Skip to content

Commit 95443ba

Browse files
libanderlibander
committed
RHDEVDOCS-3551 - Cloudwatch - STS w/ SME feedback v3 & QE v2
1 parent 329b5ad commit 95443ba

File tree

2 files changed

+136
-1
lines changed

2 files changed

+136
-1
lines changed

‎logging/cluster-logging-external.adoc

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,142 @@ include::modules/cluster-logging-collector-log-forward-syslog.adoc[leveloffset=+
4141

4242
include::modules/cluster-logging-collector-log-forward-cloudwatch.adoc[leveloffset=+1]
4343

44+
=== Forwarding logs to Amazon CloudWatch from STS enabled clusters
45+
46+
For clusters with AWS Security Token Service (STS) enabled, you can create an AWS service account manually or create a credentials request using the xref:../authentication/managing_cloud_provider_credentials/about-cloud-credential-operator.adoc[Cloud Credential Operator(CCO)] utility `ccoctl`.
47+
48+
.Prerequisites
49+
50+
* {logging-title-uc}: 5.5 and later
51+
52+
[NOTE]
53+
====
54+
This feature is not supported by the vector collector.
55+
====
56+
57+
.Creating an AWS credentials request
58+
. Create a `CredentialsRequest` Custom Resource YAML using the template below:
59+
+
60+
.CloudWatch Credentials Request Template
61+
[source,yaml]
62+
----
63+
apiVersion: cloudcredential.openshift.io/v1
64+
kind: CredentialsRequest
65+
metadata:
66+
name: <your_role_name>-credrequest
67+
namespace: openshift-cloud-credential-operator
68+
spec:
69+
providerSpec:
70+
apiVersion: cloudcredential.openshift.io/v1
71+
kind: AWSProviderSpec
72+
statementEntries:
73+
- action:
74+
- logs:PutLogEvents
75+
- logs:CreateLogGroup
76+
- logs:PutRetentionPolicy
77+
- logs:CreateLogStream
78+
- logs:DescribeLogGroups
79+
- logs:DescribeLogStreams
80+
effect: Allow
81+
resource: arn:aws:logs:*:*:*
82+
secretRef:
83+
name: <your_role_name>
84+
namespace: openshift-logging
85+
serviceAccountNames:
86+
- logcollector
87+
----
88+
+
89+
. Use the `ccoctl` command to to create a role for AWS using your `CredentialsRequest` CR. With the `CredentialsRequest` object, this `ccoctl` command creates an IAM role with a trust policy that is tied to the specified OIDC identity provider, and a permissions policy that grants permissions to perform operations on CloudWatch resources. This command also creates a YAML configuration file in ``/<path_to_ccoctl_output_dir>/manifests/openshift-logging-<your_role_name>-credentials.yaml`. This secret file contains the `role_arn` key/value used during authentication with the AWS IAM identity provider.
90+
+
91+
[source,terminal]
92+
----
93+
ccoctl aws create-iam-roles \
94+
--name=<name> \
95+
--region=<aws_region> \
96+
--credentials-requests-dir=<path_to_directory_with_list_of_credentials_requests>/credrequests \
97+
--identity-provider-arn=arn:aws:iam::<aws_account_id>:oidc-provider/<name>-oidc.s3.<aws_region>.amazonaws.com <1>
98+
----
99+
<1> <name> is the name used to tag your cloud resources and should match the name used during your STS cluster install
100+
+
101+
. Apply the secret created:
102+
[source,terminal]
103+
+
104+
----
105+
oc apply -f output/manifests/openshift-logging-<your_role_name>-credentials.yaml
106+
----
107+
+
108+
. Create or edit a `ClusterLogForwarder` custom resource:
109+
+
110+
[source,yaml]
111+
----
112+
apiVersion: "logging.openshift.io/v1"
113+
kind: ClusterLogForwarder
114+
metadata:
115+
name: instance <1>
116+
namespace: openshift-logging <2>
117+
spec:
118+
outputs:
119+
- name: cw <3>
120+
type: cloudwatch <4>
121+
cloudwatch:
122+
groupBy: logType <5>
123+
groupPrefix: <group prefix> <6>
124+
region: us-east-2 <7>
125+
secret:
126+
name: <your_role_name> <8>
127+
pipelines:
128+
- name: to-cloudwatch <9>
129+
inputRefs: <10>
130+
- infrastructure
131+
- audit
132+
- application
133+
outputRefs:
134+
- cw <11>
135+
----
136+
<1> The name of the `ClusterLogForwarder` CR must be `instance`.
137+
<2> The namespace for the `ClusterLogForwarder` CR must be `openshift-logging`.
138+
<3> Specify a name for the output.
139+
<4> Specify the `cloudwatch` type.
140+
<5> Optional: Specify how to group the logs:
141+
+
142+
* `logType` creates log groups for each log type
143+
* `namespaceName` creates a log group for each application name space. Infrastructure and audit logs are unaffected, remaining grouped by `logType`.
144+
* `namespaceUUID` creates a new log groups for each application namespace UUID. It also creates separate log groups for infrastructure and audit logs.
145+
<6> Optional: Specify a string to replace the default `infrastructureName` prefix in the names of the log groups.
146+
<7> Specify the AWS region.
147+
<8> Specify the name of the secret that contains your AWS credentials.
148+
<9> Optional: Specify a name for the pipeline.
149+
<10> Specify which log types to forward by using the pipeline: `application,` `infrastructure`, or `audit`.
150+
<11> Specify the name of the output to use when forwarding logs with this pipeline.
151+
152+
153+
[role="_additional-resources"]
154+
.Additional resources
155+
* link:https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html[AWS STS API Reference]
156+
157+
158+
==== Creating a secret for AWS CloudWatch with an existing AWS role
159+
If you have an existing role for AWS, you can create a secret for AWS with STS using the `oc create secret --from-literal` command.
160+
161+
[source,terminal]
162+
----
163+
oc create secret generic cw-sts-secret -n openshift-logging --from-literal=role_arn=arn:aws:iam::123456789012:role/my-role_with-permissions
164+
----
165+
166+
.Example Secret
167+
[source,yaml]
168+
----
169+
apiVersion: v1
170+
kind: Secret
171+
metadata:
172+
namespace: openshift-logging
173+
name: my-secret-name
174+
stringData:
175+
role_arn: arn:aws:iam::123456789012:role/my-role_with-permissions
176+
----
177+
44178
include::modules/cluster-logging-collector-log-forward-loki.adoc[leveloffset=+1]
179+
45180
include::modules/cluster-logging-troubleshooting-loki-entry-out-of-order-errors.adoc[leveloffset=+2]
46181

47182

‎modules/cluster-logging-collector-log-forward-cloudwatch.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
[id="cluster-logging-collector-log-forward-cloudwatch_{context}"]
33
= Forwarding logs to Amazon CloudWatch
44

5-
You can forward logs to Amazon CloudWatch, a monitoring and log storage service hosted by Amazon Web Services (AWS). You can forward logs to CloudWatch in addition to, or instead of, the default {logging} managed Elasticsearch log store.
5+
You can forward logs to Amazon CloudWatch, a monitoring and log storage service hosted by Amazon Web Services (AWS). You can forward logs to CloudWatch in addition to, or instead of, the default log store.
66

77
To configure log forwarding to CloudWatch, you must create a `ClusterLogForwarder` custom resource (CR) with an output for CloudWatch, and a pipeline that uses the output.
88

0 commit comments

Comments
 (0)