Skip to content

populating-configuration.md

Latest commit

 

History

History
116 lines (98 loc) · 5.09 KB

populating-configuration.md

File metadata and controls

116 lines (98 loc) · 5.09 KB

NOTE some step in this document might refer to Red Hat internal components that you do not have access to

Populating Configuration

The document describes how to prepare Fleet Manager to be able to start by populating its configurations.

Follow all subsections to get a bootable Fleet Manager server.

Interacting with the Fleet Manager API

The Fleet Manager API requires OIDC Bearer tokens, which use the JWT format, for authentication. The token is passed as an Authorization HTTP header value.

To be able to perform requests to the Fleet Manager API, you first need to get a JWT token from the configured OIDC authentication server, which is Red Hat SSO (sso.redhat.com) by default. Assuming the default OIDC authentication server is being used, this can be performed by interacting with the OCM API. This can be easily done interacting with it through the ocm cli and retrieve OCM tokens using it. To do so:

  1. Login to your desired OCM environment via web console using your Red Hat account credentials. For example, for the OCM production environment, go to https://cloud.redhat.com and login.
  2. Get your OCM offline token by going to https://cloud.redhat.com/openshift/token
  3. Login to your desired OCM environment through the OCM CLI by providing the OCM offline token and environment information: 
    ocm login --token <ocm-offline-token> --url <ocm-api-url>
    <ocm-api-url> is the URL of the OCM API. Some shorthands can also be provided like production or staging
  4. Generate an OCM token by running: ocm token. The generated token is the token that should be used to perform a request to the Fleet Manager API. For example:
curl -H "Authorization: Bearer <result-of-ocm-token-command>" http://127.0.0.1:/8000/api/rhacs/v1

OCM tokens other than the OCM offline token have an expiration time so a new one will need to be generated when that happens

There are some additional steps needed if you want to be able to perform certain actions that have additional requirements. See the User Account & Organization Setup for more information

Setting up OCM tokens

The Fleet Manager itself requires the use of an OCM token so it can interact with OCM to perform management of Data Plane clusters.

In order for the Fleet Manager to do so, an OCM offline token should be configured. To do so, retrieve your OCM offline token and then configure it for Fleet Manager by running:

make ocm/setup OCM_OFFLINE_TOKEN=<your-retrieved-ocm-offline-token>

Setup AWS configuration

Fleet Manager interacts with AWS to provide the following functionalities:

  • To be able to create and manage Data Plane clusters in a specific AWS account by passing the needed credentials to OpenShift Cluster Management
  • To create AWS's Route53 DNS records in a specific AWS account. These records are DNS records that point to some routes related to Central instances that are created.

    NOTE: The domain name used for these records can be configured by setting the domain name to be used for Central instances. This can be done through the --central-domain-name Fleet Manager binary CLI flag For both functionalities, the same underlying AWS account is used.

In order for the Fleet Manager to be able to start, create the following files:

touch secrets/aws.accountid
touch secrets/aws.accesskey
touch secrets/aws.secretaccesskey
touch secrets/aws.route53accesskey
touch secrets/aws.route53secretaccesskey

If you need any of those functionalities keep reading. Otherwise, this section can be skipped.

To accomplish the previously mentioned functionalities Fleet Manager needs to be configured to interact with the AWS account. To do so, provide existing AWS IAM user credentials to the control plane by running:

AWS_ACCOUNT_ID=<aws-account-id> \
AWS_ACCESS_KEY=<aws-iam-user-access-key> \
AWS_SECRET_ACCESS_KEY=<aws-iam-user-secret-access-key> \
ROUTE53_ACCESS_KEY=<aws-iam-user-for-route-53-access-key> \
ROUTE53_SECRET_ACCESS_KEY=<aws-iam-user-for-route-53-secret-access-key> \
make aws/setup

NOTE: If you are in Red Hat, the following documentation might be useful to get the IAM user/s credentials

Setup RedHat SSO configuration

Our default authentication server is provided by RedHat SSO and we have to configure Fleet Manager to use it.

In order for the Fleet Manager to be able to start, create the following files:

touch secrets/redhatsso-service.clientId
touch secrets/redhatsso-service.clientSecret

If you have RedHat SSO service account defined for Fleet Manager, you can set Fleet Manager to use them by running the following command:

 SSO_CLIENT_ID="<redhatsso-client-id>" \
 SSO_CLIENT_SECRET="<redhatsso-client-secret" \
 make redhatsso/setup

Setup the data plane image pull secret

In the Data Plane cluster, the Central Operator and the FleetShard Deployments might reference container images that are located in authenticated container image registries.