Chapter 2. Comprehensive guide to getting started with Red Hat OpenShift Service on AWS Note If you are looking for a quickstart guide for ROSA, see Red Hat OpenShift Service on AWS quickstart guide . Follow this getting started document to create a Red Hat OpenShift Service on AWS (ROSA) cluster, grant user access, deploy your first application, and learn how to revoke user access and delete your cluster. You can create a ROSA cluster either with or without the AWS Security Token Service (STS). The procedures in this document enable you to create a cluster that uses AWS STS. For more information about using AWS STS with ROSA clusters, see Using the AWS Security Token Service . 2.1. Prerequisites You reviewed the introduction to Red Hat OpenShift Service on AWS (ROSA) , and the documentation on ROSA architecture models and architecture concepts . You have read the documentation on limits and scalability and the guidelines for planning your environment . You have reviewed the detailed AWS prerequisites for ROSA with STS . You have the AWS service quotas that are required to run a ROSA cluster . 2.2. Setting up the environment Before you create a Red Hat OpenShift Service on AWS (ROSA) cluster, you must set up your environment by completing the following tasks: Verify ROSA prerequisites against your AWS and Red Hat accounts. Install and configure the required command line interface (CLI) tools. Verify the configuration of the CLI tools. You can follow the procedures in this section to complete these setup requirements. 2.2.1. Verifying ROSA prerequisites Use the steps in this procedure to enable Red Hat OpenShift Service on AWS (ROSA) in your AWS account. Prerequisites You have a Red Hat account. You have an AWS account. Note Consider using a dedicated AWS account to run production clusters. If you are using AWS Organizations, you can use an AWS account within your organization or create a new one . Procedure Sign in to the AWS Management Console . Navigate to the ROSA service . Click Get started . The Verify ROSA prerequisites page opens. Under ROSA enablement , ensure that a green check mark and You previously enabled ROSA are displayed. If not, follow these steps: Select the checkbox beside I agree to share my contact information with Red Hat . Click Enable ROSA . After a short wait, a green check mark and You enabled ROSA message are displayed. Under Service Quotas , ensure that a green check and Your quotas meet the requirements for ROSA are displayed. If you see Your quotas don't meet the minimum requirements , take note of the quota type and the minimum listed in the error message. See Amazon's documentation on requesting a quota increase for guidance. It may take several hours for Amazon to approve your quota request. Under ELB service-linked role , ensure that a green check mark and AWSServiceRoleForElasticLoadBalancing already exists are displayed. Click Continue to Red Hat . The Get started with Red Hat OpenShift Service on AWS (ROSA) page opens in a new tab. You have already completed Step 1 on this page, and can now continue with Step 2. Additional resources Troubleshoot ROSA enablement errors 2.2.2. Installing and configuring the required CLI tools Several command line interface (CLI) tools are required to deploy and work with your cluster. Prerequisites You have an AWS account. You have a Red Hat account. Procedure Log in to your Red Hat and AWS accounts to access the download page for each required tool. Log in to your Red Hat account at console.redhat.com . Log in to your AWS account at aws.amazon.com . Install and configure the latest AWS CLI ( aws ). Install the AWS CLI by following the AWS Command Line Interface documentation appropriate for your workstation. Configure the AWS CLI by specifying your aws_access_key_id , aws_secret_access_key , and region in the .aws/credentials file. For more information, see AWS Configuration basics in the AWS documentation. Note You can optionally use the AWS_DEFAULT_REGION environment variable to set the default AWS region. Query the AWS API to verify if the AWS CLI is installed and configured correctly: USD aws sts get-caller-identity --output text Example output <aws_account_id> arn:aws:iam::<aws_account_id>:user/<username> <aws_user_id> Install and configure the latest ROSA CLI ( rosa ). Navigate to Downloads . Find Red Hat OpenShift Service on AWS command line interface (`rosa) in the list of tools and click Download . The rosa-linux.tar.gz file is downloaded to your default download location. Extract the rosa binary file from the downloaded archive. The following example extracts the binary from a Linux tar archive: USD tar xvf rosa-linux.tar.gz Move the rosa binary file to a directory in your execution path. In the following example, the /usr/local/bin directory is included in the path of the user: USD sudo mv rosa /usr/local/bin/rosa Verify that the ROSA CLI is installed correctly by querying the rosa version: USD rosa version Example output 1.2.47 Your ROSA CLI is up to date. Log in to the ROSA CLI using an offline access token. Run the login command: USD rosa login Example output To login to your Red Hat account, get an offline access token at https://console.redhat.com/openshift/token/rosa ? Copy the token and paste it here: Navigate to the URL listed in the command output to view your offline access token. Enter the offline access token at the command line prompt to log in. ? Copy the token and paste it here: ******************* [full token length omitted] Note In the future you can specify the offline access token by using the --token="<offline_access_token>" argument when you run the rosa login command. Verify that you are logged in and confirm that your credentials are correct before proceeding: USD rosa whoami Example output AWS Account ID: <aws_account_number> AWS Default Region: us-east-1 AWS ARN: arn:aws:iam::<aws_account_number>:user/<aws_user_name> OCM API: https://api.openshift.com OCM Account ID: <red_hat_account_id> OCM Account Name: Your Name OCM Account Username: you@domain.com OCM Account Email: you@domain.com OCM Organization ID: <org_id> OCM Organization Name: Your organization OCM Organization External ID: <external_org_id> Install and configure the latest OpenShift CLI ( oc ). Use the ROSA CLI to download the oc CLI. The following command downloads the latest version of the CLI to the current working directory: USD rosa download openshift-client Extract the oc binary file from the downloaded archive. The following example extracts the files from a Linux tar archive: USD tar xvf openshift-client-linux.tar.gz Move the oc binary to a directory in your execution path. In the following example, the /usr/local/bin directory is included in the path of the user: USD sudo mv oc /usr/local/bin/oc Verify that the oc CLI is installed correctly: USD rosa verify openshift-client Example output I: Verifying whether OpenShift command-line tool is available... I: Current OpenShift Client Version: 4.17.3 2.3. Creating a ROSA cluster with STS Choose from one of the following methods to deploy a Red Hat OpenShift Service on AWS (ROSA) cluster that uses the AWS Security Token Service (STS). In each scenario, you can deploy your cluster by using Red Hat OpenShift Cluster Manager or the ROSA CLI ( rosa ): Creating a ROSA cluster with STS using the default options : You can create a ROSA cluster with STS quickly by using the default options and automatic STS resource creation. Creating a ROSA cluster with STS using customizations : You can create a ROSA cluster with STS using customizations. You can also choose between the auto and manual modes when creating the required STS resources. Additional resources For detailed steps to deploy a ROSA cluster without STS, see Creating a ROSA cluster without AWS STS and Creating an AWS PrivateLink cluster on ROSA . For information about the account-wide IAM roles and policies that are required for ROSA deployments that use STS, see Account-wide IAM role and policy reference . For details about using the auto and manual modes to create the required STS resources, see Understanding the auto and manual deployment modes . For information about the update life cycle for ROSA, see Red Hat OpenShift Service on AWS update life cycle . 2.4. Creating a cluster administrator user for quick cluster access Before configuring an identity provider, you can create a user with cluster-admin privileges for immediate access to your Red Hat OpenShift Service on AWS (ROSA) cluster. Note The cluster administrator user is useful when you need quick access to a newly deployed cluster. However, consider configuring an identity provider and granting cluster administrator privileges to the identity provider users as required. For more information about setting up an identity provider for your ROSA cluster, see Configuring an identity provider and granting cluster access . Prerequisites You have an AWS account. You installed and configured the latest Red Hat OpenShift Service on AWS (ROSA) CLI, rosa , on your workstation. You logged in to your Red Hat account using the ROSA CLI ( rosa ). You created a ROSA cluster. Procedure Create a cluster administrator user: USD rosa create admin --cluster=<cluster_name> 1 1 Replace <cluster_name> with the name of your cluster. Example output W: It is recommended to add an identity provider to login to this cluster. See 'rosa create idp --help' for more information. I: Admin account has been added to cluster '<cluster_name>'. I: Please securely store this generated password. If you lose this password you can delete and recreate the cluster admin user. I: To login, run the following command: oc login https://api.example-cluster.wxyz.p1.openshiftapps.com:6443 --username cluster-admin --password d7Rca-Ba4jy-YeXhs-WU42J I: It may take up to a minute for the account to become active. Note It might take approximately one minute for the cluster-admin user to become active. Log in to the cluster through the CLI: Run the command provided in the output of the preceding step to log in: USD oc login <api_url> --username cluster-admin --password <cluster_admin_password> 1 1 Replace <api_url> and <cluster_admin_password> with the API URL and cluster administrator password for your environment. Verify if you are logged in to the ROSA cluster as the cluster-admin user: USD oc whoami Example output cluster-admin Additional resource For steps to log in to the ROSA web console, see Accessing a cluster through the web console 2.5. Configuring an identity provider and granting cluster access Red Hat OpenShift Service on AWS (ROSA) includes a built-in OAuth server. After your ROSA cluster is created, you must configure OAuth to use an identity provider. You can then add members to your configured identity provider to grant them access to your cluster. You can also grant the identity provider users with cluster-admin or dedicated-admin privileges as required. 2.5.1. Configuring an identity provider You can configure different identity provider types for your Red Hat OpenShift Service on AWS (ROSA) cluster. Supported types include GitHub, GitHub Enterprise, GitLab, Google, LDAP, OpenID Connect and htpasswd identity providers. Important The htpasswd identity provider option is included only to enable the creation of a single, static administration user. htpasswd is not supported as a general-use identity provider for Red Hat OpenShift Service on AWS. The following procedure configures a GitHub identity provider as an example. Prerequisites You have an AWS account. You installed and configured the latest Red Hat OpenShift Service on AWS (ROSA) CLI, rosa , on your workstation. You logged in to your Red Hat account using the ROSA CLI ( rosa ). You created a ROSA cluster. You have a GitHub user account. Procedure Go to github.com and log in to your GitHub account. If you do not have an existing GitHub organization to use for identity provisioning for your ROSA cluster, create one. Follow the steps in the GitHub documentation . Configure a GitHub identity provider for your cluster that is restricted to the members of your GitHub organization. Configure an identity provider using the interactive mode: USD rosa create idp --cluster=<cluster_name> --interactive 1 1 Replace <cluster_name> with the name of your cluster. Example output I: Interactive mode enabled. Any optional fields can be left empty and a default will be selected. ? Type of identity provider: github ? Identity provider name: github-1 ? Restrict to members of: organizations ? GitHub organizations: <github_org_name> 1 ? To use GitHub as an identity provider, you must first register the application: - Open the following URL: https://github.com/organizations/<github_org_name>/settings/applications/new?oauth_application%5Bcallback_url%5D=https%3A%2F%2Foauth-openshift.apps.<cluster_name>/<random_string>.p1.openshiftapps.com%2Foauth2callback%2Fgithub-1&oauth_application%5Bname%5D=<cluster_name>&oauth_application%5Burl%5D=https%3A%2F%2Fconsole-openshift-console.apps.<cluster_name>/<random_string>.p1.openshiftapps.com - Click on 'Register application' ... 1 Replace <github_org_name> with the name of your GitHub organization. Follow the URL in the output and select Register application to register a new OAuth application in your GitHub organization. By registering the application, you enable the OAuth server that is built into ROSA to authenticate members of your GitHub organization into your cluster. Note The fields in the Register a new OAuth application GitHub form are automatically filled with the required values through the URL defined by the ROSA CLI. Use the information from your GitHub OAuth application page to populate the remaining rosa create idp interactive prompts. Continued example output ... ? Client ID: <github_client_id> 1 ? Client Secret: [? for help] <github_client_secret> 2 ? GitHub Enterprise Hostname (optional): ? Mapping method: claim 3 I: Configuring IDP for cluster '<cluster_name>' I: Identity Provider 'github-1' has been created. It will take up to 1 minute for this configuration to be enabled. To add cluster administrators, see 'rosa grant user --help'. To login into the console, open https://console-openshift-console.apps.<cluster_name>.<random_string>.p1.openshiftapps.com and click on github-1. 1 Replace <github_client_id> with the client ID for your GitHub OAuth application. 2 Replace <github_client_secret> with a client secret for your GitHub OAuth application. 3 Specify claim as the mapping method. Note It might take approximately two minutes for the identity provider configuration to become active. If you have configured a cluster-admin user, you can watch the OAuth pods redeploy with the updated configuration by running oc get pods -n openshift-authentication --watch . Enter the following command to verify that the identity provider has been configured correctly: USD rosa list idps --cluster=<cluster_name> Example output NAME TYPE AUTH URL github-1 GitHub https://oauth-openshift.apps.<cluster_name>.<random_string>.p1.openshiftapps.com/oauth2callback/github-1 Additional resource For detailed steps to configure each of the supported identity provider types, see Configuring identity providers for STS 2.5.2. Granting user access to a cluster You can grant a user access to your Red Hat OpenShift Service on AWS (ROSA) cluster by adding them to your configured identity provider. You can configure different types of identity providers for your ROSA cluster. The following example procedure adds a user to a GitHub organization that is configured for identity provision to the cluster. Prerequisites You have an AWS account. You installed and configured the latest Red Hat OpenShift Service on AWS (ROSA) CLI, rosa , on your workstation. You logged in to your Red Hat account using the ROSA CLI ( rosa ). You created a ROSA cluster. You have a GitHub user account. You have configured a GitHub identity provider for your cluster. Procedure Navigate to github.com and log in to your GitHub account. Invite users that require access to the ROSA cluster to your GitHub organization. Follow the steps in Inviting users to join your organization in the GitHub documentation. 2.5.3. Granting administrator privileges to a user After you have added a user to your configured identity provider, you can grant the user cluster-admin or dedicated-admin privileges for your Red Hat OpenShift Service on AWS (ROSA) cluster. Prerequisites You have an AWS account. You installed and configured the latest Red Hat OpenShift Service on AWS (ROSA) CLI, rosa , on your workstation. You logged in to your Red Hat account using the ROSA CLI ( rosa ). You created a ROSA cluster. You have configured a GitHub identity provider for your cluster and added identity provider users. Procedure To configure cluster-admin privileges for an identity provider user: Grant the user cluster-admin privileges: USD rosa grant user cluster-admin --user=<idp_user_name> --cluster=<cluster_name> 1 1 Replace <idp_user_name> and <cluster_name> with the name of the identity provider user and your cluster name. Example output I: Granted role 'cluster-admins' to user '<idp_user_name>' on cluster '<cluster_name>' Verify if the user is listed as a member of the cluster-admins group: USD rosa list users --cluster=<cluster_name> Example output ID GROUPS <idp_user_name> cluster-admins To configure dedicated-admin privileges for an identity provider user: Grant the user dedicated-admin privileges: USD rosa grant user dedicated-admin --user=<idp_user_name> --cluster=<cluster_name> Example output I: Granted role 'dedicated-admins' to user '<idp_user_name>' on cluster '<cluster_name>' Verify if the user is listed as a member of the dedicated-admins group: USD rosa list users --cluster=<cluster_name> Example output ID GROUPS <idp_user_name> dedicated-admins Additional resources Cluster administration role Customer administrator user 2.6. Accessing a cluster through the web console After you have created a cluster administrator user or added a user to your configured identity provider, you can log into your Red Hat OpenShift Service on AWS (ROSA) cluster through the web console. Prerequisites You have an AWS account. You installed and configured the latest Red Hat OpenShift Service on AWS (ROSA) CLI, rosa , on your workstation. You logged in to your Red Hat account using the ROSA CLI ( rosa ). You created a ROSA cluster. You have created a cluster administrator user or added your user account to the configured identity provider. Procedure Obtain the console URL for your cluster: USD rosa describe cluster -c <cluster_name> | grep Console 1 1 Replace <cluster_name> with the name of your cluster. Example output Console URL: https://console-openshift-console.apps.example-cluster.wxyz.p1.openshiftapps.com Go to the console URL in the output of the preceding step and log in. If you created a cluster-admin user, log in by using the provided credentials. If you configured an identity provider for your cluster, select the identity provider name in the Log in with... dialog and complete any authorization requests that are presented by your provider. 2.7. Deploying an application from the Developer Catalog From the Red Hat OpenShift Service on AWS web console, you can deploy a test application from the Developer Catalog and expose it with a route. Prerequisites You logged in to the Red Hat Hybrid Cloud Console . You created a Red Hat OpenShift Service on AWS cluster. You configured an identity provider for your cluster. You added your user account to the configured identity provider. Procedure Go to the Cluster List page in OpenShift Cluster Manager . Click the options icon (...) to the cluster you want to view. Click Open console . Your cluster console opens in a new browser window. Log in to your Red Hat account with your configured identity provider credentials. In the Administrator perspective, select Home Projects Create Project . Enter a name for your project and optionally add a Display Name and Description . Click Create to create the project. Switch to the Developer perspective and select +Add . Verify that the selected Project is the one that you just created. In the Developer Catalog dialog, select All services . In the Developer Catalog page, select Languages JavaScript from the menu. Click Node.js , and then click Create to open the Create Source-to-Image application page. Note You might need to click Clear All Filters to display the Node.js option. In the Git section, click Try sample . Add a unique name in the Name field. The value will be used to name the associated resources. Confirm that Deployment and Create a route are selected. Click Create to deploy the application. It will take a few minutes for the pods to deploy. Optional: Check the status of the pods in the Topology pane by selecting your Node.js app and reviewing its sidebar. You must wait for the nodejs build to complete and for the nodejs pod to be in a Running state before continuing. When the deployment is complete, click the route URL for the application, which has a format similar to the following: A new tab in your browser opens with a message similar to the following: Optional: Delete the application and clean up the resources that you created: In the Administrator perspective, navigate to Home Projects . Click the action menu for your project and select Delete Project . 2.8. Revoking administrator privileges and user access You can revoke cluster-admin or dedicated-admin privileges from a user by using the Red Hat OpenShift Service on AWS (ROSA) CLI, rosa . To revoke cluster access from a user, you must remove the user from your configured identity provider. Follow the procedures in this section to revoke administrator privileges or cluster access from a user. 2.8.1. Revoking administrator privileges from a user Follow the steps in this section to revoke cluster-admin or dedicated-admin privileges from a user. Prerequisites You installed and configured the latest Red Hat OpenShift Service on AWS (ROSA) CLI, rosa , on your workstation. You logged in to your Red Hat account using the ROSA CLI ( rosa ). You created a ROSA cluster. You have configured a GitHub identity provider for your cluster and added an identity provider user. You granted cluster-admin or dedicated-admin privileges to a user. Procedure To revoke cluster-admin privileges from an identity provider user: Revoke the cluster-admin privilege: USD rosa revoke user cluster-admin --user=<idp_user_name> --cluster=<cluster_name> 1 1 Replace <idp_user_name> and <cluster_name> with the name of the identity provider user and your cluster name. Example output ? Are you sure you want to revoke role cluster-admins from user <idp_user_name> in cluster <cluster_name>? Yes I: Revoked role 'cluster-admins' from user '<idp_user_name>' on cluster '<cluster_name>' Verify that the user is not listed as a member of the cluster-admins group: USD rosa list users --cluster=<cluster_name> Example output W: There are no users configured for cluster '<cluster_name>' To revoke dedicated-admin privileges from an identity provider user: Revoke the dedicated-admin privilege: USD rosa revoke user dedicated-admin --user=<idp_user_name> --cluster=<cluster_name> Example output ? Are you sure you want to revoke role dedicated-admins from user <idp_user_name> in cluster <cluster_name>? Yes I: Revoked role 'dedicated-admins' from user '<idp_user_name>' on cluster '<cluster_name>' Verify that the user is not listed as a member of the dedicated-admins group: USD rosa list users --cluster=<cluster_name> Example output W: There are no users configured for cluster '<cluster_name>' 2.8.2. Revoking user access to a cluster You can revoke cluster access for an identity provider user by removing them from your configured identity provider. You can configure different types of identity providers for your ROSA cluster. The following example procedure revokes cluster access for a member of a GitHub organization that is configured for identity provision to the cluster. Prerequisites You have a ROSA cluster. You have a GitHub user account. You have configured a GitHub identity provider for your cluster and added an identity provider user. Procedure Navigate to github.com and log in to your GitHub account. Remove the user from your GitHub organization. Follow the steps in Removing a member from your organization in the GitHub documentation. 2.9. Deleting a ROSA cluster and the AWS STS resources You can delete a ROSA cluster that uses the AWS Security Token Service (STS) by using the Red Hat OpenShift Service on AWS (ROSA) CLI, rosa . You can also use the ROSA CLI to delete the AWS Identity and Access Management (IAM) account-wide roles, the cluster-specific Operator roles, and the OpenID Connect (OIDC) provider. To delete the account-wide inline and Operator policies, you can use the AWS IAM Console. Important Account-wide IAM roles and policies might be used by other ROSA clusters in the same AWS account. You must only remove the resources if they are not required by other clusters. Prerequisites You installed and configured the latest Red Hat OpenShift Service on AWS (ROSA) CLI, rosa , on your workstation. You logged in to your Red Hat account using the ROSA CLI ( rosa ). You created a ROSA cluster. Procedure Delete a cluster and watch the logs, replacing <cluster_name> with the name or ID of your cluster: USD rosa delete cluster --cluster=<cluster_name> --watch Important You must wait for the cluster deletion to complete before you remove the IAM roles, policies, and OIDC provider. The account-wide roles are required to delete the resources created by the installer. The cluster-specific Operator roles are required to clean-up the resources created by the OpenShift Operators. The Operators use the OIDC provider to authenticate. Delete the OIDC provider that the cluster Operators use to authenticate: USD rosa delete oidc-provider -c <cluster_id> --mode auto 1 1 Replace <cluster_id> with the ID of the cluster. Note You can use the -y option to automatically answer yes to the prompts. Delete the cluster-specific Operator IAM roles: USD rosa delete operator-roles -c <cluster_id> --mode auto 1 1 Replace <cluster_id> with the ID of the cluster. Delete the account-wide roles: Important Account-wide IAM roles and policies might be used by other ROSA clusters in the same AWS account. You must only remove the resources if they are not required by other clusters. USD rosa delete account-roles --prefix <prefix> --mode auto 1 1 You must include the --<prefix> argument. Replace <prefix> with the prefix of the account-wide roles to delete. If you did not specify a custom prefix when you created the account-wide roles, specify the default prefix, ManagedOpenShift . Delete the account-wide inline and Operator IAM policies that you created for ROSA deployments that use STS: Log in to the AWS IAM Console . Navigate to Access management Policies and select the checkbox for one of the account-wide policies. With the policy selected, click on Actions Delete to open the delete policy dialog. Enter the policy name to confirm the deletion and select Delete to delete the policy. Repeat this step to delete each of the account-wide inline and Operator policies for the cluster. 2.10. steps Adding services to a cluster using the OpenShift Cluster Manager console Managing compute nodes Configuring the monitoring stack 2.11. Additional resources For more information about setting up accounts and ROSA clusters using AWS STS, see Understanding the ROSA with STS deployment workflow For more information about setting up accounts and ROSA clusters without using AWS STS, see Understanding the ROSA deployment workflow For more information about upgrading your cluster, see Upgrading ROSA Classic clusters

Commands:
aws sts get-caller-identity --output text
<aws_account_id> arn:aws:iam::<aws_account_id>:user/<username> <aws_user_id>
tar xvf rosa-linux.tar.gz
sudo mv rosa /usr/local/bin/rosa
rosa version
1.2.47 Your ROSA CLI is up to date.
rosa login
To login to your Red Hat account, get an offline access token at https://console.redhat.com/openshift/token/rosa ? Copy the token and paste it here:
? Copy the token and paste it here: ******************* [full token length omitted]
rosa whoami
AWS Account ID: <aws_account_number> AWS Default Region: us-east-1 AWS ARN: arn:aws:iam::<aws_account_number>:user/<aws_user_name> OCM API: https://api.openshift.com OCM Account ID: <red_hat_account_id> OCM Account Name: Your Name OCM Account Username: you@domain.com OCM Account Email: you@domain.com OCM Organization ID: <org_id> OCM Organization Name: Your organization OCM Organization External ID: <external_org_id>
rosa download openshift-client
tar xvf openshift-client-linux.tar.gz
sudo mv oc /usr/local/bin/oc
rosa verify openshift-client
I: Verifying whether OpenShift command-line tool is available I: Current OpenShift Client Version: 4.17.3
rosa create admin --cluster=<cluster_name> 1
W: It is recommended to add an identity provider to login to this cluster. See 'rosa create idp --help' for more information. I: Admin account has been added to cluster '<cluster_name>'. I: Please securely store this generated password. If you lose this password you can delete and recreate the cluster admin user. I: To login, run the following command: oc login https://api.example-cluster.wxyz.p1.openshiftapps.com:6443 --username cluster-admin --password d7Rca-Ba4jy-YeXhs-WU42J I: It may take up to a minute for the account to become active.
oc login <api_url> --username cluster-admin --password <cluster_admin_password> 1
oc whoami
cluster-admin
rosa create idp --cluster=<cluster_name> --interactive 1
I: Interactive mode enabled. Any optional fields can be left empty and a default will be selected. ? Type of identity provider: github ? Identity provider name: github-1 ? Restrict to members of: organizations ? GitHub organizations: <github_org_name> 1 ? To use GitHub as an identity provider, you must first register the application: - Open the following URL: https://github.com/organizations/<github_org_name>/settings/applications/new?oauth_application%5Bcallback_url%5D=https%3A%2F%2Foauth-openshift.apps.<cluster_name>/<random_string>.p1.openshiftapps.com%2Foauth2callback%2Fgithub-1&oauth_application%5Bname%5D=<cluster_name>&oauth_application%5Burl%5D=https%3A%2F%2Fconsole-openshift-console.apps.<cluster_name>/<random_string>.p1.openshiftapps.com - Click on 'Register application'
? Client ID: <github_client_id> 1 ? Client Secret: [? for help] <github_client_secret> 2 ? GitHub Enterprise Hostname (optional): ? Mapping method: claim 3 I: Configuring IDP for cluster '<cluster_name>' I: Identity Provider 'github-1' has been created. It will take up to 1 minute for this configuration to be enabled. To add cluster administrators, see 'rosa grant user --help'. To login into the console, open https://console-openshift-console.apps.<cluster_name>.<random_string>.p1.openshiftapps.com and click on github-1.
rosa list idps --cluster=<cluster_name>
NAME TYPE AUTH URL github-1 GitHub https://oauth-openshift.apps.<cluster_name>.<random_string>.p1.openshiftapps.com/oauth2callback/github-1
rosa grant user cluster-admin --user=<idp_user_name> --cluster=<cluster_name> 1
I: Granted role 'cluster-admins' to user '<idp_user_name>' on cluster '<cluster_name>'
rosa list users --cluster=<cluster_name>
ID GROUPS <idp_user_name> cluster-admins
rosa grant user dedicated-admin --user=<idp_user_name> --cluster=<cluster_name>
I: Granted role 'dedicated-admins' to user '<idp_user_name>' on cluster '<cluster_name>'
rosa list users --cluster=<cluster_name>
ID GROUPS <idp_user_name> dedicated-admins
rosa describe cluster -c <cluster_name> | grep Console 1
Console URL: https://console-openshift-console.apps.example-cluster.wxyz.p1.openshiftapps.com
https://nodejs-<project>.<cluster_name>.<hash>.<region>.openshiftapps.com/
Welcome to your Node.js application on OpenShift
rosa revoke user cluster-admin --user=<idp_user_name> --cluster=<cluster_name> 1
? Are you sure you want to revoke role cluster-admins from user <idp_user_name> in cluster <cluster_name>? Yes I: Revoked role 'cluster-admins' from user '<idp_user_name>' on cluster '<cluster_name>'
rosa list users --cluster=<cluster_name>
W: There are no users configured for cluster '<cluster_name>'
rosa revoke user dedicated-admin --user=<idp_user_name> --cluster=<cluster_name>
? Are you sure you want to revoke role dedicated-admins from user <idp_user_name> in cluster <cluster_name>? Yes I: Revoked role 'dedicated-admins' from user '<idp_user_name>' on cluster '<cluster_name>'
rosa list users --cluster=<cluster_name>
W: There are no users configured for cluster '<cluster_name>'
rosa delete cluster --cluster=<cluster_name> --watch
rosa delete oidc-provider -c <cluster_id> --mode auto 1
rosa delete operator-roles -c <cluster_id> --mode auto 1
rosa delete account-roles --prefix <prefix> --mode auto 1