Skip to content

Commit 091c061

Browse files
EricPonvelleEricPonvelle
committed
OSDOCS-7856: Migrated AWS Secrets Manager
1 parent 05b9132 commit 091c061

File tree

2 files changed

+342
-0
lines changed

2 files changed

+342
-0
lines changed

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,8 @@ Topics:
100100
File: cloud-experts-configure-custom-tls-ciphers
101101
- Name: Configuring Microsoft Entra ID (formerly Azure Active Directory) as an identity provider
102102
File: cloud-experts-entra-id-idp
103+
- Name: Using AWS Secrets Manager CSI on ROSA with STS
104+
File: cloud-experts-aws-secret-manager
103105
---
104106
Name: Getting started
105107
Dir: rosa_getting_started

‎cloud_experts_tutorials/cloud-experts-aws-secret-manager.adoc

Lines changed: 340 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,340 @@
1+
:_content-type: ASSEMBLY
2+
[id="cloud-experts-aws-secret-manager"]
3+
= Tutorial: Using AWS Secrets Manager CSI on ROSA with STS
4+
include::_attributes/attributes-openshift-dedicated.adoc[]
5+
:context: cloud-experts-aws-secret-manager
6+
7+
toc::[]
8+
9+
//Mobb content metadata
10+
//Brought into ROSA product docs 2023-09-18
11+
// ---
12+
// date: '2023-05-25'
13+
// title: Using AWS Secrets Manager CSI on Red Hat OpenShift on AWS with STS
14+
// tags: ["AWS", "ROSA"]
15+
// authors:
16+
// - Paul Czarkowski
17+
// - Chris Kang
18+
// ---
19+
20+
The AWS Secrets and Configuration Provider (ASCP) provides a way to expose AWS Secrets as Kubernetes storage volumes. With the ASCP, you can store and manage your secrets in Secrets Manager and then retrieve them through your workloads running on ROSA.
21+
22+
This is made even easier and more secure through the use of AWS STS and Kubernetes PodIdentity.
23+
24+
[id="cloud-experts-aws-secret-manager-prerequisites"]
25+
== Prerequisites
26+
27+
* A ROSA cluster deployed with STS
28+
* Helm 3
29+
* aws CLI
30+
* oc CLI
31+
* jq
32+
33+
[id="cloud-experts-aws-secret-manager-preparing-environment"]
34+
== Preparing Environment
35+
36+
. Validate that your cluster has STS:
37+
+
38+
[source,terminal]
39+
----
40+
$ oc get authentication.config.openshift.io cluster -o json \
41+
| jq .spec.serviceAccountIssuer
42+
----
43+
+
44+
You should see something like the following, if not you should not proceed, instead look to the link:https://docs.openshift.com/rosa/rosa_getting_started_sts/rosa_creating_a_cluster_with_sts/rosa-sts-creating-a-cluster-quickly.html[Red Hat documentation on creating an STS cluster].
45+
+
46+
[source,terminal]
47+
----
48+
"https://xxxxx.cloudfront.net/xxxxx"
49+
----
50+
51+
. Set SecurityContextConstraints to allow the CSI driver to run:
52+
+
53+
[source,terminal]
54+
----
55+
$ oc new-project csi-secrets-store
56+
$ oc adm policy add-scc-to-user privileged \
57+
system:serviceaccount:csi-secrets-store:secrets-store-csi-driver
58+
$ oc adm policy add-scc-to-user privileged \
59+
system:serviceaccount:csi-secrets-store:csi-secrets-store-provider-aws
60+
----
61+
62+
. Create some environment variables to refer to later:
63+
+
64+
[source,terminal]
65+
----
66+
$ export REGION=$(oc get infrastructure cluster -o=jsonpath="{.status.platformStatus.aws.region}")
67+
$ export OIDC_ENDPOINT=$(oc get authentication.config.openshift.io cluster \
68+
-o jsonpath='{.spec.serviceAccountIssuer}' | sed 's|^https://||')
69+
$ export AWS_ACCOUNT_ID=`aws sts get-caller-identity --query Account --output text`
70+
$ export AWS_PAGER=""
71+
----
72+
73+
[id="cloud-experts-aws-secret-manager-deply-aws-secrets"]
74+
== Deploy the AWS Secrets and Configuration Provider
75+
76+
. Use Helm to register the secrets store CSI driver:
77+
+
78+
[source,terminal]
79+
----
80+
$ helm repo add secrets-store-csi-driver \
81+
https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
82+
----
83+
84+
. Update your Helm repositories:
85+
+
86+
[source,terminal]
87+
----
88+
$ helm repo update
89+
----
90+
91+
. Install the secrets store CSI driver:
92+
+
93+
[source,terminal]
94+
----
95+
$ helm upgrade --install -n csi-secrets-store \
96+
csi-secrets-store-driver secrets-store-csi-driver/secrets-store-csi-driver
97+
----
98+
99+
. Deploy the AWS provider:
100+
+
101+
[source,terminal]
102+
----
103+
$ oc -n csi-secrets-store apply -f \
104+
https://raw.githubusercontent.com/rh-mobb/documentation/main/content/misc/secrets-store-csi/aws-provider-installer.yaml
105+
----
106+
107+
. Check that both Daemonsets are running:
108+
+
109+
[source,terminal]
110+
----
111+
$ oc -n csi-secrets-store get ds \
112+
csi-secrets-store-provider-aws \
113+
csi-secrets-store-driver-secrets-store-csi-driver
114+
----
115+
116+
. Label the Secrets Store CSI Driver to allow use with the restricted pod security profile:
117+
+
118+
[source,terminal]
119+
----
120+
$ oc label csidriver.storage.k8s.io/secrets-store.csi.k8s.io security.openshift.io/csi-ephemeral-volume-profile=restricted
121+
----
122+
123+
[id="cloud-experts-aws-secret-manager-create-iam-polices"]
124+
== Creating a Secret and IAM Access Policies
125+
126+
. Create a secret in Secrets Manager:
127+
+
128+
[source,terminal]
129+
----
130+
$ SECRET_ARN=$(aws --region "$REGION" secretsmanager create-secret \
131+
--name MySecret --secret-string \
132+
'{"username":"shadowman", "password":"hunter2"}' \
133+
--query ARN --output text)
134+
$ echo $SECRET_ARN
135+
----
136+
137+
. Create an IAM Access Policy document:
138+
+
139+
[source,terminal]
140+
----
141+
$ cat << EOF > policy.json
142+
{
143+
"Version": "2012-10-17",
144+
"Statement": [{
145+
"Effect": "Allow",
146+
"Action": [
147+
"secretsmanager:GetSecretValue",
148+
"secretsmanager:DescribeSecret"
149+
],
150+
"Resource": ["$SECRET_ARN"]
151+
}]
152+
}
153+
EOF
154+
----
155+
156+
. Create an IAM Access Policy:
157+
+
158+
[source,terminal]
159+
----
160+
$ POLICY_ARN=$(aws --region "$REGION" --query Policy.Arn \
161+
--output text iam create-policy \
162+
--policy-name openshift-access-to-mysecret-policy \
163+
--policy-document file://policy.json)
164+
$ echo $POLICY_ARN
165+
----
166+
167+
. Create an IAM Role trust policy document:
168+
+
169+
[NOTE]
170+
====
171+
The trust policy is locked down to the default service account of a namespace you will create later.
172+
====
173+
+
174+
[source,terminal]
175+
----
176+
$ cat <<EOF > trust-policy.json
177+
{
178+
"Version": "2012-10-17",
179+
"Statement": [
180+
{
181+
"Effect": "Allow",
182+
"Condition": {
183+
"StringEquals" : {
184+
"${OIDC_ENDPOINT}:sub": ["system:serviceaccount:my-application:default"]
185+
}
186+
},
187+
"Principal": {
188+
"Federated": "arn:aws:iam::$AWS_ACCOUNT_ID:oidc-provider/${OIDC_ENDPOINT}"
189+
},
190+
"Action": "sts:AssumeRoleWithWebIdentity"
191+
}
192+
]
193+
}
194+
EOF
195+
----
196+
197+
. Create an IAM role:
198+
+
199+
[source,terminal]
200+
----
201+
$ ROLE_ARN=$(aws iam create-role --role-name openshift-access-to-mysecret \
202+
--assume-role-policy-document file://trust-policy.json \
203+
--query Role.Arn --output text)
204+
$ echo $ROLE_ARN
205+
----
206+
207+
. Attach the role to the policy:
208+
+
209+
[source,terminal]
210+
----
211+
$ aws iam attach-role-policy --role-name openshift-access-to-mysecret \
212+
--policy-arn $POLICY_ARN
213+
----
214+
215+
[id="cloud-experts-aws-secret-manager-creating-application"]
216+
== Create an Application to use this secret
217+
218+
. Create an OpenShift project:
219+
+
220+
[source,terminal]
221+
----
222+
$ oc new-project my-application
223+
----
224+
225+
. Annotate the default service account to use the STS Role:
226+
+
227+
[source,terminal]
228+
----
229+
$ oc annotate -n my-application serviceaccount default \
230+
eks.amazonaws.com/role-arn=$ROLE_ARN
231+
----
232+
233+
. Create a secret provider class to access our secret:
234+
+
235+
[source,terminal]
236+
----
237+
$ cat << EOF | oc apply -f -
238+
apiVersion: secrets-store.csi.x-k8s.io/v1
239+
kind: SecretProviderClass
240+
metadata:
241+
name: my-application-aws-secrets
242+
spec:
243+
provider: aws
244+
parameters:
245+
objects: |
246+
- objectName: "MySecret"
247+
objectType: "secretsmanager"
248+
EOF
249+
----
250+
251+
. Create a Deployment using our secret:
252+
+
253+
[source,terminal]
254+
----
255+
$ cat << EOF | oc apply -f -
256+
apiVersion: v1
257+
kind: Pod
258+
metadata:
259+
name: my-application
260+
labels:
261+
app: my-application
262+
spec:
263+
volumes:
264+
- name: secrets-store-inline
265+
csi:
266+
driver: secrets-store.csi.k8s.io
267+
readOnly: true
268+
volumeAttributes:
269+
secretProviderClass: "my-application-aws-secrets"
270+
containers:
271+
- name: my-application-deployment
272+
image: k8s.gcr.io/e2e-test-images/busybox:1.29
273+
command:
274+
- "/bin/sleep"
275+
- "10000"
276+
volumeMounts:
277+
- name: secrets-store-inline
278+
mountPath: "/mnt/secrets-store"
279+
readOnly: true
280+
EOF
281+
----
282+
283+
. Verify the Pod has the secret mounted:
284+
+
285+
[source,terminal]
286+
----
287+
$ oc exec -it my-application -- cat /mnt/secrets-store/MySecret
288+
----
289+
290+
[id="cloud-experts-aws-secret-manager-cleanup"]
291+
== Clean up
292+
293+
. Delete the application:
294+
+
295+
[source,terminal]
296+
----
297+
$ oc delete project my-application
298+
----
299+
300+
. Delete the secrets store csi driver:
301+
+
302+
[source,terminal]
303+
----
304+
$ helm delete -n csi-secrets-store csi-secrets-store-driver
305+
----
306+
307+
. Delete Security Context Constraints:
308+
+
309+
[source,terminal]
310+
----
311+
$ oc adm policy remove-scc-from-user privileged \
312+
system:serviceaccount:csi-secrets-store:secrets-store-csi-driver
313+
$ oc adm policy remove-scc-from-user privileged \
314+
system:serviceaccount:csi-secrets-store:csi-secrets-store-provider-aws
315+
----
316+
317+
. Delete the AWS provider:
318+
+
319+
[source,terminal]
320+
----
321+
$ oc -n csi-secrets-store delete -f \
322+
https://raw.githubusercontent.com/rh-mobb/documentation/main/content/misc/secrets-store-csi/aws-provider-installer.yaml
323+
----
324+
325+
. Delete AWS Roles and Policies:
326+
+
327+
[source,terminal]
328+
----
329+
$ aws iam detach-role-policy --role-name openshift-access-to-mysecret \
330+
--policy-arn $POLICY_ARN
331+
$ aws iam delete-role --role-name openshift-access-to-mysecret
332+
$ aws iam delete-policy --policy-arn $POLICY_ARN
333+
----
334+
335+
. Delete the Secrets Manager secret:
336+
+
337+
[source,terminal]
338+
----
339+
$ aws secretsmanager --region $REGION delete-secret --secret-id $SECRET_ARN
340+
----

0 commit comments

Comments
 (0)