Skip to content

Commit a8c106f

Browse files
bmcelveebmcelvee
authored
Merge pull request #63277 from bmcelvee/OSDOCS-6386
OSDOCS-6386: Remove mention of ccoctl in the cloudwatch log forwarding and efs csi driver rosa procedures
2 parents 0785cb0 + 2ca8c4e commit a8c106f

4 files changed

+313
-92
lines changed

‎logging/cluster-logging-external.adoc

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,14 +52,19 @@ include::modules/cluster-logging-collector-log-forward-syslog.adoc[leveloffset=+
5252

5353
include::modules/cluster-logging-collector-log-forward-cloudwatch.adoc[leveloffset=+1]
5454

55+
ifdef::openshift-rosa[]
56+
include::modules/rosa-cluster-logging-collector-log-forward-sts-cloudwatch.adoc[leveloffset=+2]
57+
endif::[]
58+
59+
ifdef::openshift-enterprise,openshift-origin,openshift-dedicated[]
5560
[id="cluster-logging-collector-log-forward-sts-cloudwatch_{context}"]
5661
=== Forwarding logs to Amazon CloudWatch from STS enabled clusters
5762

5863
For clusters with AWS Security Token Service (STS) enabled, you can create an AWS service account manually or create a credentials request by using the
5964
ifdef::openshift-enterprise,openshift-origin[]
6065
xref:../authentication/managing_cloud_provider_credentials/about-cloud-credential-operator.adoc[Cloud Credential Operator(CCO)]
6166
endif::[]
62-
ifdef::openshift-rosa,openshift-dedicated[]
67+
ifdef::openshift-dedicated[]
6368
link:https://docs.openshift.com/container-platform/latest/authentication/managing_cloud_provider_credentials/about-cloud-credential-operator.html[Cloud Credential Operator(CCO)]
6469
endif::[]
6570
utility `ccoctl`.
@@ -168,6 +173,7 @@ spec:
168173
<9> Optional: Specify a name for the pipeline.
169174
<10> Specify which log types to forward by using the pipeline: `application,` `infrastructure`, or `audit`.
170175
<11> Specify the name of the output to use when forwarding logs with this pipeline.
176+
endif::[]
171177

172178
[role="_additional-resources"]
173179
.Additional resources

‎modules/cluster-logging-collector-log-forward-secret-cloudwatch.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
:_content-type: PROCEDURE
77
[id="cluster-logging-collector-log-forward-secret-cloudwatch_{context}"]
8-
== Creating a secret for AWS CloudWatch with an existing AWS role
8+
= Creating a secret for AWS CloudWatch with an existing AWS role
99
If you have an existing role for AWS, you can create a secret for AWS with STS using the `oc create secret --from-literal` command.
1010

1111
.Procedure

‎modules/osd-persistent-storage-csi-efs-sts.adoc

Lines changed: 117 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
This procedure explains how to configure the AWS EFS CSI Driver Operator with {product-title} on AWS Secure Token Service (STS).
1212

13-
Perform this procedure before you have installed the AWS EFS CSI Operator, but not yet installed the AWS EFS CSI driver as part of the _Installing the AWS EFS CSI Driver Operator_ procedure.
13+
Perform this procedure before you have installed the AWS EFS CSI Operator, but not yet installed the AWS EFS CSI driver as part of the _Installing the AWS EFS CSI Driver Operator_ procedure.
1414

1515
[IMPORTANT]
1616
====
@@ -23,125 +23,152 @@ If you perform this procedure after installing the driver and creating volumes,
2323
* AWS account credentials
2424
* You have installed the AWS EFS CSI Operator.
2525
26-
.Procedure
27-
28-
To configure the AWS EFS CSI Driver Operator with STS:
2926
30-
// The on-prem version of this step is documented in the cco-ccoctl-configuring procedure.
31-
. Extract the CCO utility (`ccoctl`) binary from the Cloud Credential Operator.
27+
.Procedure
3228

33-
.. Find the pod on which the Cloud Credential Operator is running.
29+
. Prepare the AWS account:
30+
.. Create an IAM policy JSON file with the following content:
31+
+
32+
[source,json]
33+
----
34+
{
35+
"Version": "2012-10-17",
36+
"Statement": [
37+
{
38+
"Effect": "Allow",
39+
"Action": [
40+
"elasticfilesystem:DescribeAccessPoints",
41+
"elasticfilesystem:DescribeFileSystems",
42+
"elasticfilesystem:DescribeMountTargets",
43+
"ec2:DescribeAvailabilityZones"
44+
],
45+
"Resource": "*"
46+
},
47+
{
48+
"Effect": "Allow",
49+
"Action": [
50+
"elasticfilesystem:CreateAccessPoint"
51+
],
52+
"Resource": "*",
53+
"Condition": {
54+
"StringLike": {
55+
"aws:RequestTag/efs.csi.aws.com/cluster": "true"
56+
}
57+
}
58+
},
59+
{
60+
"Effect": "Allow",
61+
"Action": "elasticfilesystem:DeleteAccessPoint",
62+
"Resource": "*",
63+
"Condition": {
64+
"StringEquals": {
65+
"aws:ResourceTag/efs.csi.aws.com/cluster": "true"
66+
}
67+
}
68+
}
69+
]
70+
}
71+
----
72+
73+
.. Create an IAM trust JSON file with the following content:
3474
+
3575
--
76+
[source,json]
77+
----
78+
{
79+
"Version": "2012-10-17",
80+
"Statement": [
81+
{
82+
"Effect": "Allow",
83+
"Principal": {
84+
"Federated": "arn:aws:iam::<your_aws_account_ID>:oidc-provider/<openshift_oidc_provider>" <1>
85+
},
86+
"Action": "sts:AssumeRoleWithWebIdentity",
87+
"Condition": {
88+
"StringEquals": {
89+
"<openshift_oidc_provider>:sub": [ <2>
90+
"system:serviceaccount:openshift-cluster-csi-drivers:aws-efs-csi-driver-operator",
91+
"system:serviceaccount:openshift-cluster-csi-drivers:aws-efs-csi-driver-controller-sa"
92+
]
93+
}
94+
}
95+
}
96+
]
97+
}
98+
----
99+
<1> Specify your AWS account ID and the OpenShift OIDC provider endpoint. Obtain the endpoint by running the the following command:
100+
+
36101
[source,terminal]
37102
----
38-
$ oc get pod -n openshift-cloud-credential-operator -l app=cloud-credential-operator
39-
----
40-
41-
.Example output
42-
[source,terminal]
43-
----
44-
NAME READY STATUS RESTARTS AGE
45-
cloud-credential-operator-78c9c575b-r6mmr 2/2 Running 0 6h33m
103+
$ rosa describe cluster \
104+
-c $(oc get clusterversion -o jsonpath='{.items[].spec.clusterID}{"\n"}') \
105+
-o yaml | awk '/oidc_endpoint_url/ {print $2}' | cut -d '/' -f 3,4
46106
----
107+
+
108+
<2> Specify the OpenShift OIDC endpoint again.
47109
--
48110
49-
.. Copy the `ccoctl` binary from the pod to a local directory.
111+
.. Create the IAM role:
50112
+
51113
[source,terminal]
52114
----
53-
$ oc cp -c cloud-credential-operator openshift-cloud-credential-operator/<CCO-pod-name>:/usr/bin/ccoctl ./ccoctl
115+
$ aws iam create-role \
116+
--role-name "<your_cluster_name>-aws-efs-csi-operator" \
117+
--assume-role-policy-document file://<your_trust_file_name>.json \
118+
--query "Role.Arn" --output text
54119
----
120+
+
121+
Save the output. You will use it in the next steps.
55122
56-
.. Change the permissions to make `ccoctl` executable.
123+
.. Create the IAM policy:
57124
+
58125
[source,terminal]
59126
----
60-
$ chmod 775 ./ccoctl
127+
$ aws iam create-policy \
128+
--policy-name "<your_rosa_cluster_name>-rosa-efs-csi" \
129+
--policy-document file://<your_policy_file_name>.json \
130+
--query 'Policy.Arn' --output text) || \
131+
POLICY=$(aws iam list-policies \
132+
--query 'Policies[?PolicyName==`rosa-efs-csi`].Arn' \
133+
--output text
61134
----
135+
+
136+
Save the output. You will use it in the next steps.
62137
63-
.. To verify that `ccoctl` is ready to use, display the help file:
138+
.. Attach the IAM policy to the IAM role:
64139
+
65140
[source,terminal]
66141
----
67-
$ ./ccoctl --help
142+
$ aws iam attach-role-policy \
143+
--role-name "<your_rosa_cluster_name>-aws-efs-csi-operator" \
144+
--policy-arn <policy_ARN> <1>
68145
----
146+
+
147+
<1> Replace `policy_ARN` with the output you saved while creating the policy.
69148
70-
. Create and save an EFS `CredentialsRequest` YAML file, such as shown in the following example:
149+
. Create a `Secret` YAML file for the driver operator:
71150
+
72-
.Example
73151
[source,yaml]
74152
----
75-
apiVersion: cloudcredential.openshift.io/v1
76-
kind: CredentialsRequest
153+
apiVersion: v1
154+
kind: Secret
77155
metadata:
78-
name: openshift-aws-efs-csi-driver
79-
namespace: openshift-cloud-credential-operator
80-
spec:
81-
providerSpec:
82-
apiVersion: cloudcredential.openshift.io/v1
83-
kind: AWSProviderSpec
84-
statementEntries:
85-
- action:
86-
- elasticfilesystem:*
87-
effect: Allow
88-
resource: '*'
89-
secretRef:
90-
name: aws-efs-cloud-credentials
91-
namespace: openshift-cluster-csi-drivers
92-
serviceAccountNames:
93-
- aws-efs-csi-driver-operator
94-
- aws-efs-csi-driver-controller-sa
95-
----
96-
97-
. Run the `ccoctl` tool to generate a new IAM role in AWS, and create a YAML file for it in the local file system (`<path_to_ccoctl_output_dir>/manifests/openshift-cluster-csi-drivers-aws-efs-cloud-credentials-credentials.yaml`).
156+
name: aws-efs-cloud-credentials
157+
namespace: openshift-cluster-csi-drivers
158+
stringData:
159+
credentials: |-
160+
[default]
161+
sts_regional_endpoints = regional
162+
role_arn = <role_ARN> <1>
163+
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
164+
----
165+
<1> Replace `role_ARN` with the output you saved while creating the role.
166+
167+
. Create the secret:
98168
+
99-
--
100169
[source,terminal]
101170
----
102-
$ ccoctl aws create-iam-roles --name=<name> --region=<aws_region> --credentials-requests-dir=<path_to_directory_with_list_of_credentials_requests>/credrequests --identity-provider-arn=<oidc_provider_arn>
103-
----
104-
105-
* `name=<name>` is the name used to tag any cloud resources that are created for tracking.
106-
107-
* `region=<aws_region>` is the AWS region where cloud resources are created.
108-
109-
* `dir=<path_to_directory_with_list_of_credentials_requests>/credrequests` is the directory containing the EFS CredentialsRequest file in previous step.
110-
111-
* `<oidc_provider_arn>` is the ARN for the OIDC provider that associates with your cluster.
112-
113-
.Example
114-
[source,terminal]
171+
$ oc apply -f aws-efs-cloud-credentials.yaml
115172
----
116-
$ ccoctl aws create-iam-roles --name=my-aws-efs --credentials-requests-dir= credrequests --identity-provider-arn=arn:aws:iam::123456789012:oidc-provider/example.cloudfront.net/<cluster-ID>
117-
----
118-
119-
.Example output
120-
[source,terminal]
121-
----
122-
2022/03/21 06:24:44 Role arn:aws:iam::123456789012:role/my-aws-efs -openshift-cluster-csi-drivers-aws-efs-cloud- created
123-
2022/03/21 06:24:44 Saved credentials configuration to: /manifests/openshift-cluster-csi-drivers-aws-efs-cloud-credentials-credentials.yaml
124-
2022/03/21 06:24:45 Updated Role policy for Role my-aws-efs-openshift-cluster-csi-drivers-aws-efs-cloud-credentials
125-
----
126-
--
127-
128-
. Create the AWS EFS cloud credentials and secret:
129173
+
130-
--
131-
[source,terminal]
132-
----
133-
$ oc create -f <path_to_ccoctl_output_dir>/manifests/openshift-cluster-csi-drivers-aws-efs-cloud-credentials-credentials.yaml
134-
----
135-
136-
.Example
137-
[source,terminal]
138-
----
139-
$ oc create -f /manifests/openshift-cluster-csi-drivers-aws-efs-cloud-credentials-credentials.yaml
140-
----
141-
142-
.Example output
143-
[source,terminal]
144-
----
145-
secret/aws-efs-cloud-credentials created
146-
----
147-
--
174+
You are now ready to install the AWS EFS CSI driver.

0 commit comments

Comments
 (0)