OSDOCS-3437: Installing to the AWS SC2S region #44998

mjpytlak · 2022-04-26T17:49:03Z

Version(s):
CP to 4.11

Issue:
This PR documents CORS-1951/OSDOCS-3437 (Installer support for AWS Secret Region).

Link to docs preview:

netlify · 2022-04-26T17:51:57Z

✅ Deploy Preview for osdocs ready!

Name	Link
🔨 Latest commit	db559b784c838acdf4687a4671bd34247a116ef2
🔍 Latest deploy log	https://app.netlify.com/sites/osdocs/deploys/62695796a4725200094ca180
😎 Deploy Preview	https://deploy-preview-44998--osdocs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

mjpytlak · 2022-04-27T14:53:51Z

modules/installation-aws-config-yaml.adoc

@@ -177,6 +177,10 @@ endif::china[]
 ifdef::china[]
        url: https://vpce-id.ec2.cn-north-1.vpce.amazonaws.com.cn
 endif::china[]
+ifdef::secret[]
+      - name: route53 <9>


Not sure if this can be any string or must be a specific value. Is route53 valid for this field?

I think specifying the route53 endpoint is no longer required after https://issues.redhat.com/browse/CORS-1896.

Thank you. Done.

mjpytlak · 2022-04-27T14:56:57Z

modules/installation-aws-config-yaml.adoc

@@ -177,6 +177,10 @@ endif::china[]
 ifdef::china[]
        url: https://vpce-id.ec2.cn-north-1.vpce.amazonaws.com.cn
 endif::china[]
+ifdef::secret[]
+      - name: route53 <9>
+        url:  https://route53.us-east-1.amazonaws.com


Based on the AWS doc, I specified us-east-1 as the region. Please confirm that this is valid for our implementation.

mjpytlak · 2022-04-27T15:03:28Z

@patrickdillon Installing to AWS SC2S doc is ready for eng review. Thanks!

mjpytlak · 2022-05-09T13:00:12Z

Good morning @patrickdillon following up on my review request. Thank you.

patrickdillon

I believe it is no longer necessary to specify the endpoint, which would make this even simpler.

patrickdillon · 2022-05-24T18:22:49Z

modules/installation-aws-config-yaml.adoc

@@ -177,6 +177,10 @@ endif::china[]
 ifdef::china[]
        url: https://vpce-id.ec2.cn-north-1.vpce.amazonaws.com.cn
 endif::china[]
+ifdef::secret[]
+      - name: route53 <9>


I think specifying the route53 endpoint is no longer required after https://issues.redhat.com/browse/CORS-1896.

patrickdillon · 2022-05-24T18:23:59Z

modules/installation-aws-config-yaml.adoc

+<8> The ID of the AMI used to boot machines for the cluster. If set, the AMI must belong to the same region as the cluster.
+<9> The AWS service endpoints. Custom endpoints are required when installing to an unknown AWS region. The endpoint URL must use the `https` protocol and the host must trust the certificate.
+
+If you are installing to the Secret Commercial Cloud Services (SC2S) Region, specifying the Route53 endpoint is required.


Similar comment as above, this should not be required for sc2s after https://issues.redhat.com/browse/CORS-1896

Done. Thanks.

mjpytlak · 2022-05-25T13:50:28Z

@yunjiang29 Engineering comments are addressed. Ready for QE review. Thank you.

yunjiang29 · 2022-05-27T09:21:42Z

modules/installation-aws-config-yaml.adoc

@@ -362,7 +358,7 @@ endif::openshift-origin[]
 endif::private[]
 ifdef::secret[]
 ifndef::openshift-origin[]
-<14> The custom CA certificate. This is required when deploying to the AWS C2S Top Secret Region because the AWS API requires a custom CA trust bundle.
+<14> The custom CA certificate. This is required when deploying to either the SC2S or Commercial Cloud Services (C2S) Regions because the AWS API requires a custom CA trust bundle.


SC2S or Commercial Cloud Services (C2S) Regions

It is better to be consistent

SC2S or C2S Regions
or

Secret Commercial Cloud Services (SC2S) or Commercial Cloud Services (C2S) Regions

Agreed. Thank you.

yunjiang29 · 2022-05-27T09:46:29Z

_topic_maps/_topic_map.yml

@@ -157,7 +157,7 @@ Topics:
    File: installing-aws-private
  - Name: Installing a cluster on AWS into a government region
    File: installing-aws-government-region
-  - Name: Installing a cluster on AWS into a Top Secret Region
+  - Name: Installing a cluster on AWS into a Secret or Top Secret Region


Hello @mjpytlak @patrickdillon

I am bit confused by these names:

Top Secret Region == Commercial Cloud Services Regions == C2S Regions

Secret Region == Secret Commercial Cloud Services Regions == SC2S Regions

Is it right?

It looks like we only use Top Secret Region/Secret Region in the title and TOC, in other places we use C2S/SC2S, is this intentional?

is this intentional?

Only in the sense that I was following the existing format in 4.10. Open to suggestions. Can you elaborate on what you found confusing?

Can you elaborate on what you found confusing?

Just curious, my thought was, per security level, looks like Secret Commercial > Commercial ..., so Secret Commercial ... should be Top Secret Region, and Commercial ... should be Secret Region.

But since we have fully reviewed in #39769, I agree with current description.

Just wanted to give a little bit of insight on C2S. Commercial Cloud Services (C2S) is the program allowing commercial cloud offerings for IC Agencies. The program has three flavors: Unclassified, Secret, and Top Secret. The official abbreviations for them are UC2S, SC2S, TC2S.

The first classified region stood up was TC2S. Since implementation of the C2S program and initial region took so long to be completed, SC2S was delayed several years. During this time, it became common practice to simply refer to TC2S as C2S.

Thanks @montaguethomas, good to know these background info.

yunjiang29 · 2022-05-27T10:05:05Z

@mjpytlak About Requirements for using your VPC section, (sorry that I can't add comment there):

A cluster in a Top Secret Region is unable to reach the public IP addresses for the EC2 and ELB endpoints. You must create a VPC endpoint and attach it to the subnet that the clusters are using. Name the endpoints as follows:

elasticloadbalancing.<region>.c2s.ic.gov

ec2.<region>.c2s.ic.gov

s3.<region>.c2s.ic.gov

The SC2S endpoints should be:

elasticloadbalancing.<region>.sc2s.sgov.gov
ec2.<region>.sc2s.sgov.gov
s3.<region>.sc2s.sgov.gov

cc @patrickdillon

Change A cluster in a Top Secret Region is unable to A cluster in a secret regions is unable ?

mjpytlak · 2022-06-02T21:31:03Z

Appreciate the feedback @yunjiang29. PTAL.

yunjiang29 · 2022-06-06T10:42:10Z

@mjpytlak thanks for the updates, /lgtm

patrickdillon · 2022-06-06T16:16:33Z

LGTM

EricPonvelle

I had some small nitpicks.

EricPonvelle · 2022-06-06T18:58:21Z

installing/installing_aws/installing-aws-secret-region.adoc

+* Secret Commercial Cloud Services (SC2S)
+* Commercial Cloud Services (C2S)
+
+To configure a cluster in either region, modify parameters in the `install config.yaml` file before you install the cluster.


s/modify/change

EricPonvelle · 2022-06-06T19:04:31Z

modules/installation-custom-aws-vpc.adoc

@@ -82,7 +82,13 @@ If you are working in a disconnected environment, you are unable to reach the pu
 endif::aws-china[]

 ifdef::aws-secret[]
-* A cluster in a Top Secret Region is unable to reach the public IP addresses for the EC2 and ELB endpoints. You must create a VPC endpoint and attach it to the subnet that the clusters are using. Name the endpoints as follows:
+* A cluster in a SC2S or C2S Region is unable to reach the public IP addresses for the EC2 and ELB endpoints. You must create a VPC endpoint and attach it to the subnet that the clusters are using. Name the endpoints as follows:


Should it be "an SC2S" or "a SC2S"? I keep saying "an SC2S"

EricPonvelle · 2022-06-06T19:31:08Z

/cherrypick enterprise-4.11

openshift-cherrypick-robot · 2022-06-06T19:31:49Z

@EricPonvelle: new pull request created: #46400

In response to this:

/cherrypick enterprise-4.11

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Apr 26, 2022

mjpytlak force-pushed the osdocs-3437 branch 2 times, most recently from 0c51be2 to db559b7 Compare April 27, 2022 14:47

mjpytlak commented Apr 27, 2022

View reviewed changes

patrickdillon reviewed May 24, 2022

View reviewed changes

mjpytlak force-pushed the osdocs-3437 branch from db559b7 to 96d3968 Compare May 25, 2022 13:33

yunjiang29 reviewed May 27, 2022

View reviewed changes

mjpytlak force-pushed the osdocs-3437 branch from 96d3968 to ab06ca4 Compare June 2, 2022 21:17

mjpytlak force-pushed the osdocs-3437 branch 2 times, most recently from 9b00515 to 3768d99 Compare June 6, 2022 17:31

EricPonvelle added the branch/enterprise-4.11 label Jun 6, 2022

EricPonvelle added this to the Next Release milestone Jun 6, 2022

EricPonvelle reviewed Jun 6, 2022

View reviewed changes

OSDOCS-3437: Installing to the AWS SC2S region

4ee3cc8

mjpytlak force-pushed the osdocs-3437 branch from 3768d99 to 4ee3cc8 Compare June 6, 2022 19:15

EricPonvelle merged commit ac81e00 into openshift:main Jun 6, 2022

openshift-cherrypick-robot mentioned this pull request Jun 6, 2022

[enterprise-4.11] OSDOCS-3437: Installing to the AWS SC2S region #46400

Merged

kalexand-rh removed this from the Next Release milestone Aug 9, 2022

kalexand-rh added this to the OCP 4.11 GA milestone Aug 9, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OSDOCS-3437: Installing to the AWS SC2S region #44998

OSDOCS-3437: Installing to the AWS SC2S region #44998

mjpytlak commented Apr 26, 2022 •

edited

netlify bot commented Apr 26, 2022 •

edited

mjpytlak Apr 27, 2022 •

edited

patrickdillon May 24, 2022

mjpytlak May 25, 2022

mjpytlak Apr 27, 2022

mjpytlak commented Apr 27, 2022

mjpytlak commented May 9, 2022

patrickdillon left a comment

patrickdillon May 24, 2022

patrickdillon May 24, 2022

mjpytlak May 25, 2022

mjpytlak commented May 25, 2022

yunjiang29 May 27, 2022 •

edited

mjpytlak Jun 2, 2022

yunjiang29 May 27, 2022

mjpytlak Jun 2, 2022

yunjiang29 Jun 6, 2022

montaguethomas Jun 14, 2022

yunjiang29 Jun 15, 2022

yunjiang29 commented May 27, 2022

mjpytlak commented Jun 2, 2022

yunjiang29 commented Jun 6, 2022

patrickdillon commented Jun 6, 2022

EricPonvelle left a comment

EricPonvelle Jun 6, 2022

EricPonvelle Jun 6, 2022

EricPonvelle commented Jun 6, 2022

openshift-cherrypick-robot commented Jun 6, 2022

OSDOCS-3437: Installing to the AWS SC2S region #44998

OSDOCS-3437: Installing to the AWS SC2S region #44998

Conversation

mjpytlak commented Apr 26, 2022 • edited

netlify bot commented Apr 26, 2022 • edited

✅ Deploy Preview for osdocs ready!

mjpytlak Apr 27, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mjpytlak commented Apr 27, 2022

mjpytlak commented May 9, 2022

patrickdillon left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mjpytlak commented May 25, 2022

yunjiang29 May 27, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yunjiang29 commented May 27, 2022

mjpytlak commented Jun 2, 2022

yunjiang29 commented Jun 6, 2022

patrickdillon commented Jun 6, 2022

EricPonvelle left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

EricPonvelle commented Jun 6, 2022

openshift-cherrypick-robot commented Jun 6, 2022

mjpytlak commented Apr 26, 2022 •

edited

netlify bot commented Apr 26, 2022 •

edited

mjpytlak Apr 27, 2022 •

edited

yunjiang29 May 27, 2022 •

edited