Introduction to Red Hat OpenShift Service on AWS (ROSA)

Procedure 2.1. Instructions

1. Prepare a GitHub organization. In the following steps, you grant all the GitHub users in that organization developer access to your ROSA cluster.

   1. Use your GitHub credentials to log in to GitHub at https://github.com.

   2. If you already have administrative access to a GitHub organization, then you can use that organization for the exercise. Otherwise, follow the instructions in https://docs.github.com/en/organizations/collaborating-with-groups-in-organizations/creating-a-new-organization-from-scratch to create an organization. Select the free plan for the new organization and then complete the form as follows:

      Field	value
      Organization account name	do120-yourname
      Contact email	Your email address
      This organization belongs to	My personal account

      If the organization account name is unavailable because you already performed the exercise, then choose a different name and use it in the following steps.

   3. Accept the terms of service and then click Next. Do not add members to your organization and then click Complete setup. Provide your GitHub password to confirm the operation.

2. Verify that your ROSA CLI configuration is correct and that the ROSA cluster is ready.

   1. Open a command-line terminal on your system and then run the rosa whoami command to confirm that the AWS and the Red Hat OpenShift Cluster Manager configuration is correct. Verify that the command lists your AWS account, the correct AWS region, and your Red Hat customer portal account.

      $ rosa whoami
      AWS ARN:                      arn:aws:iam::...:user/user1@example.com-fqppg-admin
      AWS Account ID:               452954386616
      AWS Default Region:           us-east-1
      OCM API:                      https://api.openshift.com
      OCM Account Email:            wlombardo@example.com
      OCM Account ID:               1VhrXTjpDWnt4rfZvdgLj2fEcso
      OCM Account Name:             Wilhelm Lombardo
      OCM Account Username:         wlombardo
      OCM Organization External ID: 15701801
      OCM Organization ID:          1HMOv5QDUifj2g6Si1hyskyv2IP
      OCM Organization Name:        Wilhelm Lombardo

      The credentials in the preceding output are different on your system. Your own credentials display.

   2. Run the rosa describe cluster command to confirm that your ROSA cluster named do120-cluster is ready.

      $ rosa describe cluster -c do120-cluster
      ...output omitted...
      State:                      ready
      ...output omitted...

3. Configure GitHub as an identity provider for OpenShift.

   1. Run the rosa create idp command to configure GitHub as an identity provider. Use github-do120 for the identity provider name. This name displays as an identity provider when you access the OpenShift web console.

      $ rosa create idp --cluster do120-cluster --interactive
      I: Interactive mode enabled.
      Any optional fields can be left empty and a default will be selected.
      ? Type of identity provider: github
      ? Identity provider name: github-do120
      ? Restrict to members of: organizations
      ? GitHub organizations: do120-yourname
      ? To use GitHub as an identity provider, you must first register the application:
        - Open the following URL:
          https://github.com/organizations/do120-yourname/settings/applications/new?oauth_application%5Bcallback_url%5D=https%3A%2F%2Foauth-openshift.apps.do120-cluster.jf96.p1.openshiftapps.com%2Foauth2callback%2FGitHub&oauth_application%5Bname%5D=do120-cluster&oauth_application%5Burl%5D=https%3A%2F%2Fconsole-openshift-console.apps.do120-cluster.jf96.p1.openshiftapps.com
        - Click on 'Register application'
      ? Client ID:

      Do not cancel the command and do not close the terminal.

   2. Open a web browser and then navigate to the URL that the preceding command output displays. This process registers your ROSA cluster and a new OAuth application in GitHub.

   3. Click Register application and then copy the client ID to the clipboard. Do not close the browser window.

      

   4. Paste the client ID into the terminal.

      ...output omitted...
      ? Client ID: 67e202f06e0989e62bb8
      ? Client Secret: [? for help]

      In the preceding output, the client ID is different on your system.

      Do not cancel the command and do not close the terminal.

   5. Switch to the web browser and then click Generate a new client secret. Copy the secret to the clipboard.

   6. Paste the secret into the terminal and then accept the default values for the remaining parameters.

      ...output omitted...
      ? Client ID: 67e202f06e0989e62bb8
      ? Client Secret: [? for help] ****************************************
      ? GitHub Enterprise Hostname (optional): <Enter>
      ? Mapping method: claim
      I: Configuring IDP for cluster 'do120-cluster'
      I: Identity Provider 'github-do120' has been created.
         It may take several minutes for this access to become active.
         To add cluster administrators, see 'rosa grant user --help'.
         To login into the console, open https://console-openshift-console.apps.do120-cluster.jf96.p1.openshiftapps.com and click on github-do120.

4. To validate your configuration, log in to the OpenShift web console by using your GitHub credentials.

   1. To access the OpenShift web console, use the web browser to navigate to the URL from the output of the preceding rosa command. Notice that the new github-do120 identity provider displays.

      Note

      You might have to wait five minutes for the github-do120 identity provider to become active. Reload the login page until the github-do120 button displays.

   2. Click github-do120. If you are not already logged in to GitHub, then provide your GitHub credentials. Click Authorize do120-yourname . The Developer view displays.

      

      All the users in the do120-yourname GitHub organization can log in to your ROSA cluster as self-service developers. If you created the GitHub organization with your GitHub account, without adding more users, then you are the only member of that organization.

   3. Switch to the Administrator view and then expand the Administration menu. Only two submenus display because as a self-service developer you do not have access to all the administration features.

5. Verify that you can also use the oc command to log in to your cluster from the command line. You cannot log in by using a username and a password when using the GitHub identity provider. You can only log in by using a token.

   1. From the web browser, click your name on the top right corner of the web console, and then click Copy login command.

      

   2. If the log in page displays, then click github-do120 and then use your GitHub credentials for authentication.

   3. Click Display Token and then copy the oc login --token=…​ command to the clipboard.

   4. Open a command-line terminal on your system, paste the command into the command-line terminal, and then run it.

      $ oc login --token=sha256~1NofZkVCi3qCBcBJGc6XiOJTK5SDXF2ZYwhAARx5yJg
        --server=https://api.do120-cluster.jf96.p1.openshiftapps.com:6443
      Logged into "https://api.do120-cluster.jf96.p1.openshiftapps.com:6443" as "wlombardogh" using the token provided.
      
      You don't have any projects. You can try to create a new project, by running
      
          oc new-project <projectname>
      
      Welcome! See 'oc help' to get started.

      Notice that the command output displays you GitHub username. That username is different in your command output.

   5. Log out from the cluster.

      $ oc logout
      Logged "wlombardogh" out on "https://api.do120-cluster.jf96.p1.openshiftapps.com:6443"

   6. Log out from the OpenShift web console. To do so, from the web browser, click your name on the top right corner of the web console and then click Log out.

6. Add the cluster-admins role to your GitHub user account.

   1. From the command-line terminal, grant cluster administrator rights to your GitHub user account. In the following command, use your GitHub username for the --user option.

      $ rosa grant user cluster-admin --user wlombardogh --cluster do120-cluster
      I: Granted role 'cluster-admins' to user 'wlombardogh' on cluster 'do120-cluster'

   2. Switch to the web browser and then log in again to the OpenShift web console by using your GitHub account.

   3. Switch to the Administrator view and then navigate to User Management → Groups.

   4. Select the cluster-admins group. Notice that your GitHub username displays under the Users section.

   5. Expand the Administration menu. Notice that you have access to more administration features than when you were connected as a self-service developer.

   6. Navigate to Administration → Cluster Settings, select Configuration, and then select Alertmanager. Configuration options for the Alert Manager display, which means that you have rights to configure that tool.

      

   7. Log out from the OpenShift web console. To do so, click your name on the top right corner of the web console and then click Log out.

7. Add the dedicated-admins role to your GitHub user account.

   1. From the command-line terminal, revoke the cluster-admins role. A user account cannot have both the cluster-admins and the dedicated-admins roles. In the following command, use your GitHub username for the --user option.

      $ rosa revoke user cluster-admin --user wlombardogh --cluster do120-cluster
      ? Are you sure you want to revoke role cluster-admins from user wlombardogh in cluster do120-cluster? Yes
      I: Revoked role 'cluster-admins' from user 'wlombardogh' on cluster 'do120-cluster'

   2. Grant dedicated administrator rights to your GitHub user account. In the following command, use your GitHub username for the --user option.

      $ rosa grant user dedicated-admin --user wlombardogh --cluster do120-cluster
      I: Granted role 'dedicated-admins' to user 'wlombardogh' on cluster 'do120-cluster'

   3. Switch to the web browser and then log in again to the OpenShift web console by using your GitHub account.

   4. Navigate to User Management → Groups and then select the dedicated-admins group. Notice that your GitHub username displays under the Users section.

   5. Navigate to Administration → Cluster Settings, select Configuration, and then select Alertmanager. The error message indicates that you are not allowed to modify the Alert Manager configuration. As a dedicated administrator, you have limited administration rights.

      

   6. Log out from the OpenShift web console. To do so, click your name on the top right corner of the web console and then click Log out.