mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
114 lines
6.7 KiB
Plaintext
114 lines
6.7 KiB
Plaintext
|
|
// Module included in the following assemblies:
|
|
//
|
|
// * rosa_hcp/rosa-hcp-cluster-no-cni.adoc
|
|
// * rosa_hcp/rosa-hcp-creating-cluster-with-aws-kms-key.adoc
|
|
// * rosa_hcp/rosa-hcp-quickstart-guide.adoc
|
|
// * rosa_hcp/rosa-hcp-sts-creating-a-cluster-quickly.adoc
|
|
// * rosa_hcp/rosa-hcp-egress-zero-install.adoc
|
|
// * rosa_planning/rosa-hcp-prepare-iam-roles-resources.adoc
|
|
|
|
:_content-type: PROCEDURE
|
|
[id="rosa-operator-config_{context}"]
|
|
= Creating Operator roles and policies
|
|
|
|
When you deploy a {product-title} cluster, you must create the Operator IAM roles. The cluster Operators use the Operator roles and policies to obtain the temporary permissions required to carry out cluster operations, such as managing back-end storage and external access to a cluster.
|
|
|
|
.Prerequisites
|
|
|
|
* You have completed the AWS prerequisites for {product-title}.
|
|
* You have installed and configured the latest ROSA CLI (`rosa`), on your installation host.
|
|
* You created the account-wide AWS roles.
|
|
|
|
.Procedure
|
|
|
|
. To create your Operator roles, run the following command:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ rosa create operator-roles --hosted-cp --prefix=$OPERATOR_ROLES_PREFIX --oidc-config-id=$OIDC_ID --installer-role-arn arn:aws:iam::$AWS_ACCOUNT_ID:role/${ACCOUNT_ROLES_PREFIX}-HCP-ROSA-Installer-Role
|
|
----
|
|
+
|
|
The following breakdown provides options for the Operator role creation.
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ rosa create operator-roles --hosted-cp
|
|
--prefix=$OPERATOR_ROLES_PREFIX <1>
|
|
--oidc-config-id=$OIDC_ID <2>
|
|
--installer-role-arn arn:aws:iam::$AWS_ACCOUNT_ID:role/$ACCOUNT_ROLES_PREFIX-HCP-ROSA-Installer-Role <3>
|
|
----
|
|
+
|
|
--
|
|
<1> You must supply a prefix when creating these Operator roles. Failing to do so produces an error. See the Additional resources of this section for information on the Operator prefix.
|
|
<2> This value is the OIDC configuration ID that you created for your {product-title} cluster.
|
|
<3> This value is the installer role ARN that you created when you created the {product-title} account roles.
|
|
--
|
|
+
|
|
You must include the `--hosted-cp` parameter to create the correct roles for {product-title} clusters. This command returns the following information.
|
|
+
|
|
.Example output
|
|
+
|
|
[source,terminal]
|
|
----
|
|
? Role creation mode: auto
|
|
? Operator roles prefix: <pre-filled_prefix> <1>
|
|
? OIDC Configuration ID: 23soa2bgvpek9kmes9s7os0a39i13qm4 | https://dvbwgdztaeq9o.cloudfront.net/23soa2bgvpek9kmes9s7os0a39i13qm4 <2>
|
|
? Create hosted control plane operator roles: Yes
|
|
W: More than one Installer role found
|
|
? Installer role ARN: arn:aws:iam::4540112244:role/<prefix>-HCP-ROSA-Installer-Role
|
|
? Permissions boundary ARN (optional):
|
|
I: Reusable OIDC Configuration detected. Validating trusted relationships to operator roles:
|
|
I: Creating roles using 'arn:aws:iam::4540112244:user/<userName>'
|
|
I: Created role '<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials'
|
|
I: Created role '<prefix>-openshift-cloud-network-config-controller-cloud-credenti' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti'
|
|
I: Created role '<prefix>-kube-system-kube-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager'
|
|
I: Created role '<prefix>-kube-system-capa-controller-manager' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager'
|
|
I: Created role '<prefix>-kube-system-control-plane-operator' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator'
|
|
I: Created role '<prefix>-kube-system-kms-provider' with ARN 'arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider'
|
|
I: Created role '<prefix>-openshift-image-registry-installer-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials'
|
|
I: Created role '<prefix>-openshift-ingress-operator-cloud-credentials' with ARN 'arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials'
|
|
I: To create a cluster with these roles, run the following command:
|
|
rosa create cluster --sts --oidc-config-id 23soa2bgvpek9kmes9s7os0a39i13qm4 --operator-roles-prefix <prefix> --hosted-cp
|
|
----
|
|
+
|
|
--
|
|
<1> This field is prepopulated with the prefix that you set in the initial creation command.
|
|
<2> This field requires you to select an OIDC configuration that you created for your {product-title} cluster.
|
|
--
|
|
+
|
|
The Operator roles are now created and ready to use for creating your {product-title} cluster.
|
|
|
|
.Verification
|
|
|
|
* You can list the Operator roles associated with your {product-title} account. Run the following command:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ rosa list operator-roles
|
|
----
|
|
+
|
|
.Example output
|
|
+
|
|
[source,terminal]
|
|
----
|
|
I: Fetching operator roles
|
|
ROLE PREFIX AMOUNT IN BUNDLE
|
|
<prefix> 8
|
|
? Would you like to detail a specific prefix Yes <1>
|
|
? Operator Role Prefix: <prefix>
|
|
ROLE NAME ROLE ARN VERSION MANAGED
|
|
<prefix>-kube-system-capa-controller-manager arn:aws:iam::4540112244:role/<prefix>-kube-system-capa-controller-manager 4.13 No
|
|
<prefix>-kube-system-control-plane-operator arn:aws:iam::4540112244:role/<prefix>-kube-system-control-plane-operator 4.13 No
|
|
<prefix>-kube-system-kms-provider arn:aws:iam::4540112244:role/<prefix>-kube-system-kms-provider 4.13 No
|
|
<prefix>-kube-system-kube-controller-manager arn:aws:iam::4540112244:role/<prefix>-kube-system-kube-controller-manager 4.13 No
|
|
<prefix>-openshift-cloud-network-config-controller-cloud-credenti arn:aws:iam::4540112244:role/<prefix>-openshift-cloud-network-config-controller-cloud-credenti 4.13 No
|
|
<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials arn:aws:iam::4540112244:role/<prefix>-openshift-cluster-csi-drivers-ebs-cloud-credentials 4.13 No
|
|
<prefix>-openshift-image-registry-installer-cloud-credentials arn:aws:iam::4540112244:role/<prefix>-openshift-image-registry-installer-cloud-credentials 4.13 No
|
|
<prefix>-openshift-ingress-operator-cloud-credentials arn:aws:iam::4540112244:role/<prefix>-openshift-ingress-operator-cloud-credentials 4.13 No
|
|
----
|
|
+
|
|
--
|
|
<1> After the command runs, it displays all the prefixes associated with your AWS account and notes how many roles are associated with this prefix. If you need to see all of these roles and their details, enter "Yes" on the detail prompt to have these roles listed out with specifics.
|
|
--
|