// Module included in the following assemblies:
//
// * cloud_experts_tutorials/cloud-experts-getting-started/cloud-experts-getting-started-what-is-rosa.adoc

:_mod-docs-content-type: CONCEPT
[id="cloud-experts-key-features-rosa-infrastructure_{context}"]
= Infrastructure

[role="_abstract"]
{product-title} uses several different cloud services such as virtual machines, storage, and load balancers. This section covers infrastructure components, credential methods, storage, networking, monitoring, and other infrastructure-related features.

== Infrastructure
{product-title} uses several different cloud services such as virtual machines, storage, and load balancers. You can see a defined list on the AWS prerequisites page in the _Additional resources_.
// This section needs to remain hidden until the HCP migration is published
// {product-title} uses several different cloud services such as virtual machines, storage, and load balancers. You can see a defined list in the xref:../../rosa_planning/rosa-sts-aws-prereqs.adoc#rosa-aws-policy-provisioned_rosa-sts-aws-prereqs[AWS prerequisites].

== Credential methods
There are two credential methods to grant Red{nbsp}Hat the permissions needed to perform the required actions in your AWS account: AWS with STS or an IAM user with admin permissions. AWS with STS is the preferred method, and the IAM user method will eventually be deprecated. AWS with STS better aligns with the principles of least privilege and secure practices in cloud service resource management.
//See the section [{product-title} with STS Explained] section for a detailed explanation.

== Prerequisite permission or failure errors
Check for a newer version of the {rosa-cli}. Every release of the {rosa-cli} is located in two places: link:https://github.com/openshift/rosa/releases[Github] and the link:https://www.openshift.com/products/rosa/download[Red{nbsp}Hat signed binary releases].

== Storage
See the _Additional resources_ for the Storage documentation. OpenShift includes the CSI driver for AWS EFS.

== Using a VPC
At installation you can select to deploy to an existing VPC or bring your own VPC. You can then select the required subnets and provide a valid CIDR range that encompasses the subnets for the installation program when using those subnets.

{product-title} allows multiple clusters to share the same VPC. The number of clusters on one VPC is limited by the remaining AWS resource quota and CIDR ranges that cannot overlap.

== Network plugin
{product-title} uses the OpenShift OVN-Kubernetes default CNI network provider.

== Cross-namespace networking
Cluster admins can customize, and deny, cross-namespace on a project basis using NetworkPolicy objects. Refer to  for more information.

== Using Prometheus and Grafana
You can use Prometheus and Grafana to monitor containers and manage capacity using OpenShift User Workload Monitoring. This is a check-box option in the {cluster-manager-url}.

== Audit logs output from the cluster control-plane
If the Cluster Logging Operator Add-on has been added to the cluster then audit logs are available through CloudWatch. If it has not, then a support request would allow you to request some audit logs. Small targeted and time-boxed logs can be requested for export and sent to a customer. The selection of audit logs available are at the discretion of SRE in the category of platform security and compliance. Requests for exports of a cluster's entirety of logs will be rejected.

== AWS Permissions Boundary
You can use an AWS Permissions Boundary around the policies for your cluster.

== AMI
{product-title} worker nodes use a different AMI from OSD and OpenShift Container Platform. Control Plane and Infra node AMIs are common across products in the same version.

== Cluster backups
{product-title} STS clusters do not have backups. Users must have their own backup policies for applications and data.

== Custom domain
You can define a custom domain for your applications.

== {product-title} domain certificates
Red{nbsp}Hat infrastructure (Hive) manages certificate rotation for default application ingress.

== Disconnected environments
{product-title} does not support an air-gapped, disconnected environment. The {product-title} cluster must have egress to the internet to access our registry, S3, and send metrics. The service requires a number of egress endpoints.
Ingress can be limited to a PrivateLink for Red{nbsp}Hat SREs and a VPN for customer access.
