OCPBUGS-15609: docs - add AWS CLI commands for STS instructions #97

alebedev87 · 2023-08-02T12:28:53Z

This PR updates the documentation about the manual configuration for STS clusters. The main goal is to provide AWS CLI commands as alternative to ccoctl commands because the latter

is not available on some OSes (Mac, Windows)
cannot be installed in a convenient way
not transparent about the AWS permissions it takes from the user's AWS credentials

Makefile's generate target is updated to generate the missing permission policy for the operator. This permission policy is required by AWS to create a IAM role.

Manual test on ROSA STS cluster:

$ oc get awsloadbalancercontroller cluster -o yaml | yq .spec
credentials:
  name: aws-load-balancer-controller-cluster
ingressClass: alb
subnetTagging: Auto

$ oc -n aws-load-balancer-operator get pods
NAME                                                            READY   STATUS    RESTARTS   AGE
aws-load-balancer-controller-cluster-64697c78bf-chdkn           1/1     Running   0          16m
aws-load-balancer-operator-controller-manager-c67f6b5cf-gvxgs   2/2     Running   0          166m

$ oc -n aws-load-balancer-operator get pods aws-load-balancer-controller-cluster-64697c78bf-chdkn -o yaml | yq .spec.volumes
- name: aws-credentials
  secret:
    defaultMode: 420
    secretName: aws-load-balancer-controller-cluster
    
$ oc -n aws-load-balancer-operator get pods aws-load-balancer-operator-controller-manager-c67f6b5cf-gvxgs -o yaml | yq .spec.volumes
- name: aws-credentials
  secret:
    defaultMode: 420
    items:
      - key: credentials
        path: credentials
    secretName: aws-load-balancer-operator
  
$ oc -n aws-load-balancer-operator get secret aws-load-balancer-operator -o yaml | yq .data.credentials | base64 -d 
[default]
sts_regional_endpoints = regional
role_arn = arn:aws:iam::269733383066:role/albo-operator
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token

$ oc -n aws-load-balancer-operator get secret aws-load-balancer-controller-cluster -o yaml | yq .data.credentials | base64 -d 
[default]
sts_regional_endpoints = regional
role_arn = arn:aws:iam::269733383066:role/albo-controller
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token

openshift-ci-robot · 2023-08-02T12:28:59Z

@alebedev87: This pull request references Jira Issue OCPBUGS-15609, which is invalid:

expected the bug to target the "4.14.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

This PR updates the documentation about the manual configuration for STS clusters. The main goal is to provide AWS CLI commands as alternative to ccoctl commands because the latter

is not available on some OSes (Mac, Windows)

doesn't provide a convenient way for the installation

not transparent about the AWS permissions it takes from the user's AWS credentials

Makefile's generate target is updated to generated the missing permission policy for the operator. This permission policy is required by AWS to create IAM role.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2023-08-02T12:36:24Z

@alebedev87: This pull request references Jira Issue OCPBUGS-15609, which is invalid:

expected the bug to target the "4.14.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

This PR updates the documentation about the manual configuration for STS clusters. The main goal is to provide AWS CLI commands as alternative to ccoctl commands because the latter

is not available on some OSes (Mac, Windows)
doesn't provide a convenient way for the installation
not transparent about the AWS permissions it takes from the user's AWS credentials

Makefile's generate target is updated to generated the missing permission policy for the operator. This permission policy is required by AWS to create IAM role.

Manual test on ROSA STS cluster:

$ oc get awsloadbalancercontroller cluster -o yaml | yq .spec
credentials:
 name: aws-load-balancer-controller-cluster
ingressClass: alb
subnetTagging: Auto

$ oc -n aws-load-balancer-operator get pods
NAME                                                            READY   STATUS    RESTARTS   AGE
aws-load-balancer-controller-cluster-64697c78bf-chdkn           1/1     Running   0          16m
aws-load-balancer-operator-controller-manager-c67f6b5cf-gvxgs   2/2     Running   0          166m

$ oc -n aws-load-balancer-operator get pods aws-load-balancer-controller-cluster-64697c78bf-chdkn -o yaml | yq .spec.volumes
- name: aws-credentials
 secret:
   defaultMode: 420
   secretName: aws-load-balancer-controller-cluster
   
$ oc -n aws-load-balancer-operator get pods aws-load-balancer-operator-controller-manager-c67f6b5cf-gvxgs -o yaml | yq .spec.volumes
- name: aws-credentials
 secret:
   defaultMode: 420
   items:
     - key: credentials
       path: credentials
   secretName: aws-load-balancer-operator
 
$ oc -n aws-load-balancer-operator get secret aws-load-balancer-operator -o yaml | yq .data.credentials | base64 -d 
[default]
sts_regional_endpoints = regional
role_arn = arn:aws:iam::269733383066:role/albo-operator
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token

$ oc -n aws-load-balancer-operator get secret aws-load-balancer-controller-cluster -o yaml | yq .data.credentials | base64 -d 
[default]
sts_regional_endpoints = regional
role_arn = arn:aws:iam::269733383066:role/albo-controller
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

alebedev87 · 2023-08-02T12:37:32Z

/jira refresh

openshift-ci-robot · 2023-08-02T12:37:35Z

@alebedev87: This pull request references Jira Issue OCPBUGS-15609, which is invalid:

expected the bug to target the "4.14.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

alebedev87 · 2023-08-02T12:50:37Z

/jira refresh

openshift-ci-robot · 2023-08-02T12:50:41Z

@alebedev87: This pull request references Jira Issue OCPBUGS-15609, which is invalid:

expected the bug to target the "4.14.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

alebedev87 · 2023-08-02T12:51:35Z

/jira refresh

openshift-ci-robot · 2023-08-02T12:51:43Z

@alebedev87: This pull request references Jira Issue OCPBUGS-15609, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.14.0) matches configured target version for branch (4.14.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @ShudiLi

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2023-08-02T15:12:51Z

@alebedev87: This pull request references Jira Issue OCPBUGS-15609, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.14.0) matches configured target version for branch (4.14.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @ShudiLi

In response to this:

This PR updates the documentation about the manual configuration for STS clusters. The main goal is to provide AWS CLI commands as alternative to ccoctl commands because the latter

is not available on some OSes (Mac, Windows)
doesn't provide a convenient way for the installation
not transparent about the AWS permissions it takes from the user's AWS credentials

Makefile's generate target is updated to generate the missing permission policy for the operator. This permission policy is required by AWS to create a IAM role.

Manual test on ROSA STS cluster:

$ oc get awsloadbalancercontroller cluster -o yaml | yq .spec
credentials:
 name: aws-load-balancer-controller-cluster
ingressClass: alb
subnetTagging: Auto

$ oc -n aws-load-balancer-operator get pods
NAME                                                            READY   STATUS    RESTARTS   AGE
aws-load-balancer-controller-cluster-64697c78bf-chdkn           1/1     Running   0          16m
aws-load-balancer-operator-controller-manager-c67f6b5cf-gvxgs   2/2     Running   0          166m

$ oc -n aws-load-balancer-operator get pods aws-load-balancer-controller-cluster-64697c78bf-chdkn -o yaml | yq .spec.volumes
- name: aws-credentials
 secret:
   defaultMode: 420
   secretName: aws-load-balancer-controller-cluster
   
$ oc -n aws-load-balancer-operator get pods aws-load-balancer-operator-controller-manager-c67f6b5cf-gvxgs -o yaml | yq .spec.volumes
- name: aws-credentials
 secret:
   defaultMode: 420
   items:
     - key: credentials
       path: credentials
   secretName: aws-load-balancer-operator
 
$ oc -n aws-load-balancer-operator get secret aws-load-balancer-operator -o yaml | yq .data.credentials | base64 -d 
[default]
sts_regional_endpoints = regional
role_arn = arn:aws:iam::269733383066:role/albo-operator
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token

$ oc -n aws-load-balancer-operator get secret aws-load-balancer-controller-cluster -o yaml | yq .data.credentials | base64 -d 
[default]
sts_regional_endpoints = regional
role_arn = arn:aws:iam::269733383066:role/albo-controller
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2023-08-09T15:17:45Z

@alebedev87: This pull request references Jira Issue OCPBUGS-15609, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.14.0) matches configured target version for branch (4.14.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @ShudiLi

In response to this:

This PR updates the documentation about the manual configuration for STS clusters. The main goal is to provide AWS CLI commands as alternative to ccoctl commands because the latter

is not available on some OSes (Mac, Windows)
cannot be installed in a convenient way
not transparent about the AWS permissions it takes from the user's AWS credentials

Makefile's generate target is updated to generate the missing permission policy for the operator. This permission policy is required by AWS to create a IAM role.

Manual test on ROSA STS cluster:

$ oc get awsloadbalancercontroller cluster -o yaml | yq .spec
credentials:
 name: aws-load-balancer-controller-cluster
ingressClass: alb
subnetTagging: Auto

$ oc -n aws-load-balancer-operator get pods
NAME                                                            READY   STATUS    RESTARTS   AGE
aws-load-balancer-controller-cluster-64697c78bf-chdkn           1/1     Running   0          16m
aws-load-balancer-operator-controller-manager-c67f6b5cf-gvxgs   2/2     Running   0          166m

$ oc -n aws-load-balancer-operator get pods aws-load-balancer-controller-cluster-64697c78bf-chdkn -o yaml | yq .spec.volumes
- name: aws-credentials
 secret:
   defaultMode: 420
   secretName: aws-load-balancer-controller-cluster
   
$ oc -n aws-load-balancer-operator get pods aws-load-balancer-operator-controller-manager-c67f6b5cf-gvxgs -o yaml | yq .spec.volumes
- name: aws-credentials
 secret:
   defaultMode: 420
   items:
     - key: credentials
       path: credentials
   secretName: aws-load-balancer-operator
 
$ oc -n aws-load-balancer-operator get secret aws-load-balancer-operator -o yaml | yq .data.credentials | base64 -d 
[default]
sts_regional_endpoints = regional
role_arn = arn:aws:iam::269733383066:role/albo-operator
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token

$ oc -n aws-load-balancer-operator get secret aws-load-balancer-controller-cluster -o yaml | yq .data.credentials | base64 -d 
[default]
sts_regional_endpoints = regional
role_arn = arn:aws:iam::269733383066:role/albo-controller
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

candita · 2023-08-23T17:13:44Z

/assign

docs/install.md

candita · 2023-08-23T23:22:23Z

docs/install.md

 secret needs to be provisioned manually. The **aws-load-balancer-operator** will wait until the required
 secret is created and available before spawning the **aws-load-balancer-controller** pod.

-#### Pre-Requisites
+### Post operator installation


Just add a little intro. Something like this, but tweak to make it correct.

Suggested change

### Post operator installation

### Post operator installation

There are three ways to manually create the required `CredentialsRequest`s. You can use the `ccoctl` binary on ____, but not on MacOS. Use the `ccoctl` binary to to use the `CredentialsRequest` created by the operator, or use a predefined Secret. Use the AWS CLI to create a predefined Secret if you prefer not to use `ccoctl`, or are running the process on MacOS.

An intro is added.

docs/install.md

candita · 2023-08-23T23:29:04Z

docs/install.md

+In case the provisioning of the credentials secret should not be done by the **cloud-credential-operator**, the secret can to be explicitly referenced in `AWSLoadBalancerController` CR, see [credentials.name field description](./tutorial.md#credentialsname).
+The credentials secret needs to reference a role with all the policies needed by the controller. There are multiple options of how to create the credentials secret.


Suggested change

In case the provisioning of the credentials secret should not be done by the **cloud-credential-operator**, the secret can to be explicitly referenced in `AWSLoadBalancerController` CR, see [credentials.name field description](./tutorial.md#credentialsname).

The credentials secret needs to reference a role with all the policies needed by the controller. There are multiple options of how to create the credentials secret.

In some cases, the provisioning of the credentials secret cannot be done by the **cloud-credential-operator**, e.g. on the MacOS. Instead, the secret can be explicitly referenced in the `AWSLoadBalancerController` CR, see [credentials.name field description](./tutorial.md#credentialsname).

The credentials secret needs to reference a role with all the policies needed by the controller.

There are two options for creating the credentials secret. Use Option 1 with `ccoctl`, or Option 2 with the AWS CLI.

Applied with some edits.

docs/install.md

candita · 2023-08-23T23:36:20Z

hack/generate-iam-from-credrequest.sh

+
+CR_FILE="${1:-operator-credentials-request.yaml}"
+POLICY_FILE="${2:-operator-permission-policy.json}"
+YQ_BIN="go run github.com/mikefarah/yq/v4"


Does the user already have access to the go binary?

This script is run as a part of make generate rule which is used during the building of the operator binary. So, it's assumed that the user has go toolchain.

alebedev87 · 2023-08-30T14:17:03Z

Remove unnecessary diff introduced by a wrong indent in docs/prerequisites.md.

ShudiLi · 2023-09-01T11:28:03Z

After created a rosa sts cluster and followed the steps, both the aws lb operator pods and aws lb controller pod are created successfully.

`
1.
sh-3.2# rosa list cluster
ID NAME STATE TOPOLOGY
25vfjt0bu7pb59famhcql5q5a3ibai36 sdli0901 ready Classic (STS)
sh-3.2#
2.
sh-3.2# oc get clusterversion
NAME VERSION AVAILABLE PROGRESSING SINCE STATUS
version 4.13.9 True False 7h52m Cluster version is 4.13.9
sh-3.2#
3.
sh-3.2# oc -n aws-load-balancer-operator get all
NAME READY STATUS RESTARTS AGE
pod/aws-load-balancer-controller-cluster-64df4bfdb5-drkxv 1/1 Running 0 13m
pod/aws-load-balancer-operator-controller-manager-85795d888f-gslh5 2/2 Running 0 48m

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/aws-load-balancer-controller-cluster ClusterIP 172.30.184.165 9443/TCP,8080/TCP 13m
service/aws-load-balancer-operator-controller-manager-metrics-service ClusterIP 172.30.233.192 8443/TCP 48m
service/aws-load-balancer-operator-controller-manager-service ClusterIP 172.30.140.145 443/TCP 48m
service/aws-load-balancer-operator-webhook-service ClusterIP 172.30.86.202 443/TCP 48m

NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/aws-load-balancer-controller-cluster 1/1 1 1 13m
deployment.apps/aws-load-balancer-operator-controller-manager 1/1 1 1 48m

NAME DESIRED CURRENT READY AGE
replicaset.apps/aws-load-balancer-controller-cluster-64df4bfdb5 1 1 1 13m
replicaset.apps/aws-load-balancer-operator-controller-manager-85795d888f 1 1 1 48m
sh-3.2#
`
/lgtm
thanks

docs/install.md

candita · 2023-09-06T21:54:15Z

docs/install.md


-#### [Extract and prepare the `ccoctl` binary](https://docs.openshift.com/container-platform/4.11/authentication/managing_cloud_provider_credentials/cco-mode-sts.html#cco-ccoctl-configuring_cco-mode-sts)
+The generated credentials secret can either be awaited by the controller pod already or can be configured in the credentials field of the AWSLoadBalancerController prior to creating the controller.


It's not clear what "awaited by the controller pod already" means here.

Rephrased to

The controller pod will wait for the generated credentials secret if AWSLoadBalancerController already exists or it can be configured in the credentials field of AWSLoadBalancerController before its creation.

candita · 2023-09-06T22:04:54Z

docs/install.md

+- Using a pre-defined `CredentialsRequest` from this repository for an `AWSLoadBalancerController` that has not yet been created.
+- Employing AWS CLI commands for an `AWSLoadBalancerController` that has not yet been created.


I'm not sure what happened here, but this doesn't match the titles of the three ways you listed below, which are something like:

Use CredentialsRequest created by the operator

Use a Predefined Secret and ccoctl

Use a Predefined Secret and the AWS CLI

Rephrased to better to match the titles.
My idea was to keep it focused on the functional aspect - creation of the IAM resources. The choice of the concrete client (ccoctl or aws) was supposed to be a technical detail to be described down the document.

docs/install.md

docs/prerequisites.md

openshift-ci · 2023-09-12T10:26:24Z

@alebedev87: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

candita · 2023-09-12T15:15:14Z

/lgtm
/approve

openshift-ci · 2023-09-12T15:15:44Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: candita

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [candita]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

ahardin-rh · 2023-09-12T15:19:12Z

/docs-approved

openshift-ci-robot · 2023-09-12T15:19:40Z

@alebedev87: Jira Issue OCPBUGS-15609: All pull requests linked via external trackers have merged:

openshift/aws-load-balancer-operator#97

Jira Issue OCPBUGS-15609 has been moved to the MODIFIED state.

In response to this:

This PR updates the documentation about the manual configuration for STS clusters. The main goal is to provide AWS CLI commands as alternative to ccoctl commands because the latter

is not available on some OSes (Mac, Windows)
cannot be installed in a convenient way
not transparent about the AWS permissions it takes from the user's AWS credentials

Makefile's generate target is updated to generate the missing permission policy for the operator. This permission policy is required by AWS to create a IAM role.

Manual test on ROSA STS cluster:

$ oc get awsloadbalancercontroller cluster -o yaml | yq .spec
credentials:
 name: aws-load-balancer-controller-cluster
ingressClass: alb
subnetTagging: Auto

$ oc -n aws-load-balancer-operator get pods
NAME                                                            READY   STATUS    RESTARTS   AGE
aws-load-balancer-controller-cluster-64697c78bf-chdkn           1/1     Running   0          16m
aws-load-balancer-operator-controller-manager-c67f6b5cf-gvxgs   2/2     Running   0          166m

$ oc -n aws-load-balancer-operator get pods aws-load-balancer-controller-cluster-64697c78bf-chdkn -o yaml | yq .spec.volumes
- name: aws-credentials
 secret:
   defaultMode: 420
   secretName: aws-load-balancer-controller-cluster
   
$ oc -n aws-load-balancer-operator get pods aws-load-balancer-operator-controller-manager-c67f6b5cf-gvxgs -o yaml | yq .spec.volumes
- name: aws-credentials
 secret:
   defaultMode: 420
   items:
     - key: credentials
       path: credentials
   secretName: aws-load-balancer-operator
 
$ oc -n aws-load-balancer-operator get secret aws-load-balancer-operator -o yaml | yq .data.credentials | base64 -d 
[default]
sts_regional_endpoints = regional
role_arn = arn:aws:iam::269733383066:role/albo-operator
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token

$ oc -n aws-load-balancer-operator get secret aws-load-balancer-controller-cluster -o yaml | yq .data.credentials | base64 -d 
[default]
sts_regional_endpoints = regional
role_arn = arn:aws:iam::269733383066:role/albo-controller
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

…shift#97)

openshift-ci bot requested review from Miciah and thejasn August 2, 2023 12:30

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 2, 2023

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Aug 2, 2023

openshift-ci bot requested a review from ShudiLi August 2, 2023 12:52

openshift-ci bot assigned candita Aug 23, 2023

candita reviewed Aug 23, 2023

View reviewed changes

docs/install.md Outdated Show resolved Hide resolved

candita reviewed Aug 23, 2023

View reviewed changes

docs/install.md Outdated Show resolved Hide resolved

candita reviewed Aug 23, 2023

View reviewed changes

docs/install.md Outdated Show resolved Hide resolved

candita reviewed Aug 23, 2023

View reviewed changes

docs/install.md Show resolved Hide resolved

candita reviewed Aug 23, 2023

View reviewed changes

docs/install.md Outdated Show resolved Hide resolved

candita reviewed Aug 23, 2023

View reviewed changes

docs/install.md Outdated Show resolved Hide resolved

candita reviewed Aug 23, 2023

View reviewed changes

alebedev87 force-pushed the aws-cli-commands-for-sts branch 3 times, most recently from c8e8d19 to 6142b3c Compare August 30, 2023 14:13

alebedev87 mentioned this pull request Aug 31, 2023

[OSDOCS-4880]: [feature] ALB on OSD/ROSA openshift/openshift-docs#62273

Merged

1 task

openshift-ci bot assigned ShudiLi Sep 1, 2023

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 1, 2023

candita reviewed Sep 6, 2023

View reviewed changes

docs/install.md Outdated Show resolved Hide resolved

candita reviewed Sep 6, 2023

View reviewed changes

docs/install.md Outdated Show resolved Hide resolved

candita reviewed Sep 6, 2023

View reviewed changes

docs/install.md Show resolved Hide resolved

candita reviewed Sep 6, 2023

View reviewed changes

docs/prerequisites.md Outdated Show resolved Hide resolved

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Sep 11, 2023

alebedev87 force-pushed the aws-cli-commands-for-sts branch 2 times, most recently from 61b55fe to 791e160 Compare September 12, 2023 08:13

OCPBUGS-15609: docs - add AWS CLI commands for STS instructions

943c6a6

alebedev87 force-pushed the aws-cli-commands-for-sts branch from 791e160 to 943c6a6 Compare September 12, 2023 08:17

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 12, 2023

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 12, 2023

openshift-merge-robot merged commit bf25e3d into openshift:main Sep 12, 2023

alebedev87 added a commit to alebedev87/aws-load-balancer-operator that referenced this pull request Sep 13, 2023

OCPBUGS-15609: docs - add AWS CLI commands for STS instructions (open…

c359014

…shift#97)

alebedev87 added a commit to alebedev87/aws-load-balancer-operator that referenced this pull request Sep 13, 2023

OCPBUGS-15609: docs - add AWS CLI commands for STS instructions (open…

2dcddad

…shift#97)

alebedev87 mentioned this pull request Oct 17, 2023

OCPBUGS-19757: bump controller iam policy to v2.4.7 #114

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-15609: docs - add AWS CLI commands for STS instructions #97

OCPBUGS-15609: docs - add AWS CLI commands for STS instructions #97

alebedev87 commented Aug 2, 2023 •

edited

Loading

openshift-ci-robot commented Aug 2, 2023

openshift-ci-robot commented Aug 2, 2023

alebedev87 commented Aug 2, 2023

openshift-ci-robot commented Aug 2, 2023

alebedev87 commented Aug 2, 2023

openshift-ci-robot commented Aug 2, 2023

alebedev87 commented Aug 2, 2023

openshift-ci-robot commented Aug 2, 2023

openshift-ci-robot commented Aug 2, 2023

openshift-ci-robot commented Aug 9, 2023

candita commented Aug 23, 2023

candita Aug 23, 2023

alebedev87 Aug 29, 2023

candita Aug 23, 2023

alebedev87 Aug 29, 2023

candita Aug 23, 2023

alebedev87 Aug 29, 2023

alebedev87 commented Aug 30, 2023

ShudiLi commented Sep 1, 2023

candita Sep 6, 2023 •

edited

Loading

alebedev87 Sep 11, 2023

candita Sep 6, 2023 •

edited

Loading

alebedev87 Sep 11, 2023 •

edited

Loading

openshift-ci bot commented Sep 12, 2023

candita commented Sep 12, 2023

openshift-ci bot commented Sep 12, 2023

ahardin-rh commented Sep 12, 2023

openshift-ci-robot commented Sep 12, 2023

		In case the provisioning of the credentials secret should not be done by the cloud-credential-operator, the secret can to be explicitly referenced in `AWSLoadBalancerController` CR, see [credentials.name field description](./tutorial.md#credentialsname).
		The credentials secret needs to reference a role with all the policies needed by the controller. There are multiple options of how to create the credentials secret.


		#### [Extract and prepare the `ccoctl` binary](https://docs.openshift.com/container-platform/4.11/authentication/managing_cloud_provider_credentials/cco-mode-sts.html#cco-ccoctl-configuring_cco-mode-sts)
		The generated credentials secret can either be awaited by the controller pod already or can be configured in the credentials field of the AWSLoadBalancerController prior to creating the controller.

		- Using a pre-defined `CredentialsRequest` from this repository for an `AWSLoadBalancerController` that has not yet been created.
		- Employing AWS CLI commands for an `AWSLoadBalancerController` that has not yet been created.

OCPBUGS-15609: docs - add AWS CLI commands for STS instructions #97

OCPBUGS-15609: docs - add AWS CLI commands for STS instructions #97

Conversation

alebedev87 commented Aug 2, 2023 • edited Loading

openshift-ci-robot commented Aug 2, 2023

openshift-ci-robot commented Aug 2, 2023

alebedev87 commented Aug 2, 2023

openshift-ci-robot commented Aug 2, 2023

alebedev87 commented Aug 2, 2023

openshift-ci-robot commented Aug 2, 2023

alebedev87 commented Aug 2, 2023

openshift-ci-robot commented Aug 2, 2023

openshift-ci-robot commented Aug 2, 2023

openshift-ci-robot commented Aug 9, 2023

candita commented Aug 23, 2023

candita Aug 23, 2023

Choose a reason for hiding this comment

alebedev87 Aug 29, 2023

Choose a reason for hiding this comment

candita Aug 23, 2023

Choose a reason for hiding this comment

alebedev87 Aug 29, 2023

Choose a reason for hiding this comment

candita Aug 23, 2023

Choose a reason for hiding this comment

alebedev87 Aug 29, 2023

Choose a reason for hiding this comment

alebedev87 commented Aug 30, 2023

ShudiLi commented Sep 1, 2023

candita Sep 6, 2023 • edited Loading

Choose a reason for hiding this comment

alebedev87 Sep 11, 2023

Choose a reason for hiding this comment

candita Sep 6, 2023 • edited Loading

Choose a reason for hiding this comment

alebedev87 Sep 11, 2023 • edited Loading

Choose a reason for hiding this comment

openshift-ci bot commented Sep 12, 2023

candita commented Sep 12, 2023

openshift-ci bot commented Sep 12, 2023

ahardin-rh commented Sep 12, 2023

openshift-ci-robot commented Sep 12, 2023

alebedev87 commented Aug 2, 2023 •

edited

Loading

candita Sep 6, 2023 •

edited

Loading

candita Sep 6, 2023 •

edited

Loading

alebedev87 Sep 11, 2023 •

edited

Loading