Skip to content

Commit 6d28cda

Browse files
mjpytlakmjpytlak
authored
Merge pull request #60921 from mjpytlak/osdocs-6222
OSDOCS#6222: Adding custom security groups in AWS
2 parents 3f4b351 + 3b29255 commit 6d28cda

10 files changed

+143
-4
lines changed

‎installing/installing_aws/installing-aws-china.adoc‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ include::modules/private-clusters-default.adoc[leveloffset=+1]
3333
include::modules/private-clusters-about-aws.adoc[leveloffset=+2]
3434

3535
include::modules/installation-custom-aws-vpc.adoc[leveloffset=+1]
36+
include::modules/installation-aws-security-groups.adoc[leveloffset=+2]
3637

3738
include::modules/ssh-agent-using.adoc[leveloffset=+1]
3839

@@ -50,6 +51,8 @@ include::modules/installation-aws-arm-tested-machine-types.adoc[leveloffset=+2]
5051

5152
include::modules/installation-configure-proxy.adoc[leveloffset=+2]
5253

54+
include::modules/installation-applying-aws-security-groups.adoc[leveloffset=+2]
55+
5356
include::modules/installation-launching-installer.adoc[leveloffset=+1]
5457

5558
include::modules/cli-installing-cli.adoc[leveloffset=+1]

‎installing/installing_aws/installing-aws-government-region.adoc‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ include::modules/private-clusters-default.adoc[leveloffset=+1]
3232
include::modules/private-clusters-about-aws.adoc[leveloffset=+2]
3333

3434
include::modules/installation-custom-aws-vpc.adoc[leveloffset=+1]
35+
include::modules/installation-aws-security-groups.adoc[leveloffset=+2]
3536

3637
include::modules/cluster-entitlements.adoc[leveloffset=+1]
3738

@@ -51,6 +52,8 @@ include::modules/installation-aws-config-yaml.adoc[leveloffset=+2]
5152

5253
include::modules/installation-configure-proxy.adoc[leveloffset=+2]
5354

55+
include::modules/installation-applying-aws-security-groups.adoc[leveloffset=+2]
56+
5457
include::modules/installation-launching-installer.adoc[leveloffset=+1]
5558

5659
include::modules/cli-installing-cli.adoc[leveloffset=+1]

‎installing/installing_aws/installing-aws-localzone.adoc‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ include::modules/installation-aws-marketplace-subscribe.adoc[leveloffset=+1]
7474
include::modules/installation-creating-aws-vpc-localzone.adoc[leveloffset=+1]
7575

7676
include::modules/installation-cloudformation-vpc-localzone.adoc[leveloffset=+2]
77+
include::modules/installation-aws-security-groups.adoc[leveloffset=+2]
7778

7879
include::modules/installation-aws-add-local-zone-locations.adoc[leveloffset=+1]
7980

@@ -97,7 +98,7 @@ include::modules/installation-aws-tested-machine-types.adoc[leveloffset=+2]
9798
[role="_additional-resources"]
9899
.Additional resources
99100

100-
* See link:https://aws.amazon.com/about-aws/global-infrastructure/localzones/features/[AWS Local Zones features] in the AWS documentation for more information about AWS Local Zones and the supported instances types and services.
101+
* See link:https://aws.amazon.com/about-aws/global-infrastructure/localzones/features/[AWS Local Zones features] in the AWS documentation for more information about AWS Local Zones and the supported instances types and services.
101102

102103
include::modules/installation-generate-aws-user-infra-install-config.adoc[leveloffset=+2]
103104
// Suggest to standarize edge-pool's specific files with same prefixes, like: machine-edge-pool-[...] or compute-edge-pool-[...] (which is more compatible with install-config.yaml/compute)

‎installing/installing_aws/installing-aws-outposts-remote-workers.adoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ Since the cluster uses the provided AWS credentials to create AWS resources for
3434
* If the cloud identity and access management (IAM) APIs are not accessible in your environment, or if you do not want to store an administrator-level credential secret in the `kube-system` namespace, you can xref:../../installing/installing_aws/manually-creating-iam.adoc#manually-creating-iam-aws[manually create and maintain IAM credentials].
3535

3636
include::modules/installation-custom-aws-vpc.adoc[leveloffset=+1]
37+
include::modules/installation-aws-security-groups.adoc[leveloffset=+2]
3738

3839
include::modules/cluster-entitlements.adoc[leveloffset=+1]
3940

@@ -50,6 +51,7 @@ include::modules/installation-initializing.adoc[leveloffset=+1]
5051
include::modules/installation-configuration-parameters.adoc[leveloffset=+2]
5152

5253
include::modules/installation-aws-config-yaml.adoc[leveloffset=+2]
54+
include::modules/installation-applying-aws-security-groups.adoc[leveloffset=+2]
5355

5456
include::modules/installation-aws-editing-manifests.adoc[leveloffset=+1]
5557

‎installing/installing_aws/installing-aws-private.adoc‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ include::modules/private-clusters-default.adoc[leveloffset=+1]
2727
include::modules/private-clusters-about-aws.adoc[leveloffset=+2]
2828

2929
include::modules/installation-custom-aws-vpc.adoc[leveloffset=+1]
30+
include::modules/installation-aws-security-groups.adoc[leveloffset=+2]
3031

3132
include::modules/cluster-entitlements.adoc[leveloffset=+1]
3233

@@ -47,6 +48,8 @@ include::modules/installation-aws-config-yaml.adoc[leveloffset=+2]
4748

4849
include::modules/installation-configure-proxy.adoc[leveloffset=+2]
4950

51+
include::modules/installation-applying-aws-security-groups.adoc[leveloffset=+2]
52+
5053
include::modules/installation-launching-installer.adoc[leveloffset=+1]
5154

5255
include::modules/cli-installing-cli.adoc[leveloffset=+1]

‎installing/installing_aws/installing-aws-secret-region.adoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ include::modules/private-clusters-default.adoc[leveloffset=+1]
3535
include::modules/private-clusters-about-aws.adoc[leveloffset=+2]
3636

3737
include::modules/installation-custom-aws-vpc.adoc[leveloffset=+1]
38+
include::modules/installation-aws-security-groups.adoc[leveloffset=+2]
3839

3940
include::modules/cluster-entitlements.adoc[leveloffset=+1]
4041

@@ -49,6 +50,7 @@ include::modules/installation-configuration-parameters.adoc[leveloffset=+2]
4950
include::modules/installation-aws-tested-machine-types.adoc[leveloffset=+2]
5051
include::modules/installation-aws-config-yaml.adoc[leveloffset=+2]
5152
include::modules/installation-configure-proxy.adoc[leveloffset=+2]
53+
include::modules/installation-applying-aws-security-groups.adoc[leveloffset=+2]
5254

5355
include::modules/installation-launching-installer.adoc[leveloffset=+1]
5456

‎installing/installing_aws/installing-aws-vpc.adoc‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ If you have an AWS profile stored on your computer, it must not use a temporary
2323
* If the cloud identity and access management (IAM) APIs are not accessible in your environment, or if you do not want to store an administrator-level credential secret in the `kube-system` namespace, you can xref:../../installing/installing_aws/manually-creating-iam.adoc#manually-creating-iam-aws[manually create and maintain IAM credentials].
2424

2525
include::modules/installation-custom-aws-vpc.adoc[leveloffset=+1]
26+
include::modules/installation-aws-security-groups.adoc[leveloffset=+2]
2627

2728
include::modules/cluster-entitlements.adoc[leveloffset=+1]
2829

@@ -43,6 +44,8 @@ include::modules/installation-aws-config-yaml.adoc[leveloffset=+2]
4344

4445
include::modules/installation-configure-proxy.adoc[leveloffset=+2]
4546

47+
include::modules/installation-applying-aws-security-groups.adoc[leveloffset=+2]
48+
4649
include::modules/installation-launching-installer.adoc[leveloffset=+1]
4750

4851
include::modules/cli-installing-cli.adoc[leveloffset=+1]

‎modules/installation-applying-aws-security-groups.adoc‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * installing/installing_aws/installing-aws-vpc.adoc
4+
// * installing/installing_aws/installing-aws-private.adoc
5+
// * installing/installing_aws/installing-aws-government-region.adoc
6+
// * installing/installing_aws/installing-aws-secret-region.adoc
7+
// * installing/installing_aws/installing-aws-china.adoc
8+
// * installing/installing_aws/installing-aws-outposts-remote-workers.adoc
9+
10+
:_content-type: PROCEDURE
11+
[id="installation-aws-vpc-security-groups_{context}"]
12+
= Applying existing AWS security groups to the cluster
13+
14+
Applying existing AWS security groups to your control plane and compute machines can help you meet the security needs of your organization, in such cases where you need to control the incoming or outgoing traffic of these machines.
15+
16+
.Prerequisites
17+
* You have created the security groups in AWS. For more information, see the AWS documentation about working with link:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html[security groups].
18+
* The security groups must be associated with the existing VPC that you are deploying the cluster to. The security groups cannot be associated with another VPC.
19+
* You have an existing `install-config.yaml` file.
20+
21+
.Procedure
22+
23+
. In the `install-config.yaml` file, edit the `compute.platform.aws.additionalSecurityGroupIDs` parameter to specify one or more custom security groups for your compute machines.
24+
. Edit the `controlPlane.platform.aws.additionalSecurityGroupIDs` parameter to specify one or more custom security groups for your control plane machines.
25+
. Save the file and reference it when deploying the cluster.
26+
27+
.Sample `install-config.yaml` file that specifies custom security groups
28+
[source,yaml]
29+
----
30+
# ...
31+
compute:
32+
- hyperthreading: Enabled
33+
name: worker
34+
platform:
35+
aws:
36+
additionalSecurityGroupIDs:
37+
- sg-1 <1>
38+
- sg-2
39+
replicas: 3
40+
controlPlane:
41+
hyperthreading: Enabled
42+
name: master
43+
platform:
44+
aws:
45+
additionalSecurityGroupIDs:
46+
- sg-3
47+
- sg-4
48+
replicas: 3
49+
platform:
50+
aws:
51+
region: us-east-1
52+
subnets: <2>
53+
- subnet-1
54+
- subnet-2
55+
- subnet-3
56+
----
57+
<1> Specify the name of the security group as it appears in the Amazon EC2 console, including the `sg` prefix.
58+
<2> Specify subnets for each availability zone that your cluster uses.

‎modules/installation-aws-security-groups.adoc‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * installing/installing_aws/installing-aws-vpc.adoc
4+
// * installing/installing_aws/installing-aws-private.adoc
5+
// * installing/installing_aws/installing-aws-government-region.adoc
6+
// * installing/installing_aws/installing-aws-secret-region.adoc
7+
// * installing/installing_aws/installing-aws-china.adoc
8+
// * installing/installing_aws/installing-aws-localzone.adoc
9+
// * installing/installing_aws/installing-aws-outposts-remote-workers.adoc
10+
11+
ifeval::["{context}" == "installing-aws-localzone"]
12+
:localzone:
13+
endif::[]
14+
15+
:_content-type: CONCEPT
16+
[id="installation-aws-security-groups_{context}"]
17+
= AWS security groups
18+
19+
By default, the installation program creates and attaches security groups to control plane and compute machines. The rules associated with the default security groups cannot be modified.
20+
21+
However, you can apply additional existing AWS security groups, which are associated with your existing VPC, to control plane and compute machines. Applying custom security groups can help you meet the security needs of your organization, in such cases where you need to control the incoming or outgoing traffic of these machines.
22+
23+
As part of the installation process, you apply custom security groups by modifying the `install-config.yaml` file before deploying the cluster.
24+
25+
ifndef::localzone[]
26+
For more information, see "Applying existing AWS security groups to the cluster".
27+
endif::localzone[]
28+
ifdef::localzone[]
29+
For more information, see "The edge compute pool for AWS Local Zones".
30+
endif::localzone[]
31+
32+
ifeval::["{context}" == "installing-aws-localzone"]
33+
:!localzone:
34+
endif::[]

‎modules/machines-edge-machine-pool.adoc‎

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,9 @@ The edge compute pool creates new labels that developers can use to deploy appli
1818
1919
By default, the system creates the edge compute pool manifests only if users add AWS Local Zone subnet IDs to the list `platform.aws.subnets`.
2020

21-
The edge compute pool's machine sets have a `NoSchedule taint` by default to prevent regular workloads from being spread out on those machines. Users can only run user workloads if the tolerations are defined on the pod spec.
21+
The edge compute pool's machine sets have a `NoSchedule taint` by default to prevent regular workloads from being spread out on those machines. Users can only run user workloads if the tolerations are defined on the pod spec.
2222

23-
The following examples show `install-config.yaml` files that use the edge machine pool.
23+
The following examples show `install-config.yaml` files that use the edge machine pool.
2424

2525
.Configuration that uses an edge pool with default settings
2626
[source,yaml]
@@ -102,4 +102,34 @@ pullSecret: '{"auths": ...}'
102102
sshKey: ssh-ed25519 AAAA...
103103
----
104104

105-
EBS types differ between locations. Check the AWS documentation to verify availability in the Local Zone in which the cluster will run.
105+
EBS types differ between locations. Check the AWS documentation to verify availability in the Local Zone in which the cluster will run.
106+
107+
.Configuration that uses an edge pool with custom security groups
108+
[source,yaml]
109+
----
110+
apiVersion: v1
111+
baseDomain: devcluster.openshift.com
112+
metadata:
113+
name: ipi-localzone
114+
compute:
115+
- name: edge
116+
platform:
117+
aws:
118+
additionalSecurityGroupIDs:
119+
- sg-1 <1>
120+
- sg-2
121+
platform:
122+
aws:
123+
region: us-west-2
124+
subnets:
125+
- publicSubnetId-1
126+
- publicSubnetId-2
127+
- publicSubnetId-3
128+
- privateSubnetId-1
129+
- privateSubnetId-2
130+
- privateSubnetId-3
131+
- publicSubnetId-LocalZone-1
132+
pullSecret: '{"auths": ...}'
133+
sshKey: ssh-ed25519 AAAA...
134+
----
135+
<1> Specify the name of the security group as it appears in the Amazon EC2 console, including the `sg` prefix.

0 commit comments

Comments
 (0)