1
1
:_content-type: ASSEMBLY
2
- [id="rosa-mobb -cloudwatch-sts"]
3
- = Tutorial: Configuring the Cluster Log Forwarder for Cloudwatch logs and STS
2
+ [id="cloud-experts-rosa -cloudwatch-sts"]
3
+ = Tutorial: Configuring the Cluster Log Forwarder for CloudWatch logs and STS
4
4
include::_attributes/attributes-openshift-dedicated.adoc[]
5
- :context: rosa-mobb -cloudwatch-sts
5
+ :context: cloud-experts-rosa -cloudwatch-sts
6
6
7
7
toc::[]
8
8
@@ -18,23 +18,23 @@ toc::[]
18
18
// - Connor Wooley
19
19
// ---
20
20
21
- This guide shows how to deploy the Cluster Log Forwarder Operator and configure it to use STS authentication to forward logs to CloudWatch.
21
+ Use this tutorial to deploy the Cluster Log Forwarder Operator and configure it to use Security Token Services ( STS) authentication to forward logs to CloudWatch.
22
22
23
- [id="rosa-mobb -cloudwatch-sts-prerequisites"]
24
- == Prerequisites
23
+ [id="cloud-experts-rosa -cloudwatch-sts-prerequisites"]
24
+ . Prerequisites
25
25
26
- * A ROSA cluster (configured with STS)
27
- * The `jq` cli command
28
- * The `aws` cli command
26
+ * A {product-title} (ROSA) Classic cluster
27
+ * The `jq` command-line interface (CLI)
28
+ * The Amazon Web Services (AWS) CLI ( `aws` )
29
29
30
- [id="rosa-mobb- cloudwatch-sts-environmental -setup"]
31
- == Environment Setup
30
+ [id="cloud-experts-rosa- cloudwatch-sts-environment -setup"]
31
+ == Setting up your environment
32
32
33
- * Configure the following environment variables:
33
+ . Configure the following environment variables, changing the cluster name to suit your cluster :
34
34
+
35
35
[NOTE]
36
36
====
37
- Change the cluster name to match your ROSA cluster and ensure you are logged into the cluster as an Administrator. Ensure all fields are outputted correctly before moving on .
37
+ You must be logged in as an administrator .
38
38
====
39
39
+
40
40
[source,terminal]
@@ -46,13 +46,19 @@ $ export AWS_ACCOUNT_ID=`aws sts get-caller-identity --query Account --output te
46
46
$ export AWS_PAGER=""
47
47
$ export SCRATCH="/tmp/${ROSA_CLUSTER_NAME}/clf-cloudwatch-sts"
48
48
$ mkdir -p ${SCRATCH}
49
+ ----
50
+
51
+ . Ensure all fields output correctly before moving to the next section:
52
+ +
53
+ [source,terminal]
54
+ ----
49
55
$ echo "Cluster: ${ROSA_CLUSTER_NAME}, Region: ${REGION}, OIDC Endpoint: ${OIDC_ENDPOINT}, AWS Account ID: ${AWS_ACCOUNT_ID}"
50
56
----
51
57
52
- [id="rosa-mobb -cloudwatch-sts-prep-aws"]
53
- == Prepare AWS Account
58
+ [id="cloud-experts-rosa -cloudwatch-sts-prep-aws"]
59
+ == Preparing your AWS account
54
60
55
- . Create an IAM policy for OpenShift Log Forwarding:
61
+ . Create an Identity Access Management ( IAM) policy for OpenShift Log Forwarding:
56
62
+
57
63
[source,terminal]
58
64
----
@@ -118,8 +124,8 @@ $ aws iam attach-role-policy --role-name "${ROSA_CLUSTER_NAME}-RosaCloudWatch" \
118
124
--policy-arn ${POLICY_ARN}
119
125
----
120
126
121
- [id="rosa-mobb -cloudwatch-sts-deploy-Os"]
122
- == Deploy Operators
127
+ [id="cloud-experts-rosa -cloudwatch-sts-deploy-Os"]
128
+ == Deploying Operators
123
129
124
130
. Deploy the Cluster Logging Operator:
125
131
+
@@ -157,10 +163,10 @@ $ cat << EOF | oc apply -f -
157
163
EOF
158
164
----
159
165
160
- [id="rosa-mobb -cloudwatch-sts-configure-cluster-logging"]
161
- == Configure cluster logging
166
+ [id="cloud-experts-rosa -cloudwatch-sts-configure-cluster-logging"]
167
+ == Configuring cluster logging
162
168
163
- . Create a cluster log forwarding resource:
169
+ . Create a cluster- log forwarding resource:
164
170
+
165
171
[source,terminal]
166
172
----
@@ -209,15 +215,11 @@ $ cat << EOF | oc apply -f -
209
215
EOF
210
216
----
211
217
212
- [id="rosa-mobb -cloudwatch-sts-check-aws"]
213
- == Check AWS CloudWatch for logs
218
+ [id="cloud-experts-rosa -cloudwatch-sts-check-aws"]
219
+ == Checking CloudWatch for logs
214
220
215
- * Use the AWS console or CLI to validate that there are log streams from the cluster:
216
- +
217
- [NOTE]
218
- ====
219
- If this is a fresh cluster, you may not see a log group for `application` logs as there are no applications running yet.
220
- ====
221
+ * Use either the AWS console or the AWS CLI to validate that there are log streams from the cluster.
222
+ ** To validate the logs in the AWS CLI, run the following command:
221
223
+
222
224
[source,terminal]
223
225
----
@@ -247,11 +249,16 @@ $ aws logs describe-log-groups --log-group-name-prefix rosa-${ROSA_CLUSTER_NAME}
247
249
]
248
250
}
249
251
----
252
+ +
253
+ [NOTE]
254
+ ====
255
+ If this is a new cluster, you might not see a log group for `application` logs as applications are not yet running.
256
+ ====
250
257
251
- [id="rosa-mobb -cloudwatch-sts-clean-up"]
252
- == Clean Up
258
+ [id="cloud-experts-rosa -cloudwatch-sts-clean-up"]
259
+ == Cleaning up your resources
253
260
254
- . Delete the cluster log forwarding resource:
261
+ . Delete the cluster- log forwarding resource:
255
262
+
256
263
[source,terminal]
257
264
----
@@ -282,17 +289,17 @@ $ aws iam delete-role --role-name "${ROSA_CLUSTER_NAME}-RosaCloudWatch"
282
289
283
290
. Delete the IAM policy:
284
291
+
285
- [NOTE ]
292
+ [IMPORTANT ]
286
293
====
287
- Only run this command if there are no other resources using the policy.
294
+ Only delete the IAM policy if there are no other resources using the policy.
288
295
====
289
296
+
290
297
[source,terminal]
291
298
----
292
299
$ aws iam delete-policy --policy-arn "${POLICY_ARN}"
293
300
----
294
301
295
- . Delete the CloudWatch Log Groups :
302
+ . Delete the CloudWatch log groups :
296
303
+
297
304
[source,terminal]
298
305
----
0 commit comments