You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/rosa-hcp-architecture.adoc
+9-9Lines changed: 9 additions & 9 deletions
Original file line number
Diff line number
Diff line change
@@ -5,21 +5,21 @@
5
5
[id="rosa-hcp-architecture_{context}"]
6
6
= ROSA with HCP architecture
7
7
8
-
In {hcp-title-first}, the ROSA service hosts a highly-available, single-tenant OpenShift control plane. The hosted control plane is deployed across 3 availability zones with 2 API server instances and 3 etcd instances.
8
+
In {rosa-first}, the ROSA service hosts a highly-available, single-tenant OpenShift control plane. The hosted control plane is deployed across 3 availability zones with 2 API server instances and 3 etcd instances.
9
9
10
10
You can create a ROSA with HCP cluster with or without an internet-facing API server. Private API servers are only accessible from your VPC subnets. You access the hosted control plane through an AWS PrivateLink endpoint.
11
11
12
12
The worker nodes are deployed in your AWS account and run on your VPC private subnets. You can add additional private subnets from one or more availability zones to ensure high availability. Worker nodes are shared by OpenShift components and applications. OpenShift components such as the ingress controller, image registry, and monitoring are deployed on the worker nodes hosted on your VPC.
13
13
14
-
.ROSA with HCP architecture
15
-
image::544_OpenShift_ROSA-HCP_architecture-model.png[ROSA with HCP architecture]
== ROSA with HCP architecture on public and private networks
19
-
With ROSA with HCP, you can create your clusters on public or private networks. The following images depict the architecture of both public and private networks.
18
+
== {rosa-short} architecture on public and private networks
19
+
With {rosa-short}, you can create your clusters on public or private networks. The following images depict the architecture of both public and private networks.
20
20
21
-
.ROSA with HCP deployed on a public network
22
-
image::544_OpenShift_ROSA-HCP-and-ROSA-Classic-public.png[ROSA with HCP deployed on a public network]
21
+
.{rosa-short} deployed on a public network
22
+
image::544_OpenShift_ROSA-HCP-and-ROSA-Classic-public.png[{rosa-short} deployed on a public network]
23
23
24
-
.ROSA with HCP deployed on a private network
25
-
image::544_OpenShift_ROSA-HCP-and-ROSA-Classic-private.png[ROSA with HCP deployed on a private network]
24
+
.{rosa-short} deployed on a private network
25
+
image::544_OpenShift_ROSA-HCP-and-ROSA-Classic-private.png[{rosa-short} deployed on a private network]
Copy file name to clipboardExpand all lines: snippets/rosa-hcp-rn.adoc
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -3,4 +3,4 @@
3
3
// * rosa_release_notes/rosa-release-notes.adoc
4
4
5
5
:_mod-docs-content-type: SNIPPET
6
-
* **Hosted control planes.**{hcp-title-first} clusters are now available as a link:https://access.redhat.com/support/offerings/techpreview[Technology Preview] feature. This new architecture provides a lower-cost, more resilient ROSA architecture. For more information, see xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-hcp-sts-creating-a-cluster-quickly[Creating {hcp-title} clusters using the default options].
6
+
* **Hosted control planes.**{rosa-first} clusters are now available as a link:https://access.redhat.com/support/offerings/techpreview[Technology Preview] feature. This new architecture provides a lower-cost, more resilient ROSA architecture. For more information, see xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-hcp-sts-creating-a-cluster-quickly[Creating {rosa-short} clusters using the default options].
{hcp-title-first} uses an AWS (Amazon Web Services) Security Token Service (STS) for AWS Identity Access Management (IAM) to obtain the necessary credentials to interact with resources in your AWS account.
14
+
{rosa-first} uses an AWS (Amazon Web Services) Security Token Service (STS) for AWS Identity Access Management (IAM) to obtain the necessary credentials to interact with resources in your AWS account.
15
15
16
16
[id="credential-methods-rosa-hcp"]
17
17
== AWS STS credential method
18
-
As part of {hcp-title}, Red{nbsp}Hat must be granted the necessary permissions to manage infrastructure resources in your AWS account.
19
-
{hcp-title} grants the cluster's automation software limited, short-term access to resources in your AWS account.
18
+
As part of {rosa-short}, Red{nbsp}Hat must be granted the necessary permissions to manage infrastructure resources in your AWS account.
19
+
{rosa-short} grants the cluster's automation software limited, short-term access to resources in your AWS account.
20
20
21
21
The STS method uses predefined roles and policies to grant temporary, least-privilege permissions to IAM roles. The credentials typically expire an hour after being requested. Once expired, they are no longer recognized by AWS and no longer have account access from API requests made with them. For more information, see the link:https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html[AWS documentation].
22
22
23
-
AWS IAM STS roles must be created for each {hcp-title} cluster. The ROSA command-line interface (CLI) (`rosa`) manages the STS roles and helps you attach the ROSA-specific, AWS-managed policies to each role. The CLI provides the commands and files to create the roles, attach the AWS-managed policies, and an option to allow the CLI to automatically create the roles and attach the policies.
23
+
AWS IAM STS roles must be created for each {rosa-short} cluster. The {rosa-short} command-line interface (CLI) (`rosa`) manages the STS roles and helps you attach the {rosa-short}-specific, AWS-managed policies to each role. The CLI provides the commands and files to create the roles, attach the AWS-managed policies, and an option to allow the CLI to automatically create the roles and attach the policies.
24
24
//See [insert new xref when we have one for HCP] for more information about the different `--mode` options.
25
25
26
26
[id="hcp-sts-security"]
@@ -33,18 +33,18 @@ Security features for AWS STS include:
33
33
* There is no need to rotate or revoke credentials. Whenever the service needs to perform an action, it obtains credentials that expire in one hour or less.
34
34
* Credential expiration reduces the risks of credentials leaking and being reused.
35
35
36
-
{hcp-title} grants cluster software components least-privilege permissions with short-term security credentials to specific and segregated IAM roles. The credentials are associated with IAM roles specific to each component and cluster that makes AWS API calls. This method aligns with principles of least-privilege and secure practices in cloud service resource management.
36
+
{rosa-short} grants cluster software components least-privilege permissions with short-term security credentials to specific and segregated IAM roles. The credentials are associated with IAM roles specific to each component and cluster that makes AWS API calls. This method aligns with principles of least-privilege and secure practices in cloud service resource management.
37
37
38
38
[id="components-specific-to-rosa-hcp-with-sts"]
39
-
== Components of {hcp-title}
40
-
* *AWS infrastructure* - The infrastructure required for the cluster including the Amazon EC2 instances, Amazon EBS storage, and networking components. See xref:../rosa_architecture/rosa_policy_service_definition/rosa-service-definition.adoc#rosa-sdpolicy-aws-compute-types_rosa-service-definition[AWS compute types] to see the supported instance types for compute nodes and xref:../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-ec2-instances_rosa-sts-aws-prereqs[provisioned AWS infrastructure] for more information on cloud resource configuration.
39
+
== Components of {rosa-short}
40
+
* *AWS infrastructure* - The infrastructure required for the cluster including the Amazon EC2 instances, Amazon EBS storage, and networking components. See xref:../rosa_architecture/rosa_policy_service_definition/rosa-hcp-service-definition.adoc#rosa-sdpolicy-aws-compute-types_rosa-service-definition[AWS compute types] to see the supported instance types for compute nodes and xref:../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-ec2-instances_rosa-sts-aws-prereqs[provisioned AWS infrastructure] for more information on cloud resource configuration.
41
41
* *AWS STS* - A method for granting short-term, dynamic tokens to provide users the necessary permissions to temporarily interact with your AWS account resources.
42
42
* *OpenID Connect (OIDC)* - A mechanism for cluster Operators to authenticate with AWS, assume the cluster roles through a trust policy, and obtain temporary credentials from AWS IAM STS to make the required API calls.
43
-
* *Roles and policies* - The roles and policies used by {hcp-title} can be divided into account-wide roles and policies and Operator roles and policies.
43
+
* *Roles and policies* - The roles and policies used by {rosa-short} can be divided into account-wide roles and policies and Operator roles and policies.
44
44
+
45
45
The policies determine the allowed actions for each of the roles.
46
46
ifdef::openshift-rosa[]
47
-
See xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-sts-about-iam-resources[About IAM resources] for more details about the individual roles and policies. See xref:../rosa_planning/rosa-sts-ocm-role.adoc#rosa-sts-ocm-role[ROSA IAM role resource] for more details about trust policies.
47
+
See xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-sts-about-iam-resources[About IAM resources] for more details about the individual roles and policies. See xref:../rosa_planning/rosa-sts-ocm-role.adoc#rosa-sts-ocm-role[{rosa-short} IAM role resource] for more details about trust policies.
48
48
endif::openshift-rosa[]
49
49
ifdef::openshift-rosa-hcp[]
50
50
See xref:../rosa_architecture/rosa-sts-about-iam-resources.adoc#rosa-sts-about-iam-resources[About IAM resources] for more details about the individual roles and policies. See xref:../rosa_planning/rosa-hcp-prepare-iam-roles-resources.adoc#rosa-hcp-prepare-iam-roles-resources[Required IAM roles and resources] for more details on preparing these resources in your cluster.
@@ -90,9 +90,9 @@ Certain policies are used by the cluster Operator roles, listed below. The Opera
90
90
** Trust policies are created for each account-wide role and each Operator role.
91
91
92
92
[id="deploying-rosa-hcp-with-sts-cluster"]
93
-
== Deploying a {hcp-title} cluster
93
+
== Deploying a {rosa-short} cluster
94
94
95
-
Deploying a {hcp-title} cluster follows the following steps:
95
+
Deploying a {rosa-short} cluster follows the following steps:
96
96
97
97
. You create the account-wide roles.
98
98
. You create the Operator roles.
@@ -105,7 +105,7 @@ During the cluster creation process, the ROSA CLI creates the required JSON file
105
105
The ROSA CLI can automatically create the roles for you, or you can manually create them by using the `--mode manual` or `--mode auto` flags. For further details about deployment, see xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-sts-creating-cluster-using-customizations_rosa-sts-creating-a-cluster-with-customizations[Creating a cluster with customizations].
106
106
107
107
[id="hcp-sts-process"]
108
-
== {hcp-title} workflow
108
+
== {rosa-short} workflow
109
109
The user creates the required account-wide roles. During role creation, a trust policy, known as a cross-account trust policy, is created which allows a Red{nbsp}Hat-owned role to assume the roles. Trust policies are also created for the EC2 service, which allows workloads on EC2 instances to assume roles and obtain credentials. AWS assigns a corresponding permissions policy to each role.
110
110
111
111
After the account-wide roles and policies are created, the user can create a cluster. Once cluster creation is initiated, the user creates the Operator roles so that cluster Operators can make AWS API calls. These roles are then assigned to the corresponding permission policies that were created earlier and a trust policy with an OIDC provider. The Operator roles differ from the account-wide roles in that they ultimately represent the pods that need access to AWS resources. Because a user cannot attach IAM roles to pods, they must create a trust policy with an OIDC provider so that the Operator, and therefore the pods, can access the roles they need.
Welcome to the official {product-title}{product-version} documentation, where you can learn about {product-title} and start exploring its features.
14
15
endif::openshift-rosa,openshift-telco[]
15
16
ifdef::openshift-rosa[]
16
-
Welcome to the official {product-title} (ROSA) documentation, where you can learn about ROSA and start exploring its features.
17
-
To learn about ROSA, interacting with ROSA by using {cluster-manager-first} and command-line interface (CLI) tools, consumption experience, and integration with Amazon Web Services (AWS) services, start with xref:../rosa_architecture/rosa-understanding.adoc#rosa-understanding[the Introduction to ROSA documentation].
17
+
Welcome to the official {product-title} ({rosa-classic-short}) documentation, where you can learn about {rosa-classic-short} and start exploring its features.
18
+
To learn about {rosa-classic-short}, interacting with {rosa-classic-short} by using {cluster-manager-first} and command-line interface (CLI) tools, consumption experience, and integration with Amazon Web Services (AWS) services, start with xref:../rosa_architecture/rosa-understanding.adoc#rosa-understanding[the Introduction to ROSA documentation].
To navigate the {product-title}{product-version} documentation, you can use one of the following methods:
28
29
29
30
* Use the navigation bar to browse the documentation.
30
31
* Select the task that interests you from xref:../welcome/learn_more_about_openshift.adoc#learn_more_about_openshift[Learn more about {product-title}].
31
32
* {product-title} has a variety of layered offerings to add additional functionality and extend the capabilities of a cluster. For more information, see link:https://access.redhat.com/support/policy/updates/openshift_operators[{product-title} Operator Life Cycles]
0 commit comments