Skip to content

Commit 566992a

Browse files
xenolinuxxenolinux
committed
CFE-652: Installing ALBO o STS cluster
1 parent 806241c commit 566992a

File tree

4 files changed

+121
-0
lines changed

4 files changed

+121
-0
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1070,6 +1070,8 @@ Topics:
10701070
File: understanding-aws-load-balancer-operator
10711071
- Name: Installing the AWS Load Balancer Operator
10721072
File: install-aws-load-balancer-operator
1073+
- Name: Installing the AWS Load Balancer Operator on Secure Token Service cluster
1074+
File: installing-albo-sts-cluster
10731075
- Name: Creating an instance of the AWS Load Balancer Controller
10741076
File: create-instance-aws-load-balancer-controller
10751077
- Name: Serving Multiple Ingresses through a single AWS Load Balancer

‎modules/bootstrap-aws-load-balancer-operator.adoc

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
// Module included in the following assemblies:
2+
// * networking/installing-albo-sts-cluster.adoc
3+
4+
:_content-type: PROCEDURE
5+
[id="nw-bootstra-albo-on-sts-cluster_{context}"]
6+
= Bootstrapping AWS Load Balancer Operator on Secure Token Service cluster
7+
8+
.Prerequisites
9+
10+
* You must extract and prepare the `coctl` binary.
11+
12+
.Procedure
13+
14+
. Download the `CredentialsRequest` custom resource (CR) of the AWS Load Balancer Operator, and create a directory to store it by running the following command:
15+
+
16+
[source,terminal]
17+
----
18+
$ curl --create-dirs -o <path-to-credrequests-dir>/cr.yaml https://raw.githubusercontent.com/openshift/aws-load-balancer-operator/main/hack/operator-credentials-request.yaml
19+
----
20+
21+
. Use the `ccoctl` tool to process `CredentialsRequest` objects of the AWS Load Balancer Operator, by running the following command:
22+
+
23+
[source,terminal]
24+
----
25+
$ ccoctl aws create-iam-roles \
26+
--name <name> --region=<aws_region> \
27+
--credentials-requests-dir=<path-to-credrequests-dir> \
28+
--identity-provider-arn <oidc-arn>
29+
----
30+
31+
. Apply the secrets generated in the manifests directory of your cluster by running the following command:
32+
+
33+
[source,terminal]
34+
----
35+
$ ls manifests/*-credentials.yaml | xargs -I{} oc apply -f {}
36+
----
37+
38+
. Verify that the credentials secret of the AWS Load Balancer Operator is created by running the following command:
39+
+
40+
[source,terminal]
41+
----
42+
$ oc -n aws-load-balancer-operator get secret aws-load-balancer-operator --template='{{index .data "credentials"}}' | base64 -d
43+
----
44+
+
45+
.Example output
46+
[source,terminal]
47+
----
48+
[default]
49+
sts_regional_endpoints = regional
50+
role_arn = arn:aws:iam::999999999999:role/aws-load-balancer-operator-aws-load-balancer-operator
51+
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
52+
----

‎modules/configuring-albo-on-sts-cluster.adoc

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
// Module included in the following assemblies:
2+
// * networking/installing-albo-sts-cluster.adoc
3+
4+
:_content-type: PROCEDURE
5+
[id="nw-installing-albo-on-sts-cluster_{context}"]
6+
= Configuring AWS Load Balancer Operator on Secure Token Service cluster
7+
8+
.Prerequisites
9+
10+
* You must extract and prepare the `coctl` binary.
11+
12+
.Procedure
13+
14+
. The AWS Load Balancer Operator creates the `CredentialsRequest` object in the `openshift-cloud-credential-operator` namespace for each `AWSLoadBalancerController` custom resource (CR). You can extract and save the created `CredentialsRequest` object in a directory by running the following command:
15+
+
16+
[source,terminal]
17+
----
18+
$ oc get credentialsrequest -n openshift-cloud-credential-operator \
19+
aws-load-balancer-controller-<cr-name> -o yaml > <path-to-credrequests-dir>/cr.yaml <1>
20+
----
21+
<1> The `aws-load-balancer-controller-<cr-name>` parameter specifies the credential request name created by the AWS Load Balancer Operator. The `cr-name` specifies the name of the AWS Load Balancer Controller instance.
22+
23+
. Use the `ccoctl` tool to process all `CredentialsRequest` objects in the `credrequests` directory by running the following command:
24+
+
25+
[source,terminal]
26+
----
27+
$ ccoctl aws create-iam-roles \
28+
--name <name> --region=<aws_region> \
29+
--credentials-requests-dir=<path-to-credrequests-dir> \
30+
--identity-provider-arn <oidc-arn>
31+
----
32+
33+
. Apply the secrets generated in manifests directory to your cluster, by running the following command:
34+
+
35+
[source,terminal]
36+
----
37+
$ ls manifests/*-credentials.yaml | xargs -I{} oc apply -f {}
38+
----
39+
40+
. Verify that the `aws-load-balancer-controller` pod is created:
41+
+
42+
[source,terminal]
43+
----
44+
$ oc -n aws-load-balancer-operator get pods
45+
NAME READY STATUS RESTARTS AGE
46+
aws-load-balancer-controller-cluster-9b766d6-gg82c 1/1 Running 0 137m
47+
aws-load-balancer-operator-controller-manager-b55ff68cc-85jzg 2/2 Running 0 3h26m
48+
----

‎networking/aws_load_balancer_operator/installing-albo-sts-cluster.adoc

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
:_content-type: ASSEMBLY
2+
[id="albo-sts-cluster"]
3+
= Installing AWS Load Balancer Operator on Secure Token Service cluster
4+
include::_attributes/common-attributes.adoc[]
5+
:context: albo-sts-cluster
6+
7+
toc::[]
8+
9+
You can install the AWS Load Balancer Operator on the Secure Token Service (STS) cluster.
10+
11+
The AWS Load Balancer Operator relies on `CredentialsRequest` to bootstrap the Operator and for each `AWSLoadBalancerController` instance. The AWS Load Balancer Operator waits until the required secrets are created and available. The Cloud Credential Operator does not provision the secrets automatically in the STS cluster. You must set the credentials secrets manually by using the `ccoctl` binary.
12+
13+
include::modules/bootstrap-aws-load-balancer-operator.adoc[leveloffset=+1]
14+
15+
include::modules/configuring-albo-on-sts-cluster.adoc[leveloffset=+1]
16+
17+
[role="_additional-resources"]
18+
== Additional resources
19+
* xref:../../authentication/managing_cloud_provider_credentials/cco-mode-sts.adoc#cco-ccoctl-configuring_cco-mode-sts[Configuring the Cloud Credential Operator utility]

0 commit comments

Comments
 (0)