Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-38771

update the doc of AWS Load Balancer Operator on ROSA cluster

XMLWordPrintable

    • Moderate
    • None
    • 8
    • OSDOCS Sprint 258, OSDOCS Sprint 259, OSDOCS Sprint 260, OSDOCS Sprint 261
    • 4
    • False
    • Hide

      None

      Show
      None

      Description of problem:

          some details weren't available, and missing creating secrets by ccoctl, also the creating albo and albc were for normal cluster.

      Version-Release number of selected component (if applicable):

          4.16 and 4.17

      How reproducible:

        100%

      Steps to Reproduce:

      https://docs.openshift.com/rosa/networking/aws-load-balancer-operator.html  
      1. In Installing an AWS Load Balancer Operator, modify the "STS mode" to "HCP(Hosted Control Plane) mode" in the first Prerequisites
      
      2. add "rosa describe cluster --cluster=<cluster_name> | grep  -i  '^ID'" to "a. Identify the ROSA cluster INFRA ID:" in step 1
      
      a. Identify the ROSA cluster INFRA ID:
      $ rosa describe cluster --cluster=<cluster_name> | grep -i 'Infra ID'     for ROSA STS cluster
      $ rosa describe cluster --cluster=<cluster_name> | grep  -i  '^ID'        for ROSA HCP cluster
      
      or
      $ oc get infrastructure cluster -o json | jq -r '.status.infrastructureName'
      
      3. update "b. Identify the ROSA cluster OIDC DNS:" in step 1 with the following:
      
      b. Identify the ROSA cluster OIDC DNS by rosa command or oc command:
      
      $ rosa describe cluster --cluster=<cluster_name> | grep -i 'OIDC'
      
      or 
       $ oc get authentication.config cluster -o=jsonpath="{.spec.serviceAccountIssuer}"
      https://oidc.op1.openshiftapps.com/28q7fsn54m2jjts3kd556aij4mu9omah
      $
      
      here the cluster OpenID Connect (OIDC) DNS is "oidc.op1.openshiftapps.com/28q7fsn54m2jjts3kd556aij4mu9omah", 
      then you can get its aws arn on the aws web console(IAM --> Access management --> Identity providers), for example, oidc-arn here is "arn:aws:iam::777777777777:oidc-provider/rh-oidc.s3.us-east-1.amazonaws.com/28292va7ad7mr9r4he1fb09b14t59t4f"(Note: 777777777777 is your AWS AccountNo).
      
      Save the output from the commands. You will use this information in future steps within this procedure.
      
      4. update "2. Create the AWS IAM policy required for the ALBO:" with "2. Create the AWS IAM policy required for the ALBO by using the AWS CLI"
      
      5. add example output of "aws iam create-role" in c step under step 2   
      
      Example outputROLE	
      arn:aws:iam::777777777777:role/albo-operator	2023-08-02T12:13:22Z 
      ASSUMEROLEPOLICYDOCUMENT	2012-10-17
      STATEMENT	sts:AssumeRoleWithWebIdentity	Allow
      STRINGEQUALS	system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-manager
      PRINCIPAL	arn:aws:iam:777777777777:oidc-provider/<oidc-provider-id>
      
      Note the ARN of the created IAM role of ALBO, for example it is arn:aws:iam::777777777777:role/albo-operator
      
      6. please add a step "Create the AWS IAM policy required for the ALBO by using the Cloud Credential Operator utility", please refer to the steps of  Creating an AWS IAM role by using the Cloud Credential Operator utility in https://docs.openshift.com/container-platform/4.16/networking/aws_load_balancer_operator/installing-albo-sts-cluster.html
      
      7. add "by using the AWS CLI" to "3. Create the AWS IAM policy required for the AWS Load Balancer Controller (ALBC):"
      
      8. add example output of "aws iam create-role" in b step under step 3 
      
      Example output of aws iam create-role
      ROLE	arn:aws:iam::777777777777:role/albo-controller	2023-08-02T12:13:22Z 
      ASSUMEROLEPOLICYDOCUMENT	2012-10-17
      STATEMENT	sts:AssumeRoleWithWebIdentity	Allow
      STRINGEQUALS	system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-cluster
      PRINCIPAL	arn:aws:iam:777777777777:oidc-provider/<oidc-provider-id>
      
      Note the ARN of an AWS IAM role of ALBC, for example it is arn:aws:iam::777777777777:role/albo-controller here
      
      9. please add a step of "Create the AWS IAM policy required for the AWS Load Balancer Controller (ALBC) by using the Cloud Credential Operator utility", please refer the steps of "Creating an AWS IAM role for the controller by using the Cloud Credential Operator utility" in https://docs.openshift.com/container-platform/4.16/networking/aws_load_balancer_operator/installing-albo-sts-cluster.html
      
      10. add "for ROSA HCP cluster" to "4. Add the tags necessary for subnet discovery:"
      
      "4. Add the tags necessary for subnet discovery for ROSA HCP cluster:"
      
      11. in "4. Add the tags necessary for subnet discovery:", remove "*" from "* kubernetes.io/cluster/${Cluster Infra ID}:owned" in a step.
      
      12. replace the content of "5. Create ALBO" with following:
      a, Create the OperatorGroup object by running the following command:
      $ cat <<EOF | oc apply -f -
      apiVersion: operators.coreos.com/v1
      kind: OperatorGroup
      metadata:
        name: aws-load-balancer-operator
        namespace: aws-load-balancer-operator
      spec:
        targetNamespaces: []
      EOF
      
      b,Create the Subscription object by running the following command:
      $ cat <<EOF | oc apply -f -
      apiVersion: operators.coreos.com/v1alpha1
      kind: Subscription
      metadata:
        name: aws-load-balancer-operator
        namespace: aws-load-balancer-operator
      spec:
        channel: stable-v1
        name: aws-load-balancer-operator
        source: redhat-operators
        sourceNamespace: openshift-marketplace
        config:
          env:
          - name: ROLEARN
            value: "<role-arn>" 
      EOF
      
      Specifies the ARN role to be used in the CredentialsRequest to provision the AWS credentials for the AWS Load Balancer Operator. for example, it could be: "arn:aws:iam::777777777777:role/albo-operator".
      
      13. replace the content of "6. Create an AWS ALBC:" with the following
      
      a. Create a YAML file that defines the AWSLoadBalancerController object:
      Example sample-aws-lb-manual-creds.yaml file:
      apiVersion: networking.olm.openshift.io/v1
      kind: AWSLoadBalancerController 1 <--
      metadata:
        name: cluster  2 <---
      spec:
        credentialsRequestConfig:
          stsIAMRoleARN: <role-arn>  3 <---
      1. Defines the AWSLoadBalancerController object.
      2. Defines the AWS Load Balancer Controller name. All related resources use this instance name as a suffix.
      3. Specifies the ARN role of ALBC. The CredentialsRequest object uses this ARN role to provision the AWS credentials. for example, it could be: "arn:aws:iam::777777777777:role/albo-controller".

      Actual results:

        missed some details of configuring the ALBO on ROSA cluster and step 5 for ALBO and step 6 for ALBC aren't corrent 

      Expected results:

      added the detail and updated for step 5 for ALBO and step 6 for ALBC  

      Additional info:

          

              dfitzmau@redhat.com Darragh Fitzmaurice
              shudili@redhat.com Shudi Li
              Shudi Li Shudi Li
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: