ARO Quickstart

A quickstart guide to deploying an Azure Red Hat OpenShift (ARO) cluster by using Azure CLI.

For new clusters, use Azure managed identities with platform workload identity federation when possible. This avoids long-lived service principal credentials for ARO platform operations.

Video Walkthrough

If you prefer a more visual medium, you can watch Paul Czarkowski walk through this quickstart on YouTube .

Prerequisites

Azure CLI

Obviously you’ll need to have an Azure account to configure the CLI against.

macOS

1. Install Azure CLI using homebrew

Linux (RHEL / Fedora / similar, using dnf)

1. Import the Microsoft Keys

2. Add the Microsoft Yum Repository

3. Install Azure CLI

Confirm your installation:

Prepare the Azure account for ARO

1. Log into the Azure CLI by running the following and then authorizing through your Web Browser. If you have more than one subscription, list them and select the one where you will deploy the cluster.

2. Make sure you have enough quota in the same Azure region you plan to use for the cluster (below, eastus matches the default AZR_RESOURCE_LOCATION used later; change both if you use another region). Confirm current vCPU requirements in Create an Azure Red Hat OpenShift cluster (prerequisites and sizing).

   See Addendum - Adding Quota to ARO account if you do not have enough quota left for Total Regional vCPUs (Azure Red Hat OpenShift requires a minimum of 44 cores to create a cluster; verify against current Microsoft documents).

3. Register resource providers

Get Red Hat pull secret

1. Log into https://console.redhat.com

2. Browse to https://console.redhat.com/openshift/install/azure/aro-provisioned

3. Click the Download pull secret button and save the file to a known path (for example the default AZR_PULL_SECRET path used below). Restrict access to the file and do not commit it to source control; for example on macOS or Linux: chmod 600 ~/Downloads/pull-secret.txt.

Choose a credential method

ARO supports two cluster credential models:

• Managed identities with platform workload identity federation: Recommended for new clusters. Azure user-assigned managed identities hold the required Azure RBAC permissions, and OpenShift platform operators authenticate by using federated service account tokens.
• Service principal: Uses an application client ID and client secret for Azure access.

For the managed-identity deployment workflow, follow Deploy ARO with Managed Identities and Workload Identity Federation .

The remaining deployment steps in this quickstart use the service-principal credential model.

Deploy ARO using the service-principal credential model

Variables and Resource Group

Set some environment variables to use later, and create an Azure Resource Group.

1. Set the following environment variables

   Change the values to suit your environment, but these defaults should work. Resource names must comply with Azure naming rules and length limits. Run all following commands in the same shell so the exported variables apply.

2. Create an Azure resource group

Networking

Create a virtual network with two empty subnets

1. Create virtual network

2. Create control plane subnet

3. Create machine subnet

4. Disable network policies for Private Link Service on the control plane subnet

   Optional. The ARO RP will disable this for you if you skip this step.

5. OpenShift version (optional)

   New clusters use a supported default OpenShift version for your region unless you choose one explicitly. List the exact versions you can install (they change over time as Microsoft and Red Hat add releases):

   To pin a build, add --version with a full version string from that output (for example 4.18.12) to the az aro create command below. Omit --version to let the platform pick the default for new clusters.

6. Create the service-principal-based cluster

   The cluster installation typically takes 45-50 minutes, but we recommend budgeting an hour or more.

   The command below creates a service-principal-based ARO cluster. For new clusters, use the [managed identity and workload identity federation guide](../miwi/) unless you have a specific requirement for the service-principal credential model.
   

   To create the cluster on a specific OpenShift version from az aro get-versions, append --version X.Y.Z to the same command (use the exact string from the table for your region).

7. Get OpenShift console URL

8. Get OpenShift credentials

9. Use the URL and the credentials provided by the output of the last two commands to log into OpenShift via a web browser.

1. Deploy an application to OpenShift

   See the following video for a guide on easy application deployment on OpenShift.

Delete Cluster

Once you’re done it is a good idea to delete the cluster so you avoid unexpected charges.

1. Delete the cluster

   The -y flag skips confirmation prompts and is convenient for lab teardown; omit it if you want to be prompted before deletion.

2. Delete the Azure resource group

   Only do this if there is nothing else in the resource group. az group delete removes all resources in that group.

Addendum

Adding Quota to ARO account

1. Create an Azure Support Request

2. Set Issue Type to “Service and subscription limits (quotas)”

3. Set Quota Type to “Compute-VM (cores-vCPUs) subscription limit increases”

4. Click Next Solutions »

5. Click Enter details

6. Set Deployment Model to “Resource Manager”

7. Set Locations to “(US) East US”

8. Set Types to “Standard”

9. Under Standard check “DSv4” and “DSv5”

10. Set New vCPU Limit for each (example “60”)

11. Click Save and continue

12. Click Review + create »

13. Wait until quota is increased.