Procedure

1. To enable the log forwarder delivery capability, prepare the IAM policy by creating an assume-role-policy.json file. Apply the following IAM policy sample:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::859037107838:role/ROSA-CentralLogDistributionRole-241c1a86"
               },
               "Action": "sts:AssumeRole"
           }
       ]
   }

   Copy code to clipboard

2. To enable the log forwarder distribution capability, create an IAM role that must include the CustomerLogDistribution name by running the following command:

   $ aws iam create-role \
       --role-name CustomerLogDistribution-RH \
       --assume-role-policy-document file://assume-role-policy.json

   Copy code to clipboard

Procedure

1. Create the CloudWatch log group by running the following command:

   $ aws logs create-log-group --log-group-name <your_log_group_name>

   Copy code to clipboard

2. In your Red Hat OpenShift Service on AWS cluster, configure the log forwarder to use the CloudWatch log group by applying the following JSON sample:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "CreatePutLogs",
               "Effect": "Allow",
               "Action": [
                   "logs:CreateLogStream",
                   "logs:PutLogEvents"
               ],
               "Resource": "<your_log_group_arn>:*"
           },
           {
               "Sid": "DescribeLogs",
               "Effect": "Allow",
               "Action": [
                   "logs:DescribeLogGroups",
                   "logs:DescribeLogStreams"
               ],
               "Resource": "*"
           }
       ]
   }

   Copy code to clipboard

3. Attach the policy to the CloudWatch role by running the following command:

   $ aws iam put-role-policy \
       --role-name CustomerLogDistribution-RH \
       --policy-name Allow-CloudWatch-Writes \
       --policy-document file://cloudwatch-policy.json

   Copy code to clipboard

4. Configure your Red Hat OpenShift Service on AWS cluster to forward logs to the CloudWatch log group by applying the following sample YAML list. Specify an application, or group, or both:

   cloudwatch:
     cloudwatch_log_role_arn: "arn:aws:iam::123456789012:role/RosaCloudWatch"
     cloudwatch_log_group_name: "rosa-logs"
     applications:
       - "<example_app1>"
     groups:
       - "<example_group1>"

   Copy code to clipboard

   where:

   <example_app1>

   Add one or more applications. For a list of applications, see the table in "Determining what log groups to use".

   <example_group1>

   Add one or more of the following groups: api, authentication, controller manager, scheduler.

5. Enable the log forwarder to send logs to your Red Hat OpenShift Service on AWS cluster.

   1. To enable control plane log forwarding on a new cluster, include the log forwarding configuration by running the following command:

      $ rosa create cluster --log-fwd-config="<path_to_file>.yaml"

      Copy code to clipboard

   2. To enable control plane log forwarding on an existing cluster, include the log forwarding configuration by running the following command:

      $ rosa create log-forwarder -c <cluster> --log-fwd-config="<path_to_file>.yaml" -o yaml

      Copy code to clipboard

6. Optional: For an example for forwarding logs to the CloudWatch log group, apply the following sample YAML:

   cloudwatch:
     cloudwatch_log_role_arn: "cloudwatch-log-role-arn"
     cloudwatch_log_group_name: "cloudwatch-group-name"
     applications:
       - "<example_app1>"
     groups:
       - "<example_group1>"

   Copy code to clipboard

Procedure

1. Create the S3 bucket by running the following command:

   $ aws s3api create-bucket \
       --bucket <your_s3_bucket_name> \
       --region <your_aws_region> \
       --create-bucket-configuration LocationConstraint=<cluster_aws_region>

   Copy code to clipboard

2. Configure the policy for the S3 bucket by applying the following S3 bucket policy sample:

    "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "AllowCentralLogDistributionWrite",
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::859037107838:role/ROSA-CentralLogDistributionRole-241c1a86"
               },
               "Action": "s3:PutObject",
               "Resource": "arn:aws:s3:::<your_s3_bucket_name>/*",
               "Condition": {
                   "StringEquals": {
                       "s3:x-amz-acl": "bucket-owner-full-control"
                   }
               }
           }
       ]
   }

   Copy code to clipboard

3. Attach the policy to the S3 role by running the following command:

   $ aws s3api put-bucket-policy \
       --bucket <your_s3_bucket_name> \
       --policy file://s3-bucket-policy.json

   Copy code to clipboard

4. Configure your Red Hat OpenShift Service on AWS cluster to forward logs to the S3 bucket by applying the following sample YAML list. Specify an application, or group, or both:

   s3:
     s3_config_bucket_name: "my-log-bucket"
     s3_config_bucket_prefix: "my-bucket-prefix"
     applications:
       - "<example_app1>"
     groups:
       - "<example_group1>"

   Copy code to clipboard

   <example_app1>

   Add one or more applications. For a list of applications, see the table in "Determining what log groups to use".

   <example_group1>

   Add one or more of the following groups: api, authentication, controller manager, scheduler.

5. Enable the log forwarder to send logs to your Red Hat OpenShift Service on AWS cluster.

   1. To enable control plane log forwarding on a new cluster, include the log forwarding configuration by running the following command:

      $ rosa create cluster --log-fwd-config="<path_to_file>.yaml"

      Copy code to clipboard

   2. To enable control plane log forwarding on an existing cluster, include the log forwarding configuration by running the following command:

      $ rosa create log-forwarder -c <cluster> --log-fwd-config="<path_to_file>.yaml" -o yaml

      Copy code to clipboard

6. Optional: For an example for forwarding logs to the S3 bucket, apply the following sample YAML:

   s3:
     s3_config_bucket_name: "s3-bucket-name"
     s3_config_bucket_prefix: "s3-bucket-prefix"
     groups:
       - "<example_group1>"

   Copy code to clipboard

Procedure

1. In the Red Hat Hybrid Cloud Console, go to Clusters → Cluster List, then click the Create cluster button.
2. On the Managed services offerings page, go to the offering, Red Hat OpenShift Service on AWS (ROSA), and click the Create cluster button, then select With web interface.
3. For Create a ROSA Cluster → Control plane, select your ROSA hosted architecture.
4. For Accounts and roles, select your Associated AWS infrastructure account and AWS billing account.

5. For the Cluster settings → Cluster details, complete the following text boxes:

   • Region
   • Cluster name
   • Version
   • Channel

   In about 20 minutes after you complete this information, your cluster is ready to install and you can continue to configure it.

6. For Machine pool → Networking → Configuration → CIDR ranges → Cluster roles and policies, complete all of the required text boxes with the specifications that you want for your cluster.
7. On the Review and create → Review your ROSA cluster page, verify that the cluster details are correct.

8. Optional: If you want to forward your control plane logs to an Amazon S3 bucket or CloudWatch log group, complete the following instructions:

   1. On the Control plane log forwarding (optional) page, click Enable Amazon S3, or Enable CloudWatch, or both.

   2. If you enable Amazon S3, complete the following fields:

      • Bucket name: Give it a unique identifier across all of Amazon Web Services (AWS).
      • Bucket prefix: Give it an optional path to organize your data.
      • Select groups and applications (optional): When you select a group, the log forwarder collects all of the applications and related services from that group.

   3. If you enable CloudWatch, complete the following fields:

      • Prerequisite: Verify that you have created an IAM role and policy, then click the box stating that you have.
      • Log group name: Give it a unique identifier.
      • Role ARN: Give the IAM role ARN. For example, arn:aws:iam::<12-digit-account-id>:role/<role-name>.
      • Select groups and applications: When you select a group, the log forwarder collects all the applications and related services from that group.
   4. On the Review and create → Review your ROSA cluster page, verify that the cluster details are correct.
   5. Click the Create cluster button.
9. If you want to finish completing your cluster with no designated log forwarding destination, click the Create cluster button.

Verification

1. In the Red Hat Hybrid Cloud Console, go to Clusters → Cluster List. You can see the name and status of your cluster.
2. Verify that the status of your cluster is “Ready” and click the name of your cluster.
3. In the Overview tab, verify that the details of your cluster are what you specified.

4. Go to the Control plane log forwarding section.

   1. If you enabled Amazon S3, verify that you see Amazon S3: Enabled. If you did not set it up, it shows, Amazon S3: Disabled.
   2. If you enabled CloudWatch, verify that you see CloudWatch: Enabled. If you did not set it up, it shows, CloudWatch: Disabled.
5. Click View details, which takes you to the Settings tab. Confirm all the specific details for your control plane log forwarding are correct.

Procedure

1. In the Red Hat Hybrid Cloud Console, go to Clusters → Cluster List, then click the name of your cluster.
2. Go to the Settings tab then the Control plane log forwarding section.

3. To add to your log forwarding, click the Add configuration dropdown button.

   1. You can add a CloudWatch or Amazon S3 configuration.
4. To make changes to your existing log forwarding, click the three dots within your CloudWatch or Amazon S3 log forwarding configuration, then select Edit configuration or Delete configuration.

5. When you click Edit configuration for Amazon S3 log forwarding, you see your configuration and can make changes to the following:

   • Bucket Name
   • Bucket Prefix
   • Select groups and applications

6. When you click Edit configuration for CloudWatch log forwarding, you see your configuration and can make changes to the following:

   • Log group name
   • Role ARN
   • Select groups and applications
7. Make the changes to your configuration, then click Save.

Verification

1. In the Settings tab → Control plane log forwarding section, verify that you see the changes you made to your configuration. The changes you made instantly go through and appear in this section.