AI Assistant Supported ROSA & AI Components Deployment

Comprehensive automation suite for deploying Red Hat OpenShift Service on AWS (ROSA) HCP clusters with integrated AI capabilities including OpenShift AI, Llama Stack, and agentic AI demonstrations using AI code assistants like Cursor.

📋 Table of Contents

Overview
AI-Powered Deployment with Code Assistants
Terraform Automation
Complete AI Stack Deployment
Getting Started

Overview

This repository provides AI-powered deployment approaches for the complete ROSA + AI stack:

Deployment Methods

🤖 AI Assistant-Led Terraform - Production-ready IaC deployment through Cursor
⚡ AI Assistant-Led CLI - Quick CLI-based deployment through Cursor

What You Can Deploy

☸️ ROSA HCP Clusters - Red Hat OpenShift Service on AWS with Hosted Control Plane
🧠 OpenShift AI Platform - Complete AI/ML platform with GPU support
🦙 Llama Stack - LLM inference infrastructure with vLLM/TGI backends
🎯 Agentic AI Demo - Pre-built agentic AI demonstration with MCP servers

🤖 AI-Powered Deployment with Code Assistants

Using ROSA Cluster Creation with Cursor or Other AI Code Assistants

This repository includes comprehensive documentation that enables AI code assistants like Cursor, GitHub Copilot, or other LLM-based coding tools to automatically deploy complete ROSA clusters with OpenShift AI, Llama Stack, and agentic AI demonstrations.

📖 Key Documentation Files

1. ROSA Cluster Creation Agent Instructions

📄 ROSA Cluster creation agent instructions.md

Purpose: Comprehensive instructions for LLM agents to act as ROSA deployment experts

What It Enables:

✅ Automated ROSA HCP cluster creation through conversational AI
✅ Input validation and prerequisite checking
✅ Step-by-step guided deployment with error handling
✅ Support for both Terraform and CLI deployment methods
✅ Context preservation during long-running deployments
✅ Network configuration options (Public, Private, Zero Egress)
✅ Complete resource inventory and cleanup instructions

Usage:

# In Cursor or your AI code assistant:
"Create a ROSA HCP cluster in Singapore with 3 m5.4xlarge worker nodes. 
Use the instructions in 'ROSA Cluster creation agent instructions.md'

IMPORTANT: Strictly follow the instructions in the document. Do not deviate 
or fall back to alternative methods. If you encounter any situation requiring 
deviation from the documented process, stop and ask me for guidance before 
proceeding."

# The AI assistant will:
# 1. Read the comprehensive instructions from the specified document
# 2. Validate prerequisites (AWS credentials, ROSA CLI, etc.) as documented
# 3. Guide you through configuration options per the instructions
# 4. Execute deployment commands exactly as specified in the document
# 5. Monitor progress and handle errors according to the documented procedures
# 6. Provide complete cluster access details
# 7. STOP and ask for user guidance if any deviation is needed

Key Features:

Validation Catalog: Mandatory and optional parameter validation rules
Error Handling Protocol: Strict rules for handling deployment failures
Multiple Deployment Methods: Terraform (production) or CLI (quick)
Network Flexibility: Public, Private, or Zero Egress cluster configurations
Resource Naming Conventions: Consistent naming for all AWS resources
Comprehensive Prerequisites: AWS and ROSA setup checklist with verification commands

2. OpenShift AI Setup Guide

📄 OpenShift AI setup.md

Purpose: Complete deployment guide for adding OpenShift AI capabilities to ROSA clusters

What It Enables:

✅ Deploy OpenShift AI operator on ROSA
✅ Configure GPU support for ML workloads
✅ Set up data science workbenches
✅ Deploy model serving infrastructure
✅ Configure S3 storage for models and artifacts

Usage with AI Assistant:

# After ROSA cluster is deployed:
"Deploy OpenShift AI on my ROSA cluster using the OpenShift AI setup.md guide

IMPORTANT: Strictly follow the instructions in the OpenShift AI setup.md document. 
Do not deviate or use alternative methods. If you encounter any situation requiring 
deviation, stop and ask me for guidance before proceeding."

# The AI assistant will:
# 1. Verify ROSA cluster is ready per the documented steps
# 2. Check prerequisites for OpenShift AI as specified
# 3. Deploy the operator and components exactly as documented
# 4. Configure storage and GPU support per instructions
# 5. Set up workbench environments following the guide
# 6. Verify installation success using documented procedures
# 7. STOP and ask for user guidance if any deviation is needed

3. Llama Stack Integration Guide

📄 Llama Stack OpenShift AI Integration Guide.md

Purpose: Deploy Meta's Llama Stack for LLM inference on OpenShift AI

What It Enables:

✅ Llama Stack server deployment on OpenShift
✅ Model serving with vLLM or TGI backends
✅ Integration with OpenShift AI
✅ MCP (Model Context Protocol) server support
✅ Connection to agentic AI frameworks

Usage with AI Assistant:

"Deploy Llama Stack on my ROSA cluster following the Llama Stack integration guide

IMPORTANT: Strictly follow the instructions in the Llama Stack OpenShift AI 
Integration Guide.md document. Do not deviate or use alternative methods. If you 
encounter any situation requiring deviation, stop and ask me for guidance before 
proceeding."

# The AI assistant will:
# 1. Deploy Llama Stack server pods as documented
# 2. Configure model serving endpoints per the guide
# 3. Set up inference routes exactly as specified
# 4. Connect to OpenShift AI workbenches following instructions
# 5. Verify model serving capabilities using documented procedures
# 6. STOP and ask for user guidance if any deviation is needed

4. Agentic AI Demo

📁 rhai-agentic-demo/

Purpose: Complete working demonstration of agentic AI with MCP servers

What It Includes:

🎯 UI: Streamlit-based chat interface for agent interactions
🔧 MCP Servers: CRM, PDF, and Slack integration servers
🗄️ Database: PostgreSQL for CRM data storage
🤖 Agent Scripts: ReAct agent with multi-MCP support
📊 Notebooks: Jupyter notebooks for experimentation
☸️ Kubernetes Manifests: Complete deployment configurations

Usage with AI Assistant:

"Deploy the agentic AI demo from rhai-agentic-demo/ on my ROSA cluster

IMPORTANT: Strictly follow the instructions in the rhai-agentic-demo documentation. 
Do not deviate or use alternative methods. If you encounter any situation requiring 
deviation, stop and ask me for guidance before proceeding."

# The AI assistant will:
# 1. Deploy PostgreSQL database with sample CRM data as documented
# 2. Deploy MCP servers (CRM, PDF, Slack) per the instructions
# 3. Deploy Llama Stack for LLM inference following the guide
# 4. Deploy UI application exactly as specified
# 5. Configure networking and routes according to documentation
# 6. Provide access URLs and usage instructions
# 7. STOP and ask for user guidance if any deviation is needed

🚀 Complete End-to-End Deployment with AI Assistant

Here's how to deploy the entire stack using an AI code assistant like Cursor:

Step 1: Initial Setup

# In your AI code assistant terminal:
"Set up my environment for ROSA deployment:
1. Verify AWS CLI is configured with your AWS account
2. Verify ROSA CLI is installed and authenticated
3. Check prerequisites using 'ROSA Cluster creation agent instructions.md'

IMPORTANT: Follow the documented prerequisites exactly. Do not skip steps 
or use shortcuts. If any prerequisite check fails, stop and ask me for 
guidance before proceeding."

Step 2: Create ROSA Cluster

"Create a ROSA HCP cluster with these requirements:
- Name: ai-demo-cluster
- Region: Singapore (ap-southeast-1)
- Worker nodes: 3 x m5.4xlarge
- Network: Public API and ingress
- Use the agent instructions for deployment

IMPORTANT: Strictly follow the deployment instructions in 'ROSA Cluster 
creation agent instructions.md'. Do not deviate or fall back to alternative 
methods. If any error occurs or deviation is needed, stop and ask me for 
guidance before proceeding."

Step 3: Deploy OpenShift AI

"Now deploy OpenShift AI on the ai-demo-cluster following 
the OpenShift AI setup.md guide

IMPORTANT: Strictly follow the OpenShift AI setup.md instructions. Do not 
deviate or use alternative deployment methods. If any issues arise, stop 
and ask me for guidance."

Step 4: Deploy Llama Stack

"Deploy Llama Stack using the Llama Stack OpenShift AI Integration Guide

IMPORTANT: Strictly follow the Llama Stack integration guide. Do not deviate 
or use alternative methods. If any issues arise, stop and ask me for guidance."

Step 5: Deploy Agentic AI Demo

"Deploy the complete agentic AI demo from rhai-agentic-demo/ 
including all MCP servers, database, and UI

IMPORTANT: Strictly follow the rhai-agentic-demo deployment documentation. 
Do not deviate or use shortcuts. If any issues arise, stop and ask me for 
guidance."

📊 What Gets Deployed Automatically

When using the AI assistant with these instructions, you get:

Infrastructure Layer:

☸️ ROSA HCP Cluster with 3 worker nodes
🌐 VPC with public/private subnets
🔐 IAM roles and OIDC provider
🔒 Security groups and network policies

AI/ML Platform:

🧠 OpenShift AI Operator
📚 Data Science workbenches
🎯 Model serving infrastructure
💾 S3 storage configuration

Llama Stack:

🦙 Llama Stack server
⚡ vLLM/TGI model serving
🔌 Inference API endpoints
📡 MCP server integration

Agentic AI Demo:

🎨 Streamlit UI for agent chat
🔧 MCP Servers (CRM, PDF, Slack)
🗄️ PostgreSQL with sample data
🤖 ReAct agent framework
📊 Jupyter notebooks for exploration

🎯 Benefits of AI-Assisted Deployment

Zero Manual Configuration: AI assistant reads the comprehensive instructions and handles all steps
Error Recovery: Built-in error handling and context preservation across failures
Prerequisites Validation: Automatic checking of all requirements before deployment
Progress Monitoring: Real-time status updates during 20-30 minute deployments
Complete Documentation: Every resource is documented and explained
Cleanup Support: Guided teardown when you're done
Best Practices: Follows Red Hat and AWS recommended configurations

⚠️ Important Notes for AI-Assisted Deployment

Prerequisites:

✅ AWS account with ROSA enabled
✅ AWS CLI configured with credentials
✅ ROSA CLI installed and authenticated
✅ Billing account linked to Red Hat (for HCP clusters)
✅ Sufficient AWS quotas (100+ vCPUs)

Token Management:

Use persistent offline token from https://console.redhat.com/openshift/token
DO NOT use rosa token output (expires during deployment)
Set export RHCS_TOKEN="<your-persistent-token>" before Terraform deployments

Deployment Time:

ROSA Cluster: 20-30 minutes
OpenShift AI: 10-15 minutes
Llama Stack: 5-10 minutes
Agentic Demo: 5-10 minutes
Total: ~45-65 minutes for complete stack

📖 Reading Order for Manual Reference

If you want to understand the process before using AI assistance:

Read ROSA Cluster creation agent instructions.md - Understand ROSA deployment
Read OpenShift AI setup.md - Learn about AI platform setup
Read Llama Stack OpenShift AI Integration Guide.md - Understand LLM serving
Explore rhai-agentic-demo/README.md - See demo architecture

🧠 Complete AI Stack Deployment

Full Stack Architecture

When deploying the complete AI stack, you get a production-ready environment for running agentic AI applications:

┌─────────────────────────────────────────────────────────────────┐
│                         ROSA HCP Cluster                         │
│  ┌───────────────────────────────────────────────────────────┐  │
│  │                    OpenShift AI Platform                  │  │
│  │  ┌─────────────────────────────────────────────────────┐  │  │
│  │  │            Llama Stack (LLM Inference)             │  │  │
│  │  │  ┌──────────────────────────────────────────────┐  │  │  │
│  │  │  │         Agentic AI Demo Application          │  │  │  │
│  │  │  │                                               │  │  │  │
│  │  │  │  ┌────────────┐  ┌────────────┐             │  │  │  │
│  │  │  │  │ Streamlit  │  │ PostgreSQL │             │  │  │  │
│  │  │  │  │     UI     │  │  Database  │             │  │  │  │
│  │  │  │  └────────────┘  └────────────┘             │  │  │  │
│  │  │  │                                               │  │  │  │
│  │  │  │  ┌──────────────────────────────────────┐   │  │  │  │
│  │  │  │  │        MCP Servers                    │   │  │  │  │
│  │  │  │  │  • CRM Integration                    │   │  │  │  │
│  │  │  │  │  • PDF Processing                     │   │  │  │  │
│  │  │  │  │  • Slack Integration                  │   │  │  │  │
│  │  │  │  └──────────────────────────────────────┘   │  │  │  │
│  │  │  └──────────────────────────────────────────────┘  │  │  │
│  │  └─────────────────────────────────────────────────────┘  │  │
│  └───────────────────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────────────────┘

Deployment Approaches

Option 1: AI Assistant-Led Terraform Deployment (Recommended for Production)

AI code assistant (Cursor) handles Terraform automation
Infrastructure as Code with version control
Repeatable, declarative deployments
State management and drift detection
Best for: Production environments, enterprise deployments, long-term infrastructure management

Option 2: AI Assistant-Led CLI Deployment (Recommended for Quick Start)

AI code assistant (Cursor) executes ROSA CLI commands
Faster initial deployment (no Terraform setup)
Direct interaction with ROSA APIs
Real-time progress monitoring
Best for: Development, testing, learning, proof-of-concepts

Both approaches leverage AI assistants to:

✅ Validate prerequisites automatically
✅ Handle errors and provide solutions
✅ Preserve context during long-running deployments
✅ Provide complete documentation of created resources

🚀 Getting Started

Quick Start (5 Minutes to Deployment)

Using Cursor or AI Code Assistant:

Clone this repository:

git clone https://github.com/yourusername/rosa-automation
cd rosa-automation

Set up credentials (add to your long-term context or .env):

export AWS_ACCESS_KEY_ID="your-aws-key"
export AWS_SECRET_ACCESS_KEY="your-aws-secret"
export RHCS_TOKEN="your-persistent-ocm-token"

Ask your AI assistant:

"Deploy a complete ROSA cluster with OpenShift AI, Llama Stack, 
and the agentic demo in Singapore region. Use the agent instructions 
in this repository."

Wait 45-65 minutes while the AI assistant:
- Validates prerequisites
- Creates ROSA cluster
- Deploys OpenShift AI
- Sets up Llama Stack
- Deploys agentic demo
- Provides access URLs
Access your environment:
- OpenShift Console: https://console-openshift-console.apps.{cluster-domain}
- Agentic UI: https://ui-route-{namespace}.apps.{cluster-domain}
- Llama Stack API: https://llama-stack-{namespace}.apps.{cluster-domain}

Prerequisites Checklist

Before starting any deployment:

Verification Commands

# Verify AWS access
aws sts get-caller-identity

# Verify ROSA CLI
rosa whoami

# Verify ROSA quotas
rosa verify quota --region ap-southeast-1

# Verify ROSA permissions
rosa verify permissions

# Check OpenShift CLI
oc version

🔧 Terraform Automation

Traditional Terraform Module Deployment

This module serves as a comprehensive solution for deploying, configuring and managing Red Hat OpenShift on AWS (ROSA) Hosted Control Plane (HCP) clusters within your AWS environment. With a focus on simplicity and efficiency, this module streamlines the process of setting up and maintaining ROSA HCP clusters, enabling users to use the power of OpenShift on AWS infrastructure effortlessly.

Example Usage

module "hcp" {
  source = "terraform-redhat/rosa-hcp/rhcs"
  version = "1.6.2"

  cluster_name           = "my-cluster"
  openshift_version      = "4.14.24"
  machine_cidr           = "10.0.0.0/16"
  aws_subnet_ids         = ["subnet-1", "subnet-2"]
  aws_availability_zones = ["us-west-2a"]
  replicas               = 2

  // STS configuration
  create_account_roles  = true
  account_role_prefix   = "my-cluster-account"
  create_oidc           = true
  create_operator_roles = true
  operator_role_prefix  = "my-cluster-operator"
}

Sub-modules

Sub-modules included in this module:

account-iam-resource: Handles the provisioning of Identity and Access Management (IAM) resources required for managing access and permissions in the AWS account associated with the ROSA HCP cluster.
idp: Responsible for configuring Identity Providers (IDPs) within the ROSA HCP cluster, faciliting seamless integration with external authentication system such as Github (GH), GitLab, Google, HTPasswd, LDAP and OpenID Connect (OIDC).
machine-pool: Facilitates the management of machine pools within the ROSA HCP cluster, enabling users to scale resources and adjust specifications based on workload demands.
oidc-config-and-provider: Manages the configuration of OpenID Connect (OIDC) hosted files and providers for ROSA HCP clusters, enabling secure authentication and access control mechanisms for operator roles.
operator-roles: Oversees the management of roles assigned to operators within the ROSA HCP cluster, enabling to perform required actions with appropriate permissions on the lifecyle of a cluster.
rosa-cluster-hcp: Handles the core configuration and provisioning of the ROSA HCP cluster, including cluster networking, security settings and other essential components.
vpc: Handles the configuration and provisioning of the Virtucal Private Cloud (VPC) infrastracture required for hosting the ROSA HCP cluster and it's associated resources.

The primary sub-modules responsible for ROSA HCP cluster creation includes optional configurations for setting up account roles, operator roles and OIDC config/provider. This comprehensive module handles the entire process of provisioning and configuring ROSA HCP clusters in your AWS environment.

Pre-requisites

Terraform CLI (1.4.6+) must be installed.
An AWS account and the associated credentials that allow you to create resources. These credentials must be configured for the AWS provider (see Authentication and Configuration section in AWS terraform provider documentation.)
The ROSA getting started AWS prerequisites must be completed.
A valid OpenShift Cluster Manager API Token must be configured (see Authentication and configuration for more information).

We recommend you install the following CLI tools:

Requirements

Name	Version
terraform	>= 1.0
aws	>= 5.38.0
null	>= 3.0.0
rhcs	>= 1.6.2

Providers

Name	Version
aws	>= 5.38.0
null	>= 3.0.0
rhcs	>= 1.6.2

Modules

Name	Source	Version
account_iam_resources	./modules/account-iam-resources	n/a
oidc_config_and_provider	./modules/oidc-config-and-provider	n/a
operator_roles	./modules/operator-roles	n/a
rhcs_hcp_kubelet_configs	./modules/kubelet-configs	n/a
rhcs_hcp_machine_pool	./modules/machine-pool	n/a
rhcs_identity_provider	./modules/idp	n/a
rosa_cluster_hcp	./modules/rosa-cluster-hcp	n/a

Resources

Name	Type
null_resource.validations	resource
rhcs_dns_domain.dns_domain	resource
aws_caller_identity.current	data source

ROSA Cluster Deployment Guide

🚀 Quick Start

1. Set RHCS Credentials

export RHCS_CLIENT_ID="your-rhcs-client-id"
export RHCS_CLIENT_SECRET="your-rhcs-client-secret"

2. Configure Deployment

cp terraform.tfvars.example terraform.tfvars
# Edit terraform.tfvars with your settings

3. Deploy

terraform init
terraform plan
terraform apply

✅ Works with Standard Terraform

The configuration now works seamlessly with standard terraform plan and terraform apply commands - no custom scripts needed!

📊 View Results

terraform output cluster_api_url
terraform output cluster_console_url

🔧 Configuration Options

New VPC: Set create_vpc = true (default) - automatically creates both public and private subnets
Existing VPC: Set create_vpc = false and provide aws_subnet_ids (must include both public and private subnets)
Machine Pools: Set create_additional_machine_pools = true
GitOps: Set deploy_openshift_gitops = true (default)

⚠️ Important: Subnet Requirements

ROSA HCP clusters require both public and private subnets:

Public subnets: For load balancers and internet access
Private subnets: For worker nodes and internal services

When create_vpc = true, this is handled automatically. When using existing VPC, ensure you provide both types of subnets in aws_subnet_ids.

Inputs

Name	Description	Type	Default	Required
account_role_prefix	User-defined prefix for all generated AWS resources (default "account-role-")	`string`	`null`	no
additional_trust_bundle	A string containing a PEM-encoded X.509 certificate bundle that will be added to the nodes' trusted certificate store.	`string`	`null`	no
admin_credentials_password	Admin password that is created with the cluster. The password must contain at least 14 characters (ASCII-standard) without whitespaces including uppercase letters, lowercase letters, and numbers or symbols.	`string`	`null`	no
admin_credentials_username	Admin username that is created with the cluster. auto generated username - "cluster-admin"	`string`	`null`	no
autoscaler_max_node_provision_time	Maximum time cluster-autoscaler waits for node to be provisioned.	`string`	`null`	no
autoscaler_max_nodes_total	Maximum number of nodes in all node groups. Cluster autoscaler will not grow the cluster beyond this number.	`number`	`null`	no
autoscaler_max_pod_grace_period	Gives pods graceful termination time before scaling down.	`number`	`null`	no
autoscaler_pod_priority_threshold	To allow users to schedule 'best-effort' pods, which shouldn't trigger Cluster Autoscaler actions, but only run when there are spare resources available.	`number`	`null`	no
aws_additional_allowed_principals	The additional allowed principals to use when installing the cluster.	`list(string)`	`null`	no
aws_additional_compute_security_group_ids	The additional security group IDs to be added to the default worker machine pool.	`list(string)`	`null`	no
aws_availability_zones	The AWS availability zones where instances of the default worker machine pool are deployed. Leave empty for the installer to pick availability zones	`list(string)`	`[]`	no
aws_billing_account_id	The AWS billing account identifier where all resources are billed. If no information is provided, the data will be retrieved from the currently connected account.	`string`	`null`	no
aws_subnet_ids	The Subnet IDs to use when installing the cluster.	`list(string)`	n/a	yes
base_dns_domain	Base DNS domain name previously reserved, e.g. '1vo8.p3.openshiftapps.com'.	`string`	`null`	no
cluster_autoscaler_enabled	Enable Autoscaler for this cluster. This resource is currently unavailable and using will result in error 'Autoscaler configuration is not available'	`bool`	`false`	no
cluster_name	Name of the cluster. After the creation of the resource, it is not possible to update the attribute value.	`string`	n/a	yes
compute_machine_type	Identifies the Instance type used by the default worker machine pool e.g. `m5.xlarge`. Use the `rhcs_machine_types` data source to find the possible values.	`string`	`null`	no
create_account_roles	Create the aws account roles for rosa	`bool`	`false`	no
create_admin_user	To create cluster admin user with default username `cluster-admin` and generated password. It will be ignored if `admin_credentials_username` or `admin_credentials_password` is set. (default: false)	`bool`	`null`	no
create_dns_domain_reservation	Creates reserves a dns domain domain for the cluster. This value will be created by the install step if not pre created via this configuration.	`bool`	`false`	no
create_oidc	Create the oidc resources. This value should not be updated, please create a new resource instead or utilize the submodule to create a new oidc config	`bool`	`false`	no
create_operator_roles	Create the aws account roles for rosa	`bool`	`false`	no
default_ingress_listening_method	Listening Method for ingress. Options are ["internal", "external"]. Default is "external". When empty is set based on private variable.	`string`	`""`	no
destroy_timeout	Maximum duration in minutes to allow for destroying resources. (Default: 60 minutes)	`number`	`null`	no
disable_waiting_in_destroy	Disable addressing cluster state in the destroy resource. Default value is false, and so a `destroy` will wait for the cluster to be deleted.	`bool`	`null`	no
ec2_metadata_http_tokens	Should cluster nodes use both v1 and v2 endpoints or just v2 endpoint of EC2 Instance Metadata Service (IMDS). Available since OpenShift 4.11.0.	`string`	`"optional"`	no
etcd_encryption	Add etcd encryption. By default etcd data is encrypted at rest. This option configures etcd encryption on top of existing storage encryption.	`bool`	`null`	no
etcd_kms_key_arn	The key ARN is the Amazon Resource Name (ARN) of a CMK. It is a unique, fully qualified identifier for the CMK. A key ARN includes the AWS account, Region, and the key ID.	`string`	`null`	no
host_prefix	Subnet prefix length to assign to each individual node. For example, if host prefix is set to "23", then each node is assigned a /23 subnet out of the given CIDR.	`number`	`null`	no
http_proxy	A proxy URL to use for creating HTTP connections outside the cluster. The URL scheme must be http.	`string`	`null`	no
https_proxy	A proxy URL to use for creating HTTPS connections outside the cluster.	`string`	`null`	no
identity_providers	Provides a generic approach to add multiple identity providers after the creation of the cluster. This variable allows users to specify configurations for multiple identity providers in a flexible and customizable manner, facilitating the management of resources post-cluster deployment. For additional details regarding the variables utilized, refer to the idp sub-module. For non-primitive variables (such as maps, lists, and objects), supply the JSON-encoded string.	`map(any)`	`{}`	no
ignore_machine_pools_deletion_error	Ignore machine pool deletion error. Assists when cluster resource is managed within the same file for the destroy use case	`bool`	`false`	no
kms_key_arn	The key ARN is the Amazon Resource Name (ARN) of a CMK. It is a unique, fully qualified identifier for the CMK. A key ARN includes the AWS account, Region, and the key ID.	`string`	`null`	no
kubelet_configs	Provides a generic approach to add multiple kubelet configs after the creation of the cluster. This variable allows users to specify configurations for multiple kubelet configs in a flexible and customizable manner, facilitating the management of resources post-cluster deployment. For additional details regarding the variables utilized, refer to the idp sub-module. For non-primitive variables (such as maps, lists, and objects), supply the JSON-encoded string.	`map(any)`	`{}`	no
machine_cidr	Block of IP addresses used by OpenShift while installing the cluster, for example "10.0.0.0/16".	`string`	`null`	no
machine_pools	Provides a generic approach to add multiple machine pools after the creation of the cluster. This variable allows users to specify configurations for multiple machine pools in a flexible and customizable manner, facilitating the management of resources post-cluster deployment. For additional details regarding the variables utilized, refer to the machine-pool sub-module. For non-primitive variables (such as maps, lists, and objects), supply the JSON-encoded string.	`map(any)`	`{}`	no
managed_oidc	OIDC type managed or unmanaged oidc. Only active when create_oidc also enabled. This value should not be updated, please create a new resource instead	`bool`	`true`	no
no_proxy	A comma-separated list of destination domain names, domains, IP addresses or other network CIDRs to exclude proxying.	`string`	`null`	no
oidc_config_id	The unique identifier associated with users authenticated through OpenID Connect (OIDC) within the ROSA cluster. If create_oidc is false this attribute is required.	`string`	`null`	no
oidc_endpoint_url	Registered OIDC configuration issuer URL, added as the trusted relationship to the operator roles. Valid only when create_oidc is false.	`string`	`null`	no
openshift_version	Desired version of OpenShift for the cluster, for example '4.1.0'. If version is greater than the currently running version, an upgrade will be scheduled.	`string`	n/a	yes
operator_role_prefix	User-defined prefix for generated AWS operator policies. Use "account-role-prefix" in case no value provided.	`string`	`null`	no
path	The arn path for the account/operator roles as well as their policies. Must begin and end with '/'.	`string`	`"/"`	no
permissions_boundary	The ARN of the policy that is used to set the permissions boundary for the IAM roles in STS clusters.	`string`	`""`	no
pod_cidr	Block of IP addresses from which Pod IP addresses are allocated, for example "10.128.0.0/14".	`string`	`null`	no
private	Restrict master API endpoint and application routes to direct, private connectivity. (default: false)	`bool`	`false`	no
properties	User defined properties.	`map(string)`	`null`	no
replicas	Number of worker nodes to provision. This attribute is applicable solely when autoscaling is disabled. Single zone clusters need at least 2 nodes, multizone clusters need at least 3 nodes. Hosted clusters require that the number of worker nodes be a multiple of the number of private subnets. (default: 2)	`number`	`null`	no
service_cidr	Block of IP addresses for services, for example "172.30.0.0/16".	`string`	`null`	no
tags	Apply user defined tags to all cluster resources created in AWS. After the creation of the cluster is completed, it is not possible to update this attribute.	`map(string)`	`null`	no
upgrade_acknowledgements_for	Indicates acknowledgement of agreements required to upgrade the cluster version between minor versions (e.g. a value of "4.12" indicates acknowledgement of any agreements required to upgrade to OpenShift 4.12.z from 4.11 or before).	`string`	`null`	no
version_channel_group	Desired channel group of the version [stable, candidate, fast, nightly].	`string`	`"stable"`	no
wait_for_create_complete	Wait until the cluster is either in a ready state or in an error state. The waiter has a timeout of 20 minutes. (default: true)	`bool`	`true`	no
wait_for_std_compute_nodes_complete	Wait until the initial set of machine pools to be available. The waiter has a timeout of 60 minutes. (default: true)	`bool`	`true`	no

Outputs

Name	Description
account_role_prefix	The prefix used for all generated AWS resources.
account_roles_arn	A map of Amazon Resource Names (ARNs) associated with the AWS IAM roles created. The key in the map represents the name of an AWS IAM role, while the corresponding value represents the associated Amazon Resource Name (ARN) of that role.
cluster_admin_password	The password of the admin user.
cluster_admin_username	The username of the admin user.
cluster_api_url	The URL of the API server.
cluster_console_url	The URL of the console.
cluster_current_version	The currently running version of OpenShift on the cluster, for example '4.11.0'.
cluster_domain	The DNS domain of cluster.
cluster_id	Unique identifier of the cluster.
cluster_state	The state of the cluster.
oidc_config_id	The unique identifier associated with users authenticated through OpenID Connect (OIDC) generated by this OIDC config.
oidc_endpoint_url	Registered OIDC configuration issuer URL, generated by this OIDC config.
operator_role_prefix	Prefix used for generated AWS operator policies.
operator_roles_arn	List of Amazon Resource Names (ARNs) for all operator roles created.
path	The arn path for the account/operator roles as well as their policies.

📚 Additional Resources

Documentation Files in This Repository

Core Deployment Guides

ROSA Cluster Creation Agent Instructions - Comprehensive LLM agent instructions for automated ROSA deployment
OpenShift AI Setup Guide - Complete guide for deploying OpenShift AI on ROSA clusters
Llama Stack Integration Guide - Deploy and integrate Llama Stack for LLM inference

Demo Applications

Agentic AI Demo - Complete working demonstration with MCP servers, UI, and agent framework

Deployment Examples

External Resources

Official Documentation

AWS Resources

Learning Resources

🎯 Use Cases

This automation suite supports various deployment scenarios:

1. Development & Testing

"Create a minimal ROSA cluster for testing:
- 2 worker nodes (m5.xlarge)
- Public access
- No GPU support
- Development/testing tags"

2. AI/ML Workloads

"Deploy a ROSA cluster for machine learning:
- 3 GPU worker nodes (g5.4xlarge)
- OpenShift AI with GPU operator
- S3 integration for model storage
- Data science workbenches"

3. Agentic AI Applications

"Deploy complete agentic AI stack:
- ROSA HCP cluster
- OpenShift AI platform
- Llama Stack for inference
- MCP servers (CRM, PDF, Slack)
- Sample agentic UI"

4. Production Workloads

"Create production-ready ROSA cluster:
- Private cluster with PrivateLink
- High availability (multi-AZ)
- Enterprise security (zero egress)
- Custom machine pools
- Monitoring and logging"

5. Hybrid Cloud

"Deploy ROSA with existing infrastructure:
- Use existing VPC
- Integrate with on-prem LDAP
- Custom networking configuration
- Shared OIDC provider"

🔒 Security Considerations

Network Security

Public Clusters: API and ingress accessible from internet (good for dev/test)
Private Clusters: API accessible only within VPC (recommended for production)
Zero Egress: No outbound internet (highest security, requires VPC endpoints)

Identity & Access

AWS IAM roles and policies follow least-privilege principles
OpenShift RBAC for cluster access control
OIDC integration for federated authentication
Optional integration with enterprise identity providers

Data Protection

Optional etcd encryption at rest
EBS volume encryption
Network encryption in transit
S3 bucket encryption for AI models and artifacts

Compliance

Consistent resource tagging for audit trails
Complete deployment documentation
Infrastructure-as-Code for reproducibility
Automated cleanup procedures

🤝 Contributing

Contributions are welcome! Please feel free to submit pull requests or open issues for:

Bug fixes
Documentation improvements
New features or examples
AI assistant instruction enhancements

📄 License

See the LICENSE file for details.

💬 Support

For issues and questions:

ROSA Issues: Red Hat Customer Portal
Repository Issues: GitHub Issues
Community: OpenShift Community

🎓 Quick Reference

Essential Commands

# ROSA Cluster Management
rosa list clusters
rosa describe cluster <cluster-name>
rosa delete cluster <cluster-name>

# OpenShift CLI
oc login <api-url> -u <username> -p <password>
oc get nodes
oc get pods --all-namespaces
oc projects

# AWS Resources
aws ec2 describe-vpcs --region <region>
aws iam list-roles --query 'Roles[?contains(RoleName, `rosa`)]'
aws resourcegroupstaggingapi get-resources --tag-filters Key=rosa_cluster,Values=<cluster-name>

# Terraform Management
terraform init
terraform plan
terraform apply
terraform destroy
terraform output cluster_console_url

Common Troubleshooting

Issue: Token expired during deployment

# Solution: Use persistent offline token
export RHCS_TOKEN="<get-from-console.redhat.com/openshift/token>"

Issue: Insufficient AWS quotas

# Solution: Check and request quota increases
rosa verify quota --region <region>
aws service-quotas list-service-quotas --service-code ec2

Issue: Billing account not linked

# Solution: Complete setup via Red Hat Console
# Visit: https://console.redhat.com/openshift/create/rosa/getstarted

Issue: Network connectivity problems

# Solution: Verify VPC and subnet configuration
aws ec2 describe-subnets --filters "Name=vpc-id,Values=<vpc-id>"
rosa describe cluster <cluster-name> | grep -E "Subnet|VPC"

🚀 Ready to Deploy?

Choose your AI-assisted deployment method:

Option 1 (Production): Ask Cursor to deploy using Terraform with the agent instructions for IaC benefits
Option 2 (Quick Start): Ask Cursor to deploy using CLI commands for faster deployment

Need Help? Refer to the comprehensive guides in this repository or use your AI code assistant with the included instructions!

Name		Name	Last commit message	Last commit date
Latest commit History 23 Commits
assets		assets
examples		examples
images		images
modules		modules
rosa_agent		rosa_agent
scripts		scripts
.gitignore		.gitignore
Dockerfile		Dockerfile
Enterprise AI Agent Development - Analysis and Recommendations.md		Enterprise AI Agent Development - Analysis and Recommendations.md
Llama Stack Configuration and Architecture.md		Llama Stack Configuration and Architecture.md
Llama Stack OpenShift AI Integration Guide.md		Llama Stack OpenShift AI Integration Guide.md
Makefile		Makefile
OpenShift AI setup.md		OpenShift AI setup.md
README.md		README.md
RHAIonInferentia.md		RHAIonInferentia.md
ROSA Cluster creation agent instructions.md		ROSA Cluster creation agent instructions.md
argocd-applications.tf		argocd-applications.tf
argocd-operator-applications.tf		argocd-operator-applications.tf
authorino.yml		authorino.yml
llama_stack_research.md		llama_stack_research.md
main.tf		main.tf
openshift-gitops.tf		openshift-gitops.tf
outputs.tf		outputs.tf
terraform.tfvars.example		terraform.tfvars.example
variables.tf		variables.tf
versions.tf		versions.tf
vllmoninferentia.md		vllmoninferentia.md

Folders and files

Latest commit

History

Repository files navigation

AI Assistant Supported ROSA & AI Components Deployment

📋 Table of Contents

Overview

Deployment Methods

What You Can Deploy

🤖 AI-Powered Deployment with Code Assistants

Using ROSA Cluster Creation with Cursor or Other AI Code Assistants

📖 Key Documentation Files

1. ROSA Cluster Creation Agent Instructions

2. OpenShift AI Setup Guide

3. Llama Stack Integration Guide

4. Agentic AI Demo

🚀 Complete End-to-End Deployment with AI Assistant

📊 What Gets Deployed Automatically

🎯 Benefits of AI-Assisted Deployment

⚠️ Important Notes for AI-Assisted Deployment

📖 Reading Order for Manual Reference

🧠 Complete AI Stack Deployment

Full Stack Architecture

Deployment Approaches

🚀 Getting Started

Quick Start (5 Minutes to Deployment)

Prerequisites Checklist

Verification Commands

🔧 Terraform Automation

Traditional Terraform Module Deployment

Example Usage

Sub-modules

Pre-requisites

Requirements

Providers

Modules

Resources

ROSA Cluster Deployment Guide

🚀 Quick Start

1. Set RHCS Credentials

2. Configure Deployment

3. Deploy

✅ Works with Standard Terraform

📊 View Results

🔧 Configuration Options

⚠️ Important: Subnet Requirements

Inputs

Outputs

📚 Additional Resources

Documentation Files in This Repository

Core Deployment Guides

Demo Applications

Deployment Examples

External Resources

Official Documentation

AWS Resources

Learning Resources

🎯 Use Cases

1. Development & Testing

2. AI/ML Workloads

3. Agentic AI Applications

4. Production Workloads

5. Hybrid Cloud

🔒 Security Considerations

Network Security

Identity & Access

Data Protection

Compliance

🤝 Contributing

📄 License

💬 Support

🎓 Quick Reference

Essential Commands

Common Troubleshooting

About

Resources

Stars

Watchers

Forks

Releases