Skip to content

Quick Start

Deploy the example public cluster (clusters/public/).

Prerequisites

Complete Account Prerequisites first, then install:

  • Terraform >= 1.5.0
  • AWS CLI (configured)
  • oc, helm, jq (for bootstrap and login)

1. Authenticate

Set RHCS credentials before any make or Terraform command:

export RHCS_TOKEN="your-offline-token"
# Or for CI/CD:
# export RHCS_CLIENT_ID="..."
# export RHCS_CLIENT_SECRET="..."

Example clusters set enable_cluster_admin = true so a break-glass HTPasswd admin is created for make login. Override the generated password only if needed:

# optional
export TF_VAR_admin_password_override="your-secure-password"

See Authentication for break-glass vs bootstrap login.

make cluster.public.validate

3. Initialize, plan, apply

make cluster.public.init
make cluster.public.plan
make cluster.public.apply

Or use scripts directly (CI/CD friendly):

./scripts/cluster/init-infrastructure.sh public
./scripts/cluster/plan-infrastructure.sh public
./scripts/cluster/apply-infrastructure.sh public

4. Bootstrap GitOps

After the cluster reaches Ready. Bootstrap creates its own short-lived HTPasswd user, then tears it down — it does not use the break-glass admin:

make cluster.public.bootstrap

5. Access the cluster (break-glass)

Requires enable_cluster_admin = true (already set in example tfvars):

make cluster.public.show-endpoints
make cluster.public.login
make cluster.public.show-credentials

Other cluster profiles

Copy an example terraform.tfvars and customize:

cp clusters/egress-zero/terraform.tfvars clusters/my-prod/
# Edit clusters/my-prod/terraform.tfvars
make cluster.my-prod.init
make cluster.my-prod.apply
Profile Example Notes
Public dev clusters/public/ Public API, NAT egress
Egress-zero clusters/egress-zero/ Zero egress, Client VPN
BYO VPC clusters/byo-vpc/ Pre-provisioned network
BYO + zero egress clusters/byo-vpc-egress-zero/ BYO VPC with zero egress

See Cluster Configurations and Full-Stack Prerequisites.

Next steps