Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

operator_roles_creation module should attach operator policies created in account_roles_creation module #31

Open
RelicCornhusk opened this issue Nov 20, 2023 · 0 comments

Comments

@RelicCornhusk
Copy link

I'm currently using this module to create the OIDC, account-wide IAM roles and operator roles for my ROSA cluster. I started having a problem when using shared VPCs because the operator role arn:aws:sts::xxxxxxxxxx:assumed-role/test-openshift-ingress-operator-cloud-credentials/OCM cannot assume the appropriate role in the account that's sharing the VPC. I understand the module has an input to support the usage of clusters with shared VPCs: shared_vpc_role_arn. That input is used to create an operator policy that has sts:AssumeRole on that role, but that policy does not get attached to the operator roles that need it as part of the operator_roles_creation module. Instead, it attaches the policy named ManagedOpenShift-openshift-cloud-credential-operator-cloud-crede, which it obtained from data.ocm_rosa_operator_roles.operator_roles, as is done in this sample code in the README. I believe there should be an additional aws_iam_policy_attachment in the operator_role_resource.tf to take care of that.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant