Skip to content

Commit e42ff79

Browse files
bmcelveebmcelvee
committed
OSDOCS-4383: BYOKMS for ROSA Clusters
1 parent c385717 commit e42ff79

File tree

2 files changed

+50
-7
lines changed

2 files changed

+50
-7
lines changed

‎modules/rosa-sts-creating-a-cluster-with-customizations-cli.adoc

Lines changed: 29 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,17 @@ link:https://docs.aws.amazon.com/vpc/latest/userguide/vpc-sharing.html[AWS Share
3333
====
3434
To successfully install ROSA clusters, use latest version of the ROSA CLI.
3535
====
36-
* If you are using a customer-managed AWS Key Management Service (KMS) key for encryption, you have created a symmetric KMS key and you have the key ID and Amazon Resource Name (ARN). For more information about creating AWS KMS keys, see link:https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html[the AWS documentation].
36+
* If you want to use a customer managed AWS Key Management Service (KMS) key for encryption, you must create a symmetric KMS key. You must provide the Amazon Resource Name (ARN) when creating your cluster. To create a customer managed KMS key, follow the procedure for link:https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html#create-symmetric-cmk[Creating symmetric encryption KMS keys].
37+
+
38+
[IMPORTANT]
39+
====
40+
The EBS operator role is required in addition to the account roles to successfully create your cluster.
41+
42+
.Example EBS Operator role
43+
`"arn:aws:iam::<aws_account_id>:role/<cluster_name>-xxxx-openshift-cluster-csi-drivers-ebs-cloud-credent"`
44+
45+
After you create your Operator Roles, you must edit the _Key Policy_ in the link:https://console.aws.amazon.com/kms[*Key Management Service (KMS)* page of the AWS Console] to add the roles.
46+
====
3747

3848
.Procedure
3949

@@ -138,7 +148,8 @@ $ aws kms get-key-policy --key-id <key_id_or_arn> --policy-name default --output
138148
"arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-Support-Role", <1>
139149
"arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-Installer-Role",
140150
"arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-Worker-Role",
141-
"arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-ControlPlane-Role"
151+
"arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-ControlPlane-Role",
152+
"arn:aws:iam::<aws_account_id>:role/<cluster_name>-xxxx-openshift-cluster-csi-drivers-ebs-cloud-credent" <2>
142153
]
143154
},
144155
"Action": [
@@ -158,7 +169,8 @@ $ aws kms get-key-policy --key-id <key_id_or_arn> --policy-name default --output
158169
"arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-Support-Role", <1>
159170
"arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-Installer-Role",
160171
"arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-Worker-Role",
161-
"arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-ControlPlane-Role"
172+
"arn:aws:iam::<aws-account-id>:role/ManagedOpenShift-ControlPlane-Role",
173+
"arn:aws:iam::<aws_account_id>:role/<cluster_name>-xxxx-openshift-cluster-csi-drivers-ebs-cloud-credent" <2>
162174
]
163175
},
164176
"Action": [
@@ -177,6 +189,7 @@ $ aws kms get-key-policy --key-id <key_id_or_arn> --policy-name default --output
177189
}
178190
----
179191
<1> You must specify the ARN for the account-wide role that will be used when you create the ROSA cluster. The ARNs listed in the section must be comma-separated.
192+
<2> You must specify the ARN for the operator role that will be used when you create the ROSA cluster. The ARNs listed in the section must be comma-separated.
180193

181194
.. Apply the changes to your KMS key policy:
182195
+
@@ -286,6 +299,15 @@ A custom prefix is applied to the Operator role names if you specified the prefi
286299

287300
If you specified custom ARN paths when you created the associated account-wide roles, the custom path is automatically detected and applied to the Operator roles.
288301
====
302+
+
303+
[IMPORTANT]
304+
====
305+
The EBS operator role is required in addition to the account roles to successfully create your cluster.
306+
.Example EBS Operator role
307+
`"arn:aws:iam::<aws_account_id>:role/<cluster_name>-xxxx-openshift-cluster-csi-drivers-ebs-cloud-credent"`
308+
309+
After you create your Operator Roles, you must edit the _Key Policy_ in the link:https://console.aws.amazon.com/kms[*Key Management Service (KMS)* page of the AWS Console] to add the roles.
310+
====
289311

290312
. Create the OpenID Connect (OIDC) provider that the cluster Operators use to authenticate:
291313
+
@@ -332,10 +354,10 @@ Instance IAM Roles:
332354
- Worker: arn:aws:iam::<aws_account_id>:role/ManagedOpenShift-Worker-Role
333355
Operator IAM Roles:
334356
- arn:aws:iam::<aws_account_id>:role/<cluster_name>-xxxx-openshift-ingress-operator-cloud-credentials
335-
- arn:aws:iam::<aws_account_id>:role/<cluster_name-xxxx-openshift-cluster-csi-drivers-ebs-cloud-credent
336-
- arn:aws:iam::<aws_account_id>:role/<cluster_name-xxxx-openshift-machine-api-aws-cloud-credentials
337-
- arn:aws:iam::<aws_account_id>:role/<cluster_name-xxxx-openshift-cloud-credential-operator-cloud-crede
338-
- arn:aws:iam::<aws_account_id>:role/<cluster_name-xxxx-openshift-image-registry-installer-cloud-creden
357+
- arn:aws:iam::<aws_account_id>:role/<cluster_name>-xxxx-openshift-cluster-csi-drivers-ebs-cloud-credent
358+
- arn:aws:iam::<aws_account_id>:role/<cluster_name>-xxxx-openshift-machine-api-aws-cloud-credentials
359+
- arn:aws:iam::<aws_account_id>:role/<cluster_name>-xxxx-openshift-cloud-credential-operator-cloud-crede
360+
- arn:aws:iam::<aws_account_id>:role/<cluster_name>-xxxx-openshift-image-registry-installer-cloud-creden
339361
State: ready
340362
Private: No
341363
Created: Oct 1 2021 08:12:25 UTC

‎modules/rosa-sts-creating-a-cluster-with-customizations-ocm.adoc

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -224,6 +224,18 @@ Only persistent volumes (PVs) created from the default storage class are encrypt
224224
225225
PVs created by using any other storage class are only encrypted if the storage class is configured to be encrypted.
226226
====
227+
+
228+
... Optional. To create a customer managed KMS key, follow the procedure for link:https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html#create-symmetric-cmk[Creating symmetric encryption KMS keys].
229+
+
230+
[IMPORTANT]
231+
====
232+
The EBS operator role is required in addition to the account roles to successfully create your cluster.
233+
234+
.Example EBS Operator role
235+
`"arn:aws:iam::<aws_account_id>:role/<cluster_name>-xxxx-openshift-cluster-csi-drivers-ebs-cloud-credent"`
236+
237+
After you create your Operator Roles, you must edit the _Key Policy_ in the link:https://console.aws.amazon.com/kms[*Key Management Service (KMS)* page of the AWS Console] to add the roles.
238+
====
227239

228240
.. Click *Next*.
229241

@@ -392,6 +404,15 @@ If you specified custom ARN paths when you created the associated account-wide r
392404
====
393405
If you opted to use *Auto* mode, {cluster-manager} creates the Operator roles and the OIDC provider automatically.
394406
====
407+
+
408+
[IMPORTANT]
409+
====
410+
The EBS operator role is required in addition to the account roles to successfully create your cluster.
411+
.Example EBS Operator role
412+
`"arn:aws:iam::<aws_account_id>:role/<cluster_name>-xxxx-openshift-cluster-csi-drivers-ebs-cloud-credent"`
413+
414+
After you create your Operator Roles, you must edit the _Key Policy_ in the link:https://console.aws.amazon.com/kms[*Key Management Service (KMS)* page of the AWS Console] to add the roles.
415+
====
395416

396417
.Verification
397418

0 commit comments

Comments
 (0)