Skip to content

Commit c6b1496

Browse files
xenolinuxxenolinux
committed
OSDOCS#6056: cert-manager: Authenticating the cert-manager Operator with AWS [non-sts]
1 parent 583f431 commit c6b1496

File tree

3 files changed

+119
-0
lines changed

3 files changed

+119
-0
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1010,6 +1010,8 @@ Topics:
10101010
File: cert-manager-log-levels
10111011
- Name: Authenticating the cert-manager Operator for Red Hat OpenShift with GCP Workload Identity
10121012
File: cert-manager-authenticate-gcp
1013+
- Name: Authenticating the cert-manager Operator for Red Hat OpenShift on AWS
1014+
File: cert-manager-authentication-non-sts
10131015
- Name: Uninstalling the cert-manager Operator for Red Hat OpenShift
10141016
File: cert-manager-operator-uninstall
10151017
- Name: Viewing audit logs

‎modules/cert-manager-configure-cloud-credentials-aws-non-sts.adoc

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-authenticate-aws.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="cert-manager-configure-cloud-credentials-aws-non-sts_{context}"]
7+
= Configuring cloud credentials for the {cert-manager-operator} on AWS
8+
9+
To configure the cloud credentials for the {cert-manager-operator} on the AWS cluster you must generate the cloud credentials secret by creating a `CredentialsRequest` object, and allowing the Cloud Credential Operator.
10+
11+
.Prerequisites
12+
13+
* You have installed the {cert-manager-operator} 1.11.1 or later.
14+
* You have configured the Cloud Credential Operator to operate in _mint_ or _passthrough_ mode.
15+
16+
.Procedure
17+
18+
. Create a `CredentialsRequest` resource YAML file, for example, `sample-credential-request.yaml`, as follows:
19+
+
20+
[source,yaml]
21+
----
22+
apiVersion: cloudcredential.openshift.io/v1
23+
kind: CredentialsRequest
24+
metadata:
25+
name: cert-manager
26+
namespace: openshift-cloud-credential-operator
27+
spec:
28+
providerSpec:
29+
apiVersion: cloudcredential.openshift.io/v1
30+
kind: AWSProviderSpec
31+
statementEntries:
32+
- action:
33+
- "route53:GetChange"
34+
effect: Allow
35+
resource: "arn:aws:route53:::change/*"
36+
- action:
37+
- "route53:ChangeResourceRecordSets"
38+
- "route53:ListResourceRecordSets"
39+
effect: Allow
40+
resource: "arn:aws:route53:::hostedzone/*"
41+
- action:
42+
- "route53:ListHostedZonesByName"
43+
effect: Allow
44+
resource: "*"
45+
secretRef:
46+
name: aws-creds
47+
namespace: cert-manager
48+
serviceAccountNames:
49+
- cert-manager
50+
----
51+
52+
. Create a `CredentialsRequest` resource by running the following command:
53+
+
54+
[source,terminal]
55+
----
56+
$ oc create -f sample-credential-request.yaml
57+
----
58+
59+
. Update the subscription object for {cert-manager-operator} by running the following command:
60+
+
61+
[source,terminal]
62+
----
63+
$ oc -n cert-manager-operator patch subscription openshift-cert-manager-operator --type=merge -p '{"spec":{"config":{"env":[{"name":"CLOUD_CREDENTIALS_SECRET_NAME","value":"aws-creds"}]}}}'
64+
----
65+
66+
.Verification
67+
68+
. Get the name of the redeployed cert-manager controller pod by running the following command:
69+
+
70+
[source,terminal]
71+
----
72+
$ oc get pods -l app.kubernetes.io/name=cert-manager -n cert-manager
73+
----
74+
+
75+
.Example output
76+
[source,terminal]
77+
----
78+
NAME READY STATUS RESTARTS AGE
79+
cert-manager-bd7fbb9fc-wvbbt 1/1 Running 0 15m39s
80+
----
81+
82+
. Verify that the cert-manager controller pod is updated with AWS credential volumes that are mounted under the path specified in `mountPath` by running the following command:
83+
+
84+
[source,terminal]
85+
----
86+
$ oc get -n cert-manager pod/<cert-manager_controller_pod_name> -o yaml
87+
----
88+
+
89+
.Example output
90+
[source,terminal]
91+
----
92+
...
93+
spec:
94+
containers:
95+
- args:
96+
...
97+
- mountPath: /.aws
98+
name: cloud-credentials
99+
...
100+
volumes:
101+
...
102+
- name: cloud-credentials
103+
secret:
104+
...
105+
secretName: aws-creds
106+
----

‎security/cert_manager_operator/cert-manager-authentication-non-sts.adoc

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
:_content-type: ASSEMBLY
2+
[id="cert-manager-authentication-non-sts"]
3+
= Authenticating the {cert-manager-operator} on AWS
4+
include::_attributes/common-attributes.adoc[]
5+
:context: cert-manager-authentication-non-sts
6+
7+
toc::[]
8+
9+
You can configure the cloud credentials for the {cert-manager-operator} on the AWS cluster. The cloud credentials are generated by the Cloud Credential Operator.
10+
11+
include::modules/cert-manager-configure-cloud-credentials-aws-non-sts.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)