-
Bug
-
Resolution: Done
-
Undefined
-
4.16
-
Moderate
-
None
-
8
-
OSDOCS Sprint 258, OSDOCS Sprint 259, OSDOCS Sprint 260, OSDOCS Sprint 261
-
4
-
False
-
Description of problem:
some details weren't available, and missing creating secrets by ccoctl, also the creating albo and albc were for normal cluster.
Version-Release number of selected component (if applicable):
4.16 and 4.17
How reproducible:
100%
Steps to Reproduce:
https://docs.openshift.com/rosa/networking/aws-load-balancer-operator.html 1. In Installing an AWS Load Balancer Operator, modify the "STS mode" to "HCP(Hosted Control Plane) mode" in the first Prerequisites 2. add "rosa describe cluster --cluster=<cluster_name> | grep -i '^ID'" to "a. Identify the ROSA cluster INFRA ID:" in step 1 a. Identify the ROSA cluster INFRA ID: $ rosa describe cluster --cluster=<cluster_name> | grep -i 'Infra ID' for ROSA STS cluster $ rosa describe cluster --cluster=<cluster_name> | grep -i '^ID' for ROSA HCP cluster or $ oc get infrastructure cluster -o json | jq -r '.status.infrastructureName' 3. update "b. Identify the ROSA cluster OIDC DNS:" in step 1 with the following: b. Identify the ROSA cluster OIDC DNS by rosa command or oc command: $ rosa describe cluster --cluster=<cluster_name> | grep -i 'OIDC' or $ oc get authentication.config cluster -o=jsonpath="{.spec.serviceAccountIssuer}" https://oidc.op1.openshiftapps.com/28q7fsn54m2jjts3kd556aij4mu9omah $ here the cluster OpenID Connect (OIDC) DNS is "oidc.op1.openshiftapps.com/28q7fsn54m2jjts3kd556aij4mu9omah", then you can get its aws arn on the aws web console(IAM --> Access management --> Identity providers), for example, oidc-arn here is "arn:aws:iam::777777777777:oidc-provider/rh-oidc.s3.us-east-1.amazonaws.com/28292va7ad7mr9r4he1fb09b14t59t4f"(Note: 777777777777 is your AWS AccountNo). Save the output from the commands. You will use this information in future steps within this procedure. 4. update "2. Create the AWS IAM policy required for the ALBO:" with "2. Create the AWS IAM policy required for the ALBO by using the AWS CLI" 5. add example output of "aws iam create-role" in c step under step 2 Example outputROLE arn:aws:iam::777777777777:role/albo-operator 2023-08-02T12:13:22Z ASSUMEROLEPOLICYDOCUMENT 2012-10-17 STATEMENT sts:AssumeRoleWithWebIdentity Allow STRINGEQUALS system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-manager PRINCIPAL arn:aws:iam:777777777777:oidc-provider/<oidc-provider-id> Note the ARN of the created IAM role of ALBO, for example it is arn:aws:iam::777777777777:role/albo-operator 6. please add a step "Create the AWS IAM policy required for the ALBO by using the Cloud Credential Operator utility", please refer to the steps of Creating an AWS IAM role by using the Cloud Credential Operator utility in https://docs.openshift.com/container-platform/4.16/networking/aws_load_balancer_operator/installing-albo-sts-cluster.html 7. add "by using the AWS CLI" to "3. Create the AWS IAM policy required for the AWS Load Balancer Controller (ALBC):" 8. add example output of "aws iam create-role" in b step under step 3 Example output of aws iam create-role ROLE arn:aws:iam::777777777777:role/albo-controller 2023-08-02T12:13:22Z ASSUMEROLEPOLICYDOCUMENT 2012-10-17 STATEMENT sts:AssumeRoleWithWebIdentity Allow STRINGEQUALS system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-cluster PRINCIPAL arn:aws:iam:777777777777:oidc-provider/<oidc-provider-id> Note the ARN of an AWS IAM role of ALBC, for example it is arn:aws:iam::777777777777:role/albo-controller here 9. please add a step of "Create the AWS IAM policy required for the AWS Load Balancer Controller (ALBC) by using the Cloud Credential Operator utility", please refer the steps of "Creating an AWS IAM role for the controller by using the Cloud Credential Operator utility" in https://docs.openshift.com/container-platform/4.16/networking/aws_load_balancer_operator/installing-albo-sts-cluster.html 10. add "for ROSA HCP cluster" to "4. Add the tags necessary for subnet discovery:" "4. Add the tags necessary for subnet discovery for ROSA HCP cluster:" 11. in "4. Add the tags necessary for subnet discovery:", remove "*" from "* kubernetes.io/cluster/${Cluster Infra ID}:owned" in a step. 12. replace the content of "5. Create ALBO" with following: a, Create the OperatorGroup object by running the following command: $ cat <<EOF | oc apply -f - apiVersion: operators.coreos.com/v1 kind: OperatorGroup metadata: name: aws-load-balancer-operator namespace: aws-load-balancer-operator spec: targetNamespaces: [] EOF b,Create the Subscription object by running the following command: $ cat <<EOF | oc apply -f - apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: name: aws-load-balancer-operator namespace: aws-load-balancer-operator spec: channel: stable-v1 name: aws-load-balancer-operator source: redhat-operators sourceNamespace: openshift-marketplace config: env: - name: ROLEARN value: "<role-arn>" EOF Specifies the ARN role to be used in the CredentialsRequest to provision the AWS credentials for the AWS Load Balancer Operator. for example, it could be: "arn:aws:iam::777777777777:role/albo-operator". 13. replace the content of "6. Create an AWS ALBC:" with the following a. Create a YAML file that defines the AWSLoadBalancerController object: Example sample-aws-lb-manual-creds.yaml file: apiVersion: networking.olm.openshift.io/v1 kind: AWSLoadBalancerController 1 <-- metadata: name: cluster 2 <--- spec: credentialsRequestConfig: stsIAMRoleARN: <role-arn> 3 <--- 1. Defines the AWSLoadBalancerController object. 2. Defines the AWS Load Balancer Controller name. All related resources use this instance name as a suffix. 3. Specifies the ARN role of ALBC. The CredentialsRequest object uses this ARN role to provision the AWS credentials. for example, it could be: "arn:aws:iam::777777777777:role/albo-controller".
Actual results:
missed some details of configuring the ALBO on ROSA cluster and step 5 for ALBO and step 6 for ALBC aren't corrent
Expected results:
added the detail and updated for step 5 for ALBO and step 6 for ALBC
Additional info:
- is cloned by
-
OCPBUGS-43373 Mention SDN removal in ROSA docs
-
- Closed
-
- is related to
-
OCPBUGS-38762 update the doc for ALBO on a cluster using the AWS Security Token Service
-
- Closed
-
- links to