Skip to content

Commit 84bf1bc

Browse files
serngawyserngawy
committed
Fix comments
Signed-off-by: serngawy <[email protected]>
1 parent fed1e9c commit 84bf1bc

15 files changed

+579
-775
lines changed

‎config/crd/bases/controlplane.cluster.x-k8s.io_rosacontrolplanes.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -782,8 +782,8 @@ spec:
782782
rule: self == oldSelf
783783
rosaRoleConfigRef:
784784
description: |-
785-
RosaRoleConfigRef is a reference to a RosaRoleConfig resource that contains account and operator roles and OIDC configuration.
786-
If specified, the roles and OIDC configuration will be taken from the referenced RosaRoleConfig instead of the direct fields.
785+
RosaRoleConfigRef is a reference to a RosaRoleConfig resource that contains account roles, operator roles and OIDC configuration.
786+
RosaRoleConfigRef and role fields such as installerRoleARN, supportRoleARN, workerRoleARN, rolesRef and oidcID are mutually exclusive.
787787
properties:
788788
name:
789789
default: ""

‎config/crd/bases/infrastructure.cluster.x-k8s.io_rosaroleconfigs.yaml‎

Lines changed: 48 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -48,31 +48,44 @@ spec:
4848
creating your ROSA cluster.
4949
properties:
5050
path:
51+
description: The arn path for the account/operator roles as well
52+
as their policies.
5153
type: string
5254
permissionsBoundaryARN:
55+
description: The ARN of the policy that is used to set the permissions
56+
boundary for the account roles.
5357
type: string
5458
prefix:
55-
description: User-defined prefix for all generated AWS resources
59+
description: User-defined prefix for all generated AWS account
60+
role
5661
maxLength: 4
62+
pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$
5763
type: string
64+
x-kubernetes-validations:
65+
- message: prefix is immutable
66+
rule: self == oldSelf
5867
sharedVPCConfig:
5968
description: SharedVPCConfig is used to set up shared VPC.
6069
properties:
6170
routeRoleARN:
62-
description: ' Role ARN associated with the private hosted
63-
zone used for Hosted Control Plane cluster shared VPC, this
64-
role contains policies to be used with Route 53'
71+
description: Role ARN associated with the private hosted zone
72+
used for Hosted Control Plane cluster shared VPC, this role
73+
contains policies to be used with Route 53
6574
type: string
6675
vpcEndpointRoleArn:
67-
description: ' Role ARN associated with the shared VPC used
76+
description: Role ARN associated with the shared VPC used
6877
for Hosted Control Plane clusters, this role contains policies
69-
to be used with the VPC endpoint'
78+
to be used with the VPC endpoint
7079
type: string
7180
type: object
7281
version:
73-
description: ' Version of OpenShift that will be used to setup
74-
policy tag, for example "4.11"'
82+
description: |-
83+
Version of OpenShift that will be used to the roles tag in formate of x.y.z example; "4.19.0"
84+
Setting the role OpenShift version tag does not affect the associated ROSAControlplane version.
7585
type: string
86+
x-kubernetes-validations:
87+
- message: version is immutable
88+
rule: self == oldSelf
7689
required:
7790
- prefix
7891
- version
@@ -93,7 +106,9 @@ spec:
93106
type: object
94107
x-kubernetes-map-type: atomic
95108
identityRef:
96-
description: AWSIdentityReference specifies a identity.
109+
description: |-
110+
IdentityRef is a reference to an identity to be used when reconciling the ROSA Role Config.
111+
If no identity is specified, the default identity for this controller will be used.
97112
properties:
98113
kind:
99114
description: Kind of the identity.
@@ -110,43 +125,59 @@ spec:
110125
- kind
111126
- name
112127
type: object
128+
oidcProviderType:
129+
default: Managed
130+
description: OIDC provider type values are Managed or UnManaged. When
131+
set to UnManged OperatorRoleConfig OIDCID field must be provided.
132+
enum:
133+
- Managed
134+
- UnManaged
135+
type: string
113136
operatorRoleConfig:
114137
description: OperatorRoleConfig defines cluster-specific operator
115138
IAM roles based on your cluster configuration.
116139
properties:
117140
oidcID:
118141
description: |-
119142
OIDCID is the ID of the OIDC config that will be used to create the operator roles.
120-
A managed OIDC-provider will be created if the OIDCID not specified
143+
Cannot be set when OidcProviderType set to Managed
121144
type: string
145+
x-kubernetes-validations:
146+
- message: oidcID is immutable
147+
rule: self == oldSelf
122148
permissionsBoundaryARN:
123149
description: The ARN of the policy that is used to set the permissions
124150
boundary for the operator roles.
125151
type: string
126152
prefix:
127153
description: ' User-defined prefix for generated AWS operator
128-
policies.'
154+
roles.'
129155
maxLength: 4
156+
pattern: ^[a-z]([-a-z0-9]*[a-z0-9])?$
130157
type: string
158+
x-kubernetes-validations:
159+
- message: prefix is immutable
160+
rule: self == oldSelf
131161
sharedVPCConfig:
132162
description: SharedVPCConfig is used to set up shared VPC.
133163
properties:
134164
routeRoleARN:
135-
description: ' Role ARN associated with the private hosted
136-
zone used for Hosted Control Plane cluster shared VPC, this
137-
role contains policies to be used with Route 53'
165+
description: Role ARN associated with the private hosted zone
166+
used for Hosted Control Plane cluster shared VPC, this role
167+
contains policies to be used with Route 53
138168
type: string
139169
vpcEndpointRoleArn:
140-
description: ' Role ARN associated with the shared VPC used
170+
description: Role ARN associated with the shared VPC used
141171
for Hosted Control Plane clusters, this role contains policies
142-
to be used with the VPC endpoint'
172+
to be used with the VPC endpoint
143173
type: string
144174
type: object
145175
required:
146176
- prefix
147177
type: object
148178
required:
149179
- accountRoleConfig
180+
- oidcProviderType
150181
- operatorRoleConfig
151182
type: object
152183
status:
@@ -170,8 +201,7 @@ spec:
170201
type: string
171202
type: object
172203
conditions:
173-
description: Conditions provide observations of the operational state
174-
of a Cluster API resource.
204+
description: Conditions specifies the ROSARoleConfig conditions
175205
items:
176206
description: Condition defines an observation of a Cluster API resource
177207
operational state.

‎config/crd/kustomization.yaml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@ patchesStrategicMerge:
4242
- patches/webhook_in_awsmanagedcontrolplanetemplates.yaml
4343
- patches/webhook_in_eksconfigs.yaml
4444
- patches/webhook_in_eksconfigtemplates.yaml
45-
- patches/webhook_in_rosaroleconfigs.yaml
4645
# +kubebuilder:scaffold:crdkustomizewebhookpatch
4746

4847
# [CERTMANAGER] To enable webhook, uncomment all the sections with [CERTMANAGER] prefix.
@@ -59,7 +58,6 @@ patchesStrategicMerge:
5958
- patches/cainjection_in_awsmanagedclustertemplates.yaml
6059
- patches/cainjection_in_eksconfigs.yaml
6160
- patches/cainjection_in_eksconfigtemplates.yaml
62-
- patches/cainjection_in_rosaroleconfigs.yaml
6361
# +kubebuilder:scaffold:crdkustomizecainjectionpatch
6462

6563
# [LABEL] To enable label, uncomment all the sections with [LABEL] prefix.

‎controlplane/rosa/api/v1beta2/rosacontrolplane_types.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -123,8 +123,8 @@ type RosaControlPlaneSpec struct { //nolint: maligned
123123
// +kubebuilder:default=WaitForAcknowledge
124124
VersionGate VersionGateAckType `json:"versionGate"`
125125

126-
// RosaRoleConfigRef is a reference to a RosaRoleConfig resource that contains account and operator roles and OIDC configuration.
127-
// If specified, the roles and OIDC configuration will be taken from the referenced RosaRoleConfig instead of the direct fields.
126+
// RosaRoleConfigRef is a reference to a RosaRoleConfig resource that contains account roles, operator roles and OIDC configuration.
127+
// RosaRoleConfigRef and role fields such as installerRoleARN, supportRoleARN, workerRoleARN, rolesRef and oidcID are mutually exclusive.
128128
//
129129
// +optional
130130
RosaRoleConfigRef *corev1.LocalObjectReference `json:"rosaRoleConfigRef,omitempty"`

‎controlplane/rosa/api/v1beta2/rosacontrolplane_webhook.go‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,6 @@ import (
3131
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
3232
)
3333

34-
// log is for logging in this package.
35-
var rosacpLog = ctrl.Log.WithName("rosacontrolplane-resource")
36-
3734
// SetupWebhookWithManager will setup the webhooks for the ROSAControlPlane.
3835
func (r *ROSAControlPlane) SetupWebhookWithManager(mgr ctrl.Manager) error {
3936
w := new(rosaControlPlaneWebhook)
@@ -124,6 +121,10 @@ func (*rosaControlPlaneWebhook) ValidateUpdate(_ context.Context, oldObj, newObj
124121
allErrs = append(allErrs, err)
125122
}
126123

124+
if err := r.validateRosaRoleConfig(); err != nil {
125+
allErrs = append(allErrs, err)
126+
}
127+
127128
allErrs = append(allErrs, r.validateNetwork()...)
128129
allErrs = append(allErrs, r.Spec.AdditionalTags.Validate()...)
129130

@@ -203,14 +204,14 @@ func (r *ROSAControlPlane) validateExternalAuthProviders() *field.Error {
203204
}
204205

205206
func (r *ROSAControlPlane) validateRosaRoleConfig() *field.Error {
206-
hasAnyDirectRoleFields := r.Spec.OIDCID != "" || r.Spec.InstallerRoleARN != "" || r.Spec.SupportRoleARN != "" || r.Spec.WorkerRoleARN != "" ||
207+
hasRoleFields := r.Spec.OIDCID != "" || r.Spec.InstallerRoleARN != "" || r.Spec.SupportRoleARN != "" || r.Spec.WorkerRoleARN != "" ||
207208
r.Spec.RolesRef.IngressARN != "" || r.Spec.RolesRef.ImageRegistryARN != "" || r.Spec.RolesRef.StorageARN != "" ||
208209
r.Spec.RolesRef.NetworkARN != "" || r.Spec.RolesRef.KubeCloudControllerARN != "" || r.Spec.RolesRef.NodePoolManagementARN != "" ||
209210
r.Spec.RolesRef.ControlPlaneOperatorARN != "" || r.Spec.RolesRef.KMSProviderARN != ""
210211

211212
if r.Spec.RosaRoleConfigRef != nil {
212-
if hasAnyDirectRoleFields {
213-
rosacpLog.Info("rosaRoleConfigRef and direct role fields (oidcID, installerRoleARN, supportRoleARN, workerRoleARN, rolesRef) are mutually exclusive")
213+
if hasRoleFields {
214+
return field.Invalid(field.NewPath("spec.rosaRoleConfigRef"), r.Spec.RosaRoleConfigRef, "RosaRoleConfigRef and role fields such as installerRoleARN, supportRoleARN, workerRoleARN, rolesRef and oidcID are mutually exclusive")
214215
}
215216
return nil
216217
}

‎controlplane/rosa/controllers/rosacontrolplane_controller.go‎

Lines changed: 5 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -198,10 +198,10 @@ func (r *ROSAControlPlaneReconciler) Reconcile(ctx context.Context, req ctrl.Req
198198
}
199199

200200
// Handle normal reconciliation loop.
201-
return r.reconcileNormal(ctx, rosaScope, log)
201+
return r.reconcileNormal(ctx, rosaScope)
202202
}
203203

204-
func (r *ROSAControlPlaneReconciler) reconcileNormal(ctx context.Context, rosaScope *scope.ROSAControlPlaneScope, log *logger.Logger) (res ctrl.Result, reterr error) {
204+
func (r *ROSAControlPlaneReconciler) reconcileNormal(ctx context.Context, rosaScope *scope.ROSAControlPlaneScope) (res ctrl.Result, reterr error) {
205205
rosaScope.Info("Reconciling ROSAControlPlane")
206206

207207
if controllerutil.AddFinalizer(rosaScope.ControlPlane, ROSAControlPlaneFinalizer) {
@@ -245,10 +245,10 @@ func (r *ROSAControlPlaneReconciler) reconcileNormal(ctx context.Context, rosaSc
245245
rosacontrolplanev1.ROSARoleConfigNotFoundReason,
246246
clusterv1.ConditionSeverityError,
247247
"RosaRoleConfig %s/%s not found", rosaScope.ControlPlane.Namespace, rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name)
248-
log.Error(err, fmt.Sprintf("RosaRoleConfig %s/%s not found: %s", rosaScope.ControlPlane.Namespace, rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name, err.Error()))
248+
rosaScope.Error(err, fmt.Sprintf("RosaRoleConfig %s/%s not found: %s", rosaScope.ControlPlane.Namespace, rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name, err.Error()))
249249
return ctrl.Result{RequeueAfter: time.Second * 60}, nil
250250
}
251-
log.Error(err, fmt.Sprintf("failed to get RosaRoleConfig %s/%s: %s", rosaScope.ControlPlane.Namespace, rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name, err.Error()))
251+
rosaScope.Error(err, fmt.Sprintf("failed to get RosaRoleConfig %s/%s: %s", rosaScope.ControlPlane.Namespace, rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name, err.Error()))
252252
return ctrl.Result{RequeueAfter: time.Second * 60}, nil
253253
}
254254

@@ -259,7 +259,7 @@ func (r *ROSAControlPlaneReconciler) reconcileNormal(ctx context.Context, rosaSc
259259
rosacontrolplanev1.ROSARoleConfigNotReadyReason,
260260
clusterv1.ConditionSeverityWarning,
261261
"RosaRoleConfig %s/%s is not ready", rosaScope.ControlPlane.Namespace, rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name)
262-
log.Error(err, fmt.Sprintf("RosaRoleConfig %s/%s is not ready", rosaScope.ControlPlane.Namespace, rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name))
262+
rosaScope.Error(err, fmt.Sprintf("RosaRoleConfig %s/%s is not ready", rosaScope.ControlPlane.Namespace, rosaScope.ControlPlane.Spec.RosaRoleConfigRef.Name))
263263

264264
return ctrl.Result{RequeueAfter: time.Second * 60}, nil
265265
}
@@ -278,11 +278,6 @@ func (r *ROSAControlPlaneReconciler) reconcileNormal(ctx context.Context, rosaSc
278278
return ctrl.Result{}, fmt.Errorf("failed to validate ROSAControlPlane.spec: %w", err)
279279
}
280280

281-
err = validateRoleConfigSpec(rosaRoleConfig)
282-
if err != nil {
283-
return ctrl.Result{}, fmt.Errorf("failed to validate ROSAControlPlane.spec: %w", err)
284-
}
285-
286281
conditions.MarkTrue(rosaScope.ControlPlane, rosacontrolplanev1.ROSAControlPlaneValidCondition)
287282
if validationMessage != "" {
288283
conditions.MarkFalse(rosaScope.ControlPlane,
@@ -1189,55 +1184,3 @@ func buildAPIEndpoint(cluster *cmv1.Cluster) (*clusterv1.APIEndpoint, error) {
11891184
Port: int32(port), //#nosec G109 G115
11901185
}, nil
11911186
}
1192-
1193-
func validateRoleConfigSpec(roleConfig *expinfrav1.ROSARoleConfig) error {
1194-
if roleConfig.Status.OIDCID == "" {
1195-
return fmt.Errorf("OIDCID is required")
1196-
}
1197-
1198-
if roleConfig.Status.AccountRolesRef.InstallerRoleARN == "" {
1199-
return fmt.Errorf("InstallerRoleARN is required")
1200-
}
1201-
1202-
if roleConfig.Status.AccountRolesRef.SupportRoleARN == "" {
1203-
return fmt.Errorf("SupportRoleARN is required")
1204-
}
1205-
1206-
if roleConfig.Status.AccountRolesRef.WorkerRoleARN == "" {
1207-
return fmt.Errorf("WorkerRoleARN is required")
1208-
}
1209-
1210-
if roleConfig.Status.OperatorRolesRef.IngressARN == "" {
1211-
return fmt.Errorf("IngressARN is required")
1212-
}
1213-
1214-
if roleConfig.Status.OperatorRolesRef.ImageRegistryARN == "" {
1215-
return fmt.Errorf("ImageRegistryARN is required")
1216-
}
1217-
1218-
if roleConfig.Status.OperatorRolesRef.StorageARN == "" {
1219-
return fmt.Errorf("StorageARN is required")
1220-
}
1221-
1222-
if roleConfig.Status.OperatorRolesRef.NetworkARN == "" {
1223-
return fmt.Errorf("NetworkARN is required")
1224-
}
1225-
1226-
if roleConfig.Status.OperatorRolesRef.KubeCloudControllerARN == "" {
1227-
return fmt.Errorf("KubeCloudControllerARN is required")
1228-
}
1229-
1230-
if roleConfig.Status.OperatorRolesRef.KMSProviderARN == "" {
1231-
return fmt.Errorf("KMSProviderARN is required")
1232-
}
1233-
1234-
if roleConfig.Status.OperatorRolesRef.ControlPlaneOperatorARN == "" {
1235-
return fmt.Errorf("ControlPlaneOperatorARN is required")
1236-
}
1237-
1238-
if roleConfig.Status.OperatorRolesRef.NodePoolManagementARN == "" {
1239-
return fmt.Errorf("NodePoolManagementARN is required")
1240-
}
1241-
1242-
return nil
1243-
}

‎docs/book/src/topics/rosa/creating-a-cluster.md‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -89,30 +89,46 @@ The SSO offline token is being deprecated and it is recommended to use service a
8989

9090
Follow the guide [here](https://docs.aws.amazon.com/ROSA/latest/userguide/getting-started-hcp.html) up until ["Create a ROSA with HCP Cluster"](https://docs.aws.amazon.com/ROSA/latest/userguide/getting-started-hcp.html#create-hcp-cluster-cli) to install the required tools and setup the prerequisite infrastructure. Once Step 3 is done, you will be ready to proceed with creating a ROSA HCP cluster using cluster-api.
9191

92+
Note; Skip the "Create the required IAM roles and OpenID Connect configuration" step from the prerequisites url above and use the templates/cluster-template-rosa-role-config.yaml to generate a ROSARoleConfig CR to create the required account roles, operator roles & managed OIDC provider.
93+
9294
## Creating the cluster
9395

9496
1. Prepare the environment:
9597
```bash
96-
export OPENSHIFT_VERSION="4.14.5"
98+
export OPENSHIFT_VERSION="4.19.0"
9799
export AWS_REGION="us-west-2"
98100
export AWS_AVAILABILITY_ZONE="us-west-2a"
99101
export AWS_ACCOUNT_ID="<account_id>"
100102
export AWS_CREATOR_ARN="<user_arn>" # can be retrieved e.g. using `aws sts get-caller-identity`
101103
104+
# Note: if using templates/cluster-template-rosa.yaml set the below env variables
102105
export OIDC_CONFIG_ID="<oidc_id>" # OIDC config id creating previously with `rosa create oidc-config`
103106
export ACCOUNT_ROLES_PREFIX="ManagedOpenShift-HCP" # prefix used to create account IAM roles with `rosa create account-roles`
104107
export OPERATOR_ROLES_PREFIX="capi-rosa-quickstart" # prefix used to create operator roles with `rosa create operator-roles --prefix <PREFIX_NAME>`
105108
109+
# Note: if using templates/cluster-template-rosa-role-config.yaml set the below env variables
110+
export ACCOUNT_ROLES_PREFIX="capa" # prefix can be change to preferable prefix with max 4 chars
111+
export OPERATOR_ROLES_PREFIX="capa" # prefix can be change to preferable prefix with max 4 chars
112+
106113
# subnet IDs created earlier
107114
export PUBLIC_SUBNET_ID="subnet-0b54a1111111111111"
108115
export PRIVATE_SUBNET_ID="subnet-05e72222222222222"
109116
```
110117

111118
1. Render the cluster manifest using the ROSA HCP cluster template:
119+
120+
a. Using templates/cluster-template-rosa.yaml
121+
122+
Note: The AWS role name must be no more than 64 characters in length. Otherwise an error will be returned. Truncate values exceeding 64 characters.
112123
```shell
113124
clusterctl generate cluster <cluster-name> --from templates/cluster-template-rosa.yaml > rosa-capi-cluster.yaml
114125
```
115-
Note: The AWS role name must be no more than 64 characters in length. Otherwise an error will be returned. Truncate values exceeding 64 characters.
126+
127+
b. Using templates/cluster-template-rosa-role-config.yaml
128+
```shell
129+
clusterctl generate cluster <cluster-name> --from templates/cluster-template-rosa-role-config.yaml > rosa-capi-cluster.yaml
130+
```
131+
116132

117133
1. If a credentials secret was created earlier, edit `ROSAControlPlane` to reference it:
118134
```yaml

0 commit comments

Comments
 (0)