Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -11,11 +11,11 @@ include::snippets/snip-mobb-support-statement.adoc[leveloffset=+1]

[TIP]
====
Load Balancers created by the AWS Load Balancer Operator cannot be used for xref:../networking/ingress_load_balancing/routes/nw-configuring-routes.adoc#route-configuration[OpenShift Routes], and should only be used for individual services or ingress resources that do not need the full layer 7 capabilities of an OpenShift Route.
Load Balancers created by the AWS Load Balancer Operator cannot be used for {OCP-short} Routes, and should only be used for individual services or ingress resources that do not need the full layer 7 capabilities of an {OCP-short} Route. For more information about {OCP-short} Routes, see _Additional resources_.
====

[role="_abstract"]
The link:https://kubernetes-sigs.github.io/aws-load-balancer-controller/[AWS Load Balancer Controller] manages AWS Elastic Load Balancers for a {product-title} cluster. The controller provisions link:https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html[AWS Application Load Balancers (ALB)] when you create Kubernetes Ingress resources and link:https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html[AWS Network Load Balancers (NLB)] when implementing Kubernetes Service resources with a type of LoadBalancer.
The AWS Load Balancer Controller manages AWS Elastic Load Balancers for a {product-title} cluster. The controller provisions AWS Application Load Balancers (ALB) when you create Kubernetes Ingress resources and AWS Network Load Balancers (NLB) when implementing Kubernetes Service resources with a type of LoadBalancer. For more information, see _Additional resources_.

Compared with the default AWS in-tree load balancer provider, this controller is developed with advanced annotations for both ALBs and NLBs. Some advanced use cases are:

Expand All @@ -30,28 +30,23 @@ WAFv1, WAF classic, is no longer supported. Use WAFv2.
* Specify custom NLB source IP ranges
* Specify custom NLB internal IP addresses

The link:https://github.com/openshift/aws-load-balancer-operator[AWS Load Balancer Operator] is used to used to install, manage and configure an instance of `aws-load-balancer-controller` in a {product-title} cluster.
The AWS Load Balancer Operator is used to used to install, manage and configure an instance of `aws-load-balancer-controller` in a {product-title} cluster. For more information, see _Additional resources_.

[id="prerequisites_{context}"]
== Prerequisites
include::modules/cloud-experts-aws-load-balancer-operator-environment.adoc[leveloffset=+1]

[NOTE]
====
AWS ALBs require a multi-AZ cluster, as well as three public subnets split across three AZs in the same VPC as the cluster. This makes ALBs unsuitable for many PrivateLink clusters. AWS NLBs do not have this restriction.
====

ifndef::openshift-rosa-hcp[]
* xref:../rosa_install_access_delete_clusters/rosa-sts-creating-a-cluster-quickly.adoc#rosa-sts-creating-a-cluster-quickly[A multi-AZ {product-title} cluster]
endif::openshift-rosa-hcp[]
ifdef::openshift-rosa-hcp[]
* xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-hcp-sts-creating-a-cluster-quickly[A multi-AZ {product-title} cluster]
endif::openshift-rosa-hcp[]
* BYO VPC cluster
* AWS CLI
* OC CLI

include::modules/cloud-experts-aws-load-balancer-operator-environment.adoc[leveloffset=+2]
include::modules/cloud-experts-aws-load-balancer-operator-aws-vpc-subnets.adoc[leveloffset=+2]

include::modules/cloud-experts-aws-load-balancer-operator-install.adoc[leveloffset=+1]

include::modules/cloud-experts-aws-load-balancer-operator-validating.adoc[leveloffset=+1]
include::modules/cloud-experts-aws-load-balancer-operator-cleanup.adoc[leveloffset=+1]

include::modules/cloud-experts-aws-load-balancer-operator-cleanup.adoc[leveloffset=+1]

[role="_additional-resources"]
[id="additional-resources_{context}"]
== Additional resources
* xref:../networking/ingress_load_balancing/routes/nw-configuring-routes.adoc#nw-configuring-routes[{OCP-short} Routes]
* link:https://kubernetes-sigs.github.io/aws-load-balancer-controller/[AWS Load Balancer Controller]
* link:https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html[AWS Application Load Balancers]
* link:https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html[AWS Network Load Balancers]
* link:https://github.com/openshift/aws-load-balancer-operator[AWS Load Balancer Operator]
17 changes: 5 additions & 12 deletions cloud_experts_tutorials/cloud-experts-aws-secret-manager.adoc
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
:_mod-docs-content-type: ASSEMBLY
[id="cloud-experts-aws-secret-manager"]
= Tutorial: Using AWS Secrets Manager CSI on {product-title} with STS
= Tutorial: Use AWS Secrets Manager CSI on {product-title} with STS

include::_attributes/attributes-openshift-dedicated.adoc[]
:context: cloud-experts-aws-secret-manager
Expand All @@ -10,19 +10,12 @@ toc::[]
[role="_abstract"]
The AWS Secrets and Configuration Provider (ASCP) provides a way to expose AWS Secrets as Kubernetes storage volumes. With the ASCP, you can store and manage your secrets in Secrets Manager and then retrieve them through your workloads running on {product-title}.

[id="cloud-experts-aws-secret-manager-prerequisites"]
== Prerequisites
include::modules/cloud-experts-aws-secret-manager-preparing-environment.adoc[leveloffset=+1]

Ensure that you have the following resources and tools before starting this process:

* A {product-title} cluster deployed with STS
* Helm 3
* `aws` CLI
* `oc` CLI
* `jq` CLI

include::modules/cloud-experts-aws-secret-manager-preparing-environment.adoc[leveloffset=+2]
include::modules/cloud-experts-aws-secret-manager-deply-aws-secrets.adoc[leveloffset=+1]

include::modules/cloud-experts-aws-secret-manager-create-iam-polices.adoc[leveloffset=+1]

include::modules/cloud-experts-aws-secret-manager-creating-application.adoc[leveloffset=+1]

include::modules/cloud-experts-aws-secret-manager-cleanup.adoc[leveloffset=+1]
39 changes: 24 additions & 15 deletions cloud_experts_tutorials/cloud-experts-consistent-egress-ip.adoc
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
:_mod-docs-content-type: ASSEMBLY
[id="cloud-experts-consistent-egress-ip"]
= Tutorial: Assigning a consistent egress IP for external traffic
= Tutorial: Assign a consistent egress IP for external traffic

include::_attributes/attributes-openshift-dedicated.adoc[]
include::_attributes/common-attributes.adoc[]
Expand All @@ -13,29 +13,38 @@ This tutorial teaches you how to configure a set of predictable IP addresses for

By default, {product-title} uses the OVN-Kubernetes container network interface (CNI) to assign random IP addresses from a pool. This can make configuring security lockdowns unpredictable or open.

ifndef::openshift-rosa-hcp[]
See xref:../networking/ovn_kubernetes_network_provider/configuring-egress-ips-ovn.adoc#configuring-egress-ips-ovn[Configuring an egress IP address] for more information.
endif::openshift-rosa-hcp[]
ifdef::openshift-rosa-hcp[]
See link:https://docs.openshift.com/rosa/networking/ovn_kubernetes_network_provider/configuring-egress-ips-ovn.html[Configuring an egress IP address] for more information.
endif::openshift-rosa-hcp[]

== Prerequisites

* A {product-title} cluster deployed with OVN-Kubernetes
* The xref:../cli_reference/openshift_cli/getting-started-cli.adoc#cli-getting-started[OpenShift CLI] (`oc`)
* The xref:../cli_reference/rosa_cli/rosa-get-started-cli.adoc#rosa-get-started-cli[ROSA CLI] (`rosa`)
* link:https://stedolan.github.io/jq/[`jq`]
ifdef::openshift-rosa[]
For more information on configuring an egress IP address, see _Additional resources_.
endif::openshift-rosa[]

include::modules/egress-ip-env-variables.adoc[leveloffset=+1]

include::modules/egress-ip-capacity.adoc[leveloffset=+1]

include::modules/egress-ip-creating-ip-rules.adoc[leveloffset=+1]

include::modules/egress-ip-assign-ip-namespace.adoc[leveloffset=+1]

include::modules/egress-ip-assigning-to-pod.adoc[leveloffset=+1]

include::modules/egress-ip-node-labels.adoc[leveloffset=+2]

include::modules/egress-ip-egress-ip-review.adoc[leveloffset=+2]

include::modules/egress-ip-deploy-sample-app.adoc[leveloffset=+2]

include::modules/egress-ip-namespace-egress.adoc[leveloffset=+2]

include::modules/egress-ip-pod-egress-test.adoc[leveloffset=+2]

include::modules/egress-ip-blocked-egress.adoc[leveloffset=+2]
include::modules/egress-ip-cluster-cleanup.adoc[leveloffset=+1]

include::modules/egress-ip-cluster-cleanup.adoc[leveloffset=+1]

ifdef::openshift-rosa[]
[role="_additional-resources"]
[id="additional-resources_{context}"]
== Additional resources
* xref:../networking/ovn_kubernetes_network_provider/configuring-egress-ips-ovn.adoc#configuring-egress-ips-ovn[Configuring an egress IP address]
endif::openshift-rosa[]
//Additional resources are Classic-only because the assembly configuring-egress-ips-ovn is commented out of the ROSA HCP topic map (as of June 2026).
25 changes: 9 additions & 16 deletions cloud_experts_tutorials/cloud-experts-custom-dns-resolver.adoc
Original file line number Diff line number Diff line change
@@ -1,36 +1,26 @@
:_mod-docs-content-type: ASSEMBLY
[id="cloud-experts-custom-dns-resolver"]
= Tutorial: Deploying {product-title} with a Custom DNS Resolver
= Tutorial: Deploy {product-title} with a custom DNS resolver

include::_attributes/attributes-openshift-dedicated.adoc[]
:context: cloud-experts-custom-dns-resolver

toc::[]

[role="_abstract"]
A link:https://docs.aws.amazon.com/vpc/latest/userguide/DHCPOptionSet.html[custom DHCP option set] enables you to customize your VPC with your own DNS server, domain name, and more. {product-title} clusters support using custom DHCP option sets. By default, {product-title} clusters require setting the "domain name servers" option to `AmazonProvidedDNS` to ensure successful cluster creation and operation. Customers who want to use custom DNS servers for DNS resolution must do additional configuration to ensure successful {product-title} cluster creation and operation.
Use a custom Dynamic Host Configuration Protocol (DHCP) option set to customize your Virtual Private Cloud (VPC) with your own Domain Name System (DNS) server, domain name, and more. {product-title} clusters support using custom DHCP option sets. By default, {product-title} clusters require setting the "domain name servers" option to `AmazonProvidedDNS` to ensure successful cluster creation and operation. Customers who want to use custom DNS servers for DNS resolution must do additional configuration to ensure successful {product-title} cluster creation and operation.

In this tutorial, we will configure our DNS server to forward DNS lookups for specific DNS zones (further detailed below) to an link:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html[Amazon Route 53 Inbound Resolver].
In this tutorial, we will configure our DNS server to forward DNS lookups for specific DNS zones (further detailed below) to an Amazon Route 53 Inbound Resolver. For more information, see _Additional resources_.

[NOTE]
====
This tutorial uses the open-source BIND DNS server (`named`) to demonstrate the configuration necessary to forward DNS lookups to an Amazon Route 53 Inbound Resolver located in the VPC you plan to deploy a {product-title} cluster into. Refer to the documentation of your preferred DNS server for how to configure zone forwarding.
====

== Prerequisites

* ROSA CLI (`rosa`)
* AWS CLI (`aws`)
ifdef::openshift-rosa[]
* A manually created AWS VPC
endif::openshift-rosa[]
ifdef::openshift-rosa-hcp[]
* A xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-hcp-creating-vpc_rosa-hcp-sts-creating-a-cluster-quickly[manually created AWS VPC]
endif::openshift-rosa-hcp[]
* A DHCP option set configured to point to a custom DNS server and set as the default for your VPC

include::modules/cloud-experts-custom-dns-resolver-environment-setup.adoc[leveloffset=+1]

include::modules/cloud-experts-custom-dns-resolver-create-inbound-resolver.adoc[leveloffset=+1]

ifdef::openshift-rosa-hcp[]
include::modules/cloud-experts-custom-dns-resolver-configure-dns-server-hcp.adoc[leveloffset=+1]
endif::openshift-rosa-hcp[]
Expand All @@ -39,10 +29,13 @@ include::modules/cloud-experts-custom-dns-resolver-configure-dns-server-classic.
endif::openshift-rosa[]

[role="_additional-resources"]
[id="additional-resources_{context}"]
== Additional resources
* link:https://docs.aws.amazon.com/vpc/latest/userguide/DHCPOptionSet.html[Custom DHCP option set]
* link:https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html[Amazon Route 53 Inbound Resolver]
ifdef::openshift-rosa[]
* xref:../rosa_install_access_delete_clusters/rosa-sts-creating-a-cluster-quickly.adoc#rosa-sts-creating-account-wide-sts-roles-and-policies_rosa-sts-creating-a-cluster-quickly[Create your cluster]
endif::openshift-rosa[]
ifdef::openshift-rosa-hcp[]
* xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-hcp-sts-creating-a-cluster-quickly[Create your cluster]
endif::openshift-rosa-hcp[]
endif::openshift-rosa-hcp[]
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
:_mod-docs-content-type: ASSEMBLY
[id="cloud-experts-deploy-api-data-protection"]
= Tutorial: Deploying OpenShift API for Data Protection on a {product-title} cluster
= Tutorial: Deploy OpenShift API for Data Protection on a {product-title} cluster

include::_attributes/common-attributes.adoc[]
include::_attributes/attributes-openshift-dedicated.adoc[]
:context: cloud-experts-deploy-api-data-protection

Expand All @@ -10,25 +11,20 @@ toc::[]
include::snippets/snip-mobb-support-statement.adoc[leveloffset=+1]

[role="_abstract"]
The following tutorial shows you how to deploy the OpenShift API for data protection on your {product-title} cluster.

[id="cloud-experts-deploy-api-data-protection-prerequisites_{context}"]
== Prerequisites

ifndef::openshift-rosa-hcp[]
* A xref:../rosa_install_access_delete_clusters/rosa-sts-creating-a-cluster-quickly.adoc#rosa-sts-creating-a-cluster-quickly[{product-title} cluster]
endif::openshift-rosa-hcp[]
ifdef::openshift-rosa-hcp[]
* A xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-hcp-sts-creating-a-cluster-quickly[{product-title} cluster]
endif::openshift-rosa-hcp[]
The following tutorial shows you how to deploy the {oadp-full} on your {product-title} cluster.

include::modules/cloud-experts-deploy-api-data-protection-environment-variables.adoc[leveloffset=+1]

include::modules/cloud-experts-deploy-api-data-protection-prepare-aws-account.adoc[leveloffset=+1]

include::modules/cloud-experts-deploy-api-data-protection-deploy-oadp-on-cluster.adoc[leveloffset=+1]

include::modules/cloud-experts-deploy-api-data-protection-perform-backup.adoc[leveloffset=+1]

include::modules/cloud-experts-deploy-api-data-protection-cleanup.adoc[leveloffset=+1]

[role="_additional-resources"]
[id="additional-resources_{context}"]
== Additional resources
* link:https://github.com/openshift/oadp-operator/blob/master/docs/TROUBLESHOOTING.md[OADP team's troubleshooting documentation]
* link:https://github.com/openshift/oadp-operator/tree/master/tests/e2e/sample-applications[Sample applications directory]
15 changes: 9 additions & 6 deletions cloud_experts_tutorials/cloud-experts-entra-id-idp.adoc
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
:_mod-docs-content-type: ASSEMBLY
[id="cloud-experts-entra-id-idp"]
= Tutorial: Configuring Microsoft Entra ID (formerly Azure Active Directory) as an identity provider
= Tutorial: Configure Microsoft Entra ID (formerly Azure Active Directory) as an identity provider

include::_attributes/attributes-openshift-dedicated.adoc[]
:context: cloud-experts-entra-id-idp
Expand All @@ -17,20 +17,23 @@ This tutorial guides you to complete the following tasks:
. Configure the {product-title} cluster to use Entra ID as the identity provider.
. Grant additional permissions to individual groups.

== Prerequisites

* You created a set of security groups and assigned users by following link:https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/how-to-manage-groups[the Microsoft documentation].

include::modules/cloud-experts-entra-id-idp-register-app.adoc[leveloffset=+1]

include::modules/cloud-experts-entra-id-idp-configure-app.adoc[leveloffset=+1]

include::modules/cloud-experts-entra-id-idp-configure-optional-claims.adoc[leveloffset=+2]

include::modules/cloud-experts-entra-id-idp-configure-group-claims.adoc[leveloffset=+2]

include::modules/cloud-experts-entra-id-idp-configure-entra-idp.adoc[leveloffset=+1]

include::modules/cloud-experts-entra-id-idp-additional-user-groups.adoc[leveloffset=+1]

include::modules/cloud-experts-entra-id-idp-additional-individual-user.adoc[leveloffset=+1]

include::modules/cloud-experts-entra-id-idp-additional-individual-groups.adoc[leveloffset=+1]

[role="_additional-resources"]
[id="additional-resources_{context}"]
== Additional resources

* link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/authentication_and_authorization/using-rbac[Using RBAC to define and apply permissions]
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
:_mod-docs-content-type: ASSEMBLY
[id="cloud-experts-activation-account-linking"]
= Tutorial: {product-title} activation and account linking
= Tutorial: Activate {product-title} and link your account

include::_attributes/attributes-openshift-dedicated.adoc[]
:context: cloud-experts-activation-account-linking
Expand All @@ -14,14 +14,10 @@ This tutorial describes the process for activating {product-title} and linking t
If you have received a private offer for the product, make sure to proceed according to the instructions provided with the private offer before following this tutorial. The private offer is designed either for a case when the product is already activated, which replaces an active subscription, or for first time activations.
====

== Prerequisites

* Log in to the Red{nbsp}Hat account that you want to associate with the AWS account that will activate the {product-title} product subscription.
* The AWS account used for service billing can only be associated with a single Red{nbsp}Hat account. Typically an AWS payer account is the one that is used to subscribe to {product-title} and used for account linking and billing.
* All team members belonging to the same Red{nbsp}Hat organization can use the linked AWS account for service billing while creating {product-title} clusters.

include::modules/subscription-enablement.adoc[leveloffset=+1]

include::modules/aws-rh-linking.adoc[leveloffset=+1]

include::modules/selecting-billing-account-cli.adoc[leveloffset=+1]

ifdef::openshift-rosa[]
Expand All @@ -34,8 +30,8 @@ endif::openshift-rosa[]
include::modules/selecting-billing-account-ui.adoc[leveloffset=+1]

[role="_additional-resources"]
.Additional resources

[id="additional-resources_{context}"]
== Additional resources
ifdef::openshift-rosa-hcp[]
* xref:../rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc#rosa-hcp-sts-creating-a-cluster-quickly[Creating {product-title} clusters using the default options]
endif::openshift-rosa-hcp[]
Expand Down
Loading