Goals

Establish a common and simplified configuration experience for Cluster Logging on STS-enabled clusters using the new, standardized configuration flow described in OCPBU-559. Users have a repeatable process to configure Cluster Logging for STS with well-known inputs and behavior and can reuse the knowledge about that process with other operators.

Non-Goals

Support for any older version of OCP than 4.14.

Motivation

Today, the support for AWS STS authentication is well established in our core platform but fragmented at best among our layered products and OLM-managed operators. The configuration experience is also different between individual OLM-managed operators that support STS. OCPBU-4 aims to solve this for all cloud providers using the CloudCredentialOperator (CCO) and its CredentialRequest API.

Based on this, customers get a repeatable and simple experience of installing and configuring Cluster Logging, or any OLM-managed operator that supports it, for tokenized authentication with their cloud provider.

Cluster Logging has been identified as one of the first critical operators to support that flow to act on customer feedback from ROSA and OSD customers.

Alternatives

None.

Acceptance Criteria

• Cluster Logging implements the standardized configuration flow for STS-enabled clusters using CCO and CredentialRequests described here: https://docs.google.com/document/d/1iFNpyycby_rOY1wUew-yl3uPWlE00krTgr9XHDZOTNo/edit#
• Cluster Logging gracefully falls back to regular operations when no role ARN is provided
• Cluster Logging degrades when the role ARN is provided but CCO does not reconcile the CredentialRequest (either due to a bug or due to running on an older than OCP 4.14 release)
• Cluster Logging documents what specific IAM permissions are needed when integrating with AWS using STS and provides easy to consume instructions to create those
• Cluster Logging supports this workflow and provides the documentation from 4.14 onwards

Risk and Assumptions

• Assumption: you don't currently have an existing way to integrate with STS
• Risk: if the above assumption is wrong, you need to deprecate this configuration flow in favor of the flow defined in OCPBU-559

Documentation Considerations

• Cluster Logging should rely on documentation the OLM portion of the OCP docs on how to carry out the configuration flow using either the OCP console or the CLI
• Cluster Logging in its own documentation section shall supply the required IAM credential instructions

Open Questions

Additional Notes

• Upstream dev helper: https://github.com/cahartma/cluster-logging-operator/blob/master/hack/aws-sts-cluster-install.sh
• Current STS Logging Docs: https://docs.openshift.com/container-platform/4.13/logging/cluster-logging-external.html#cluster-logging-collector-log-forward-sts-cloudwatch_cluster-logging-external