diff --git a/modules/rosa-hcp-sharing-vpc-cluster-creation.adoc b/modules/rosa-hcp-sharing-vpc-cluster-creation.adoc index a9ae226d27e..3c0f4770043 100644 --- a/modules/rosa-hcp-sharing-vpc-cluster-creation.adoc +++ b/modules/rosa-hcp-sharing-vpc-cluster-creation.adoc @@ -27,5 +27,5 @@ image::372_OpenShift_on_AWS_persona_worflows_0923_4.png[Step four of the shared + [source,terminal] ---- -$ rosa create cluster --cluster-name --sts --operator-roles-prefix --oidc-config-id --region us-east-1 --subnet-ids --hcp-internal-communication-hosted-zone-id --ingress-private-hosted-zone-id --route53-role-arn vpc-endpoint-role-arn --base-domain --additional-allowed-principals , --hosted-cp +$ rosa create cluster --cluster-name --sts --operator-roles-prefix --oidc-config-id --region us-east-1 --subnet-ids --hcp-internal-communication-hosted-zone-id --ingress-private-hosted-zone-id --route53-role-arn --vpc-endpoint-role-arn --base-domain --additional-allowed-principals , --hosted-cp --role-arn --support-role-arn --worker-iam-role ---- \ No newline at end of file diff --git a/modules/rosa-hcp-sharing-vpc-creation-and-sharing.adoc b/modules/rosa-hcp-sharing-vpc-creation-and-sharing.adoc index dccd4fbc730..9317650e2ee 100644 --- a/modules/rosa-hcp-sharing-vpc-creation-and-sharing.adoc +++ b/modules/rosa-hcp-sharing-vpc-creation-and-sharing.adoc @@ -87,7 +87,7 @@ The trust policy principals (`Principal.AWS`) may be scoped down to the ingress [source,terminal] ---- $ aws iam create-role --role-name \ - --assume-role-policy-document file:///tmp/vpce-role.json + --assume-role-policy-document file:///tmp/shared-vpc-role.json ---- + .. Attach the AWS managed policy `ROSASharedVPCEndpointPolicy` to allow for necessary shared VPC permissions. diff --git a/modules/rosa-hcp-sharing-vpc-dns-and-roles.adoc b/modules/rosa-hcp-sharing-vpc-dns-and-roles.adoc index 0a447e86a24..8ced2aa87e6 100644 --- a/modules/rosa-hcp-sharing-vpc-dns-and-roles.adoc +++ b/modules/rosa-hcp-sharing-vpc-dns-and-roles.adoc @@ -96,13 +96,14 @@ where: [NOTE] ==== The Installer account role and the shared VPC roles must have a one-to-one relationship. If you want to create multiple shared VPC roles, you should create one set of account roles per shared VPC role. +Take note of the Support role ARN and Worker role ARN, since you will use them in the cluster's creation command. ==== . After creating the Operator roles, share the _Ingress Operator Cloud Credentials_, _Installer_, and _Control plane Operator Cloud Credentials_ role ARNs with the *VPC Owner*. + The shared information resembles these examples: + -* ``my-rosa-cluster.14eo.p1.openshiftapps.com`` -* ``arn:aws:iam::111122223333:role/ManagedOpenShift-Installer-Role`` -* ``arn:aws:iam::111122223333:role/my-rosa-cluster-openshift-ingress-operator-cloud-credentials`` -* ``arn:aws:iam::111122223333:role/my-rosa-cluster-control-plane-operator`` \ No newline at end of file +* ``14eo.p3.openshiftapps.com`` +* ``arn:aws:iam::111122223333:role/-HCP-ROSA-Installer-Role`` +* ``arn:aws:iam::111122223333:role/-openshift-ingress-operator-cloud-credentials`` +* ``arn:aws:iam::111122223333:role/-kube-system-control-plane-operator`` \ No newline at end of file diff --git a/modules/rosa-hcp-sharing-vpc-hosted-zones.adoc b/modules/rosa-hcp-sharing-vpc-hosted-zones.adoc index 1d3f83f5131..0e9ab00c862 100644 --- a/modules/rosa-hcp-sharing-vpc-hosted-zones.adoc +++ b/modules/rosa-hcp-sharing-vpc-hosted-zones.adoc @@ -42,9 +42,9 @@ include::snippets/rosa-long-cluster-name.adoc[] "Effect": "Allow", "Principal": { "AWS": [ - "arn:aws:iam:::role/-ingress-operator-cloud-credentials", - "arn:aws:iam:::role/-hcp-Installer-Role", - "arn:aws:iam:::role/-control-plane-operator" + "arn:aws:iam:::role/-openshift-ingress-operator-cloud-credentials", + "arn:aws:iam:::role/-HCP-ROSA-Installer-Role", + "arn:aws:iam:::role/-kube-system-control-plane-operator" ] }, "Action": "sts:AssumeRole"