// Module included in the following assemblies:
//
// * rosa_install_access_delete_clusters/rosa-sts-interactive-mode-reference.adoc

:_mod-docs-content-type: REFERENCE
[id="rosa-sts-interactive-cluster-creation-mode-options_{context}"]
= Interactive cluster creation mode options

[role="_abstract"]
You can create a {product-title} cluster with the AWS Security Token Service (STS) by using the interactive mode. You can enable the mode by specifying the `--interactive` option when you run the `rosa create cluster` command.

The following table describes the interactive cluster creation mode options:

.`--interactive` cluster creation mode options
[cols=".^2,.^3a",options="header"]
|===

|Field|Description

|`Cluster name`
|Enter a name for your cluster, for example `my-rosa-cluster`.

|`Domain prefix`
|When creating your cluster, you can customize the subdomain for your cluster on `*.openshiftapps.com`. The value for this flag must be unique within your organization, cannot be longer than 15 characters, and cannot be changed after cluster creation. If the flag is not supplied, an autogenerated value is created that depends on the length of the cluster name. If the cluster name is fewer than or equal to 15 characters, that name is used for the domain prefix. If the cluster name is longer than 15 characters, the domain prefix is randomly generated to a 15 character string.

|`Deploy cluster with Hosted Control Plane (optional)`
|Enable the use of Hosted Control Planes.

|`Create cluster admin user`
a|Create a local administrator user (`cluster-admin`) for your cluster. This automatically configures a htpasswd identity provider for the `cluster-admin` user.

|`Create custom password for cluster admin`
a|Create a custom password for the `cluster-admin` user, or use a system-generated password. If you create a custom password, the password must be at least 14 characters (ASCII-standard) and contain no whitespace characters. If you do not create a custom password, the system generates a password and displays it in the command-line output.

|`Deploy cluster using AWS STS`
|Create an OpenShift cluster that uses the AWS Security Token Service (STS) to allocate temporary, limited-privilege credentials for component-specific AWS Identity and Access Management (IAM) roles. The service enables cluster components to make AWS API calls using secure cloud resource management practices. The default is `Yes`.

|`OpenShift version`
|Select the version of OpenShift to install, for example {product-version}. The default is the latest version. The listed `OpenShift version` options include the major, minor, and patch versions, for example `4.22.0`.

a|`Configure the use of IMDSv2 for ec2 instances optional/required (optional)`
|Specify `optional` to configure all EC2 instances to use both v1 and v2 endpoints of EC2 Instance Metadata Service (IMDS). This is the default value. Specify `required` to configure all EC2 instances to use IMDSv2 only.
ifdef::openshift-rosa[]
[IMPORTANT]
====
The Instance Metadata Service settings cannot be changed after your cluster is created.
====
endif::openshift-rosa[]

|`Installer role ARN`
|If you have more than one set of account roles in your AWS account for your cluster version, a list of installer role ARNs are provided. Select the ARN for the installer role that you want to use with your cluster. The cluster uses the account-wide roles and policies that relate to the selected installer role.

|`External ID (optional)`
|Specify an unique identifier that is passed by {cluster-manager} and the OpenShift installer when an account role is assumed. This option is only required for custom account roles that expect an external ID.

a|`Operator roles prefix`
|By default, the cluster-specific Operator role names are prefixed with the cluster name and a random 4-digit hash. You can optionally specify a custom prefix to replace `<cluster_name>-<hash>` in the role names. The prefix is applied when you create the cluster-specific Operator IAM roles. For information about the prefix, see _About custom Operator IAM role prefixes_.
ifdef::openshift-rosa[]
[NOTE]
====
If you specified custom ARN paths when you created the associated account-wide roles, the custom path is automatically detected. The custom path is applied to the cluster-specific Operator roles when you create them in a later step.
====
endif::openshift-rosa[]

|`Deploy cluster using pre registered OIDC Configuration ID`
|Specify if you want to use a preconfigured OIDC configuration or if you want to create a new OIDC configuration as part of the cluster creation process.

|`Tags (optional)`
|Specify a tag that is used on all resources created by {product-title} in AWS. Tags can help you manage, identify, organize, search for, and filter resources within AWS. Tags are comma separated, for example: `key value, data input`.
[IMPORTANT]
====
{product-title} only supports custom tags to Red{nbsp}Hat OpenShift resources during cluster creation. Once added, the tags cannot be removed or edited.
Tags that are added by Red{nbsp}Hat are required for clusters to stay in compliance with Red{nbsp}Hat production service level agreements (SLAs). These tags must not be removed.

{product-title} does not support adding additional tags outside of ROSA cluster-managed resources. These tags can be lost when AWS resources are managed by the ROSA cluster. In these cases, you might need custom solutions or tools to reconcile the tags and keep them intact.
====

|`Multiple availability zones (optional)`
|Deploy the cluster to multiple availability zones in the AWS region. The default is `No`, which results in a cluster being deployed to a single availability zone. If you deploy a cluster into multiple availability zones, the AWS region must have at least 3 availability zones. Multiple availability zones are recommended for production workloads.

|`AWS region`
|Specify the AWS region to deploy the cluster in. This overrides the `AWS_REGION` environment variable.

|`PrivateLink cluster (optional)`
|Create a cluster using AWS PrivateLink. This option provides private connectivity between Virtual Private Clouds (VPCs), AWS services, and your on-premise networks, without exposing your traffic to the public internet. To provide support, Red{nbsp}Hat Site Reliability Engineering (SRE) can connect to the cluster by using AWS PrivateLink Virtual Private Cloud (VPC) endpoints. This option cannot be changed after a cluster is created. The default is `No`.

|`Machine CIDR`
|Specify the IP address range for machines (cluster nodes), which must encompass all CIDR address ranges for your VPC subnets. Subnets must be contiguous. A minimum IP address range of 128 addresses, using the subnet prefix `/25`, is supported for single availability zone deployments. A minimum address range of 256 addresses, using the subnet prefix `/24`, is supported for deployments that use multiple availability zones. The default is `10.0.0.0/16`. This range must not conflict with any connected networks.

|`Service CIDR`
|Specify the IP address range for services. It is recommended, but not required, that the address block is the same between clusters. This will not create IP address conflicts. The range must be large enough to accommodate your workload. The address block must not overlap with any external service accessed from within the cluster. The default is `172.30.0.0/16`.

|`Pod CIDR`
|Specify the IP address range for pods. It is recommended, but not required, that the address block is the same between clusters. This will not create IP address conflicts. The range must be large enough to accommodate your workload. The address block must not overlap with any external service accessed from within the cluster. The default is `10.128.0.0/14`.

|`Install into an existing VPC (optional)`
|Install a cluster into an existing AWS VPC. To use this option, your VPC must have 2 subnets for each availability zone that you are installing the cluster into. The default is `No`.
[WARNING]
====
You cannot install a {product-title} cluster into an existing VPC that was created by the OpenShift installer. These VPCs are created during the cluster deployment process and must only be associated with a single cluster to ensure that cluster provisioning and deletion operations work correctly.

To verify whether a VPC was created by the OpenShift installer, check for the `owned` value on the `kubernetes.io/cluster/<infra-id>` tag. For example, when viewing the tags for the VPC named `mycluster-12abc-34def`, the `kubernetes.io/cluster/mycluster-12abc-34def` tag has a value of `owned`. Therefore, the VPC was created by the installer and must not be modified by the administrator.
====

|`Select availability zones (optional)`
|Specify the availability zones that are used when installing into an existing AWS VPC. Use a comma-separated list to provide the availability zones. If you specify `No`, the installer selects the availability zones automatically.

|`Enable customer managed key (optional)`
|Enable this option if you are using your own AWS Key Management Service (KMS) key to encrypt the control plane, infrastructure, worker node root volumes, and PVs. Specify the ARN for the KMS key that you added to the account-wide role ARN in the preceding step.
[IMPORTANT]
====
Only persistent volumes (PVs) created from the default storage class are encrypted with this specific key.

PVs created by using any other storage class are still encrypted, but the PVs are not encrypted with this key unless the storage class is specifically configured to use this key.
====

|`Compute nodes instance type`
|Select a compute node instance type. The default is `m5.xlarge`.

|`Enable autoscaling (optional)`
|Enable compute node autoscaling. The autoscaler adjusts the size of the cluster to meet your deployment demands. The default is `No`.

|`Additional Compute Security Group IDs (optional)`
|Select the additional custom security group IDs that are used with the standard machine pool created along side the cluster. The default is none selected. Only security groups associated with the selected VPC are displayed. You can select a maximum of 5 additional security groups.

|`Additional Infra Security Group IDs (optional)`
|Select the additional custom security group IDs that are used with the infra nodes created along side the cluster. The default is none selected. Only security groups associated with the selected VPC are displayed. You can select a maximum of 5 additional security groups.

|`Additional Control Plane Security Group IDs (optional)`
|Select the additional custom security group IDs that are used with the control plane nodes created along side the cluster. The default is none selected. Only security groups associated with the selected VPC are displayed. You can select a maximum of 5 additional security groups.

|`Compute nodes`
|Specify the number of compute nodes to provision into each availability zone. Clusters deployed in a single availability zone require at least 2 nodes. Clusters deployed in multiple zones must have at least 3 nodes. The maximum number of worker nodes is 249 nodes. The default value is `2`.

|`Default machine pool labels (optional)`
|Specify the labels for the default machine pool. The label format should be a comma-separated list of key-value pairs. This list will overwrite any modifications made to node labels on an ongoing basis.

|`Host prefix`
|Specify the subnet prefix length assigned to pods scheduled to individual machines. The host prefix determines the pod IP address pool for each machine. For example, if the host prefix is set to `/23`, each machine is assigned a `/23` subnet from the pod CIDR address range. The default is `/23`, allowing 512 cluster nodes and 512 pods per node, both of which are beyond our supported maximums. For information on the supported maximums, see the Additional resources section below.

|`Machine pool root disk size (GiB or TiB)`
|Specify the size of the machine pool root disk. This value must include a unit suffix like GiB or TiB, for example the default value of `300GiB`.

|`Enable FIPS support (optional)`
|Enable this option if you require your cluster to be FIPS validated. Selecting this option means the encrypt etcd data option is enabled by default and cannot be disabled. You can encrypt etcd data without enabling FIPS support.

include::snippets/fips-snippet.adoc[]

|`Encrypt etcd data (optional)`
|Enable this option if your use case only requires etcd key value encryption in addition to the control plane storage encryption that encrypts the etcd volumes by default. With this option, the etcd key values are encrypted but not the keys.
[IMPORTANT]
====
By enabling etcd encryption for the key values in etcd, you will incur a performance overhead of approximately 20%. The overhead is a result of introducing this second layer of encryption, in addition to the default control plane storage encryption that encrypts the etcd volumes. Red{nbsp}Hat recommends that you enable etcd encryption only if you specifically require it for your use case.
====

|`Disable workload monitoring (optional)`
|Disable monitoring for user-defined projects. Monitoring for user-defined projects is enabled by default.

|`Route Selector for ingress (optional)`
|Specify the route selector for your ingress. The format should be a comma-separated list of key-value pairs. If you do not specify a label, all routes will be exposed on both routers. For legacy ingress support, these labels are inclusion labels; otherwise, they are treated as exclusion labels.

|`Excluded namespaces for ingress (optional)`
|Specify the excluded namespaces for your ingress. The format should be a comma-separated list `value1, value2...`. If you do not specify any values, all namespaces will be exposed.

|`Wildcard Policy (optional, choose 'Skip' to skip selection. The default value will be supplied.)`
|Choose the wildcard policy for your ingress. The options are `WildcardsDisallowed` and `WildcardsAllowed`. Default is `WildcardsDisallowed`.

|`Namespace Ownership Policy (optional, choose 'Skip' to skip selection. The default value will be supplied.)`
|Choose the namespace ownership policy for your ingress. The options are `Strict` and `InterNamespaceAllowed`. The default is `Strict`.

|===
