[デモ] ROSA HCPクラスターの作成

$ cat ~/.aws/config
[default]
region = us-east-2

$ aws sts get-caller-identity
{
    "UserId": "AIDXXXXXXXXXXXXX",
    "Account": "XXXXXXXXX",
    "Arn": "arn:aws:iam::XXXXXXXXX:user/testuser01"
}

$ aws iam create-service-linked-role --aws-service-name "elasticloadbalancing.amazonaws.com"

Congratulations, your Red Hat and AWS accounts are linked
Welcome to the Red Hat Hybrid Cloud Console. If you cannot access production tools for a subscription that you have purchased, please wait 5 minutes and and confirm your subscription at subscription inventory. Here you can configure or manage Red Hat OpenShift Cluster Manager.

$ chmod +x rosa
$ sudo mv rosa /usr/local/bin/
$ rosa version
1.2.31

$ rosa login
To login to your Red Hat account, get an offline access token at https://console.redhat.com/openshift/token/rosa
? Copy the token and paste it here: ********************
I: Logged in as '<Red Hatアカウントのユーザー名>' on 'https://api.openshift.com'

$ rosa whoami
AWS Account ID:               XXXXXXXXXX
AWS Default Region:           us-east-2
AWS ARN:                      arn:aws:iam::XXXXXXXXXX:user/testuser01
OCM API:                      https://api.openshift.com
OCM Account ID:               XXXXXXXXXX
OCM Account Name:             Hiforumi Kojima
OCM Account Username:         <Red Hatアカウントのユーザー名>
OCM Account Email:            hkojima@redhat.com
OCM Organization ID:          XXXXXXXXXX
OCM Organization Name:        Hiforumi Kojima
OCM Organization External ID: XXXXXXXXXX

$ rosa download openshift-client
$ tar xvf openshift-client-linux.tar.gz
$ sudo mv oc /usr/local/bin/
$ rosa verify openshift-client
I: Verifying whether OpenShift command-line tool is available...
I: Current OpenShift Client Version: 4.14.5

$ git clone https://github.com/openshift-cs/terraform-vpc-example
$ cd terraform-vpc-example
$ terraform init

$ terraform plan -out rosa.tfplan -var region=us-east-2
$ terraform apply rosa.tfplan

$ export SUBNET_IDS=$(terraform output -raw cluster-subnets-string)
$ echo $SUBNET_IDS
subnet-0fb4f75f448b5499c,subnet-0087cb7bb3f628793

$ rosa create account-roles --mode auto --hosted-cp --yes
I: Logged in as '<Red Hatアカウントのユーザー名>' on 'https://api.openshift.com'
I: Validating AWS credentials...
I: AWS credentials are valid!
I: Validating AWS quota...
I: AWS quota ok. If cluster installation fails, validate actual AWS resource usage against https://docs.openshift.com/rosa/rosa_getting_started/rosa-required-aws-service-quotas.html
I: Verifying whether OpenShift command-line tool is available...
I: Current OpenShift Client Version: 4.14.5
I: Creating account roles
I: Creating hosted CP account roles using 'arn:aws:iam::XXXXXXXXX:user/testuser01'
I: Created role 'ManagedOpenShift-HCP-ROSA-Installer-Role' with ARN 'arn:aws:iam::XXXXXXXXX:role/ManagedOpenShift-HCP-ROSA-Installer-Role'
I: Created role 'ManagedOpenShift-HCP-ROSA-Support-Role' with ARN 'arn:aws:iam::XXXXXXXXX:role/ManagedOpenShift-HCP-ROSA-Support-Role'
I: Created role 'ManagedOpenShift-HCP-ROSA-Worker-Role' with ARN 'arn:aws:iam::XXXXXXXXX:role/ManagedOpenShift-HCP-ROSA-Worker-Role'
I: To create an OIDC Config, run the following command:
	rosa create oidc-config

$ rosa create oidc-config --mode auto --yes
I: Setting up managed OIDC configuration
I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice:
	rosa create operator-roles --prefix <user-defined> --oidc-config-id 280rqooan3kqqn4o1us1ip073fsrkfm8
If you are going to create a Hosted Control Plane cluster please include '--hosted-cp'
I: Creating OIDC provider using 'arn:aws:iam::XXXXXXXXX:user/testuser01'
I: Created OIDC provider with ARN 'arn:aws:iam::XXXXXXXXX:oidc-provider/rh-oidc.s3.us-east-1.amazonaws.com/280rqooan3kqqn4o1us1ip073fsrkfm8'

$ rosa create cluster --cluster-name=hcp-01 --mode=auto --yes --hosted-cp \
  --oidc-config-id 280rqooan3kqqn4o1us1ip073fsrkfm8 \
  --subnet-ids=$SUBNET_IDS --region=us-east-2 \
  --compute-machine-type m5.xlarge --version 4.14.2

$ rosa create cluster --cluster-name=hcp-01 --mode=auto --hosted-cp \
  --subnet-ids=$SUBNET_IDS --region=us-east-2 --version 4.14.2

I: Using 'XXXXXXXXX' as billing account
I: To use a different billing account, add --billing-account xxxxxxxxxx to previous command
I: Using arn:aws:iam::XXXXXXXXX:role/ManagedOpenShift-HCP-ROSA-Installer-Role for the Installer role
I: Using arn:aws:iam::XXXXXXXXX:role/ManagedOpenShift-HCP-ROSA-Worker-Role for the Worker role
I: Using arn:aws:iam::XXXXXXXXX:role/ManagedOpenShift-HCP-ROSA-Support-Role for the Support role

? OIDC Configuration ID: 280rqooan3kqqn4o1us1ip073fsrkfm8 | https://rh-oidc.s3.us-east-1.amazonaws.com/280rqooan3kqqn4o1us1ip073fsrkfm8
? Tags (optional):
? AWS region: us-east-2
? PrivateLink cluster: No
? Machine CIDR: 10.0.0.0/16
? Service CIDR: 172.30.0.0/16
? Pod CIDR: 10.128.0.0/14
? Enable Customer Managed key: No
? Compute nodes instance type:  [Use arrows to move, type to filter, ? for more help]
  m5dn.metal
  m5.metal
  m5n.metal
> m5.xlarge
  m5zn.metal
  m6a.12xlarge
  m6a.16xlarge
? Compute nodes instance type: m5.xlarge
? Enable autoscaling: No
? Compute nodes: 2
? Host prefix: 23
? Enable FIPS support: No
? Encrypt etcd data: No
? Disable Workload monitoring: No
? Use cluster-wide proxy: No
? Additional trust bundle file path (optional):
? Enable audit log forwarding to AWS CloudWatch: No

I: Creating cluster 'hcp-01'
I: To create this cluster again in the future, you can run:
   rosa create cluster --cluster-name hcp-01 --sts --mode auto --role-arn arn:aws:iam::XXXXXXXXX:role/ManagedOpenShift-HCP-ROSA-Installer-Role --support-role-arn arn:aws:iam::XXXXXXXXX:role/ManagedOpenShift-HCP-ROSA-Support-Role --worker-iam-role arn:aws:iam::XXXXXXXXX:role/ManagedOpenShift-HCP-ROSA-Worker-Role --operator-roles-prefix hcp-01-g8r1 --oidc-config-id 280rqooan3kqqn4o1us1ip073fsrkfm8 --region us-east-2 --version 4.14.2 --replicas 2 --compute-machine-type m5.xlarge --machine-cidr 10.0.0.0/16 --service-cidr 172.30.0.0/16 --pod-cidr 10.128.0.0/14 --host-prefix 23 --subnet-ids subnet-0fb4f75f448b5499c,subnet-0087cb7bb3f628793 --hosted-cp
I: To view a list of clusters and their status, run 'rosa list clusters'
I: Cluster 'hcp-01' has been created.
I: Once the cluster is installed you will need to add an Identity Provider before you can login into the cluster. See 'rosa create idp --help' for more information.

Name:                       hcp-01
ID:                         280scqkn8ocjoochasq423tg4donvpaq
External ID:                56549c55-3d86-4ba3-b163-4ca5abf67c59
Control Plane:              ROSA Service Hosted
OpenShift Version:          4.14.2
Channel Group:              stable
DNS:                        Not ready
AWS Account:                XXXXXXXXX
AWS Billing Account:        XXXXXXXXX
API URL:
Console URL:
Region:                     us-east-2
Availability:
 - Control Plane:           MultiAZ
 - Data Plane:              SingleAZ
Nodes:
 - Compute (desired):       2
 - Compute (current):       0
Network:
 - Type:                    OVNKubernetes
 - Service CIDR:            172.30.0.0/16
 - Machine CIDR:            10.0.0.0/16
 - Pod CIDR:                10.128.0.0/14
 - Host Prefix:             /23
Workload Monitoring:        Enabled
Ec2 Metadata Http Tokens:   optional
STS Role ARN:               arn:aws:iam::XXXXXXXXX:role/ManagedOpenShift-HCP-ROSA-Installer-Role
Support Role ARN:           arn:aws:iam::XXXXXXXXX:role/ManagedOpenShift-HCP-ROSA-Support-Role
Instance IAM Roles:
 - Worker:                  arn:aws:iam::XXXXXXXXX:role/ManagedOpenShift-HCP-ROSA-Worker-Role
Operator IAM Roles:
 - arn:aws:iam::XXXXXXXXX:role/hcp-01-g8r1-kube-system-capa-controller-manager
 - arn:aws:iam::XXXXXXXXX:role/hcp-01-g8r1-kube-system-control-plane-operator
 - arn:aws:iam::XXXXXXXXX:role/hcp-01-g8r1-kube-system-kms-provider
 - arn:aws:iam::XXXXXXXXX:role/hcp-01-g8r1-openshift-cluster-csi-drivers-ebs-cloud-credentials
 - arn:aws:iam::XXXXXXXXX:role/hcp-01-g8r1-openshift-cloud-network-config-controller-cloud-cred
 - arn:aws:iam::XXXXXXXXX:role/hcp-01-g8r1-openshift-image-registry-installer-cloud-credentials
 - arn:aws:iam::XXXXXXXXX:role/hcp-01-g8r1-openshift-ingress-operator-cloud-credentials
 - arn:aws:iam::XXXXXXXXX:role/hcp-01-g8r1-kube-system-kube-controller-manager
Managed Policies:           Yes
State:                      waiting (Waiting for user action)
Private:                    No
Created:                    Dec  9 2023 07:17:00 UTC
Details Page:               https://console.redhat.com/openshift/details/s/2ZIOeJctRNZzSZe58wMQFmAl2Sd
OIDC Endpoint URL:          https://rh-oidc.s3.us-east-1.amazonaws.com/280rqooan3kqqn4o1us1ip073fsrkfm8 (Managed)
Audit Log Forwarding:       disabled

I: Preparing to create operator roles.
I: Creating roles using 'arn:aws:iam::XXXXXXXXX:user/testuser01'
I: Created role 'hcp-01-g8r1-openshift-cloud-network-config-controller-cloud-cred' with ARN 'arn:aws:iam::XXXXXXXXX:role/hcp-01-g8r1-openshift-cloud-network-config-controller-cloud-cred'
I: Created role 'hcp-01-g8r1-kube-system-capa-controller-manager' with ARN 'arn:aws:iam::XXXXXXXXX:role/hcp-01-g8r1-kube-system-capa-controller-manager'
I: Created role 'hcp-01-g8r1-kube-system-control-plane-operator' with ARN 'arn:aws:iam::XXXXXXXXX:role/hcp-01-g8r1-kube-system-control-plane-operator'
I: Created role 'hcp-01-g8r1-kube-system-kms-provider' with ARN 'arn:aws:iam::XXXXXXXXX:role/hcp-01-g8r1-kube-system-kms-provider'
I: Created role 'hcp-01-g8r1-kube-system-kube-controller-manager' with ARN 'arn:aws:iam::XXXXXXXXX:role/hcp-01-g8r1-kube-system-kube-controller-manager'
I: Created role 'hcp-01-g8r1-openshift-image-registry-installer-cloud-credentials' with ARN 'arn:aws:iam::XXXXXXXXX:role/hcp-01-g8r1-openshift-image-registry-installer-cloud-credentials'
I: Created role 'hcp-01-g8r1-openshift-ingress-operator-cloud-credentials' with ARN 'arn:aws:iam::XXXXXXXXX:role/hcp-01-g8r1-openshift-ingress-operator-cloud-credentials'
I: Created role 'hcp-01-g8r1-openshift-cluster-csi-drivers-ebs-cloud-credentials' with ARN 'arn:aws:iam::XXXXXXXXX:role/hcp-01-g8r1-openshift-cluster-csi-drivers-ebs-cloud-credentials'
I: Preparing to create OIDC Provider.
I: OIDC provider already exists.
I: To determine when your cluster is Ready, run 'rosa describe cluster -c hcp-01'.
I: To watch your cluster installation logs, run 'rosa logs install -c hcp-01 --watch'.

$ rosa list cluster
ID                                NAME    STATE  TOPOLOGY
280scqkn8ocjoochasq423tg4donvpaq  hcp-01  ready  Hosted CP

$ rosa list machinepool -c hcp-01
ID       AUTOSCALING  REPLICAS  INSTANCE TYPE  LABELS    TAINTS    AVAILABILITY ZONE  SUBNET                    VERSION  AUTOREPAIR
workers  No           2/2       m5.xlarge                          us-east-2a         subnet-0087cb7bb3f628793  4.14.2   Yes

$ rosa create admin --cluster hcp-01

I: Admin account has been added to cluster 'hcp-01'.
I: Please securely store this generated password. If you lose this password you can delete and recreate the cluster admin user.
I: To login, run the following command:

   oc login https://api.hcp-01.240p.p3.openshiftapps.com:443 --username cluster-admin --password XXXXX-XXXXX-XXXXX-XXXXX

I: It may take several minutes for this access to become active.

$ rosa describe cluster -c hcp-01 |grep Console
Console URL:                https://console-openshift-console.apps.rosa.hcp-01.240p.p3.openshiftapps.com

$ htpasswd -cbB users.htpasswd testuser1 <適当なランダム文字列のパスワード>
$ for i in {2..100}; do htpasswd -bB users.htpasswd testuser$i <適当なランダム文字列のパスワード>; done


$ rosa create idp --type=htpasswd --name=testuser-htpasswd01 --cluster=hcp-01 --from-file=users.htpasswd
I: Configuring IDP for cluster 'hcp-01'
I: Identity Provider 'testuser-htpasswd01' has been created.
   It may take several minutes for this access to become active.
   To add cluster administrators, see 'rosa grant user --help'.

I: To log in to the console, open https://console-openshift-console.apps.rosa.hcp-01.240p.p3.openshiftapps.com and click on 'testuser-htpasswd01'.

$ rosa list cluster
ID                                NAME    STATE  TOPOLOGY
280scqkn8ocjoochasq423tg4donvpaq  hcp-01  ready  Hosted CP

$ rosa delete cluster -c hcp-01 --yes
...<snip>...
I: Once the cluster is uninstalled use the following commands to remove the above aws resources.

	rosa delete operator-roles --prefix hcp-01-g8r1
	rosa delete oidc-provider --oidc-config-id 280rqooan3kqqn4o1us1ip073fsrkfm8
I: To watch your cluster uninstallation logs, run 'rosa logs uninstall -c rosa-hcp-01 --watch'

$ rosa delete operator-roles --prefix hcp-01-g8r1 --mode auto --yes