CFE-712: Adds the procedure to configure AWS Load Balancer Operator on STS cluster by using predefined credentials #53666

xenolinux · 2022-12-12T09:12:08Z

Adds the procedure to configure AWS Load Balancer Operator on STS cluster by using predefined credentials

Version(s): 4.12+

Issue: https://issues.redhat.com/browse/CFE-712

Link to docs preview: https://53666--docspreview.netlify.app/openshift-enterprise/latest/networking/aws_load_balancer_operator/installing-albo-sts-cluster.html#nw-installing-albo-on-sts-cluster-predefined-credentials_albo-sts-cluster

QE review:

QE has approved this change.

Additional information:

ocpdocs-previewbot · 2022-12-12T09:22:03Z

🤖 Updated build preview is available at:
https://53666--docspreview.netlify.app

Build log: https://circleci.com/gh/ocpdocs-previewbot/openshift-docs/5369

alebedev87 · 2022-12-13T07:47:55Z

modules/configuring-albo-on-sts-cluster-predefined-credentials.adoc

+.Prerequisites
+
+* You must extract and prepare the `ccoctl` binary.


This part is repeated in each sub chapter of Installing the AWS Load Balancer Operator on Secure Token Service cluster, maybe worth moving it to the very top to reduce the repetitive commands?

IMO, since this is part of a prerequisites section, we must keep it at the beginning of each chapter. But I can check once the peer-review process begins if we can eliminate the repetitive commands

alebedev87 · 2022-12-13T07:50:22Z

modules/configuring-albo-on-sts-cluster-predefined-credentials.adoc

+
+* You must extract and prepare the `ccoctl` binary.
+
+.Procedure


As the first setp we need to retrieve the predefined credentials file, similar to what we did in Bootstraping ... chapter but from another directory:

$ curl --create-dirs -o <path-to-credrequests-dir>/cr.yaml https://raw.githubusercontent.com/openshift/aws-load-balancer-operator/main/hack/controller/controller-credentials-request.yaml

alebedev87 · 2022-12-13T07:53:10Z

modules/configuring-albo-on-sts-cluster-predefined-credentials.adoc

+$ ccoctl aws create-iam-roles \
+        --name <name> --region=<aws_region> \
+        --credentials-requests-dir=hack/controller \
+        --identity-provider-arn <oidc-arn>


Suggested change

$ ccoctl aws create-iam-roles \

--name <name> --region=<aws_region> \

--credentials-requests-dir=hack/controller \

--identity-provider-arn <oidc-arn>

$ ccoctl aws create-iam-roles \

--name <name> --region=<aws_region> \

--credentials-requests-dir=<path-to-credrequests-dir> \

--identity-provider-arn <oidc-arn>

alebedev87 · 2022-12-13T07:55:00Z

modules/configuring-albo-on-sts-cluster-predefined-credentials.adoc

+        --credentials-requests-dir=hack/controller \
+        --identity-provider-arn <oidc-arn>
+----
+For each `CredentialsRequest` object, the `ccoctl` tool creates an IAM role with a trust policy. The trust policy contains the specified OIDC identity provider, and permissions policy as defined in each `CredentialsRequest` object. The `ccoctl` tool also generates a set of secrets in a `manifests` directory that the AWS Load Balancer Controller uses.


We didn't mention these details before, maybe we can skip them this time too. ccoctl details can be discovered in its documentation.

alebedev87 · 2022-12-13T08:03:15Z

modules/configuring-albo-on-sts-cluster-predefined-credentials.adoc

+    web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
+----
+
+. Create the `aws-load-balancer-controller` resource YAML file, for example, `sample-aws-lb-predefined-creds.yaml`, as follows:


Suggested change

. Create the `aws-load-balancer-controller` resource YAML file, for example, `sample-aws-lb-predefined-creds.yaml`, as follows:

. Create the `AWSLoadBalancerController` resource YAML file, for example, `sample-aws-lb-manual-creds.yaml`, as follows:

alebedev87 · 2022-12-13T08:03:54Z

modules/configuring-albo-on-sts-cluster-predefined-credentials.adoc

+spec:
+  credentials: <secret-name> <3>


Suggested change

spec:

credentials: <secret-name> <3>

spec:

credentials:

name: <secret-name> <3>

alebedev87 · 2022-12-13T08:04:27Z

modules/configuring-albo-on-sts-cluster-predefined-credentials.adoc

+spec:
+  credentials: <secret-name> <3>
+----
+<1> Defines the `aws-load-balancer-controller` resource.


Suggested change

<1> Defines the `aws-load-balancer-controller` resource.

<1> Defines the `AWSLoadBalancerController` resource.

alebedev87

Noticed that we could do some more clarifications. Feel free to rephrase the suggestions, I just wanted to give an idea.

alebedev87 · 2022-12-13T08:42:31Z

networking/aws_load_balancer_operator/installing-albo-sts-cluster.adoc

-The AWS Load Balancer Operator relies on `CredentialsRequest` to bootstrap the Operator and for each `AWSLoadBalancerController` instance. The AWS Load Balancer Operator waits until the required secrets are created and available. The Cloud Credential Operator does not provision the secrets automatically in the STS cluster. You must set the credentials secrets manually by using the `ccoctl` binary. 
+The AWS Load Balancer Operator relies on `CredentialsRequest` to bootstrap the Operator and for each `AWSLoadBalancerController` instance. The AWS Load Balancer Operator waits until the required secrets are created and available. The Cloud Credential Operator does not provision the secrets automatically in the STS cluster. You must set the credentials secrets manually by using the `ccoctl` binary.
+
+You can also configure the AWS Load Balancer Operator on the STS cluster by using predefined credentials.


Maybe we can elaborate on this one because the reason to add the new configuration possibility was driven by the fact that the Cloud Credential Operator is not available in all the clusters. In the GitHub doc we mentioned this briefly. What do you think about something like this:

Suggested change

You can also configure the AWS Load Balancer Operator on the STS cluster by using predefined credentials.

In case the provisioning of the credentials secret should not be done by the Cloud Credential Operator, the `AWSLoadBalancerController` instance can be configured with explicitly specified credentials secret.

alebedev87 · 2022-12-13T08:44:38Z

modules/configuring-albo-on-sts-cluster.adoc

@@ -3,11 +3,11 @@

 :_content-type: PROCEDURE
 [id="nw-installing-albo-on-sts-cluster_{context}"]
-= Configuring AWS Load Balancer Operator on Secure Token Service cluster
+= Configuring AWS Load Balancer Operator on Secure Token Service cluster by using `CredentialsRequest` objects


Suggested change

= Configuring AWS Load Balancer Operator on Secure Token Service cluster by using `CredentialsRequest` objects

= Configuring AWS Load Balancer Operator on Secure Token Service cluster by using managed `CredentialsRequest` objects

Or maybe even managed by operator.

alebedev87 · 2022-12-13T09:07:41Z

modules/configuring-albo-on-sts-cluster-predefined-credentials.adoc

+[id="nw-installing-albo-on-sts-cluster-predefined-credentials_{context}"]
+= Configuring the AWS Load Balancer Operator on Secure Token Service cluster by using predefined credentials
+
+You can use the predefined `CredentialsRequest` object by specifying the `spec.credential` field in the AWS load Balancer Controller custom resource (CR).


Suggested change

You can use the predefined `CredentialsRequest` object by specifying the `spec.credential` field in the AWS load Balancer Controller custom resource (CR).

The credentials secret can be specified explicitly using the `spec.credentials` field in the AWS Load Balancer Controller custom resource (CR). You can use the predefined controller's `CredentialsRequest` object to fin dout which roles are required by the controller.

alebedev87 · 2022-12-13T09:08:12Z

modules/configuring-albo-on-sts-cluster-predefined-credentials.adoc

+
+.Procedure
+
+. Download the CredentialsRequest custom resource (CR) of the AWS Load Balancer Operator, and create a directory to store it by running the following command:


Suggested change

. Download the CredentialsRequest custom resource (CR) of the AWS Load Balancer Operator, and create a directory to store it by running the following command:

. Download the CredentialsRequest custom resource (CR) of the AWS Load Balancer Controller, and create a directory to store it by running the following command:

alebedev87 · 2022-12-13T09:09:24Z

modules/configuring-albo-on-sts-cluster-predefined-credentials.adoc

+
+:_content-type: PROCEDURE
+[id="nw-installing-albo-on-sts-cluster-predefined-credentials_{context}"]
+= Configuring the AWS Load Balancer Operator on Secure Token Service cluster by using predefined credentials


Suggested change

= Configuring the AWS Load Balancer Operator on Secure Token Service cluster by using predefined credentials

= Configuring the AWS Load Balancer Operator on Secure Token Service cluster by using explicitly set credentials

alebedev87 · 2022-12-13T10:08:45Z

/lgtm

xenolinux · 2022-12-14T10:49:28Z

@lihongan Please take a look at this PR at your leisure

lihongan · 2022-12-14T11:01:57Z

Looks good. Thank you @xenolinux

GroceryBoyJr · 2022-12-14T12:07:19Z

/label peer-review-in-progress
/remove-label peer-review-needed

GroceryBoyJr · 2022-12-14T19:28:48Z

networking/aws_load_balancer_operator/installing-albo-sts-cluster.adoc

@@ -8,12 +8,16 @@ toc::[]

 You can install the AWS Load Balancer Operator on the Secure Token Service (STS) cluster.

-The AWS Load Balancer Operator relies on `CredentialsRequest` to bootstrap the Operator and for each `AWSLoadBalancerController` instance. The AWS Load Balancer Operator waits until the required secrets are created and available. The Cloud Credential Operator does not provision the secrets automatically in the STS cluster. You must set the credentials secrets manually by using the `ccoctl` binary. 
+The AWS Load Balancer Operator relies on `CredentialsRequest` to bootstrap the Operator and for each `AWSLoadBalancerController` instance. The AWS Load Balancer Operator waits until the required secrets are created and available. The Cloud Credential Operator does not provision the secrets automatically in the STS cluster. You must set the credentials secrets manually by using the `ccoctl` binary.


The sentence "The AWS Load Balancer Operator waits until the required secrets are created and available." is passive voice. The problem is the phrase "are created". A possible rewrite could be: "The AWS Load Balancer Operator requires the secrets to be created and available for correct function."

GroceryBoyJr

Great work, Servesha! Only two very small suggestions for change. I am on peer review all week, reach out to me if you would like me to re-review tomorrow or (US) Friday, I am glad to do so.

GroceryBoyJr · 2022-12-14T20:02:15Z

modules/configuring-albo-on-sts-cluster-predefined-credentials.adoc

+$ ls manifests/*-credentials.yaml | xargs -I{} oc apply -f {}
+----
+
+. Verify that the credentials secret of the controller is created:


Suggestion: Instead of "Verify that the credentials secret of the controller is created:", replace with "Verify the credentials secret has been created for use by the controller:" See https://www.ibm.com/docs/en/ibm-style?topic=grammar-verbs under the heading "Voice" . (Please ping me if you have trouble seeing the IBM style guide.)

GroceryBoyJr · 2022-12-14T20:08:42Z

/label peer-review-completed
/remove-label peer-review-in-progress

openshift-ci · 2022-12-14T20:08:46Z

@GroceryBoyJr: The label(s) /label peer-review-completed cannot be applied. These labels are supported: platform/aws, platform/azure, platform/baremetal, platform/google, platform/libvirt, platform/openstack, ga, tide/merge-method-merge, tide/merge-method-rebase, tide/merge-method-squash, px-approved, docs-approved, qe-approved, downstream-change-needed, approved, backport-risk-assessed, bugzilla/valid-bug, cherry-pick-approved, cnv, dev-tools, distributed-tracing, ims, jira/valid-bug, merge-review-in-progress, merge-review-needed, mtc, multi-arch, oadp, peer-review-done, peer-review-in-progress, peer-review-needed, rhacs, rhv, serverless, service-mesh, staff-eng-approved, telco. Is this label configured under labels -> additional_labels or labels -> restricted_labels in plugin.yaml?

In response to this:

/label peer-review-completed
/remove-label peer-review-in-progress

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

GroceryBoyJr · 2022-12-14T20:13:58Z

/label peer-review-done

…en Service cluster by using predefined credentials

openshift-ci · 2022-12-15T09:15:49Z

New changes are detected. LGTM label has been removed.

snarayan-redhat · 2022-12-15T12:08:25Z

/cherrypick enterprise-4.12

openshift-cherrypick-robot · 2022-12-15T12:09:16Z

@snarayan-redhat: new pull request created: #53868

In response to this:

/cherrypick enterprise-4.12

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Dec 12, 2022

xenolinux changed the title ~~Adds the procedure to create AWS Load Balancer Operator on Secure Tok…~~ Adds the procedure to create AWS Load Balancer Operator on STS cluster by using predefined credentials Dec 12, 2022

xenolinux changed the title ~~Adds the procedure to create AWS Load Balancer Operator on STS cluster by using predefined credentials~~ Adds the procedure to configure AWS Load Balancer Operator on STS cluster by using predefined credentials Dec 12, 2022

xenolinux force-pushed the sts-api branch from 8f76407 to 4c7ae39 Compare December 12, 2022 09:16

xenolinux force-pushed the sts-api branch 3 times, most recently from 83640a4 to 4b34300 Compare December 12, 2022 10:11

openshift-ci bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Dec 12, 2022

xenolinux force-pushed the sts-api branch 5 times, most recently from 2994707 to 5295746 Compare December 13, 2022 07:20

alebedev87 reviewed Dec 13, 2022

View reviewed changes

xenolinux force-pushed the sts-api branch from 5295746 to 2fb1fd2 Compare December 13, 2022 08:17

alebedev87 reviewed Dec 13, 2022

View reviewed changes

xenolinux force-pushed the sts-api branch 3 times, most recently from 46b6eff to d02b32a Compare December 13, 2022 09:50

openshift-ci bot assigned alebedev87 Dec 13, 2022

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Dec 13, 2022

xenolinux added the peer-review-needed Signifies that the peer review team needs to review this PR label Dec 14, 2022

openshift-ci bot added peer-review-in-progress Signifies that the peer review team is reviewing this PR and removed peer-review-needed Signifies that the peer review team needs to review this PR labels Dec 14, 2022

GroceryBoyJr reviewed Dec 14, 2022

View reviewed changes

openshift-ci bot removed the peer-review-in-progress Signifies that the peer review team is reviewing this PR label Dec 14, 2022

openshift-ci bot added the peer-review-done Signifies that the peer review team has reviewed this PR label Dec 14, 2022

Adds the procedure to create AWS Load Balancer Operator on Secure Tok…

6b19bd4

…en Service cluster by using predefined credentials

xenolinux force-pushed the sts-api branch from d02b32a to 6b19bd4 Compare December 15, 2022 09:15

xenolinux added the merge-review-needed Signifies that the merge review team needs to review this PR label Dec 15, 2022

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Dec 15, 2022

snarayan-redhat added merge-review-in-progress Signifies that the merge review team is reviewing this PR branch/enterprise-4.12 labels Dec 15, 2022

snarayan-redhat added this to the Planned for 4.12 GA milestone Dec 15, 2022

snarayan-redhat merged commit b78e09e into openshift:main Dec 15, 2022

openshift-cherrypick-robot mentioned this pull request Dec 15, 2022

[enterprise-4.12] Adds the procedure to configure AWS Load Balancer Operator on STS cluster by using predefined credentials #53868

Merged

xenolinux changed the title ~~Adds the procedure to configure AWS Load Balancer Operator on STS cluster by using predefined credentials~~ CFE-712: Adds the procedure to configure AWS Load Balancer Operator on STS cluster by using predefined credentials Dec 15, 2022

		.Prerequisites

		* You must extract and prepare the `ccoctl` binary.


		* You must extract and prepare the `ccoctl` binary.

		.Procedure

	. Create the `aws-load-balancer-controller` resource YAML file, for example, `sample-aws-lb-predefined-creds.yaml`, as follows:
	. Create the `AWSLoadBalancerController` resource YAML file, for example, `sample-aws-lb-manual-creds.yaml`, as follows:

	<1> Defines the `aws-load-balancer-controller` resource.
	<1> Defines the `AWSLoadBalancerController` resource.

	You can also configure the AWS Load Balancer Operator on the STS cluster by using predefined credentials.
	In case the provisioning of the credentials secret should not be done by the Cloud Credential Operator, the `AWSLoadBalancerController` instance can be configured with explicitly specified credentials secret.

	= Configuring AWS Load Balancer Operator on Secure Token Service cluster by using `CredentialsRequest` objects
	= Configuring AWS Load Balancer Operator on Secure Token Service cluster by using managed `CredentialsRequest` objects

	You can use the predefined `CredentialsRequest` object by specifying the `spec.credential` field in the AWS load Balancer Controller custom resource (CR).
	The credentials secret can be specified explicitly using the `spec.credentials` field in the AWS Load Balancer Controller custom resource (CR). You can use the predefined controller's `CredentialsRequest` object to fin dout which roles are required by the controller.


		.Procedure

		. Download the CredentialsRequest custom resource (CR) of the AWS Load Balancer Operator, and create a directory to store it by running the following command:

	= Configuring the AWS Load Balancer Operator on Secure Token Service cluster by using predefined credentials
	= Configuring the AWS Load Balancer Operator on Secure Token Service cluster by using explicitly set credentials

CFE-712: Adds the procedure to configure AWS Load Balancer Operator on STS cluster by using predefined credentials #53666

CFE-712: Adds the procedure to configure AWS Load Balancer Operator on STS cluster by using predefined credentials #53666

Conversation

xenolinux commented Dec 12, 2022 • edited

ocpdocs-previewbot commented Dec 12, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alebedev87 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alebedev87 commented Dec 13, 2022

xenolinux commented Dec 14, 2022

lihongan commented Dec 14, 2022

GroceryBoyJr commented Dec 14, 2022

Choose a reason for hiding this comment

GroceryBoyJr left a comment • edited

Choose a reason for hiding this comment

GroceryBoyJr Dec 14, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

GroceryBoyJr commented Dec 14, 2022

openshift-ci bot commented Dec 14, 2022

GroceryBoyJr commented Dec 14, 2022

openshift-ci bot commented Dec 15, 2022

snarayan-redhat commented Dec 15, 2022

openshift-cherrypick-robot commented Dec 15, 2022

xenolinux commented Dec 12, 2022 •

edited

ocpdocs-previewbot commented Dec 12, 2022 •

edited

GroceryBoyJr left a comment •

edited

GroceryBoyJr Dec 14, 2022 •

edited