11:_content-type: ASSEMBLY
2- [id="rosa-mobb -cloudwatch-sts"]
3- = Tutorial: Configuring the Cluster Log Forwarder for Cloudwatch logs and STS
2+ [id="cloud-experts-rosa -cloudwatch-sts"]
3+ = Tutorial: Configuring the Cluster Log Forwarder for CloudWatch logs and STS
44include::_attributes/attributes-openshift-dedicated.adoc[]
5- :context: rosa-mobb -cloudwatch-sts
5+ :context: cloud-experts-rosa -cloudwatch-sts
66
77toc::[]
88
@@ -18,23 +18,23 @@ toc::[]
1818// - Connor Wooley
1919// ---
2020
21- This guide shows how to deploy the Cluster Log Forwarder Operator and configure it to use STS authentication to forward logs to CloudWatch.
21+ Use this tutorial to deploy the Cluster Log Forwarder Operator and configure it to use Security Token Services ( STS) authentication to forward logs to CloudWatch.
2222
23- [id="rosa-mobb -cloudwatch-sts-prerequisites"]
24- == Prerequisites
23+ [id="cloud-experts-rosa -cloudwatch-sts-prerequisites"]
24+ . Prerequisites
2525
26- * A ROSA cluster (configured with STS)
27- * The `jq` cli command
28- * The `aws` cli command
26+ * A {product-title} (ROSA) Classic cluster
27+ * The `jq` command-line interface (CLI)
28+ * The Amazon Web Services (AWS) CLI ( `aws` )
2929
30- [id="rosa-mobb- cloudwatch-sts-environmental -setup"]
31- == Environment Setup
30+ [id="cloud-experts-rosa- cloudwatch-sts-environment -setup"]
31+ == Setting up your environment
3232
33- * Configure the following environment variables:
33+ . Configure the following environment variables, changing the cluster name to suit your cluster :
3434+
3535[NOTE]
3636====
37- Change the cluster name to match your ROSA cluster and ensure you are logged into the cluster as an Administrator. Ensure all fields are outputted correctly before moving on .
37+ You must be logged in as an administrator .
3838====
3939+
4040[source,terminal]
@@ -46,13 +46,19 @@ $ export AWS_ACCOUNT_ID=`aws sts get-caller-identity --query Account --output te
4646$ export AWS_PAGER=""
4747$ export SCRATCH="/tmp/${ROSA_CLUSTER_NAME}/clf-cloudwatch-sts"
4848$ mkdir -p ${SCRATCH}
49+ ----
50+
51+ . Ensure all fields output correctly before moving to the next section:
52+ +
53+ [source,terminal]
54+ ----
4955$ echo "Cluster: ${ROSA_CLUSTER_NAME}, Region: ${REGION}, OIDC Endpoint: ${OIDC_ENDPOINT}, AWS Account ID: ${AWS_ACCOUNT_ID}"
5056----
5157
52- [id="rosa-mobb -cloudwatch-sts-prep-aws"]
53- == Prepare AWS Account
58+ [id="cloud-experts-rosa -cloudwatch-sts-prep-aws"]
59+ == Preparing your AWS account
5460
55- . Create an IAM policy for OpenShift Log Forwarding:
61+ . Create an Identity Access Management ( IAM) policy for OpenShift Log Forwarding:
5662+
5763[source,terminal]
5864----
@@ -118,8 +124,8 @@ $ aws iam attach-role-policy --role-name "${ROSA_CLUSTER_NAME}-RosaCloudWatch" \
118124 --policy-arn ${POLICY_ARN}
119125----
120126
121- [id="rosa-mobb -cloudwatch-sts-deploy-Os"]
122- == Deploy Operators
127+ [id="cloud-experts-rosa -cloudwatch-sts-deploy-Os"]
128+ == Deploying Operators
123129
124130. Deploy the Cluster Logging Operator:
125131+
@@ -157,10 +163,10 @@ $ cat << EOF | oc apply -f -
157163EOF
158164----
159165
160- [id="rosa-mobb -cloudwatch-sts-configure-cluster-logging"]
161- == Configure cluster logging
166+ [id="cloud-experts-rosa -cloudwatch-sts-configure-cluster-logging"]
167+ == Configuring cluster logging
162168
163- . Create a cluster log forwarding resource:
169+ . Create a cluster- log forwarding resource:
164170+
165171[source,terminal]
166172----
@@ -209,15 +215,11 @@ $ cat << EOF | oc apply -f -
209215EOF
210216----
211217
212- [id="rosa-mobb -cloudwatch-sts-check-aws"]
213- == Check AWS CloudWatch for logs
218+ [id="cloud-experts-rosa -cloudwatch-sts-check-aws"]
219+ == Checking CloudWatch for logs
214220
215- * Use the AWS console or CLI to validate that there are log streams from the cluster:
216- +
217- [NOTE]
218- ====
219- If this is a fresh cluster, you may not see a log group for `application` logs as there are no applications running yet.
220- ====
221+ * Use either the AWS console or the AWS CLI to validate that there are log streams from the cluster.
222+ ** To validate the logs in the AWS CLI, run the following command:
221223+
222224[source,terminal]
223225----
@@ -247,11 +249,16 @@ $ aws logs describe-log-groups --log-group-name-prefix rosa-${ROSA_CLUSTER_NAME}
247249 ]
248250}
249251----
252+ +
253+ [NOTE]
254+ ====
255+ If this is a new cluster, you might not see a log group for `application` logs as applications are not yet running.
256+ ====
250257
251- [id="rosa-mobb -cloudwatch-sts-clean-up"]
252- == Clean Up
258+ [id="cloud-experts-rosa -cloudwatch-sts-clean-up"]
259+ == Cleaning up your resources
253260
254- . Delete the cluster log forwarding resource:
261+ . Delete the cluster- log forwarding resource:
255262+
256263[source,terminal]
257264----
@@ -282,17 +289,17 @@ $ aws iam delete-role --role-name "${ROSA_CLUSTER_NAME}-RosaCloudWatch"
282289
283290. Delete the IAM policy:
284291+
285- [NOTE ]
292+ [IMPORTANT ]
286293====
287- Only run this command if there are no other resources using the policy.
294+ Only delete the IAM policy if there are no other resources using the policy.
288295====
289296+
290297[source,terminal]
291298----
292299$ aws iam delete-policy --policy-arn "${POLICY_ARN}"
293300----
294301
295- . Delete the CloudWatch Log Groups :
302+ . Delete the CloudWatch log groups :
296303+
297304[source,terminal]
298305----
0 commit comments