Skip to content

Commit f0b5d95

Browse files
EricPonvelleEricPonvelle
committed
OSDOCS-7769: Migrated the Cloudwatch and STS topic from MOBB docs to ROSA product docs
1 parent 5be3956 commit f0b5d95

File tree

2 files changed

+303
-0
lines changed

2 files changed

+303
-0
lines changed

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,8 @@ Topics:
8888
File: rosa-mobb-configure-custom-tls-ciphers
8989
- Name: Verifying Permissions for a ROSA STS Deployment
9090
File: rosa-mobb-verify-permissions-sts-deployment
91+
- Name: Configuring the Cluster Log Forwarder for Cloudwatch logs and STS
92+
File: rosa-mobb-cloudwatch-sts
9193
---
9294
Name: Getting started
9395
Dir: rosa_getting_started

‎cloud_experts_tutorials/rosa-mobb-cloudwatch-sts.adoc

Lines changed: 301 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,301 @@
1+
:_content-type: ASSEMBLY
2+
[id="rosa-mobb-cloudwatch-sts"]
3+
= Tutorial: Configuring the Cluster Log Forwarder for Cloudwatch logs and STS
4+
include::_attributes/attributes-openshift-dedicated.adoc[]
5+
:context: rosa-mobb-cloudwatch-sts
6+
7+
toc::[]
8+
9+
//Mobb content metadata
10+
//Brought into ROSA product docs 2023-09-18
11+
//---
12+
// date: '2022-08-19'
13+
// date:
14+
// title: Configuring the Cluster Log Forwarder for CloudWatch Logs and STS
15+
// tags: ["AWS", "ROSA"]
16+
// authors:
17+
// - Paul Czarkowski
18+
// - Connor Wooley
19+
// ---
20+
21+
This guide shows how to deploy the Cluster Log Forwarder Operator and configure it to use STS authentication to forward logs to CloudWatch.
22+
23+
[id="rosa-mobb-cloudwatch-sts-prerequisites"]
24+
== Prerequisites
25+
26+
* A ROSA cluster (configured with STS)
27+
* The `jq` cli command
28+
* The `aws` cli command
29+
30+
[id="rosa-mobb-cloudwatch-sts-environmental-setup"]
31+
== Environment Setup
32+
33+
* Configure the following environment variables:
34+
+
35+
[NOTE]
36+
====
37+
Change the cluster name to match your ROSA cluster and ensure you are logged into the cluster as an Administrator. Ensure all fields are outputted correctly before moving on.
38+
====
39+
+
40+
[source,terminal]
41+
----
42+
$ export ROSA_CLUSTER_NAME=$(oc get infrastructure cluster -o=jsonpath="{.status.infrastructureName}" | sed 's/-[a-z0-9]\{5\}$//')
43+
$ export REGION=$(rosa describe cluster -c ${ROSA_CLUSTER_NAME} --output json | jq -r .region.id)
44+
$ export OIDC_ENDPOINT=$(oc get authentication.config.openshift.io cluster -o json | jq -r .spec.serviceAccountIssuer | sed 's|^https://||')
45+
$ export AWS_ACCOUNT_ID=`aws sts get-caller-identity --query Account --output text`
46+
$ export AWS_PAGER=""
47+
$ export SCRATCH="/tmp/${ROSA_CLUSTER_NAME}/clf-cloudwatch-sts"
48+
$ mkdir -p ${SCRATCH}
49+
$ echo "Cluster: ${ROSA_CLUSTER_NAME}, Region: ${REGION}, OIDC Endpoint: ${OIDC_ENDPOINT}, AWS Account ID: ${AWS_ACCOUNT_ID}"
50+
----
51+
52+
[id="rosa-mobb-cloudwatch-sts-prep-aws"]
53+
== Prepare AWS Account
54+
55+
. Create an IAM policy for OpenShift Log Forwarding:
56+
+
57+
[source,terminal]
58+
----
59+
$ POLICY_ARN=$(aws iam list-policies --query "Policies[?PolicyName=='RosaCloudWatch'].{ARN:Arn}" --output text)
60+
$ if [[ -z "${POLICY_ARN}" ]]; then
61+
cat << EOF > ${SCRATCH}/policy.json
62+
{
63+
"Version": "2012-10-17",
64+
"Statement": [
65+
{
66+
"Effect": "Allow",
67+
"Action": [
68+
"logs:CreateLogGroup",
69+
"logs:CreateLogStream",
70+
"logs:DescribeLogGroups",
71+
"logs:DescribeLogStreams",
72+
"logs:PutLogEvents",
73+
"logs:PutRetentionPolicy"
74+
],
75+
"Resource": "arn:aws:logs:*:*:*"
76+
}
77+
]
78+
}
79+
EOF
80+
POLICY_ARN=$(aws iam create-policy --policy-name "RosaCloudWatch" \
81+
--policy-document file:///${SCRATCH}/policy.json --query Policy.Arn --output text)
82+
fi
83+
$ echo ${POLICY_ARN}
84+
----
85+
86+
. Create an IAM role trust policy for the cluster:
87+
+
88+
[source,terminal]
89+
----
90+
$ cat <<EOF > ${SCRATCH}/trust-policy.json
91+
{
92+
"Version": "2012-10-17",
93+
"Statement": [{
94+
"Effect": "Allow",
95+
"Principal": {
96+
"Federated": "arn:aws:iam::${AWS_ACCOUNT_ID}:oidc-provider/${OIDC_ENDPOINT}"
97+
},
98+
"Action": "sts:AssumeRoleWithWebIdentity",
99+
"Condition": {
100+
"StringEquals": {
101+
"${OIDC_ENDPOINT}:sub": "system:serviceaccount:openshift-logging:logcollector"
102+
}
103+
}
104+
}]
105+
}
106+
EOF
107+
$ ROLE_ARN=$(aws iam create-role --role-name "${ROSA_CLUSTER_NAME}-RosaCloudWatch" \
108+
--assume-role-policy-document file://${SCRATCH}/trust-policy.json \
109+
--query Role.Arn --output text)
110+
$ echo ${ROLE_ARN}
111+
----
112+
113+
. Attach the IAM policy to the IAM role:
114+
+
115+
[source,terminal]
116+
----
117+
$ aws iam attach-role-policy --role-name "${ROSA_CLUSTER_NAME}-RosaCloudWatch" \
118+
--policy-arn ${POLICY_ARN}
119+
----
120+
121+
[id="rosa-mobb-cloudwatch-sts-deploy-Os"]
122+
== Deploy Operators
123+
124+
. Deploy the Cluster Logging Operator:
125+
+
126+
[source,terminal]
127+
----
128+
$ cat << EOF | oc apply -f -
129+
apiVersion: operators.coreos.com/v1alpha1
130+
kind: Subscription
131+
metadata:
132+
labels:
133+
operators.coreos.com/cluster-logging.openshift-logging: ""
134+
name: cluster-logging
135+
namespace: openshift-logging
136+
spec:
137+
channel: stable
138+
installPlanApproval: Automatic
139+
name: cluster-logging
140+
source: redhat-operators
141+
sourceNamespace: openshift-marketplace
142+
EOF
143+
----
144+
145+
. Create a secret:
146+
+
147+
[source,terminal]
148+
----
149+
$ cat << EOF | oc apply -f -
150+
apiVersion: v1
151+
kind: Secret
152+
metadata:
153+
name: cloudwatch-credentials
154+
namespace: openshift-logging
155+
stringData:
156+
role_arn: $ROLE_ARN
157+
EOF
158+
----
159+
160+
[id="rosa-mobb-cloudwatch-sts-configure-cluster-logging"]
161+
== Configure cluster logging
162+
163+
. Create a cluster log forwarding resource:
164+
+
165+
[source,terminal]
166+
----
167+
$ cat << EOF | oc apply -f -
168+
apiVersion: "logging.openshift.io/v1"
169+
kind: ClusterLogForwarder
170+
metadata:
171+
name: instance
172+
namespace: openshift-logging
173+
spec:
174+
outputs:
175+
- name: cw
176+
type: cloudwatch
177+
cloudwatch:
178+
groupBy: namespaceName
179+
groupPrefix: rosa-${ROSA_CLUSTER_NAME}
180+
region: ${REGION}
181+
secret:
182+
name: cloudwatch-credentials
183+
pipelines:
184+
- name: to-cloudwatch
185+
inputRefs:
186+
- infrastructure
187+
- audit
188+
- application
189+
outputRefs:
190+
- cw
191+
EOF
192+
----
193+
194+
. Create a cluster logging resource:
195+
+
196+
[source,terminal]
197+
----
198+
$ cat << EOF | oc apply -f -
199+
apiVersion: logging.openshift.io/v1
200+
kind: ClusterLogging
201+
metadata:
202+
name: instance
203+
namespace: openshift-logging
204+
spec:
205+
collection:
206+
logs:
207+
type: vector
208+
managementState: Managed
209+
EOF
210+
----
211+
212+
[id="rosa-mobb-cloudwatch-sts-check-aws"]
213+
== Check AWS CloudWatch for logs
214+
215+
* Use the AWS console or CLI to validate that there are log streams from the cluster:
216+
+
217+
[NOTE]
218+
====
219+
If this is a fresh cluster, you may not see a log group for `application` logs as there are no applications running yet.
220+
====
221+
+
222+
[source,terminal]
223+
----
224+
$ aws logs describe-log-groups --log-group-name-prefix rosa-${ROSA_CLUSTER_NAME}
225+
----
226+
+
227+
.Sample output
228+
+
229+
[source,c]
230+
----
231+
{
232+
"logGroups": [
233+
{
234+
"logGroupName": "rosa-xxxx.audit",
235+
"creationTime": 1661286368369,
236+
"metricFilterCount": 0,
237+
"arn": "arn:aws:logs:us-east-2:xxxx:log-group:rosa-xxxx.audit:*",
238+
"storedBytes": 0
239+
},
240+
{
241+
"logGroupName": "rosa-xxxx.infrastructure",
242+
"creationTime": 1661286369821,
243+
"metricFilterCount": 0,
244+
"arn": "arn:aws:logs:us-east-2:xxxx:log-group:rosa-xxxx.infrastructure:*",
245+
"storedBytes": 0
246+
}
247+
]
248+
}
249+
----
250+
251+
[id="rosa-mobb-cloudwatch-sts-clean-up"]
252+
== Clean Up
253+
254+
. Delete the cluster log forwarding resource:
255+
+
256+
[source,terminal]
257+
----
258+
$ oc delete -n openshift-logging clusterlogforwarder instance
259+
----
260+
261+
. Delete the cluster logging resource:
262+
+
263+
[source,terminal]
264+
----
265+
$ oc delete -n openshift-logging clusterlogging instance
266+
----
267+
268+
. Detach the IAM policy to the IAM role:
269+
+
270+
[source,terminal]
271+
----
272+
$ aws iam detach-role-policy --role-name "${ROSA_CLUSTER_NAME}-RosaCloudWatch" \
273+
--policy-arn "${POLICY_ARN}"
274+
----
275+
276+
. Delete the IAM role:
277+
+
278+
[source,terminal]
279+
----
280+
$ aws iam delete-role --role-name "${ROSA_CLUSTER_NAME}-RosaCloudWatch"
281+
----
282+
283+
. Delete the IAM policy:
284+
+
285+
[NOTE]
286+
====
287+
Only run this command if there are no other resources using the policy.
288+
====
289+
+
290+
[source,terminal]
291+
----
292+
$ aws iam delete-policy --policy-arn "${POLICY_ARN}"
293+
----
294+
295+
. Delete the CloudWatch Log Groups:
296+
+
297+
[source,terminal]
298+
----
299+
$ aws logs delete-log-group --log-group-name "rosa-${ROSA_CLUSTER_NAME}.audit"
300+
$ aws logs delete-log-group --log-group-name "rosa-${ROSA_CLUSTER_NAME}.infrastructure"
301+
----

0 commit comments

Comments
 (0)