supernovae · supernovae · Jun 23, 2026 · Jun 23, 2026
@@ -214,9 +214,11 @@ If you attempt an unsupported deployment, Terraform will show a helpful error me
 | IAM Policies | Customer managed | AWS managed |
 | Account Roles | 4 (cluster-scoped) | 3 (account-level, shared) |
 | IAM Lifecycle | Created/destroyed with cluster | Persist independently |
-| Spot Instances | ✅ Supported | ❌ Not supported |
+| Spot Instances | ✅ Supported | ✅ Via AutoNode* |
 | Version Drift | Independent | Machine pools n-2 of CP |
 
+> \*HCP spot instances are available via AutoNode (Karpenter). Traditional machine pool spot is not yet available on HCP. See [AutoNode docs](docs/AUTONODE.md).
+
 > **HCP IAM Note:** HCP account roles must exist before deploying HCP clusters. See [HCP Account Roles](#hcp-account-roles-required-before-hcp-clusters).
 
 ## GitOps Integration (Optional)

@@ -1,12 +1,8 @@
 # AutoNode (Karpenter) on ROSA HCP
 
-> **Technology Preview -- Not for Production Use**
->
-> AutoNode (Karpenter) on ROSA HCP is a **Technology Preview** feature. Technology Preview features are not fully supported under Red Hat subscription service level agreements, may not be functionally complete, and are not intended for production use. Red Hat does not guarantee the stability of Technology Preview features or that a migration path will exist from Technology Preview to General Availability (GA). Clusters with AutoNode enabled should be treated as **disposable test environments**.
->
-> Support cases for Technology Preview features are limited to Severity 3 and 4. There may not be any migration path from Technology Preview to GA -- a full reinstall of the GA version may be required and customer data may need to be migrated or may be lost.
->
-> For full details see: https://access.redhat.com/support/offerings/techpreview
+> **Generally Available** -- AutoNode (Red Hat build of Karpenter) is GA and fully supported
+> on ROSA HCP clusters in all AWS regions where ROSA is available. Requires OpenShift 4.19+
+> and ROSA CLI >= 1.2.61.
 
 ## Overview
 

@@ -169,9 +169,9 @@ All modules in this framework use **local paths** (no external registry modules)
 | Provider | Source | Min Lock Version | Used For |
 |----------|--------|------------------|----------|
 | aws | `hashicorp/aws` | 6.28.0 | VPC, IAM, Route53, S3, KMS |
-| rhcs | `terraform-redhat/rhcs` | 1.7.6 | ROSA cluster lifecycle via OCM API |
+| rhcs | `terraform-redhat/rhcs` | 1.7.7 | ROSA cluster lifecycle via OCM API |
 | kubernetes | `hashicorp/kubernetes` | 3.0.1 | Namespaces, ServiceAccounts, Secrets, ConfigMaps |
-| kubectl | `alekc/kubectl` | 2.1.3 | CRD-based resources (Subscriptions, ArgoCD, LokiStack) |
+| kubectl | `alekc/kubectl` | 2.2.0 | CRD-based resources (Subscriptions, ArgoCD, LokiStack) |
 | external | `hashicorp/external` | 2.3.5 | OAuth token retrieval (bootstrap only) |
 | null | `hashicorp/null` | 3.2.4 | Validation preconditions |
 | time | `hashicorp/time` | 0.13.1 | Operator readiness waits |

@@ -23,7 +23,7 @@ machine_pools = [
 
 | Feature | HCP | Classic |
 |---------|-----|---------|
-| Spot Instances | Coming soon | Supported |
+| Spot Instances | Via [AutoNode](AUTONODE.md) (Karpenter) | Supported |
 | Version Control | Must be within n-2 of control plane | Matches cluster |
 | Multi-AZ | Single subnet per pool | Configurable |
 | Disk Size | Fixed | Configurable |

@@ -127,6 +127,61 @@ module "hcp_account_roles" {
   tags = local.common_tags
 }
 
+#------------------------------------------------------------------------------
+# OCM Role (links Red Hat's OCM to this AWS account)
+#
+# The OCM role grants Red Hat's OpenShift Cluster Manager permissions to
+# manage resources in this AWS account. The profile controls the scope:
+#   - no-console: CLI-only, least privilege (recommended for automation)
+#   - standard:   Console + CLI
+#   - admin:      Auto-creates operator roles and OIDC via console
+#------------------------------------------------------------------------------
+
+locals {
+  ocm_role_name = "${var.ocm_role_prefix}-OCM-Role"
+
+  ocm_role_policy_map = {
+    "no-console" = data.rhcs_hcp_policies.ocm[0].ocm_role_policies.sts_ocm_no_console_permission_policy
+    "standard"   = data.rhcs_hcp_policies.ocm[0].ocm_role_policies.sts_ocm_permission_policy
+    "admin"      = data.rhcs_hcp_policies.ocm[0].ocm_role_policies.sts_ocm_admin_permission_policy
+  }
+}
+
+data "rhcs_hcp_policies" "ocm" {
+  count = var.create_ocm_role ? 1 : 0
+}
+
+data "rhcs_info" "ocm" {
+  count = var.create_ocm_role ? 1 : 0
+}
+
+resource "aws_iam_role" "ocm_role" {
+  count = var.create_ocm_role ? 1 : 0
+
+  name               = local.ocm_role_name
+  path               = var.path
+  assume_role_policy = data.rhcs_hcp_policies.ocm[0].ocm_role_policies.sts_ocm_trust_policy
+
+  tags = merge(local.common_tags, {
+    rosa_ocm_role    = "true"
+    ocm_role_profile = var.ocm_role_profile
+  })
+}
+
+resource "aws_iam_role_policy" "ocm_role" {
+  count = var.create_ocm_role ? 1 : 0
+
+  name   = "${var.ocm_role_prefix}-OCM-Policy"
+  role   = aws_iam_role.ocm_role[0].id
+  policy = local.ocm_role_policy_map[var.ocm_role_profile]
+}
+
+resource "rhcs_rosa_ocm_role_link" "ocm" {
+  count = var.create_ocm_role ? 1 : 0
+
+  role_arn = aws_iam_role.ocm_role[0].arn
+}
+
 #------------------------------------------------------------------------------
 # Optional: Shared KMS Keys
 # Uncomment if you want account-wide KMS keys for all HCP clusters

@@ -54,6 +54,20 @@ output "worker_role_name" {
   value       = module.hcp_account_roles.worker_role_name
 }
 
+#------------------------------------------------------------------------------
+# OCM Role
+#------------------------------------------------------------------------------
+
+output "ocm_role_arn" {
+  description = "ARN of the OCM IAM role (if created)."
+  value       = var.create_ocm_role ? aws_iam_role.ocm_role[0].arn : null
+}
+
+output "ocm_role_profile" {
+  description = "OCM role permission profile in use."
+  value       = var.create_ocm_role ? var.ocm_role_profile : null
+}
+
 #------------------------------------------------------------------------------
 # Usage Instructions
 #------------------------------------------------------------------------------

@@ -123,6 +123,38 @@ variable "kms_key_arns" {
   default     = []
 }
 
+#------------------------------------------------------------------------------
+# OCM Role
+#------------------------------------------------------------------------------
+
+variable "create_ocm_role" {
+  type        = bool
+  description = "Create and link the OCM IAM role for this account."
+  default     = true
+}
+
+variable "ocm_role_profile" {
+  type        = string
+  description = <<-EOT
+    OCM role permission profile. Controls what OCM can do in your AWS account:
+      - "no-console": Minimal permissions, CLI-only (default, least privilege)
+      - "standard": Full OCM permissions for console + CLI usage
+      - "admin": Enhanced permissions (auto-creates operator roles/OIDC via console)
+  EOT
+  default     = "no-console"
+
+  validation {
+    condition     = contains(["no-console", "standard", "admin"], var.ocm_role_profile)
+    error_message = "ocm_role_profile must be no-console, standard, or admin."
+  }
+}
+
+variable "ocm_role_prefix" {
+  type        = string
+  description = "Prefix for the OCM IAM role name."
+  default     = "ManagedOpenShift"
+}
+
 #------------------------------------------------------------------------------
 # Optional Features
 #------------------------------------------------------------------------------

@@ -8,11 +8,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.0"
+      version = ">= 6.0"
     }
     rhcs = {
       source  = "terraform-redhat/rhcs"
-      version = ">= 1.7.6"
+      version = ">= 1.7.7"
     }
   }
 }
@@ -4,19 +4,19 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.0"
+      version = ">= 6.0"
     }
     rhcs = {
       source  = "terraform-redhat/rhcs"
-      version = ">= 1.7.6"
+      version = ">= 1.7.7"
     }
     kubernetes = {
       source  = "hashicorp/kubernetes"
-      version = ">= 2.35.0"
+      version = ">= 3.0.1"
     }
     kubectl = {
       source  = "alekc/kubectl"
-      version = ">= 2.1.0"
+      version = ">= 2.2.0"
     }
     external = {
       source  = "hashicorp/external"

@@ -4,19 +4,19 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.0"
+      version = ">= 6.0"
     }
     rhcs = {
       source  = "terraform-redhat/rhcs"
-      version = ">= 1.7.6"
+      version = ">= 1.7.7"
     }
     kubernetes = {
       source  = "hashicorp/kubernetes"
-      version = ">= 2.35.0"
+      version = ">= 3.0.1"
     }
     kubectl = {
       source  = "alekc/kubectl"
-      version = ">= 2.1.0"
+      version = ">= 2.2.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -26,10 +26,22 @@ terraform {
       source  = "hashicorp/time"
       version = ">= 0.9.0"
     }
+    external = {
+      source  = "hashicorp/external"
+      version = ">= 2.0"
+    }
     null = {
       source  = "hashicorp/null"
       version = ">= 3.0"
     }
+    tls = {
+      source  = "hashicorp/tls"
+      version = ">= 4.0"
+    }
+    local = {
+      source  = "hashicorp/local"
+      version = ">= 2.0"
+    }
   }
 
   # Recommended: Configure backend for state management

@@ -4,19 +4,19 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.0"
+      version = ">= 6.0"
     }
     rhcs = {
       source  = "terraform-redhat/rhcs"
-      version = ">= 1.7.6"
+      version = ">= 1.7.7"
     }
     kubernetes = {
       source  = "hashicorp/kubernetes"
-      version = ">= 2.35.0"
+      version = ">= 3.0.1"
     }
     kubectl = {
       source  = "alekc/kubectl"
-      version = ">= 2.1.0"
+      version = ">= 2.2.0"
     }
     external = {
       source  = "hashicorp/external"

@@ -4,19 +4,19 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.0"
+      version = ">= 6.0"
     }
     rhcs = {
       source  = "terraform-redhat/rhcs"
-      version = ">= 1.7.6"
+      version = ">= 1.7.7"
     }
     kubernetes = {
       source  = "hashicorp/kubernetes"
-      version = ">= 2.35.0"
+      version = ">= 3.0.1"
     }
     kubectl = {
       source  = "alekc/kubectl"
-      version = ">= 2.1.0"
+      version = ">= 2.2.0"
     }
     random = {
       source  = "hashicorp/random"
@@ -26,10 +26,22 @@ terraform {
       source  = "hashicorp/time"
       version = ">= 0.9.0"
     }
+    external = {
+      source  = "hashicorp/external"
+      version = ">= 2.0"
+    }
     null = {
       source  = "hashicorp/null"
       version = ">= 3.0"
     }
+    tls = {
+      source  = "hashicorp/tls"
+      version = ">= 4.0"
+    }
+    local = {
+      source  = "hashicorp/local"
+      version = ">= 2.0"
+    }
   }
 
   # Recommended: Configure backend for state management

@@ -102,7 +102,7 @@ certmanager_certificate_domains = [
 
 ### `autonode.tfvars`
 
-> **Technology Preview** -- AutoNode is not supported for production use. Clusters with AutoNode enabled should be treated as disposable test environments. See [Red Hat Technology Preview scope](https://access.redhat.com/support/offerings/techpreview).
+> AutoNode (Red Hat build of Karpenter) is GA and fully supported on ROSA HCP. Requires OpenShift 4.19+ and ROSA CLI >= 1.2.61.
 
 AutoNode (Karpenter) node autoscaling on ROSA HCP. Replaces traditional machine pool autoscaling with Karpenter's bin-packing scheduler. See [docs/AUTONODE.md](../docs/AUTONODE.md) for the full guide.
 

@@ -1,19 +1,12 @@
 #------------------------------------------------------------------------------
 # AutoNode (Karpenter) Example Configuration
 #
-# !! TECHNOLOGY PREVIEW -- NOT FOR PRODUCTION USE !!
-#
-# AutoNode on ROSA HCP is a Technology Preview feature. It is not fully
-# supported under Red Hat subscription service level agreements, may not
-# be functionally complete, and is not intended for production use. Red Hat
-# does not guarantee stability or a migration path to GA. Clusters with
-# AutoNode enabled should be treated as disposable test environments.
-# See: https://access.redhat.com/support/offerings/techpreview
-#
 # Enables Karpenter-based node autoscaling on ROSA HCP clusters.
 # AutoNode replaces traditional machine pool autoscaling with Karpenter's
 # bin-packing scheduler for faster, more efficient scaling.
 #
+# AutoNode is GA and fully supported on ROSA HCP in all AWS regions.
+#
 # Usage (two-phase deployment):
 #   # Phase 1: Create cluster + IAM + AutoNode
 #   terraform apply -var-file=cluster-dev.tfvars
@@ -27,7 +20,7 @@
 #
 # Requirements:
 #   - OpenShift 4.19+
-#   - Commercial AWS only
+#   - ROSA CLI >= 1.2.61
 #------------------------------------------------------------------------------
 
 #------------------------------------------------------------------------------

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.0"
+      version = ">= 6.0"
     }
   }
 }

@@ -8,11 +8,11 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.0"
+      version = ">= 6.0"
     }
     rhcs = {
       source  = "terraform-redhat/rhcs"
-      version = ">= 1.7.6"
+      version = ">= 1.7.7"
     }
     time = {
       source  = "hashicorp/time"