Skip to content

Commit 0f6d86f

Browse files
opayne1opayne1
authored
Merge pull request #52392 from xenolinux/sts-cluster
CFE-652: Installing ALBO on STS cluster
2 parents 1ce42c0 + 566992a commit 0f6d86f

File tree

4 files changed

+121
-0
lines changed

4 files changed

+121
-0
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1076,6 +1076,8 @@ Topics:
10761076
File: understanding-aws-load-balancer-operator
10771077
- Name: Installing the AWS Load Balancer Operator
10781078
File: install-aws-load-balancer-operator
1079+
- Name: Installing the AWS Load Balancer Operator on Secure Token Service cluster
1080+
File: installing-albo-sts-cluster
10791081
- Name: Creating an instance of the AWS Load Balancer Controller
10801082
File: create-instance-aws-load-balancer-controller
10811083
- Name: Serving Multiple Ingresses through a single AWS Load Balancer

‎modules/bootstrap-aws-load-balancer-operator.adoc

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
// Module included in the following assemblies:
2+
// * networking/installing-albo-sts-cluster.adoc
3+
4+
:_content-type: PROCEDURE
5+
[id="nw-bootstra-albo-on-sts-cluster_{context}"]
6+
= Bootstrapping AWS Load Balancer Operator on Secure Token Service cluster
7+
8+
.Prerequisites
9+
10+
* You must extract and prepare the `coctl` binary.
11+
12+
.Procedure
13+
14+
. Download the `CredentialsRequest` custom resource (CR) of the AWS Load Balancer Operator, and create a directory to store it by running the following command:
15+
+
16+
[source,terminal]
17+
----
18+
$ curl --create-dirs -o <path-to-credrequests-dir>/cr.yaml https://raw.githubusercontent.com/openshift/aws-load-balancer-operator/main/hack/operator-credentials-request.yaml
19+
----
20+
21+
. Use the `ccoctl` tool to process `CredentialsRequest` objects of the AWS Load Balancer Operator, by running the following command:
22+
+
23+
[source,terminal]
24+
----
25+
$ ccoctl aws create-iam-roles \
26+
--name <name> --region=<aws_region> \
27+
--credentials-requests-dir=<path-to-credrequests-dir> \
28+
--identity-provider-arn <oidc-arn>
29+
----
30+
31+
. Apply the secrets generated in the manifests directory of your cluster by running the following command:
32+
+
33+
[source,terminal]
34+
----
35+
$ ls manifests/*-credentials.yaml | xargs -I{} oc apply -f {}
36+
----
37+
38+
. Verify that the credentials secret of the AWS Load Balancer Operator is created by running the following command:
39+
+
40+
[source,terminal]
41+
----
42+
$ oc -n aws-load-balancer-operator get secret aws-load-balancer-operator --template='{{index .data "credentials"}}' | base64 -d
43+
----
44+
+
45+
.Example output
46+
[source,terminal]
47+
----
48+
[default]
49+
sts_regional_endpoints = regional
50+
role_arn = arn:aws:iam::999999999999:role/aws-load-balancer-operator-aws-load-balancer-operator
51+
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
52+
----

‎modules/configuring-albo-on-sts-cluster.adoc

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
// Module included in the following assemblies:
2+
// * networking/installing-albo-sts-cluster.adoc
3+
4+
:_content-type: PROCEDURE
5+
[id="nw-installing-albo-on-sts-cluster_{context}"]
6+
= Configuring AWS Load Balancer Operator on Secure Token Service cluster
7+
8+
.Prerequisites
9+
10+
* You must extract and prepare the `coctl` binary.
11+
12+
.Procedure
13+
14+
. The AWS Load Balancer Operator creates the `CredentialsRequest` object in the `openshift-cloud-credential-operator` namespace for each `AWSLoadBalancerController` custom resource (CR). You can extract and save the created `CredentialsRequest` object in a directory by running the following command:
15+
+
16+
[source,terminal]
17+
----
18+
$ oc get credentialsrequest -n openshift-cloud-credential-operator \
19+
aws-load-balancer-controller-<cr-name> -o yaml > <path-to-credrequests-dir>/cr.yaml <1>
20+
----
21+
<1> The `aws-load-balancer-controller-<cr-name>` parameter specifies the credential request name created by the AWS Load Balancer Operator. The `cr-name` specifies the name of the AWS Load Balancer Controller instance.
22+
23+
. Use the `ccoctl` tool to process all `CredentialsRequest` objects in the `credrequests` directory by running the following command:
24+
+
25+
[source,terminal]
26+
----
27+
$ ccoctl aws create-iam-roles \
28+
--name <name> --region=<aws_region> \
29+
--credentials-requests-dir=<path-to-credrequests-dir> \
30+
--identity-provider-arn <oidc-arn>
31+
----
32+
33+
. Apply the secrets generated in manifests directory to your cluster, by running the following command:
34+
+
35+
[source,terminal]
36+
----
37+
$ ls manifests/*-credentials.yaml | xargs -I{} oc apply -f {}
38+
----
39+
40+
. Verify that the `aws-load-balancer-controller` pod is created:
41+
+
42+
[source,terminal]
43+
----
44+
$ oc -n aws-load-balancer-operator get pods
45+
NAME READY STATUS RESTARTS AGE
46+
aws-load-balancer-controller-cluster-9b766d6-gg82c 1/1 Running 0 137m
47+
aws-load-balancer-operator-controller-manager-b55ff68cc-85jzg 2/2 Running 0 3h26m
48+
----

‎networking/aws_load_balancer_operator/installing-albo-sts-cluster.adoc

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
:_content-type: ASSEMBLY
2+
[id="albo-sts-cluster"]
3+
= Installing AWS Load Balancer Operator on Secure Token Service cluster
4+
include::_attributes/common-attributes.adoc[]
5+
:context: albo-sts-cluster
6+
7+
toc::[]
8+
9+
You can install the AWS Load Balancer Operator on the Secure Token Service (STS) cluster.
10+
11+
The AWS Load Balancer Operator relies on `CredentialsRequest` to bootstrap the Operator and for each `AWSLoadBalancerController` instance. The AWS Load Balancer Operator waits until the required secrets are created and available. The Cloud Credential Operator does not provision the secrets automatically in the STS cluster. You must set the credentials secrets manually by using the `ccoctl` binary.
12+
13+
include::modules/bootstrap-aws-load-balancer-operator.adoc[leveloffset=+1]
14+
15+
include::modules/configuring-albo-on-sts-cluster.adoc[leveloffset=+1]
16+
17+
[role="_additional-resources"]
18+
== Additional resources
19+
* xref:../../authentication/managing_cloud_provider_credentials/cco-mode-sts.adoc#cco-ccoctl-configuring_cco-mode-sts[Configuring the Cloud Credential Operator utility]

0 commit comments

Comments
 (0)