We’re integrating Tectonic with Red Hat OpenShift

We are bringing the best of Tectonic to Red Hat OpenShift to build the most secure, hybrid Kubernetes application platform.

AWS: Installation Requirements

What You Need

  • Access Key and Secret or alternatively a temporary Access Key, Secret, and Session Token
  • Region and Availability Zone to use
  • Tectonic License and Pull Secret
  • SSH Key pair in that region
  • KMS Key in that region or access rights for Tectonic to generate one
  • A Public Route53 Hosted Zone identifier. Public Route53 resolution is a requirement for controller-worker TLS communication. Tectonic will generate 2 subdomains in this Hosted Zone during provisioning.
  • A current version of the Google Chrome or Mozilla Firefox web browser to run Tectonic Installer.


The AWS credentials you provide require access to the following AWS services:

  • CloudFormation
  • ELB
  • EC2
  • KMS
  • Route53
  • S3
  • Security Groups
  • VPC

An importable AWS policy containing the minimum privileges needed to run the Tectonic installer can be found here.

Temporary Credentials

The following steps demonstrate how to generate and use temporary AWS credentials in conjunction with the Tectonic Installer:

  1. Ensure the AWS CLI tool is installed by following the instructions on the AWS CLI documentation. On Fedora, this can be done with dnf install:

     $ sudo dnf install awscli
  2. Ensure the AWS CLI is configured to use your access key ID and secret access key:

     $ aws configure
  3. Create a tectonic-installer role in AWS with the trust policy detailed here. The trust relationship policy grants an entity permission to assume the role.

     $ aws iam create-role --role-name tectonic-installer --assume-role-policy-document file://Documentation/files/aws-sts-trust-policy.json
  4. Add an inline AWS policy document to the tectonic-installer role containing the minimum privileges needed to run the Tectonic installer. The policy is available here.

     $ aws iam put-role-policy --role-name tectonic-installer --policy-name TectonicInstallerPolicy --policy-document file://Documentation/files/aws-policy.json
  5. Add your user's ARN, found on the IAM user detail page, to the trusted entities for the tectonic-installer role. To do so, click on the Trust Relationships tab and then on the Edit Trust Relationship button to bring up the trusted entities JSON editor. You'll then need to add a new section for your user's ARN.

  6. Assume the tectonic-installer role with your AWS user using the AWS CLI tool as follows:

     $ aws sts assume-role --role-arn=<TECTONIC_INSTALLER_ROLE_ARN> --role-session-name=tectonic-installer

    The returned response will look like:

         "Credentials": {
             "SecretAccessKey": "<SECRET_ACCESS_KEY>",
             "AccessKeyId": "<ACCESS_KEY_ID>",
             "Expiration": "2016-12-14T02:21:37Z",
             "SessionToken": "<SESSION_TOKEN>"

    Use the SECRET_ACCESS_KEY, ACCESS_KEY_ID, and SESSION_TOKEN to authenticate in the installer.


In order to access to the cluster 2 ELB backed services are exposed, both over the standard TLS port (443).