diff --git a/hosted_control_planes/hcp-manage/hcp-manage-aws.adoc b/hosted_control_planes/hcp-manage/hcp-manage-aws.adoc index 28be95c4fc85..2af9ba0ba454 100644 --- a/hosted_control_planes/hcp-manage/hcp-manage-aws.adoc +++ b/hosted_control_planes/hcp-manage/hcp-manage-aws.adoc @@ -29,8 +29,6 @@ include::modules/hcp-managed-aws-infra-iam-separate.adoc[leveloffset=+1] include::modules/hcp-managed-aws-infra-separate.adoc[leveloffset=+2] -include::modules/hcp-managed-aws-iam-separate.adoc[leveloffset=+2] - include::modules/hcp-managed-aws-hc-separate.adoc[leveloffset=+2] include::modules/hcp-migrate-aws-single-to-multiarch.adoc[leveloffset=+1] diff --git a/modules/hcp-managed-aws-hc-separate.adoc b/modules/hcp-managed-aws-hc-separate.adoc index 7945df96149d..3ec48ad4c3c9 100644 --- a/modules/hcp-managed-aws-hc-separate.adoc +++ b/modules/hcp-managed-aws-hc-separate.adoc @@ -2,40 +2,56 @@ // // * hosted_control_planes/hcp-manage/hcp-manage-aws.adoc -:_mod-docs-content-type: CONCEPT +:_mod-docs-content-type: PROCEDURE [id="hcp-managed-aws-hc-separate_{context}"] = Creating a hosted cluster separately -You can create a hosted cluster separately on {aws-first}. +[role="_abstract"] +In {hcp} on {aws-short}, you can create a hosted cluster separately from creating the infrastructure and Identity and Access Management (IAM) resources. -To create a hosted cluster separately, enter the following command: +.Prerequisites +* You created infrastructure resources separately. For more information, see "Creating the {aws-short} infrastructure separately". + +* You created the following IAM resources: + +** An OpenID Connect (OIDC) identity provider in IAM, which is required to enable STS authentication. For more information, see link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html[Create an OpenID Connect (OIDC) identity provider in IAM]. +** Seven roles, which are separate for every component that interacts with the provider, such as the Kubernetes controller manager, cluster API provider, and registry. For more information, see link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html[IAM role creation]. +** The instance profile, which is the profile that is assigned to all worker instances of the cluster. For more information, see link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html[Use instance profiles]. + +.Procedure + +* To create a hosted cluster separately, enter the following command: ++ [source,terminal] [subs="+quotes"] ---- $ hcp create cluster aws \ - --infra-id \// <1> - --name \// <2> - --sts-creds \// <3> - --pull-secret \// <4> - --generate-ssh \// <5> - --node-pool-replicas 3 - --role-arn <6> + --infra-id \ + --name \ + --sts-creds \ + --pull-secret \ + --generate-ssh \ + --node-pool-replicas 3 \ + --role-arn \ + --render > .yaml ---- -<1> Replace `` with the same ID that you specified in the `create infra aws` command. This value identifies the IAM resources that are associated with the hosted cluster. -<2> Replace `` with the name of your hosted cluster. -<3> Replace `` with the same name that you specified in the `create infra aws` command. -<4> Replace `` with the name of the file that contains a valid {product-title} pull secret. -<5> The `--generate-ssh` flag is optional, but is good to include in case you need to SSH to your workers. An SSH key is generated for you and is stored as a secret in the same namespace as the hosted cluster. -<6> Replace `` with the Amazon Resource Name (ARN), for example, `arn:aws:iam::820196288204:role/myrole`. Specify the Amazon Resource Name (ARN), for example, `arn:aws:iam::820196288204:role/myrole`. For more information about ARN roles, see "Identity and Access Management (IAM) permissions". - -You can also add the `--render` flag to the command and redirect output to a file where you can edit the resources before you apply them to the cluster. - -After you run the command, the following resources are applied to your cluster: - -* A namespace -* A secret with your pull secret -* A `HostedCluster` -* A `NodePool` -* Three AWS STS secrets for control plane components -* One SSH key secret if you specified the `--generate-ssh` flag. ++ +** `--infra-id` specifies the same ID that you specified in the `create infra aws` command. This value identifies the IAM resources that are associated with the hosted cluster. +** `--name` specifies the name of your hosted cluster. +** `--sts-creds` specifies the same name that you specified in the `create infra aws` command. +** `--pull-secret` specifies the name of the file that contains a valid {product-title} pull secret. +** `--generate-ssh` is an optional flag, but it is good to include in case you need to SSH to your workers. An SSH key is generated for you and is stored as a secret in the same namespace as the hosted cluster. +** `--role-arn` specifies the Amazon Resource Name (ARN); for example, `arn:aws:iam::820196288204:role/myrole`. For more information about ARN roles, see "Identity and Access Management (IAM) permissions". +** `--render` is an optional flag. You can include this flag to redirect output to a file where you can edit the resources before you apply them to the cluster. + +.Verification + +* After you run the command, you can verify that the following resources are applied to your cluster: ++ +** A namespace +** A secret with your pull secret +** A `HostedCluster` +** A `NodePool` +** Three {aws-short} STS secrets for control plane components +** If you specified the `--generate-ssh` flag, one SSH key secret. diff --git a/modules/hcp-managed-aws-iam-separate.adoc b/modules/hcp-managed-aws-iam-separate.adoc deleted file mode 100644 index 2f3165b217f5..000000000000 --- a/modules/hcp-managed-aws-iam-separate.adoc +++ /dev/null @@ -1,13 +0,0 @@ -// Module included in the following assemblies: -// -// * hosted_control_planes/hcp-manage/hcp-manage-aws.adoc - -:_mod-docs-content-type: CONCEPT -[id=" hcp-managed-aws-iam-separate_{context}"] -= Creating the {aws-short} IAM resources - -In {aws-first}, you must create the following IAM resources: - -* link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html[An OpenID Connect (OIDC) identity provider in IAM], which is required to enable STS authentication. -* link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html[Seven roles], which are separate for every component that interacts with the provider, such as the Kubernetes controller manager, cluster API provider, and registry -* The link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html[instance profile], which is the profile that is assigned to all worker instances of the cluster