openshift-docs/modules/rosa-create-objects.adoc

// Module included in the following assemblies:
//
// * rosa_cli/rosa-manage-objects-cli.adoc
:_mod-docs-content-type: REFERENCE
[id="rosa-create-objects_{context}"]
= Create objects

This section describes the `create` commands for clusters and resources.

[id="rosa-create-account-roles_{context}"]
== create account-roles

Create the required account-wide role and policy resources for your cluster.

.Syntax
[source,terminal]
----
$ rosa create account-roles [flags]
----

.Flags
[cols="30,70"]
|===
|Option |Definition

|--debug
|Enable debug mode.

|-i, --interactive
|Enable interactive mode.

|-m, --mode string
a|How to perform the operation. Valid options are:

`auto`:: Resource changes will be automatically applied using the current AWS account.
`manual`:: Commands necessary to modify AWS resources will be output to be run manually.

|--path string
|The Amazon Resource Name (ARN) path for the account-wide roles and policies, including the Operator policies.

|--permissions-boundary string
|The ARN of the policy that is used to set the permissions boundary for the account roles.

|--prefix string
|User-defined prefix for all generated AWS resources. The default is `ManagedOpenShift`.

|--profile string
|Use a specific AWS profile from your credential file.

|-y, --yes
|Automatically answer yes to confirm operations.

|===

[id="rosa-create-admin_{context}"]
== create admin

Create a cluster administrator with an automatically generated password that can log in to a cluster.

.Syntax
[source,terminal]
----
$ rosa create admin --cluster=<cluster_name>|<cluster_id>
----

.Arguments
[cols="30,70"]
|===
|Option |Definition

a|--cluster <cluster_name>\|<cluster_id>
|Required. The name or ID (string) of the cluster to add to the identity provider (IDP).
|===

.Optional arguments inherited from parent commands
[cols="30,70"]
|===
|Option |Definition

|--help
|Shows help for this command.

|--debug
|Enables debug mode.

|--interactive
|Enables interactive mode.

|--profile string
|Specifies an AWS profile from your credentials file.
|===

.Example
Create a cluster administrator that can log in to a cluster named `mycluster`.

[source,terminal]
----
$ rosa create admin --cluster=mycluster
----

[id="rosa-create-cluster-command_{context}"]
== create cluster

Create a new cluster.

.Syntax
[source,terminal]
----
$ rosa create cluster --cluster-name=<cluster_name> [arguments]
----
//Note to writers: The create cluster command specifically uses --cluster-name because a cluster ID does not exist yet. All other commands use --cluster because either the name or the ID can be used.

.Arguments
[cols="30,70"]
|===
|Option |Definition

|--additional-compute-security-group-ids <sec_group_id>
|The identifier of one or more additional security groups to use along with the default security groups that are used with the standard machine pool created alongside the cluster. For more information on additional security groups, see the requirements for _Security groups_ under _Additional resources_.

|--additional-infra-security-group-ids <sec_group_id>
|The identifier of one or more additional security groups to use along with the default security groups that are used with the infra nodes created alongside the cluster. For more information on additional security groups, see the requirements for _Security groups_ under _Additional resources_.

|--additional-control-plane-security-group-ids <sec_group_id>
|The identifier of one or more additional security groups to use along with the default security groups that are used with the control plane nodes created alongside the cluster. For more information on additional security groups, see the requirements for _Security groups_ under _Additional resources_.

a|--cluster-name <cluster_name>
|Required. The name of the cluster. When used with the `create cluster` command, this argument is used to set the cluster name and to generate a sub-domain for your cluster on `openshiftapps.com`. The value for this argument must be unique within your organization.

|--compute-machine-type <instance_type>
|The instance type for compute nodes in the cluster. This determines the amount of memory and vCPU that is allocated to each compute node. For more information on valid instance types, see _AWS Instance types_ in _ROSA service definition_.

|--controlplane-iam-role <arn>
|The ARN of the IAM role to attach to control plane instances.

|--disable-scp-checks
|Indicates whether cloud permission checks are disabled when attempting to install a cluster.

|--dry-run
|Simulates creating the cluster.

|--ec2-metadata-http-tokens string
|Configures the use of IMDSv2 for EC2 instances. Valid values are `optional` (default) or `required`.

|--enable-autoscaling
|Enables autoscaling of compute nodes. By default, autoscaling is set to `2` nodes. To set non-default node limits, use this argument with the `--min-replicas` and `--max-replicas` arguments.

|--host-prefix <subnet>
|The subnet prefix length to assign to each individual node, as an integer. For example, if host prefix is set to `23`, then each node is assigned a `/23` subnet out of the given CIDR.

|--machine-cidr <address_block>
a|Block of IP addresses (ipNet) used by ROSA while installing the cluster, for example, `10.0.0.0/16`.

[IMPORTANT]
====
OVN-Kubernetes, the default network provider in ROSA 4.11 and later, uses the `100.64.0.0/16` IP address range internally. If your cluster uses OVN-Kubernetes, do not include the `100.64.0.0/16` IP address range in any other CIDR definitions in your cluster.
====

|--max-replicas <number_of_nodes>
|Specifies the maximum number of compute nodes when enabling autoscaling. Default: `2`

|--min-replicas <number_of_nodes>
|Specifies the minimum number of compute nodes when enabling autoscaling. Default: `2`

|--multi-az
|Deploys to multiple data centers.

|--operator-roles-prefix <string>
|Prefix that are used for all IAM roles used by the operators needed in the OpenShift installer. A prefix is generated automatically if you do not specify one.

|--pod-cidr <address_block>
a|Block of IP addresses (ipNet) from which pod IP addresses are allocated, for example, `10.128.0.0/14`.

[IMPORTANT]
====
OVN-Kubernetes, the default network provider in ROSA 4.11 and later, uses the `100.64.0.0/16` IP address range internally. If your cluster uses OVN-Kubernetes, do not include the `100.64.0.0/16` IP address range in any other CIDR definitions in your cluster.
====

|--private
|Restricts primary API endpoint and application routes to direct, private connectivity.

|--private-link
|Specifies to use AWS PrivateLink to provide private connectivity between VPCs and services. The `--subnet-ids` argument is required when using `--private-link`.

|--region <region_name>
|The name of the AWS region where your worker pool will be located, for example, `us-east-1`. This argument overrides the `AWS_REGION` environment variable.

|--replicas n
|The number of worker nodes to provision per availability zone. Single-zone clusters require at least 2 nodes. Multi-zone clusters require at least 3 nodes. Default: `2` for single-zone clusters; `3` for multi-zone clusters.

|--role-arn <arn>
|The ARN of the installer role that {cluster-manager} uses to create the cluster. This is required if you have not already created account roles.

|--service-cidr <address_block>
a|Block of IP addresses (ipNet) for services, for example, `172.30.0.0/16`.

[IMPORTANT]
====
OVN-Kubernetes, the default network provider in ROSA 4.11 and later, uses the `100.64.0.0/16` IP address range internally. If your cluster uses OVN-Kubernetes, do not include the `100.64.0.0/16` IP address range in any other CIDR definitions in your cluster.
====

a|--sts \| --non-sts
|Specifies whether to use AWS Security Token Service (STS) or IAM credentials (non-STS) to deploy your cluster.

|--subnet-ids <aws_subnet_id>
|The AWS subnet IDs that are used when installing the cluster, for example, `subnet-01abc234d5678ef9a`. Subnet IDs must be in pairs with one private subnet ID and one public subnet ID per availability zone. Subnets are comma-delimited, for example, `--subnet-ids=subnet-1,subnet-2`. Leave the value empty for installer-provisioned subnet IDs.

When using `--private-link`, the `--subnet-ids` argument is required and only one private subnet is allowed per zone.

|--support-role-arn string
|The ARN of the role used by Red Hat Site Reliabilty Engineers (SREs) to enable access to the cluster account to provide support.

|--tags
a|Tags that are used on resources created by {product-title} in AWS. Tags can help you manage, identify, organize, search for, and filter resources within AWS. Tags are comma separated, for example: "key value, foo bar".
[IMPORTANT]
====
{product-title} only supports custom tags to Red Hat OpenShift resources during cluster creation. Once added, the tags cannot be removed or edited.
Tags that are added by Red Hat are required for clusters to stay in compliance with Red Hat production service level agreements (SLAs). These tags must not be removed.

{product-title} does not support adding additional tags outside of ROSA cluster-managed resources. These tags can be lost when AWS resources are managed by the ROSA cluster. In these cases, you might need custom solutions or tools to reconcile the tags and keep them intact.
====

|--version string
|The version of ROSA that will be used to install the cluster or cluster resources. For `cluster` use an `X.Y.Z` format, for example, `4.14.0`. For `account-role` use an `X.Y` format, for example, `4.14`.

|--worker-iam-role string
|The ARN of the IAM role that will be attached to compute instances.
|===

.Optional arguments inherited from parent commands
[cols="30,70"]
|===
|Option |Definition

|--help
|Shows help for this command.

|--debug
|Enables debug mode.

|--interactive
|Enables interactive mode.

|--profile
|Specifies an AWS profile (string) from your credentials file.
|===

.Examples
Create a cluster named `mycluster`.

[source,terminal]
----
$ rosa create cluster --cluster-name=mycluster
----
//Note to writers: The create cluster command specifically uses --cluster-name because a cluster ID does not exist yet. All other commands use --cluster because either the name or the ID can be used.

Create a cluster with a specific AWS region.

[source,terminal]
----
$ rosa create cluster --cluster-name=mycluster --region=us-east-2
----

Create a cluster with autoscaling enabled on the default worker machine pool.

[source,terminal]
----
$ rosa create cluster --cluster-name=mycluster -region=us-east-1 --enable-autoscaling --min-replicas=2 --max-replicas=5
----

[id="rosa-create-idp_{context}"]
== create idp

Add an identity provider (IDP) to define how users log in to a cluster.

.Syntax
[source,terminal]
----
$ rosa create idp --cluster=<cluster_name> | <cluster_id> [arguments]
----

.Arguments
[cols="30,70"]
|===
|Option |Definition

a|--cluster <cluster_name>\|<cluster_id>
|Required. The name or ID of the cluster to which the IDP will be added.

|--ca <path_to_file>
|The path to the PEM-encoded certificate file to use when making requests to the server, for example, `/usr/share/cert.pem`.

|--client-id
|The client ID (string) from the registered application.

|--client-secret
|The client secret (string) from the registered application.

|--mapping-method
|Specifies how new identities (string) are mapped to users when they log in. Default: `claim`

|--name
|The name (string) for the identity provider.

|--type
|The type (string) of identity provider. Options: `github`, `gitlab`, `google`, `ldap`, `openid`
|===

.GitHub arguments
[cols="30,70"]
|===
|Option |Definition

|--hostname
|The optional domain (string) that are used with a hosted instance of GitHub Enterprise.

|--organizations
|Specifies the organizations for login access. Only users that are members of at least one of the listed organizations (string) are allowed to log in.

|--teams
|Specifies the teams for login access. Only users that are members of at least one of the listed teams (string) are allowed to log in. The format is `<org>/<team>`.
|===

.GitLab arguments
[cols="30,70"]
|===
|Option |Definition

|--host-url
|The host URL (string) of a GitLab provider. Default: `https://gitlab.com`
|===

.Google arguments
[cols="30,70"]
|===
|Option |Definition

|--hosted-domain
|Restricts users to a Google Apps domain (string).
|===

.LDAP arguments
[cols="30,70"]
|===
|Option |Definition

|--bind-dn
|The domain name (string) to bind with during the search phase.

|--bind-password
|The password (string) to bind with during the search phase.

|--email-attributes
|The list (string) of attributes whose values should be used as the email address.

|--id-attributes
|The list (string) of attributes whose values should be used as the user ID. Default: `dn`

|--insecure
|Does not make TLS connections to the server.

|--name-attributes
|The list (string) of attributes whose values should be used as the display name. Default: `cn`

|--url
|An RFC 2255 URL (string) which specifies the LDAP search parameters that are used.

|--username-attributes
|The list (string) of attributes whose values should be used as the preferred username. Default: `uid`
|===

.OpenID arguments
[cols="30,70"]
|===
|Option |Definition

|--email-claims
|The list (string) of claims that are used as the email address.

|--extra-scopes
|The list (string) of scopes to request, in addition to the `openid` scope, during the authorization token request.

|--issuer-url
|The URL (string) that the OpenID provider asserts as the issuer identifier. It must use the HTTPS scheme with no URL query parameters or fragment.

|--name-claims
|The list (string) of claims that are used as the display name.

|--username-claims
|The list (string) of claims that are used as the preferred username when provisioning a user.

|--groups-claims
|The list (string) of claims that are used as the groups names.
|===

.Optional arguments inherited from parent commands
[cols="30,70"]
|===
|Option |Definition

|--help
|Shows help for this command.

|--debug
|Enables debug mode.

|--interactive
|Enables interactive mode.

|--profile
|Specifies an AWS profile (string) from your credentials file.
|===

.Examples
Add a GitHub identity provider to a cluster named `mycluster`.

[source,terminal]
----
$ rosa create idp --type=github --cluster=mycluster
----

Add an identity provider following interactive prompts.

[source,terminal]
----
$ rosa create idp --cluster=mycluster --interactive
----

[id="rosa-create-ingress_{context}"]
== create ingress

Add an ingress endpoint to enable API access to the cluster.

.Syntax
[source,terminal]
----
$ rosa create ingress --cluster=<cluster_name> | <cluster_id> [arguments]
----

.Arguments
[cols="30,70"]
|===
|Option |Definition

a|--cluster <cluster_name>\|<cluster_id>
|Required: The name or ID of the cluster to which the ingress will be added.

|--label-match
|The label match (string) for ingress. The format must be a comma-delimited list of key=value pairs. If no label is specified, all routes are exposed on both routers.

|--private
|Restricts application route to direct, private connectivity.
|===

.Optional arguments inherited from parent commands
[cols="30,70"]
|===
|Option |Definition

|--help
|Shows help for this command.

|--debug
|Enables debug mode.

|--interactive
|Enables interactive mode.

|--profile
|Specifies an AWS profile (string) from your credentials file.
|===

.Examples
Add an internal ingress to a cluster named `mycluster`.

[source,terminal]
----
$ rosa create ingress --private --cluster=mycluster
----

Add a public ingress to a cluster named `mycluster`.

[source,terminal]
----
$ rosa create ingress --cluster=mycluster
----

Add an ingress with a route selector label match.

[source,terminal]
----
$ rosa create ingress --cluster=mycluster --label-match=foo=bar,bar=baz
----

[id="rosa-create-machinepool_{context}"]
== create machinepool

Add a machine pool to an existing cluster.

.Syntax
[source,terminal]
----
$ rosa create machinepool --cluster=<cluster_name> | <cluster_id> --replicas=<number> --name=<machinepool_name> [arguments]
----

.Arguments
[cols="30,70"]
|===
|Option |Definition

// Note for writers: This command works the same way as rosa create --additional-compute-security-group-ids but all subsequent machinepools are compute only so we don't specify compute here yet; consistency across commands to come in OCM-3111.
|--additional-security-group-ids <sec_group_id>
|The identifier of one or more additional security groups to use along with the default security groups for this machine pool. For more information on additional security groups, see the requirements for _Security groups_ under _Additional resources_.

a|--cluster <cluster_name>\|<cluster_id>
|Required: The name or ID of the cluster to which the machine pool will be added.

|--enable-autoscaling
|Enable or disable autoscaling of compute nodes. To enable autoscaling, use this argument with the `--min-replicas` and `--max-replicas` arguments. To disable autoscaling, use `--enable-autoscaling=false` with the `--replicas` argument.

|--instance-type
|The instance type (string) that should be used. Default: `m5.xlarge`

|--labels
|The labels (string) for the machine pool. The format must be a comma-delimited list of key=value pairs. This list overwrites any modifications made to node labels on an ongoing basis.

|--max-replicas
|Specifies the maximum number of compute nodes when enabling autoscaling.

|--min-replicas
|Specifies the minimum number of compute nodes when enabling autoscaling.

|--name
|Required: The name (string) for the machine pool.

|--replicas
|Required when autoscaling is not configured. The number (integer) of machines for this machine pool.

|--taints
|Taints for the machine pool. This string value should be formatted as a comma-separated list of `key=value:ScheduleType`. This list will overwrite any modifications made to Node taints on an ongoing basis.
|===

.Optional arguments inherited from parent commands
[cols="30,70"]
|===
|Option |Definition

|--help
|Shows help for this command.

|--debug
|Enables debug mode.

|--interactive
|Enables interactive mode.

|--profile
|Specifies an AWS profile (string) from your credentials file.
|===

.Examples
Interactively add a machine pool to a cluster named `mycluster`.

[source,terminal]
----
$ rosa create machinepool --cluster=mycluster --interactive
----

Add a machine pool that is named `mp-1` to a cluster with autoscaling enabled.

[source,terminal]
----
$ rosa create machinepool --cluster=mycluster --enable-autoscaling --min-replicas=2 --max-replicas=5 --name=mp-1
----

Add a machine pool that is named `mp-1` with 3 replicas of `m5.xlarge` to a cluster.

[source,terminal]
----
$ rosa create machinepool --cluster=mycluster --replicas=3 --instance-type=m5.xlarge --name=mp-1
----

Add a machine pool with labels to a cluster.

[source,terminal]
----
$ rosa create machinepool --cluster=mycluster --replicas=2 --instance-type=r5.2xlarge --labels=foo=bar,bar=baz --name=mp-1
----

[id="rosa-create-ocm-role_{context}"]
== create ocm-role

Create the required ocm-role resources for your cluster.

.Syntax
[source,terminal]
----
$ rosa create ocm-role [flags]
----

.Flags
[cols="30,70"]
|===
|Option |Definition

|--admin
|Enable admin capabilities for the role.

|--debug
|Enable debug mode.

|-i, --interactive
|Enable interactive mode.

|-m, --mode string
a|How to perform the operation. Valid options are:

* `auto`: Resource changes will be automatically applied using the current AWS account
* `manual`: Commands necessary to modify AWS resources will be output to be run manually

|--path string
|The ARN path for the OCM role and policies.

|--permissions-boundary string
|The ARN of the policy that is used to set the permissions boundary for the OCM role.

|--prefix string
|User-defined prefix for all generated AWS resources. The default is `ManagedOpenShift`.

|--profile string
|Use a specific AWS profile from your credential file.

|-y, --yes
|Automatically answer yes to confirm operation.

|===

For more information about the OCM role created with the `rosa create ocm-role` command, see _Account-wide IAM role and policy reference_.

[id="rosa-create-user-role_{context}"]
== create user-role

Create the required user-role resources for your cluster.

.Syntax
[source,terminal]
----
$ rosa create user-role [flags]
----

.Flags
[cols="30,70"]
|===
|Option |Definition

|--debug
|Enable debug mode.

|-i, --interactive
|Enable interactive mode.

|-m, --mode string
a|How to perform the operation. Valid options are:

* `auto`: Resource changes will be automatically applied using the current AWS account
* `manual`: Commands necessary to modify AWS resources will be output to be run manually

|--path string
|The ARN path for the user role and policies.

|--permissions-boundary string
|The ARN of the policy that is used to set the permissions boundary for the user role.

|--prefix string
|User-defined prefix for all generated AWS resources The default is `ManagedOpenShift`.

|--profile string
|Use a specific AWS profile from your credential file.

|-y, --yes
|Automatically answer yes to confirm operation.

|===

For more information about the user role created with the `rosa create user-role` command, see _Understanding AWS account association_.