Skip to content

Commit dacde0d

Browse files
EricPonvelleEricPonvelle
authored
Merge pull request #62611 from jneczypor/OSDOCS-5468
OSDOCS-5470: Rework Responsibility Assignment and Process/Security
2 parents f0853b6 + cab70cf commit dacde0d

12 files changed

+552
-544
lines changed

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ Topics:
6565
File: rosa-service-definition
6666
- Name: ROSA update life cycle
6767
File: rosa-life-cycle
68-
- Name: Understanding process and security for ROSA
68+
- Name: Understanding security for ROSA
6969
File: rosa-policy-process-security
7070
# - Name: SRE and service account access
7171
# File: rosa-sre-access

‎modules/rosa-policy-change-management.adoc

Lines changed: 161 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,16 @@
11

22
// Module included in the following assemblies:
33
//
4-
// * rosa_architecture/rosa_policy_service_definition/rosa-policy-process-security.adoc
4+
// * rosa_architecture/rosa_policy_service_definition/rosa-policy-shared-responsibility.adoc
55

66
[id="rosa-policy-change-management_{context}"]
77
= Change management
88

9-
109
This section describes the policies about how cluster and configuration changes, patches, and releases are managed.
1110

11+
Red Hat is responsible for enabling changes to the cluster infrastructure and services that the customer will control, as well as maintaining versions for the control plane nodes, infrastructure nodes and services, and worker nodes. AWS is responsible for protecting the hardware infrastructure that runs all of the services offered in the
12+
AWS Cloud. The customer is responsible for initiating infrastructure change requests and installing and maintaining optional services and networking configurations on the cluster, as well as all changes to customer data and customer applications.
13+
1214
[id="rosa-policy-customer-initiated-changes_{context}"]
1315
== Customer-initiated changes
1416

@@ -66,3 +68,160 @@ Because the required permissions can change between y-stream releases, the polic
6668
====
6769

6870
You can review the history of all cluster upgrade events in the {cluster-manager} web console. For more information about releases, see the link:https://access.redhat.com/support/policy/updates/openshift/dedicated[Life Cycle policy].
71+
72+
[cols="2a,3a,3a",options="header"]
73+
|===
74+
75+
|Resource
76+
|Service responsibilities
77+
|Customer responsibilities
78+
79+
|Logging
80+
|**Red Hat**
81+
82+
- Centrally aggregate and monitor platform audit logs.
83+
84+
- Provide and maintain a logging Operator to enable the customer to deploy a logging stack for default application logging.
85+
86+
- Provide audit logs upon customer request.
87+
88+
|- Install the optional default application logging Operator on the cluster.
89+
- Install, configure, and maintain any optional application logging solutions, such as logging sidecar containers or third-party logging applications.
90+
- Tune size and frequency of application logs being produced by customer applications if they are affecting the stability of the logging stack or the cluster.
91+
- Request platform audit logs through a support case for researching specific incidents.
92+
93+
|Application networking
94+
|**Red Hat**
95+
96+
- Set up public load balancers. Provide the ability to set up private load balancers and up to one additional load balancer when required.
97+
98+
- Set up native OpenShift router service. Provide the ability to set the router as private and add up to one additional router shard.
99+
100+
- Install, configure, and maintain OpenShift SDN components for default internal pod traffic (for clusters created prior to version 4.11).
101+
102+
- Provide the ability for the customer to manage `NetworkPolicy` and `EgressNetworkPolicy` (firewall) objects.
103+
104+
|- Configure non-default pod network permissions for project and pod networks, pod ingress, and pod egress using `NetworkPolicy` objects.
105+
- Use {cluster-manager} to request a private load balancer for default application routes.
106+
- Use {cluster-manager} to configure up to one additional public or private router shard and corresponding load balancer.
107+
- Request and configure any additional service load balancers for specific services.
108+
- Configure any necessary DNS forwarding rules.
109+
110+
|Cluster networking
111+
|**Red Hat**
112+
113+
- Set up cluster management components, such as public or private service endpoints and necessary integration with Amazon VPC components.
114+
115+
- Set up internal networking components required for internal cluster communication between worker, infrastructure, and control plane nodes.
116+
117+
|- Provide optional non-default IP address ranges for machine CIDR, service CIDR, and pod CIDR if needed through {cluster-manager} when the cluster is provisioned.
118+
- Request that the API service endpoint be made public or private on cluster creation or after cluster creation through {cluster-manager}.
119+
120+
|Virtual networking management
121+
|**Red Hat**
122+
123+
- Set up and configure Amazon VPC components required to provision the cluster, such as subnets, load balancers, internet gateways, and NAT gateways.
124+
125+
- Provide the ability for the customer to
126+
manage AWS VPN connectivity with on-premises resources, Amazon VPC-to-VPC connectivity, and AWS Direct Connect as required through {cluster-manager}.
127+
128+
- Enable customers to create and deploy AWS load balancers for use with service load balancers.
129+
130+
|- Set up and maintain optional Amazon VPC components, such as Amazon VPC-to-VPC connection, AWS VPN connection, or AWS Direct Connect.
131+
- Request and configure any additional service load balancers for specific services.
132+
133+
|Virtual compute management
134+
|**Red Hat**
135+
136+
- Set up and configure the ROSA control plane and data plane to use Amazon EC2 instances for cluster compute.
137+
138+
- Monitor and manage the deployment of Amazon EC2 control plane and infrastructure nodes on the cluster.
139+
140+
|- Monitor and manage Amazon EC2 worker nodes by creating a
141+
machine pool using the OpenShift Cluster Manager or the ROSA CLI (`rosa`).
142+
- Manage changes to customer-deployed applications and application data.
143+
144+
|Cluster version
145+
|**Red Hat**
146+
147+
- Enable upgrade scheduling process.
148+
149+
- Monitor upgrade progress and remedy any issues encountered.
150+
151+
- Publish change logs and release notes for patch release upgrades.
152+
153+
|- Either set up automatic upgrades or schedule patch release upgrades immediately or for the future.
154+
- Acknowledge and schedule minor version upgrades.
155+
- Test customer applications on patch releases to ensure compatibility.
156+
157+
|Capacity management
158+
|**Red Hat**
159+
160+
- Monitor the use of the control plane. Control planes include control plane nodes and infrastructure nodes.
161+
162+
- Scale and resize control plane nodes to maintain quality of service.
163+
164+
| - Monitor worker node utilization and, if appropriate, enables the auto-scaling feature.
165+
- Determine the scaling strategy of the cluster. See the additional resources for more information on machine pools.
166+
- Use the provided {cluster-manager} controls to add or remove additional worker nodes as required.
167+
- Respond to Red Hat notifications regarding cluster resource requirements.
168+
169+
|Virtual storage management
170+
|**Red Hat**
171+
172+
- Set up and configure Amazon EBS to provision local node storage and persistent volume storage for the cluster.
173+
174+
- Set up and configure the built-in image registry to use Amazon S3 bucket storage.
175+
176+
- Regularly prune image registry resources in
177+
Amazon S3 to optimize Amazon S3 usage and cluster performance.
178+
179+
| - Optionally configure the Amazon EBS CSI driver or the Amazon
180+
EFS CSI driver to provision persistent volumes on the cluster.
181+
182+
|AWS software (public AWS services)
183+
|**AWS**
184+
185+
**Compute:** Provide the Amazon EC2 service, used for
186+
ROSA control plane, infrastructure, and worker nodes.
187+
188+
**Storage:** Provide Amazon EBS, used by ROSA to provision local node storage and persistent volume storage for the cluster.
189+
190+
**Storage:** Provide Amazon S3, used for the ROSA service's
191+
built-in image registry.
192+
193+
**Networking:**
194+
Provide the following AWS Cloud services, used by ROSA
195+
to satisfy virtual networking
196+
infrastructure needs:
197+
198+
** Amazon VPC
199+
** Elastic Load Balancing
200+
** AWS IAM
201+
202+
**Networking:**
203+
Provide the following AWS services, which customers can optionally integrate with ROSA:
204+
205+
- AWS VPN
206+
- AWS Direct Connect
207+
- AWS PrivateLink
208+
- AWS Transit Gateway
209+
210+
| - Sign requests using an access key ID and secret access key
211+
associated with an IAM principal or STS temporary security
212+
credentials.
213+
- Specify VPC subnets for the cluster to use during cluster
214+
creation.
215+
- Optionally configure a customer-managed VPC for use with ROSA clusters (required for PrivateLink and HCP clusters).
216+
217+
|Hardware/AWS global infrastructure
218+
|**AWS**
219+
220+
- For information regarding management controls for AWS data centers, see link:https://aws.amazon.com/compliance/data-center/controls[Our Controls] on the AWS Cloud Security page.
221+
222+
- For information regarding change management best practices, see link:https://aws.amazon.com/solutions/guidance/change-management-on-aws/[Guidance for Change Management on AWS] in the AWS Solutions Library.
223+
224+
|- Implement change management best practices for customer
225+
applications and data hosted on the AWS Cloud.
226+
227+
|===

‎modules/rosa-policy-customer-responsibility.adoc

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,7 @@
44
// * rosa_architecture/rosa_policy_service_definition/rosa-policy-responsibility-matrix.adoc
55

66
[id="rosa-policy-customer-responsibility_{context}"]
7-
= Customer responsibilities for data and applications
8-
7+
= Additional customer responsibilities for data and applications
98

109
The customer is responsible for the applications, workloads, and data that they deploy to Red Hat
1110
OpenShift Service on AWS. However, Red Hat and AWS provide various tools to help the customer

‎modules/rosa-policy-disaster-recovery.adoc

Lines changed: 74 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
1-
21
// Module included in the following assemblies:
32
//
4-
// * rosa_architecture/rosa_policy_service_definition/rosa-policy-process-security.adoc
3+
// * rosa_architecture/rosa_policy_service_definition/rosa-policy-shared-responsibility.adoc
54

65
[id="rosa-policy-disaster-recovery_{context}"]
76
= Disaster recovery
8-
7+
Disaster recovery includes data and configuration backup, replicating data and configuration to the disaster recovery environment, and failover on disaster events.
98

109
{product-title} (ROSA) provides disaster recovery for failures that occur at the pod, worker node, infrastructure node, control plane node, and availability zone levels.
1110

@@ -14,3 +13,75 @@ All disaster recovery requires that the customer use best practices for deployin
1413
One single-zone cluster will not provide disaster avoidance or recovery in the event of an availability zone or region outage. Multiple single-zone clusters with customer-maintained failover can account for outages at the zone or at the regional level.
1514

1615
One multi-zone cluster will not provide disaster avoidance or recovery in the event of a full region outage. Multiple multi-zone clusters with customer-maintained failover can account for outages at the regional level.
16+
17+
[cols="2a,3a,3a" ,options="header"]
18+
|===
19+
|Resource
20+
|Service responsibilities
21+
|Customer responsibilities
22+
23+
|Virtual networking management
24+
|**Red Hat**
25+
26+
- Restore or recreate affected virtual network components that are necessary for the platform to function.
27+
|- Configure virtual networking connections with more than one tunnel where possible for protection against outages as recommended by the public cloud provider.
28+
- Maintain failover DNS and load balancing if using a global load balancer with multiple clusters.
29+
30+
|Virtual Storage management
31+
|**Red Hat**
32+
33+
- For ROSA clusters created with IAM user credentials, back up all Kubernetes objects on the cluster through hourly, daily, and weekly volume snapshots.
34+
35+
- For ROSA clusters created with IAM user credentials, back up persistent volumes on the cluster through daily and weekly volume snapshots.
36+
37+
|- Back up customer applications and application data.
38+
39+
|Virtual compute management
40+
|**Red Hat**
41+
42+
- Monitor the cluster and replace failed Amazon EC2 control plane or infrastructure nodes.
43+
44+
- Provide the ability for the customer to manually or automatically replace failed worker nodes.
45+
46+
|- Replace failed Amazon EC2 worker nodes by editing the
47+
machine pool configuration through OpenShift Cluster Manager or the ROSA CLI.
48+
49+
|AWS software (public AWS services)
50+
|**AWS**
51+
52+
**Compute:** Provide Amazon EC2 features that support data resiliency such as Amazon EBS snapshots and Amazon EC2 Auto Scaling. For more information, see link:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/disaster-recovery-resiliency.html[Resilience in Amazon EC2] in the EC2 User Guide.
53+
54+
**Storage:** Provide the ability for the ROSA service
55+
and customers to back up the Amazon EBS volume on the cluster through Amazon EBS volume snapshots.
56+
57+
**Storage:** For information about Amazon S3 features that support data resiliency, see link:https://docs.aws.amazon.com/AmazonS3/latest/userguide/disaster-recovery-resiliency.html[Resilience in Amazon S3].
58+
59+
**Networking:** For information about Amazon VPC features that support data resiliency, see link:https://docs.aws.amazon.com/vpc/latest/userguide/disaster-recovery-resiliency.html[Resilience in Amazon Virtual Private
60+
Cloud] in the Amazon VPC User Guide.
61+
62+
|- Configure ROSA
63+
multi-AZ clusters to
64+
improve fault
65+
tolerance and cluster
66+
availability.
67+
68+
- Provision persistent
69+
volumes using the
70+
Amazon EBS CSI
71+
driver to enable
72+
volume snapshots.
73+
74+
- Create CSI volume snapshots of Amazon
75+
EBS persistent volumes.
76+
|Hardware/AWS global infrastructure
77+
|**AWS**
78+
79+
- Provide AWS global infrastructure that allows ROSA to scale control plane, infrastructure, and worker nodes across
80+
Availability Zones. This functionality enables ROSA to orchestrate automatic failover between zones without interruption.
81+
82+
- For more information about disaster recovery best practices, see link:https://docs.aws.amazon.com/whitepapers/latest/disaster-recovery-workloads-on-aws/disaster-recovery-options-in-the-cloud.html[Disaster recovery options in the cloud] in the AWS
83+
Well-Architected Framework.
84+
85+
|- Configure ROSA multi-AZ clusters to improve fault tolerance and cluster availability.
86+
87+
|===

‎modules/rosa-policy-identity-access-management.adoc

Lines changed: 92 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

22
// Module included in the following assemblies:
33
//
4-
// * rosa_architecture/rosa_policy_service_definition/rosa-policy-process-security.adoc
4+
// * rosa_architecture/rosa_policy_service_definition/rosa-policy-shared-responsibility.adoc
55

66
[id="rosa-policy-identity-access-management_{context}"]
77
= Identity and access management
@@ -155,3 +155,94 @@ Customer access is limited to namespaces created by the customer and permissions
155155
[id="rosa-policy-access-approval_{context}"]
156156
== Access approval and review
157157
New SRE user access requires management approval. Separated or transferred SRE accounts are removed as authorized users through an automated process. Additionally, the SRE performs periodic access review, including management sign-off of authorized user lists.
158+
159+
The access and identity authorization table includes responsibilities for managing authorized access to clusters, applications, and infrastructure resources. This includes tasks such as providing access control mechanisms, authentication, authorization, and managing access to resources.
160+
161+
[cols="2a,3a,3a",options="header"]
162+
|===
163+
|Resource
164+
|Service responsibilities
165+
|Customer responsibilities
166+
167+
|Logging
168+
|**Red Hat**
169+
170+
- Adhere to an industry standards-based tiered internal access process for platform audit logs.
171+
172+
- Provide native OpenShift RBAC capabilities.
173+
174+
|- Configure OpenShift RBAC to control access to projects and by extension a project’s application logs.
175+
- For third-party or custom application logging solutions, the customer is responsible for access management.
176+
177+
|Application networking
178+
|**Red Hat**
179+
180+
- Provide native OpenShift RBAC and `dedicated-admin` capabilities.
181+
182+
|- Configure OpenShift `dedicated-admin` and RBAC to control access to route configuration as required.
183+
- Manage organization administrators for Red Hat to grant access to {cluster-manager}. The cluster manager is used to configure router options and provide service load balancer quota.
184+
185+
|Cluster networking
186+
|**Red Hat**
187+
188+
- Provide customer access controls through {cluster-manager}.
189+
190+
- Provide native OpenShift RBAC and `dedicated-admin` capabilities.
191+
192+
|- Manage Red Hat organization membership of Red Hat accounts.
193+
- Manage organization administrators for Red Hat to grant access to {cluster-manager}.
194+
- Configure OpenShift `dedicated-admin` and RBAC to control access to route configuration as required.
195+
196+
|Virtual networking management
197+
|**Red Hat**
198+
199+
- Provide customer access controls through {cluster-manager}.
200+
201+
|- Manage optional user access to AWS components through {cluster-manager}.
202+
203+
|Virtual storage management
204+
|**Red Hat**
205+
206+
- Provide customer access controls through
207+
OpenShift Cluster Manager.
208+
209+
|- Manage optional user access to AWS components through {cluster-manager}.
210+
- Create AWS IAM roles and attached policies necessary to enable ROSA service access.
211+
212+
|Virtual compute management
213+
|**Red Hat**
214+
215+
- Provide customer access controls through
216+
OpenShift Cluster Manager.
217+
218+
|- Manage optional user access to AWS components through {cluster-manager}.
219+
- Create AWS IAM roles and attached policies necessary to enable ROSA service access.
220+
221+
|AWS software (public AWS services)
222+
|**AWS**
223+
224+
**Compute:** Provide the Amazon EC2 service, used for ROSA control plane, infrastructure, and worker nodes.
225+
226+
**Storage:** Provide Amazon EBS, used to allow ROSA to provision local node storage and persistent volume storage for the cluster.
227+
228+
**Storage:** Provide Amazon S3, used for the service’s built-in image registry.
229+
230+
**Networking:** Provide AWS Identity and Access Management (IAM), used by customers to control access to ROSA resources running on customer accounts.
231+
232+
|- Create AWS IAM roles and attached policies necessary to enable ROSA service access.
233+
234+
- Use IAM tools to apply the appropriate permissions to AWS
235+
resources in the customer account.
236+
237+
- To enable ROSA across your AWS organization, the customer is
238+
responsible for managing AWS Organizations administrators.
239+
240+
- To enable ROSA across your AWS organization, the customer is
241+
responsible for distributing the ROSA entitlement grant using AWS License Manager.
242+
243+
|Hardware/AWS global infrastructure
244+
|**AWS**
245+
246+
- For information regarding physical access controls for AWS data centers, see link:https://aws.amazon.com/compliance/data-center/controls/[Our Controls] on the AWS Cloud Security page.
247+
|- Customer is not responsible for AWS global infrastructure.
248+
|===

0 commit comments

Comments
 (0)