Integrating ROSA Applications with AWS Services (cs221)
Learn how to seamlessly integrate Red Hat OpenShift Service on AWS (ROSA) with native AWS services. This course covers best practices for deploying, managing, and optimizing cloud-native applications on ROSA.
Course Overview
This course equips you with the skills to deploy and manage applications on AWS with Kubernetes. You’ll learn to integrate with external container registries like ECR and Quay.io, configure storage classes for EBS and EFS, and apply security best practices.
You’ll gain hands-on experience setting up pod identities with STS/IRSA for secure AWS service access (Aurora, SQS, S3) and provisioning AWS resources using AWS Controllers for Kubernetes (ACK).
For observability, the course covers workload monitoring with Amazon Managed Prometheus and log aggregation with CloudWatch. Additionally, you’ll configure custom domains and TLS certificates for secure public access. By the end, you’ll be able to integrate Kubernetes with AWS efficiently for scalable and secure application deployments.
Recommended Training
To get the most out of this course, we recommend having prior experience with Red Hat OpenShift on AWS (ROSA). Ideally, you should have completed CS220 – Create and Configure Production Red Hat OpenShift on AWS (ROSA) Clusters or have equivalent hands-on experience, meaning you’re comfortable creating and accessing a private ROSA cluster.
A solid understanding of AWS administration is also important. This can come from certifications like AWS Certified SysOps Administrator – Associate or AWS Certified Solutions Architect – Associate, or equivalent practical experience in managing AWS infrastructure services.
Additionally, basic knowledge of OpenShift and container concepts is helpful. If you’re new to OpenShift, completing the DO080 Technical Overview will provide a good foundation.
For those looking to deepen their expertise, we also recommend enrolling in Red Hat Certified OpenShift Administration certification courses alongside CS220 and CS221 to further build your skills in OpenShift management.
Course Outline
Deploy Applications From External Registries
Deploy applications on Red Hat OpenShift Service on AWS (ROSA) from private container image repositories in external centralized container image registries.
Provide Amazon Storage Volumes for Applications
Configure Amazon Elastic Block Storage (EBS) or Amazon Elastic File System (EFS) volumes that meet the cost, performance, and sharing requirements of their applications.
Configure Application Access to AWS Services
Then, Configure applications for access to shared AWS services by using Kubernetes service accounts. In addition, provision dedicated AWS services by using Kubernetes custom resources.
OpenShift and AWS Application Observability
Furthermore, configure ROSA clusters to forward application logs to Amazon CloudWatch. At the same time, send application metrics to Amazon Managed Service for Prometheus.
Custom Domains for ROSA Applications
Expose applications to internet users with secure URLs by using human-readable DNS domains.
Impact on Your Organization
Red Hat OpenShift Service on AWS (ROSA) is a fully managed OpenShift platform that runs natively on AWS, helping organizations streamline operations, focus on innovation, and accelerate application deployment and scaling. As a hybrid cloud solution, OpenShift ensures a consistent operational experience across on-premises and cloud environments.
ROSA is designed for businesses already using AWS services who want to seamlessly integrate OpenShift clusters into their existing infrastructure. These organizations often have strong security requirements and prioritize robust access controls and network security for their AWS resources, including ROSA clusters.
Impact on the Individual
Upon successful completion of CS221, students will be able to integrate applications deployed on a private ROSA cluster so that cluster administrators and platform engineers retain control over credentials and roles. As a result, application developers will not need direct access to those credentials.