Skip to content

Commit 65a2db8

Browse files
stevsmitstevsmit
authored
Merge pull request #70486 from anarnold97/OADP-3365-Fix-issues-in-OADP-ROSA-docs
OADP-3365: Fix issues in OADP docs
2 parents f8104b1 + f317d8c commit 65a2db8

File tree

3 files changed

+158
-160
lines changed

3 files changed

+158
-160
lines changed

‎modules/installing-oadp-rosa-sts.adoc

Lines changed: 75 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -36,9 +36,9 @@ The Data Mover feature is not currently supported in ROSA clusters. You can use
3636
[source,terminal]
3737
----
3838
$ cat <<EOF > ${SCRATCH}/credentials
39-
[default]
40-
role_arn = ${ROLE_ARN}
41-
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
39+
[default]
40+
role_arn = ${ROLE_ARN}
41+
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
4242
EOF
4343
----
4444

@@ -66,8 +66,6 @@ secret, you only need to supply the role ARN during the installation of OLM-mana
6666
The preceding secret is created automatically by CCO.
6767
====
6868

69-
. Install the OADP Operator:
70-
.. In the {product-title} web console, browse to *Operators* -> *OperatorHub*.
7169
. Install the OADP Operator:
7270
.. In the {product-title} web console, browse to *Operators* -> *OperatorHub*.
7371
.. Search for the *OADP Operator*.
@@ -78,19 +76,19 @@ The preceding secret is created automatically by CCO.
7876
[source,terminal]
7977
----
8078
$ cat << EOF | oc create -f -
81-
apiVersion: oadp.openshift.io/v1alpha1
82-
kind: CloudStorage
83-
metadata:
84-
name: ${CLUSTER_NAME}-oadp
85-
namespace: openshift-adp
86-
spec:
87-
creationSecret:
88-
key: credentials
89-
name: cloud-credentials
90-
enableSharedConfig: true
91-
name: ${CLUSTER_NAME}-oadp
92-
provider: aws
93-
region: $REGION
79+
apiVersion: oadp.openshift.io/v1alpha1
80+
kind: CloudStorage
81+
metadata:
82+
name: ${CLUSTER_NAME}-oadp
83+
namespace: openshift-adp
84+
spec:
85+
creationSecret:
86+
key: credentials
87+
name: cloud-credentials
88+
enableSharedConfig: true
89+
name: ${CLUSTER_NAME}-oadp
90+
provider: aws
91+
region: $REGION
9492
EOF
9593
----
9694
// bringing over from MOB docs
@@ -151,34 +149,34 @@ If the application or applications that are being backed up are all using persis
151149
[source,terminal]
152150
----
153151
$ cat << EOF | oc create -f -
154-
apiVersion: oadp.openshift.io/v1alpha1
155-
kind: DataProtectionApplication
156-
metadata:
157-
name: ${CLUSTER_NAME}-dpa
158-
namespace: openshift-adp
159-
spec:
160-
backupImages: false
161-
features:
162-
dataMover:
163-
enable: false
164-
backupLocations:
165-
- bucket:
166-
cloudStorageRef:
167-
name: ${CLUSTER_NAME}-oadp
168-
credential:
169-
key: credentials
170-
name: cloud-credentials
171-
default: true
172-
config:
173-
region: ${REGION}
174-
configuration:
175-
velero:
176-
defaultPlugins:
177-
- openshift
178-
- aws
179-
- csi
180-
restic:
181-
enable: false
152+
apiVersion: oadp.openshift.io/v1alpha1
153+
kind: DataProtectionApplication
154+
metadata:
155+
name: ${CLUSTER_NAME}-dpa
156+
namespace: openshift-adp
157+
spec:
158+
backupImages: false
159+
features:
160+
dataMover:
161+
enable: false
162+
backupLocations:
163+
- bucket:
164+
cloudStorageRef:
165+
name: ${CLUSTER_NAME}-oadp
166+
credential:
167+
key: credentials
168+
name: cloud-credentials
169+
default: true
170+
config:
171+
region: ${REGION}
172+
configuration:
173+
velero:
174+
defaultPlugins:
175+
- openshift
176+
- aws
177+
- csi
178+
restic:
179+
enable: false
182180
EOF
183181
----
184182
// . Create the `DataProtectionApplication` resource, which is used to configure the connection to the storage where the backups and volume snapshots are stored:
@@ -188,38 +186,38 @@ EOF
188186
[source,terminal]
189187
----
190188
$ cat << EOF | oc create -f -
191-
apiVersion: oadp.openshift.io/v1alpha1
192-
kind: DataProtectionApplication
193-
metadata:
194-
name: ${CLUSTER_NAME}-dpa
195-
namespace: openshift-adp
196-
spec:
197-
backupLocations:
198-
- bucket:
199-
cloudStorageRef:
200-
name: ${CLUSTER_NAME}-oadp
201-
credential:
202-
key: credentials
203-
name: cloud-credentials
204-
default: true
205-
config:
206-
region: ${REGION}
207-
configuration:
208-
velero:
209-
defaultPlugins:
210-
- openshift
211-
- aws
212-
nodeAgent: <1>
213-
enable: false
214-
uploaderType: restic
215-
snapshotLocations:
216-
- velero:
189+
apiVersion: oadp.openshift.io/v1alpha1
190+
kind: DataProtectionApplication
191+
metadata:
192+
name: ${CLUSTER_NAME}-dpa
193+
namespace: openshift-adp
194+
spec:
195+
backupLocations:
196+
- bucket:
197+
cloudStorageRef:
198+
name: ${CLUSTER_NAME}-oadp
199+
credential:
200+
key: credentials
201+
name: cloud-credentials
202+
default: true
217203
config:
218-
credentialsFile: /tmp/credentials/openshift-adp/cloud-credentials-credentials <2>
219-
enableSharedConfig: "true" <3>
220-
profile: default <4>
221-
region: ${REGION} <5>
222-
provider: aws
204+
region: ${REGION}
205+
configuration:
206+
velero:
207+
defaultPlugins:
208+
- openshift
209+
- aws
210+
nodeAgent: <1>
211+
enable: false
212+
uploaderType: restic
213+
snapshotLocations:
214+
- velero:
215+
config:
216+
credentialsFile: /tmp/credentials/openshift-adp/cloud-credentials-credentials <2>
217+
enableSharedConfig: "true" <3>
218+
profile: default <4>
219+
region: ${REGION} <5>
220+
provider: aws
223221
EOF
224222
----
225223
<1> See the following note.

‎modules/performing-a-backup-oadp-rosa-sts.adoc

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -48,16 +48,16 @@ Hello OpenShift!
4848
[source,terminal]
4949
----
5050
$ cat << EOF | oc create -f -
51-
apiVersion: velero.io/v1
52-
kind: Backup
53-
metadata:
54-
name: hello-world
55-
namespace: openshift-adp
56-
spec:
57-
includedNamespaces:
58-
- hello-world
59-
storageLocation: ${CLUSTER_NAME}-dpa-1
60-
ttl: 720h0m0s
51+
apiVersion: velero.io/v1
52+
kind: Backup
53+
metadata:
54+
name: hello-world
55+
namespace: openshift-adp
56+
spec:
57+
includedNamespaces:
58+
- hello-world
59+
storageLocation: ${CLUSTER_NAME}-dpa-1
60+
ttl: 720h0m0s
6161
EOF
6262
----
6363

@@ -98,13 +98,13 @@ $ oc delete ns hello-world
9898
[source,terminal]
9999
----
100100
$ cat << EOF | oc create -f -
101-
apiVersion: velero.io/v1
102-
kind: Restore
103-
metadata:
104-
name: hello-world
105-
namespace: openshift-adp
106-
spec:
107-
backupName: hello-world
101+
apiVersion: velero.io/v1
102+
kind: Restore
103+
metadata:
104+
name: hello-world
105+
namespace: openshift-adp
106+
spec:
107+
backupName: hello-world
108108
EOF
109109
----
110110

‎modules/preparing-aws-credentials-for-oadp.adoc

Lines changed: 66 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -19,16 +19,16 @@ Change the cluster name to match your ROSA cluster, and ensure you are logged in
1919
[source,terminal]
2020
----
2121
$ export CLUSTER_NAME=my-cluster <1>
22-
export ROSA_CLUSTER_ID=$(rosa describe cluster -c ${CLUSTER_NAME} --output json | jq -r .id)
23-
export REGION=$(rosa describe cluster -c ${CLUSTER_NAME} --output json | jq -r .region.id)
24-
export OIDC_ENDPOINT=$(oc get authentication.config.openshift.io cluster -o jsonpath='{.spec.serviceAccountIssuer}' | sed 's|^https://||')
25-
export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
26-
export CLUSTER_VERSION=$(rosa describe cluster -c ${CLUSTER_NAME} -o json | jq -r .version.raw_id | cut -f -2 -d '.')
27-
export ROLE_NAME="${CLUSTER_NAME}-openshift-oadp-aws-cloud-credentials"
28-
export SCRATCH="/tmp/${CLUSTER_NAME}/oadp"
29-
mkdir -p ${SCRATCH}
30-
echo "Cluster ID: ${ROSA_CLUSTER_ID}, Region: ${REGION}, OIDC Endpoint:
31-
${OIDC_ENDPOINT}, AWS Account ID: ${AWS_ACCOUNT_ID}"
22+
export ROSA_CLUSTER_ID=$(rosa describe cluster -c ${CLUSTER_NAME} --output json | jq -r .id)
23+
export REGION=$(rosa describe cluster -c ${CLUSTER_NAME} --output json | jq -r .region.id)
24+
export OIDC_ENDPOINT=$(oc get authentication.config.openshift.io cluster -o jsonpath='{.spec.serviceAccountIssuer}' | sed 's|^https://||')
25+
export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
26+
export CLUSTER_VERSION=$(rosa describe cluster -c ${CLUSTER_NAME} -o json | jq -r .version.raw_id | cut -f -2 -d '.')
27+
export ROLE_NAME="${CLUSTER_NAME}-openshift-oadp-aws-cloud-credentials"
28+
export SCRATCH="/tmp/${CLUSTER_NAME}/oadp"
29+
mkdir -p ${SCRATCH}
30+
echo "Cluster ID: ${ROSA_CLUSTER_ID}, Region: ${REGION}, OIDC Endpoint:
31+
${OIDC_ENDPOINT}, AWS Account ID: ${AWS_ACCOUNT_ID}"
3232
----
3333
+
3434
<1> Replace `my-cluster` with your ROSA cluster name.
@@ -54,49 +54,49 @@ If the policy ARN is not found, the command creates the policy. If the policy AR
5454
[source,terminal]
5555
----
5656
$ if [[ -z "${POLICY_ARN}" ]]; then
57-
cat << EOF > ${SCRATCH}/policy.json <1>
58-
{
59-
"Version": "2012-10-17",
60-
"Statement": [
57+
cat << EOF > ${SCRATCH}/policy.json <1>
6158
{
62-
"Effect": "Allow",
63-
"Action": [
64-
"s3:CreateBucket",
65-
"s3:DeleteBucket",
66-
"s3:PutBucketTagging",
67-
"s3:GetBucketTagging",
68-
"s3:PutEncryptionConfiguration",
69-
"s3:GetEncryptionConfiguration",
70-
"s3:PutLifecycleConfiguration",
71-
"s3:GetLifecycleConfiguration",
72-
"s3:GetBucketLocation",
73-
"s3:ListBucket",
74-
"s3:GetObject",
75-
"s3:PutObject",
76-
"s3:DeleteObject",
77-
"s3:ListBucketMultipartUploads",
78-
"s3:AbortMultipartUploads",
79-
"s3:ListMultipartUploadParts",
80-
"s3:DescribeSnapshots",
81-
"ec2:DescribeVolumes",
82-
"ec2:DescribeVolumeAttribute",
83-
"ec2:DescribeVolumesModifications",
84-
"ec2:DescribeVolumeStatus",
85-
"ec2:CreateTags",
86-
"ec2:CreateVolume",
87-
"ec2:CreateSnapshot",
88-
"ec2:DeleteSnapshot"
89-
],
90-
"Resource": "*"
91-
}
92-
]}
59+
"Version": "2012-10-17",
60+
"Statement": [
61+
{
62+
"Effect": "Allow",
63+
"Action": [
64+
"s3:CreateBucket",
65+
"s3:DeleteBucket",
66+
"s3:PutBucketTagging",
67+
"s3:GetBucketTagging",
68+
"s3:PutEncryptionConfiguration",
69+
"s3:GetEncryptionConfiguration",
70+
"s3:PutLifecycleConfiguration",
71+
"s3:GetLifecycleConfiguration",
72+
"s3:GetBucketLocation",
73+
"s3:ListBucket",
74+
"s3:GetObject",
75+
"s3:PutObject",
76+
"s3:DeleteObject",
77+
"s3:ListBucketMultipartUploads",
78+
"s3:AbortMultipartUploads",
79+
"s3:ListMultipartUploadParts",
80+
"s3:DescribeSnapshots",
81+
"ec2:DescribeVolumes",
82+
"ec2:DescribeVolumeAttribute",
83+
"ec2:DescribeVolumesModifications",
84+
"ec2:DescribeVolumeStatus",
85+
"ec2:CreateTags",
86+
"ec2:CreateVolume",
87+
"ec2:CreateSnapshot",
88+
"ec2:DeleteSnapshot"
89+
],
90+
"Resource": "*"
91+
}
92+
]}
9393
EOF
9494
95-
POLICY_ARN=$(aws iam create-policy --policy-name "RosaOadpVer1" \
96-
--policy-document file:///${SCRATCH}/policy.json --query Policy.Arn \
97-
--tags Key=rosa_openshift_version,Value=${CLUSTER_VERSION} Key=rosa_role_prefix,Value=ManagedOpenShift Key=operator_namespace,Value=openshift-oadp Key=operator_name,Value=openshift-oadp \
98-
--output text)
99-
fi
95+
POLICY_ARN=$(aws iam create-policy --policy-name "RosaOadpVer1" \
96+
--policy-document file:///${SCRATCH}/policy.json --query Policy.Arn \
97+
--tags Key=rosa_openshift_version,Value=${CLUSTER_VERSION} Key=rosa_role_prefix,Value=ManagedOpenShift Key=operator_namespace,Value=openshift-oadp Key=operator_name,Value=openshift-oadp \
98+
--output text)
99+
fi
100100
----
101101
+
102102
<1> `SCRATCH` is a name for a temporary directory created for the environment variables.
@@ -116,23 +116,23 @@ $ echo ${POLICY_ARN}
116116
[source,terminal]
117117
----
118118
$ cat <<EOF > ${SCRATCH}/trust-policy.json
119-
{
120-
"Version":2012-10-17",
121-
"Statement": [{
122-
"Effect": "Allow",
123-
"Principal": {
124-
"Federated": "arn:aws:iam::${AWS_ACCOUNT_ID}:oidc-provider/${OIDC_ENDPOINT}"
125-
},
126-
"Action": "sts:AssumeRoleWithWebIdentity",
127-
"Condition": {
128-
"StringEquals": {
129-
"${OIDC_ENDPOINT}:sub": [
130-
"system:serviceaccount:openshift-adp:openshift-adp-controller-manager",
131-
"system:serviceaccount:openshift-adp:velero"]
119+
{
120+
"Version":2012-10-17",
121+
"Statement": [{
122+
"Effect": "Allow",
123+
"Principal": {
124+
"Federated": "arn:aws:iam::${AWS_ACCOUNT_ID}:oidc-provider/${OIDC_ENDPOINT}"
125+
},
126+
"Action": "sts:AssumeRoleWithWebIdentity",
127+
"Condition": {
128+
"StringEquals": {
129+
"${OIDC_ENDPOINT}:sub": [
130+
"system:serviceaccount:openshift-adp:openshift-adp-controller-manager",
131+
"system:serviceaccount:openshift-adp:velero"]
132+
}
132133
}
133-
}
134-
}]
135-
}
134+
}]
135+
}
136136
EOF
137137
----
138138

0 commit comments

Comments
 (0)