Skip to content

Commit 22cf0b8

Browse files
lpettyjolpettyjo
authored
Merge pull request #44136 from lpettyjo/OSDOCS-3436
OSDOCS-3436: Add STS info for AWS EFS CSI driver operator
2 parents 1cf62c7 + 91683b5 commit 22cf0b8

File tree

3 files changed

+119
-1
lines changed

3 files changed

+119
-1
lines changed

‎modules/persistent-storage-csi-efs-sts.adoc‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * storage/persistent_storage/persistent-storage-csi-aws-efs.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="efs-sts_{context}"]
7+
= Configuring AWS EFS CSI Driver Operator with Secure Token Service
8+
9+
This procedure explains how to configure the AWS EFS CSI Driver Operator with {product-title} on AWS Secure Token Service (STS).
10+
11+
Perform this procedure after installing the AWS EFS CSI Operator, but before installing the AWS EFS CSI driver as part of _Installing the AWS EFS CSI Driver Operator_ procedure. If you perform this procedure after installing the driver and creating volumes, your volumes will fail to mount into pods.
12+
13+
.Prerequisites
14+
15+
* AWS account credentials
16+
17+
.Procedure
18+
19+
To configure the AWS EFS CSI Driver Operator with STS:
20+
21+
. Extract the CCO utility (`ccoctl`) binary from the {product-title} release image, which you used to install the cluster with STS. For more information, see "Configuring the Cloud Credential Operator utility".
22+
23+
. Create and save an EFS `CredentialsRequest` YAML file, such as shown in the following example, and then place it in the `credrequests` directory:
24+
+
25+
.Example
26+
+
27+
[source, yaml]
28+
----
29+
apiVersion: cloudcredential.openshift.io/v1
30+
kind: CredentialsRequest
31+
metadata:
32+
name: openshift-aws-efs-csi-driver
33+
namespace: openshift-cloud-credential-operator
34+
spec:
35+
providerSpec:
36+
apiVersion: cloudcredential.openshift.io/v1
37+
kind: AWSProviderSpec
38+
statementEntries:
39+
- action:
40+
- elasticfilesystem:*
41+
effect: Allow
42+
resource: '*'
43+
secretRef:
44+
name: aws-efs-cloud-credentials
45+
namespace: openshift-cluster-csi-drivers
46+
serviceAccountNames:
47+
- aws-efs-csi-driver-operator
48+
- aws-efs-csi-driver-controller-sa
49+
----
50+
51+
. Run the `ccoctl` tool to generate a new IAM role in AWS, and create a YAML file for it in the local file system (`<path_to_ccoctl_output_dir>/manifests/openshift-cluster-csi-drivers-aws-efs-cloud-credentials-credentials.yaml`).
52+
+
53+
[source, terminal]
54+
----
55+
$ ccoctl aws create-iam-roles --name=<name> --region=<aws_region> --credentials-requests-dir=<path_to_directory_with_list_of_credentials_requests>/credrequests --identity-provider-arn=arn:aws:iam::<aws_account_id>:oidc-provider/<name>-oidc.s3.<aws_region>.amazonaws.com
56+
----
57+
+
58+
* `name=<name>` is the name used to tag any cloud resources that are created for tracking.
59+
60+
* `region=<aws_region>` is the AWS region where cloud resources are created.
61+
62+
* `dir=<path_to_directory_with_list_of_credentials_requests>/credrequests` is the directory containing the EFS CredentialsRequest file in previous step.
63+
64+
* `<aws_account_id>`` is the AWS account ID.
65+
+
66+
.Example
67+
+
68+
[source, terminal]
69+
----
70+
$ ccoctl aws create-iam-roles --name my-aws-efs --credentials-requests-dir credrequests --identity-provider-arn arn:aws:iam::123456789012:oidc-provider/my-aws-efs-oidc.s3.us-east-2.amazonaws.com
71+
----
72+
+
73+
.Example output
74+
+
75+
[source, terminal]
76+
----
77+
2022/03/21 06:24:44 Role arn:aws:iam::123456789012:role/my-aws-efs -openshift-cluster-csi-drivers-aws-efs-cloud- created
78+
2022/03/21 06:24:44 Saved credentials configuration to: /manifests/openshift-cluster-csi-drivers-aws-efs-cloud-credentials-credentials.yaml
79+
2022/03/21 06:24:45 Updated Role policy for Role my-aws-efs-openshift-cluster-csi-drivers-aws-efs-cloud-
80+
----
81+
82+
. Create the AWS EFS cloud credentials and secret:
83+
+
84+
[source, terminal]
85+
----
86+
$ oc create -f <path_to_ccoctl_output_dir>/manifests/openshift-cluster-csi-drivers-aws-efs-cloud-credentials-credentials.yaml
87+
----
88+
+
89+
.Example
90+
+
91+
[source, terminal]
92+
----
93+
$ oc create -f /manifests/openshift-cluster-csi-drivers-aws-efs-cloud-credentials-credentials.yaml
94+
----
95+
+
96+
.Example output
97+
+
98+
[source, terminal]
99+
----
100+
secret/aws-efs-cloud-credentials created
101+
----

‎modules/persistent-storage-csi-olm-operator-install.adoc‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,10 @@
66
[id="persistent-storage-csi-olm-operator-install_{context}"]
77
= Installing the {FeatureName} CSI Driver Operator
88

9+
ifeval::["{context}" == "persistent-storage-csi-aws-efs"]
10+
:AWS_EFS:
11+
endif::[]
12+
913
The {FeatureName} CSI Driver Operator is not installed in {product-title} by default. Use the following procedure to install and configure the {FeatureName} CSI Driver Operator in your cluster.
1014

1115
.Prerequisites
@@ -40,6 +44,10 @@ Be sure to select the *AWS EFS CSI Driver Operator* and not the *AWS EFS Operato
4044
+
4145
After the installation finishes, the {FeatureName} CSI Operator is listed in the *Installed Operators* section of the web console.
4246

47+
ifdef::AWS_EFS[]
48+
. If you are using {FeatureName} with AWS Secure Token Service (STS), you must configure the {FeatureName} CSI Driver with STS. For more information, see "Configuring AWS EFS CSI Driver with STS".
49+
endif::AWS_EFS[]
50+
4351
. Install the {FeatureName} CSI Driver:
4452

4553
.. Click *administration* -> *CustomResourceDefinitions* -> *ClusterCSIDriver*.

‎storage/container_storage_interface/persistent-storage-csi-aws-efs.adoc‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ After installing the AWS EFS CSI Driver Operator, {product-title} installs the A
1717
* The _AWS EFS CSI Driver Operator_, after being installed, does not create a storage class by default to use to create persistent volume claims (PVCs). However, you can manually create the AWS EFS `StorageClass`.
1818
The AWS EFS CSI Driver Operator supports dynamic volume provisioning by allowing storage volumes to be created on-demand, eliminating the need for cluster administrators to pre-provision storage.
1919

20-
* The _AWS EFS CSI driver_ enables you to create and mount AWS EFS PVs.
20+
* The _AWS EFS CSI driver_ enables you to create and mount AWS EFS PVs.
2121

2222
[NOTE]
2323
====
@@ -28,6 +28,15 @@ include::modules/persistent-storage-csi-about.adoc[leveloffset=+1]
2828

2929
:FeatureName: AWS EFS
3030
include::modules/persistent-storage-csi-olm-operator-install.adoc[leveloffset=+1]
31+
[role="_additional-resources"]
32+
.Additional resources
33+
* xref:../../storage/container_storage_interface//persistent-storage-csi-aws-efs.adoc#efs-sts_persistent-storage-csi-aws-efs[Configuring AWS EFS CSI Driver with STS]
34+
35+
include::modules/persistent-storage-csi-efs-sts.adoc[leveloffset=+1]
36+
[role="_additional-resources"]
37+
.Additional resources
38+
* xref:../../storage/container_storage_interface/persistent-storage-csi-aws-efs.adoc#persistent-storage-csi-olm-operator-install_persistent-storage-csi-aws-efs[Installing the AWS EFS CSI Driver Operator]
39+
* xref:../../authentication/managing_cloud_provider_credentials/cco-mode-sts.adoc#cco-ccoctl-configuring_cco-mode-sts[Configuring the Cloud Credential Operator utility]
3140

3241
:StorageClass: AWS EFS
3342
:Provisioner: efs.csi.aws.com

0 commit comments

Comments
 (0)