Create ROSA HCP Disaster Recovery Infrastructure

This guide builds the shared infrastructure for disaster recovery between two ROSA HCP clusters in different AWS Regions. It configures the EFS CSI Driver, S3 Cross-Region Replication, and EFS replication, giving you a foundation that multiple DR recovery patterns can build on.

Once this infrastructure is in place, choose a recovery pattern:

• Disaster Recovery with OADP uses OADP (OpenShift API for Data Protection) to back up and restore Kubernetes resources. This is a traditional backup-and-restore approach where Velero captures application state on the primary cluster and replays it on the DR cluster during failover.
• Disaster Recovery with ACM and OpenShift GitOps uses Red Hat Advanced Cluster Management for automatic failover detection and OpenShift GitOps (ArgoCD) for application deployment. ACM monitors cluster health, and an ArgoCD ApplicationSet deploys the application to whichever cluster carries the active label, removing the need for manual backup and restore operations.

Both patterns use the same shared infrastructure configured in this guide.

Architecture

The reference environment has:

• A primary ROSA HCP cluster in one AWS Region
• A DR ROSA HCP cluster in another AWS Region
• An application S3 bucket in the primary Region, replicated to a DR bucket
• A DR-pattern-specific S3 bucket in the primary Region, replicated to a DR bucket (for example, an OADP backup bucket)
• A primary EFS file system, replicated to an EFS file system in the DR Region
• EFS CSI Driver installed on both clusters

DNS or traffic cutover is external to this guide. After recovery is validated, update DNS, load balancer, or application routing according to your environment.

0. Prerequisites

You need:

• Two existing ROSA HCP clusters in different AWS Regions
• AWS CLI
• rosa CLI
• oc CLI
• jq
• AWS permissions for IAM, EC2, S3, and EFS
• Cluster admin access to both clusters

Clone the helper scripts repository:

Environment Variables

Set your cluster names:

The helper scripts detect regions, VPCs, subnets, and worker security groups from the cluster names. No additional environment setup is needed before continuing.

1. Install the EFS CSI Driver

Log in to the primary cluster, then install the EFS CSI Driver:

Log in to the DR cluster, then install the EFS CSI Driver:

The helper creates a customer-managed EFS CSI controller IAM policy. This is intentional. The AWS-managed EFS CSI policy includes tag conditions that can conflict with tags injected by ROSA or OpenShift during access point creation. A custom policy avoids those tag-condition failures while keeping the EFS CSI permissions explicit.

Verify the driver on each cluster:

2. Configure S3 Replication

Create S3 buckets for application data and DR-pattern backups, then configure one-way replication from primary to DR:

For the purposes of this guide, S3 Cross-Region Replication is configured as one-way (primary to DR). However, in a real-world production environment, you should configure bi-directional replication to ensure any objects written to the DR bucket during a failover automatically sync back to the primary bucket.

3. Configure EFS Replication

Create the primary EFS file system, mount targets, and the DR replica:

The script:

• Detects regions, subnets, and worker security groups from the cluster names
• Discovers each cluster VPC from the subnet list
• Creates or reuses named EFS security groups
• Uses the worker security groups to allow NFS (port 2049) access
• Creates a primary EFS file system
• Waits for the primary file system to become available
• Creates mount targets in every machine pool subnet
• Creates EFS replication to the DR Region
• Waits for the DR replica file system to become available
• Creates DR mount targets
• Waits for all mount targets to become available

After EFS is created, create the EFS StorageClass on both clusters.

Log in to the primary cluster, then apply the StorageClass and run a smoke test:

Log in to the DR cluster, then apply the StorageClass:

The StorageClass uses dynamic EFS access point provisioning and directoryPerms: "775". The --smoke-test flag creates a small throwaway PVC on the primary cluster, waits for it to bind, and removes the smoke-test namespace before continuing.

Next Steps

With the EFS CSI Driver, S3 replication, and EFS replication in place, continue with a DR recovery pattern:

• Disaster Recovery with OADP – backup-and-restore approach using OADP/Velero for Kubernetes resource recovery, with EFS PVC mapping and full failover/failback workflow.
• Disaster Recovery with ACM and OpenShift GitOps – ACM-driven approach using automatic failover detection and ArgoCD ApplicationSet for application deployment.