr6b
rosa list oidc-config
ID MANAGED ISSUER URL SECRET ARN 2330dbs0n8m3chkkr25gkkcd8pnj3lk2 true https://dvbwgdztaeq9o.cloudfront.net/2330dbs0n8m3chkkr25gkkcd8pnj3lk2 233hvnrjoqu14jltk6lhbhf2tj11f8un false https://oidc-r7u1.s3.us-east-1.amazonaws.com aws:secretsmanager:us-east-1:242819244:secret:rosa-private-key-oidc-r7u1-tM3MDN
export OPERATOR_ROLES_PREFIX=<prefix_name>
rosa create operator-roles --hosted-cp --prefix=USDOPERATOR_ROLES_PREFIX --oidc-config-id=USDOIDC_ID --installer-role-arn arn:aws:iam::USD{AWS_ACCOUNT_ID}:role/USD{ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role
rosa create operator-roles --hosted-cp --prefix=USDOPERATOR_ROLES_PREFIX 1 --oidc-config-id=USDOIDC_ID 2 --installer-role-arn arn:aws:iam::USD{AWS_ACCOUNT_ID}:role/USD{ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role 3
? Role creation mode: auto ? Operator roles prefix: <pre-filled_prefix> 1 ? OIDC Configuration ID: 23soa2bgvpek9kmes9s7os0a39i13qm4 | https://dvbwgdztaeq9o.cloudfront.net/23soa2bgvpek9kmes9s7os0a39i13qm4 2 ? Create hosted control plane operator roles: Yes W: More than one Installer role found ? Installer role ARN: arn:aws:iam::4540112244:role/<prefix>-HCP-ROSA-Installer-Role ? Permissions boundary ARN (optional): I: Reusable OIDC Configuration detected. Validating trusted relationships to operator roles: I: Creating roles using 'arn:aws:iam::4540112244:user/<userName>' I: Created role '<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials' I: Created role '<prefix>-openshift-cloud-network-config-controller-cloud-credenti' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti' I: Created role '<prefix>-kube-system-kube-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager' I: Created role '<prefix>-kube-system-capa-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager' I: Created role '<prefix>-kube-system-control-plane-operator' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator' I: Created role '<prefix>-kube-system-kms-provider' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider' I: Created role '<prefix>-openshift-image-registry-installer-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials' I: Created role '<prefix>-openshift-ingress-operator-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials' I: To create a cluster with these roles, run the following command: rosa create cluster --sts --oidc-config-id 23soa2bgvpek9kmes9s7os0a39i13qm4 --operator-roles-prefix <prefix> --hosted-cp
rosa list operator-roles
I: Fetching operator roles ROLE PREFIX AMOUNT IN BUNDLE <prefix> 8 ? Would you like to detail a specific prefix Yes 1 ? Operator Role Prefix: <prefix> ROLE NAME ROLE ARN VERSION MANAGED <prefix>-kube-system-capa-controller-manager arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager 4.13 No <prefix>-kube-system-control-plane-operator arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator 4.13 No <prefix>-kube-system-kms-provider arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider 4.13 No <prefix>-kube-system-kube-controller-manager arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager 4.13 No <prefix>-openshift-cloud-network-config-controller-cloud-credenti arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti 4.13 No <prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials 4.13 No <prefix>-openshift-image-registry-installer-cloud-credentials arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials 4.13 No <prefix>-openshift-ingress-operator-cloud-credentials arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials 4.13 No
KMS_ARN=USD(aws kms create-key --region USDAWS_REGION --description 'Custom ROSA Encryption Key' --tags TagKey=red-hat,TagValue=true --query KeyMetadata.Arn --output text)
echo USDKMS_ARN
AWS_ACCOUNT_ID=<aws_account_id>
{ "Version": "2012-10-17", "Id": "key-rosa-policy-1", "Statement": [ { "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::USD{AWS_ACCOUNT_ID}:root" }, "Action": "kms:*", "Resource": "*" }, { "Sid": "Installer Permissions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::USD{AWS_ACCOUNT_ID}:role/ManagedOpenShift-HCP-ROSA-Installer-Role" }, "Action": [ "kms:CreateGrant", "kms:DescribeKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*" }, { "Sid": "ROSA KubeControllerManager Permissions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::USD{AWS_ACCOUNT_ID}:role/<operator_role_prefix>-kube-system-kube-controller-manager" }, "Action": "kms:DescribeKey", "Resource": "*" }, { "Sid": "ROSA KMS Provider Permissions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::USD{AWS_ACCOUNT_ID}:role/<operator_role_prefix>-kube-system-kms-provider" }, "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:DescribeKey" ], "Resource": "*" }, { "Sid": "ROSA NodeManager Permissions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::USD{AWS_ACCOUNT_ID}:role/<operator_role_prefix>-kube-system-capa-controller-manager" }, "Action": [ "kms:DescribeKey", "kms:GenerateDataKeyWithoutPlaintext", "kms:CreateGrant" ], "Resource": "*" } ] }
cat rosa-key-policy.json
aws kms put-key-policy --key-id USDKMS_ARN --policy file://rosa-key-policy.json --policy-name default
rosa create cluster --cluster-name <cluster_name> --subnet-ids <private_subnet_id>,<public_subnet_id> --sts --mode auto --machine-cidr 10.0.0.0/16 --compute-machine-type m5.xlarge --hosted-cp --region <aws_region> --oidc-config-id USDOIDC_ID --kms-key-arn USDKMS_ARN \ 1 --etcd-encryption-kms-arn USDKMS_ARN \ 2 --operator-roles-prefix USDOPERATOR_ROLES_PREFIX