Skip to content

Commit d000c1a

Browse files
xenolinuxxenolinux
committed
OSDOCS#6018: Authenticating cert-manager Operator on the AWS STS cluster
1 parent 4971c38 commit d000c1a

File tree

3 files changed

+143
-0
lines changed

3 files changed

+143
-0
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1004,6 +1004,8 @@ Topics:
10041004
File: cert-manager-operator-proxy
10051005
- Name: Customizing cert-manager by using the cert-manager Operator API fields
10061006
File: cert-manager-customizing-api-fields
1007+
- Name: Authenticating the cert-manager Operator with AWS Security Token Service
1008+
File: cert-manager-authenticate-aws
10071009
- Name: Uninstalling the cert-manager Operator for Red Hat OpenShift
10081010
File: cert-manager-operator-uninstall
10091011
- Name: Viewing audit logs

‎modules/cert-manager-configure-cloud-credentials-aws-sts.adoc

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-authenticate-aws.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="cert-manager-configure-cloud-credentials-aws-sts_{context}"]
7+
= Configuring cloud credentials for the {cert-manager-operator} for the AWS Security Token Service cluster
8+
9+
To configure the cloud credentials for the {cert-manager-operator} on the AWS Security Token Service (STS) cluster with the cloud credentials. You must generate the cloud credentials manually, and apply it on the cluster by using the `ccoctl` binary.
10+
11+
.Prerequisites
12+
13+
* You have extracted and prepared the `ccoctl` binary.
14+
* You have configured an {product-title} cluster with AWS STS by using the Cloud Credential Operator in manual mode.
15+
16+
.Procedure
17+
18+
. Create a directory to store a `CredentialsRequest` resource YAML file by running the following command:
19+
+
20+
[source,terminal]
21+
----
22+
$ mkdir credentials-request
23+
----
24+
25+
. Create a `CredentialsRequest` resource YAML file under the `credentials-request` directory, such as, `sample-credential-request.yaml`, by applying the following yaml:
26+
+
27+
[source,yaml]
28+
----
29+
apiVersion: cloudcredential.openshift.io/v1
30+
kind: CredentialsRequest
31+
metadata:
32+
name: cert-manager
33+
namespace: openshift-cloud-credential-operator
34+
spec:
35+
providerSpec:
36+
apiVersion: cloudcredential.openshift.io/v1
37+
kind: AWSProviderSpec
38+
statementEntries:
39+
- action:
40+
- "route53:GetChange"
41+
effect: Allow
42+
resource: "arn:aws:route53:::change/*"
43+
- action:
44+
- "route53:ChangeResourceRecordSets"
45+
- "route53:ListResourceRecordSets"
46+
effect: Allow
47+
resource: "arn:aws:route53:::hostedzone/*"
48+
- action:
49+
- "route53:ListHostedZonesByName"
50+
effect: Allow
51+
resource: "*"
52+
secretRef:
53+
name: aws-creds
54+
namespace: cert-manager
55+
serviceAccountNames:
56+
- cert-manager
57+
----
58+
59+
. Use the `ccoctl` tool to process `CredentialsRequest` objects by running the following command:
60+
+
61+
[source,terminal]
62+
----
63+
$ ccoctl aws create-iam-roles \
64+
--name <user_defined_name> --region=<aws_region> \
65+
--credentials-requests-dir=<path_to_credrequests_dir> \
66+
--identity-provider-arn <oidc_provider_arn> --output-dir=<path_to_output_dir>
67+
----
68+
+
69+
.Example output
70+
[source,terminal]
71+
----
72+
2023/05/15 18:10:34 Role arn:aws:iam::XXXXXXXXXXXX:role/<user_defined_name>-cert-manager-aws-creds created
73+
2023/05/15 18:10:34 Saved credentials configuration to: <path_to_output_dir>/manifests/cert-manager-aws-creds-credentials.yaml
74+
2023/05/15 18:10:35 Updated Role policy for Role <user_defined_name>-cert-manager-aws-creds
75+
----
76+
+
77+
Copy the `<aws_role_arn>` from the output to use in the next step. For example, `"arn:aws:iam::XXXXXXXXXXXX:role/<user_defined_name>-cert-manager-aws-creds"`
78+
79+
. Add the `eks.amazonaws.com/role-arn="<aws_role_arn>"` annotation to the service account by running the following command:
80+
+
81+
[source,terminal]
82+
----
83+
$ oc -n cert-manager annotate serviceaccount cert-manager eks.amazonaws.com/role-arn="<aws_role_arn>"
84+
----
85+
86+
. To create a new pod, delete the existing cert-manager controller pod by running the following command:
87+
+
88+
[source,terminal]
89+
----
90+
$ oc delete pods -l app.kubernetes.io/name=cert-manager -n cert-manager
91+
----
92+
+
93+
The AWS credentials are applied to a new cert-manager controller pod within a minute.
94+
95+
.Verification
96+
97+
. Get the name of the updated cert-manager controller pod by running the following command:
98+
+
99+
[source,terminal]
100+
----
101+
$ oc get pods -l app.kubernetes.io/name=cert-manager -n cert-manager
102+
----
103+
+
104+
.Example output
105+
[source,terminal]
106+
----
107+
NAME READY STATUS RESTARTS AGE
108+
cert-manager-bd7fbb9fc-wvbbt 1/1 Running 0 39s
109+
----
110+
111+
. Verify that AWS credentials are updated by running the following command:
112+
+
113+
[source,terminal]
114+
----
115+
$ oc set env -n cert-manager po/<cert_manager_controller_pod_name> --list
116+
----
117+
+
118+
.Example output
119+
[source,terminal]
120+
----
121+
# pods/cert-manager-57f9555c54-vbcpg, container cert-manager-controller
122+
# POD_NAMESPACE from field path metadata.namespace
123+
AWS_ROLE_ARN=XXXXXXXXXXXX
124+
AWS_WEB_IDENTITY_TOKEN_FILE=/var/run/secrets/eks.amazonaws.com/serviceaccount/token
125+
----

‎security/cert_manager_operator/cert-manager-authenticate-aws.adoc

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
:_content-type: ASSEMBLY
2+
[id="cert-manager-authenticate-aws"]
3+
= Authenticating the {cert-manager-operator} with AWS Security Token Service
4+
include::_attributes/common-attributes.adoc[]
5+
:context: cert-manager-authenticate-aws
6+
7+
toc::[]
8+
9+
You can authenticate the {cert-manager-operator} on the AWS Security Token Service (STS) cluster. You can configure cloud credentials for the {cert-manager-operator} by using the `ccoctl` binary.
10+
11+
include::modules/cert-manager-configure-cloud-credentials-aws-sts.adoc[leveloffset=+1]
12+
13+
[role="_additional-resources"]
14+
[id="additional-resources_cert-manager-authenticate-gcp"]
15+
== Additional resources
16+
* xref:../../authentication/managing_cloud_provider_credentials/cco-mode-sts.adoc#cco-ccoctl-configuring_cco-mode-sts[Configuring the Cloud Credential Operator utility]

0 commit comments

Comments
 (0)