Skip to content

Commit c458df8

Browse files
jneczyporjneczypor
committed
OSDOCS-10767
1 parent 4690a03 commit c458df8

File tree

5 files changed

+358
-0
lines changed

5 files changed

+358
-0
lines changed

‎_topic_maps/_topic_map_rosa_hcp.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,14 @@ Topics:
8383
Topics:
8484
- Name: Deploying a cluster
8585
File: cloud-experts-getting-started-hcp-for-hcp
86+
- Name: Creating an admin user
87+
File: cloud-experts-getting-started-admin
88+
- Name: Setting up an identity provider
89+
File: cloud-experts-getting-started-idp
90+
- Name: Granting admin rights
91+
File: cloud-experts-getting-started-admin-rights
92+
- Name: Accessing your cluster
93+
File: cloud-experts-getting-started-accessing
8694
# ---
8795
# Name: Architecture
8896
# Dir: architecture

‎rosa_learning/creating_cluster_workshop/cloud-experts-getting-started-accessing.adoc

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="cloud-experts-getting-started-accessing"]
3+
= Tutorial: Accessing your cluster
4+
include::_attributes/attributes-openshift-dedicated.adoc[]
5+
:context: cloud-experts-getting-started-accessing
6+
7+
toc::[]
8+
9+
//rosaworkshop.io content metadata
10+
//Brought into ROSA product docs 2023-11-30
11+
12+
You can connect to your cluster using the command line interface (CLI) or the {hybrid-console} user interface (UI).
13+
14+
== Accessing your cluster using the CLI
15+
16+
To access the cluster using the CLI, you must have the `oc` CLI installed. If you are following the tutorials, you already installed the `oc` CLI.
17+
18+
. Log in to the {cluster-manager-url}.
19+
. Click your username in the top right corner.
20+
. Click *Copy Login Command*.
21+
+
22+
image::cloud-experts-getting-started-accessing-copy-login.png[]
23+
24+
. This opens a new tab with a choice of identity providers (IDPs). Click the IDP you want to use. For example, "rosa-github".
25+
+
26+
image::cloud-experts-getting-started-accessing-copy-token.png[]
27+
28+
. A new tab opens. Click *Display token*.
29+
30+
. Run the following command in your terminal:
31+
+
32+
[source,terminal]
33+
----
34+
$ oc login --token=sha256~GBAfS4JQ0t1UTKYHbWAK6OUWGUkdMGz000000000000 --server=https://api.my-rosa-cluster.abcd.p1.openshiftapps.com:6443
35+
----
36+
+
37+
.Example output
38+
+
39+
[source,terminal]
40+
----
41+
Logged into "https://api.my-rosa-cluster.abcd.p1.openshiftapps.com:6443" as "rosa-user" using the token provided.
42+
43+
You have access to 79 projects, the list has been suppressed. You can list all projects with ' projects'
44+
45+
Using project "default".
46+
----
47+
48+
. Confirm that you are logged in by running the following command:
49+
+
50+
[source,terminal]
51+
----
52+
$ oc whoami
53+
----
54+
+
55+
.Example output
56+
+
57+
[source,terminal]
58+
----
59+
rosa-user
60+
----
61+
62+
. You can now access your cluster.
63+
64+
== Accessing the cluster via the {hybrid-console-second}
65+
. Log in to the {cluster-manager-url}.
66+
.. To retrieve the {hybrid-console-second} URL run:
67+
+
68+
[source,terminal]
69+
----
70+
rosa describe cluster -c <cluster-name> | grep Console
71+
----
72+
73+
. Click your IDP. For example, "rosa-github".
74+
+
75+
image::cloud-experts-getting-started-accessing-copy-token.png[]
76+
77+
. Enter your user credentials.
78+
. You should be logged in. If you are following the tutorials, you will be a cluster-admin and should see the {hybrid-console-second} webpage with the *Administrator* panel visible.
79+
+
80+
image::cloud-experts-getting-started-accessing-logged.png[]

‎rosa_learning/creating_cluster_workshop/cloud-experts-getting-started-admin-rights.adoc

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="cloud-experts-getting-started-admin-rights"]
3+
= Tutorial: Granting admin privileges
4+
include::_attributes/attributes-openshift-dedicated.adoc[]
5+
:context: cloud-experts-getting-started-admin-rights
6+
7+
toc::[]
8+
9+
//rosaworkshop.io content metadata
10+
//Brought into ROSA product docs 2023-11-30
11+
12+
Administration (admin) privileges are not automatically granted to users that you add to your cluster. If you want to grant admin-level privileges to certain users, you will need to manually grant them to each user. You can grant admin privileges from either the ROSA command line interface (CLI) or the Red{nbsp}Hat OpenShift Cluster Manager web user interface (UI).
13+
14+
Red{nbsp}Hat offers two types of admin privileges:
15+
16+
* `cluster-admin`: `cluster-admin` privileges give the admin user full privileges within the cluster.
17+
18+
* `dedicated-admin`: `dedicated-admin` privileges allow the admin user to complete most administrative tasks with certain limitations to prevent cluster damage. It is best practice to use `dedicated-admin` when elevated privileges are needed.
19+
20+
For more information on admin privileges, see the xref:../../rosa_install_access_delete_clusters/rosa-sts-accessing-cluster.adoc#rosa-create-cluster-admins_rosa-sts-accessing-cluster[administering a cluster] documentation.
21+
22+
== Using the ROSA CLI
23+
24+
. Assuming you are the user who created the cluster, run one of the following commands to grant admin privileges:
25+
+
26+
* For `cluster-admin`:
27+
+
28+
[source,terminal]
29+
----
30+
$ rosa grant user cluster-admin --user <idp_user_name> --cluster=<cluster-name>
31+
----
32+
+
33+
* For `dedicated-admin`:
34+
+
35+
[source,terminal]
36+
----
37+
$ rosa grant user dedicated-admin --user <idp_user_name> --cluster=<cluster-name>
38+
----
39+
40+
. Verify that the admin privileges were added by running the following command:
41+
+
42+
[source,terminal]
43+
----
44+
$ rosa list users --cluster=<cluster-name>
45+
----
46+
+
47+
.Example output
48+
+
49+
[source,terminal]
50+
----
51+
$ rosa list users --cluster=my-rosa-cluster
52+
ID GROUPS
53+
<idp_user_name> cluster-admins
54+
----
55+
56+
. If you are currently logged into the {hybrid-console}, log out of the console and log back in to the cluster to see a new perspective with the "Administrator Panel". You might need an incognito or private window.
57+
+
58+
image:cloud-experts-getting-started-admin-rights-admin-panel.png[]
59+
60+
. You can also test that admin privileges were added to your account by running the following command. Only a `cluster-admin` users can run this command without errors.
61+
+
62+
[source,terminal]
63+
----
64+
$ oc get all -n openshift-apiserver
65+
----
66+
67+
== Using the Red{nbsp}Hat OpenShift Cluster Manager UI
68+
69+
. Log in to the {cluster-manager-url}.
70+
. Select your cluster.
71+
. Click the *Access Control* tab.
72+
. Click the *Cluster roles and Access* tab in the sidebar.
73+
. Click *Add user*.
74+
+
75+
image::cloud-experts-getting-started-admin-rights-access-control.png[]
76+
77+
. On the pop-up screen, enter the user ID.
78+
. Select whether you want to grant the user `cluster-admins` or `dedicated-admins` privileges.
79+
+
80+
image::cloud-experts-getting-started-admin-rights-add-user2.png[]

‎rosa_learning/creating_cluster_workshop/cloud-experts-getting-started-admin.adoc

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="cloud-experts-getting-started-admin"]
3+
= Tutorial: Creating an admin user
4+
include::_attributes/attributes-openshift-dedicated.adoc[]
5+
:context: cloud-experts-getting-started-admin
6+
7+
toc::[]
8+
9+
//rosaworkshop.io content metadata
10+
//Brought into ROSA product docs 2023-11-27
11+
12+
Creating an administration (admin) user allows you to access your cluster quickly. Follow these steps to create an admin user.
13+
14+
[NOTE]
15+
====
16+
An admin user works well in this tutorial setting. For actual deployment, use a xref:../../authentication/sd-configuring-identity-providers.adoc#sd-configuring-identity-providers[formal identity provider] to access the cluster and grant the user admin privileges.
17+
====
18+
19+
. Run the following command to create the admin user:
20+
+
21+
[source,terminal]
22+
----
23+
rosa create admin --cluster=<cluster-name>
24+
----
25+
+
26+
.Example output
27+
+
28+
[source,terminal]
29+
----
30+
W: It is recommended to add an identity provider to login to this cluster. See 'rosa create idp --help' for more information.
31+
I: Admin account has been added to cluster 'my-rosa-cluster'. It may take up to a minute for the account to become active.
32+
I: To login, run the following command:
33+
oc login https://api.my-rosa-cluster.abcd.p1.openshiftapps.com:6443 \
34+
--username cluster-admin \
35+
--password FWGYL-2mkJI-00000-00000
36+
----
37+
38+
. Copy the log in command returned to you in the previous step and paste it into your terminal. This will log you in to the cluster using the CLI so you can start using the cluster.
39+
+
40+
[source,terminal]
41+
----
42+
$ oc login https://api.my-rosa-cluster.abcd.p1.openshiftapps.com:6443 \
43+
> --username cluster-admin \
44+
> --password FWGYL-2mkJI-00000-00000
45+
----
46+
+
47+
.Example output
48+
+
49+
[source,terminal]
50+
----
51+
Login successful.
52+
53+
You have access to 79 projects, the list has been suppressed. You can list all projects with ' projects'
54+
55+
Using project "default".
56+
----
57+
58+
. To check that you are logged in as the admin user, run one of the following commands:
59+
+
60+
* Option 1:
61+
+
62+
[source,terminal]
63+
----
64+
$ oc whoami
65+
----
66+
+
67+
.Example output
68+
+
69+
[source,terminal]
70+
----
71+
cluster-admin
72+
----
73+
+
74+
* Option 2:
75+
+
76+
[source,terminal]
77+
----
78+
oc get all -n openshift-apiserver
79+
----
80+
+
81+
Only an admin user can run this command without errors.
82+
83+
. You can now use the cluster as an admin user, which will suffice for this tutorial. For actual deployment, it is highly recommended to set up an identity provider, which is explained in the xref:../../cloud_experts_tutorials/cloud-experts-getting-started/cloud-experts-getting-started-idp.adoc#cloud-experts-getting-started-idp[next tutorial].

‎rosa_learning/creating_cluster_workshop/cloud-experts-getting-started-idp.adoc

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="cloud-experts-getting-started-idp"]
3+
= Tutorial: Setting up an identity provider
4+
include::_attributes/attributes-openshift-dedicated.adoc[]
5+
:context: cloud-experts-getting-started-idp
6+
7+
toc::[]
8+
9+
//rosaworkshop.io content metadata
10+
//Brought into ROSA product docs 2023-11-28
11+
12+
To log in to your cluster, set up an identity provider (IDP). This tutorial uses GitHub as an example IDP. See the full list of xref:../../rosa_install_access_delete_clusters/rosa-sts-config-identity-providers.adoc#understanding-idp-supported_rosa-sts-config-identity-providers[IDPs supported by ROSA].
13+
14+
* To view all IDP options, run the following command:
15+
+
16+
[source,terminal]
17+
----
18+
rosa create idp --help
19+
----
20+
21+
== Setting up an IDP with GitHub
22+
. Log in to your GitHub account.
23+
. Create a new GitHub organization where you are an administrator.
24+
+
25+
[TIP]
26+
====
27+
If you are already an administrator in an existing organization and you want to use that organization, skip to step 9.
28+
====
29+
+
30+
Click the *+* icon, then click *New Organization*.
31+
+
32+
image::cloud-experts-getting-started-idp-new-org.png[]
33+
34+
. Choose the most applicable plan for your situation or click *Join for free*.
35+
36+
. Enter an organization account name, an email, and whether it is a personal or business account. Then, click *Next*.
37+
+
38+
image::cloud-experts-getting-started-idp-team.png[]
39+
40+
. *Optional:* Add the GitHub IDs of other users to grant additional access to your ROSA cluster. You can also add them later.
41+
. Click *Complete Setup*.
42+
. *Optional:* Enter the requested information on the following page.
43+
. Click *Submit*.
44+
. Go back to the terminal and enter the following command to set up the GitHub IDP:
45+
+
46+
[source,terminal]
47+
----
48+
rosa create idp --cluster=<cluster name> --interactive
49+
----
50+
51+
. Enter the following values:
52+
+
53+
[source,terminal]
54+
----
55+
Type of identity provider: github
56+
Identity Provider Name: <IDP-name>
57+
Restrict to members of: organizations
58+
GitHub organizations: <organization-account-name>
59+
----
60+
61+
. The CLI will provide you with a link. Copy and paste the link into a browser and press *Enter*. This will fill the required information to register this application for OAuth. You do not need to modify any of the information.
62+
+
63+
image::cloud-experts-getting-started-idp-link.png[]
64+
65+
. Click *Register application*.
66+
+
67+
image::cloud-experts-getting-started-idp-register.png[]
68+
69+
. The next page displays a *Client ID*. Copy the ID and paste it in the terminal where it asks for *Client ID*.
70+
+
71+
[NOTE]
72+
====
73+
Do not close the tab.
74+
====
75+
76+
. The CLI will ask for a *Client Secret*. Go back in your browser and click *Generate a new client secret*.
77+
+
78+
image::cloud-experts-getting-started-idp-secret.png[]
79+
80+
. A secret is generated for you. Copy your secret because it will never be visible again.
81+
82+
. Paste your secret into the terminal and press *Enter*.
83+
. Leave *GitHub Enterprise Hostname* blank.
84+
. Select *claim*.
85+
. Wait approximately 1 minute for the IDP to be created and the configuration to land on your cluster.
86+
+
87+
image::cloud-experts-getting-started-idp-inputs.png[]
88+
89+
. Copy the returned link and paste it into your browser. The new IDP should be available under your chosen name. Click your IDP and use your GitHub credentials to access the cluster.
90+
+
91+
image::cloud-experts-getting-started-idp-login.png[]
92+
93+
== Granting other users access to the cluster
94+
To grant access to other cluster user you will need to add their GitHub user ID to the GitHub organization used for this cluster.
95+
96+
. In GitHub, go to the *Your organizations* page.
97+
98+
. Click your *profile icon*, then *Your organizations*. Then click *<your-organization-name>*. In our example, it is `my-rosa-cluster`.
99+
+
100+
image::cloud-experts-getting-started-idp-org.png[]
101+
102+
. Click *Invite someone*.
103+
+
104+
image::cloud-experts-getting-started-idp-invite.png[]
105+
106+
. Enter the GitHub ID of the new user, select the correct user, and click *Invite*.
107+
. Once the new user accepts the invitation, they will be able to log in to the ROSA cluster using the {hybrid-console-second} link and their GitHub credentials.

0 commit comments

Comments
 (0)