Skip to content

Commit c66c9be

Browse files
sheriff-rhsheriff-rh
authored
Merge pull request #67219 from kowen-rh/osdocs-7363
2 parents 1077789 + 4ef223a commit c66c9be

12 files changed

+357
-192
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1304,7 +1304,7 @@ Topics:
13041304
File: understanding-aws-load-balancer-operator
13051305
- Name: Installing the AWS Load Balancer Operator
13061306
File: install-aws-load-balancer-operator
1307-
- Name: Installing the AWS Load Balancer Operator on Security Token Service cluster
1307+
- Name: Installing the AWS Load Balancer Operator on a Security Token Service cluster
13081308
File: installing-albo-sts-cluster
13091309
- Name: Creating an instance of the AWS Load Balancer Controller
13101310
File: create-instance-aws-load-balancer-controller

‎modules/aws-installing-an-aws-load-balancer-operator.adoc

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,7 @@ Do not include the `https` portion of the OIDC DNS URL when replacing `{Cluster_
139139
====
140140
+
141141
For more information on assigning trust policies to AWS IAM roles, see link:https://aws.amazon.com/blogs/security/how-to-use-trust-policies-with-iam-roles/[How to use trust policies with IAM roles].
142-
.. Create and verify the role by using the generated trusted policy:
142+
.. Create and verify the role by using the generated trust policy:
143143
+
144144
[source, terminal]
145145
----
@@ -182,7 +182,7 @@ $ oc -n aws-load-balancer-operator create secret generic aws-load-balancer-opera
182182
----
183183
. Create the AWS IAM policy required for the AWS Load Balancer Controller (ALBC):
184184
+
185-
.. Generate a trusted policy file for your identity provider. The following example uses OpenID Connect:
185+
.. Generate a trust policy file for your identity provider. The following example uses OpenID Connect:
186186
+
187187
[source,terminal]
188188
----
@@ -209,7 +209,7 @@ $ cat <<EOF > albo-controller-trusted-policy.json
209209
EOF
210210
----
211211
+
212-
.. Create and verify the role by using the generated trusted policy:
212+
.. Create and verify the role by using the generated trust policy:
213213
+
214214
[source, terminal]
215215
----

‎modules/bootstrap-aws-load-balancer-operator.adoc

Lines changed: 0 additions & 59 deletions
This file was deleted.

‎modules/configuring-albo-on-sts-cluster-predefined-credentials.adoc

Lines changed: 0 additions & 71 deletions
This file was deleted.

‎modules/configuring-albo-on-sts-cluster.adoc

Lines changed: 0 additions & 48 deletions
This file was deleted.

‎modules/nw-aws-load-balancer-operator.adoc

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,6 @@ The AWS Load Balancer Operator can tag the public subnets if the `kubernetes.io/
1313
1414
The AWS Load Balancer Operator supports the Kubernetes service resource of type `LoadBalancer` by using Network Load Balancer (NLB) with the `instance` target type only.
1515

16-
.Prerequisites
17-
18-
* You must have the AWS credentials secret. The credentials are used to provide subnet tagging and VPC discovery.
19-
2016
.Procedure
2117

2218
. You can deploy the AWS Load Balancer Operator on demand from the OperatorHub, by creating a `Subscription` object:

‎modules/specifying-role-arn-albo-sts.adoc

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/installing-albo-sts-cluster.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="specifying-role-arn-albo-sts_{context}"]
7+
= Specifying the role ARN for the ALB Operator on an STS cluster
8+
9+
The role Amazon Resource Name (ARN) needs to be passed to the AWS Load Balancer (ALB) Operator as an environment variable. You can use the dedicated input box in the OperatorHub web UI or specify it in the `Subscription` resource when installing the Operator by using the OpenShift CLI.
10+
11+
.Prerequisites
12+
13+
* You have installed the OpenShift CLI (`oc`).
14+
15+
.Procedure
16+
17+
. Create the `aws-load-balancer-operator` project by running the following command:
18+
+
19+
[source,terminal]
20+
----
21+
$ oc new-project aws-load-balancer-operator
22+
----
23+
24+
. Create an `OperatorGroup` for the ALB Operator by running the following command:
25+
+
26+
[source,terminal]
27+
----
28+
$ cat <<EOF | oc apply -f -
29+
apiVersion: operators.coreos.com/v1
30+
kind: OperatorGroup
31+
metadata:
32+
name: aws-load-balancer-operator
33+
namespace: aws-load-balancer-operator
34+
spec:
35+
targetNamespaces: []
36+
EOF
37+
----
38+
39+
. Create a `Subscription` object for the ALB Operator with the role ARN by running the following command:
40+
+
41+
[source,terminal]
42+
----
43+
$ cat <<EOF | oc apply -f -
44+
apiVersion: operators.coreos.com/v1alpha1
45+
kind: Subscription
46+
metadata:
47+
name: aws-load-balancer-operator
48+
namespace: aws-load-balancer-operator
49+
spec:
50+
channel: stable-v1
51+
name: aws-load-balancer-operator
52+
source: redhat-operators
53+
sourceNamespace: openshift-marketplace
54+
config:
55+
env:
56+
- name: ROLEARN
57+
value: "<role-arn>" <1>
58+
EOF
59+
----
60+
<1> Specifies the role ARN to be used in the `CredentialsRequest` to provision the AWS credentials for the Operator.
61+
+
62+
[NOTE]
63+
====
64+
The ALB Operator waits until the creation of the required secret before moving to the available state.
65+
====

‎modules/using-aws-cli-create-iam-role-alb-controller.adoc

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/installing-albo-sts-cluster.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="using-aws-cli-create-iam-role-alb-controller_{context}"]
7+
= Using the AWS CLI to create an IAM role for the Controller
8+
9+
You can use the `aws` command line interface to create an IAM role for the `AWSLoadBalancerController`. The created IAM role is used to interact with subnets and Virtual Private Clouds (VPCs).
10+
11+
.Prerequisites
12+
13+
* You must have access to the `aws` command line interface.
14+
15+
.Procedure
16+
17+
. Generate a trust policy file using your identity provider by running the following command:
18+
+
19+
[source,terminal]
20+
----
21+
$ cat <<EOF > albo-controller-trust-policy.json
22+
{
23+
"Version": "2012-10-17",
24+
"Statement": [
25+
{
26+
"Effect": "Allow",
27+
"Principal": {
28+
"Federated": "arn:aws:iam::777777777777:oidc-provider/<oidc-provider-id>" <1>
29+
},
30+
"Action": "sts:AssumeRoleWithWebIdentity",
31+
"Condition": {
32+
"StringEquals": {
33+
"<oidc-provider-id>:sub": "system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-cluster" <2>
34+
}
35+
}
36+
}
37+
]
38+
}
39+
EOF
40+
----
41+
<1> Specifies the ARN of the identity provider.
42+
<2> Specifies the service account for the `AWSLoadBalancerController`.
43+
44+
. Create the IAM role with the generated trust policy by running the following command:
45+
+
46+
[source,terminal]
47+
----
48+
$ aws iam create-role --role-name albo-controller --assume-role-policy-document file://albo-controller-trusted-policy.json
49+
----
50+
+
51+
.Example output
52+
[source,terminal]
53+
----
54+
ROLE arn:aws:iam::777777777777:role/albo-controller 2023-08-02T12:13:22Z <1>
55+
ASSUMEROLEPOLICYDOCUMENT 2012-10-17
56+
STATEMENT sts:AssumeRoleWithWebIdentity Allow
57+
STRINGEQUALS system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-cluster
58+
PRINCIPAL arn:aws:iam:777777777777:oidc-provider/<oidc-provider-id>
59+
----
60+
<1> Note the ARN of the created IAM role.
61+
62+
. Download the permission policy for the `AWSLoadBalancerController` by running the following command:
63+
+
64+
[source,terminal]
65+
----
66+
$ curl -o albo-controller-permission-policy.json https://raw.githubusercontent.com/openshift/aws-load-balancer-operator/main/assets/iam-policy.json
67+
----
68+
69+
. Attach the permission policy for the `AWSLoadBalancerController` to the IAM role by running the following command:
70+
+
71+
[source,terminal]
72+
----
73+
$ aws iam put-role-policy --role-name albo-controller --policy-name perms-policy-albo-controller --policy-document file://albo-controller-permission-policy.json
74+
----
75+
76+
. Create an `AWSLoadBalancerController` resource file named `example-sts-iam-role.yaml` with contents such as the following example:
77+
+
78+
[source,yaml]
79+
----
80+
apiVersion: networking.olm.openshift.io/v1
81+
kind: AWSLoadBalancerController <1>
82+
metadata:
83+
name: cluster <2>
84+
spec:
85+
credentialsRequestConfig:
86+
stsIAMRoleARN: <role-arn> <3>
87+
----
88+
<1> Defines the `AWSLoadBalancerController` resource.
89+
<2> Defines the instance name for the `AWSLoadBalancerController`. All related resources use this instance name as a suffix.
90+
<3> Specifies the role ARN to be used in a `CredentialsRequest` to provision the AWS credentials for the controller.

0 commit comments

Comments
 (0)