Skip to content

Commit 0dbea8e

Browse files
kcarmichael08kcarmichael08
authored
Merge pull request #73846 from libander/OBSDOCS-797
OBSDOCS-797 - Short term authentication for cloud providers
2 parents cac69ee + 4b701df commit 0dbea8e

6 files changed

+229
-13
lines changed

‎logging/log_storage/installing-log-storage.adoc

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,19 @@ include::modules/loki-create-object-storage-secret-console.adoc[leveloffset=+2]
2626
.Additional resources
2727
* xref:../../logging/log_storage/installing-log-storage.adoc#logging-loki-storage_installing-log-storage[Loki object storage]
2828

29-
include::modules/create-lokistack-cr-console.adoc[leveloffset=+2]
29+
[id="installing-log-storage-loki-sts"]
30+
== Deploying a Loki log store on an STS enabled cluster
31+
32+
For cloud based storage, you can use the xref:/../../authentication/managing_cloud_provider_credentials/cco-short-term-creds.adoc[Cloud Credential Operator (CCO)] and CCO utility (`ccoctl`) to configure authentication for your {logging} object store.
33+
34+
[NOTE]
35+
====
36+
STS authentication must be configured during a new installation of {loki-op}, on an STS enabled cluster. You cannot configure an existing cluster that uses a different credentials strategy to use this feature.
37+
====
38+
39+
include::modules/logging-identity-federation.adoc[leveloffset=+2]
40+
41+
include::modules/logging-create-loki-cr-console.adoc[leveloffset=+2,tag=!pre-5.9]
3042

3143
// Loki CLI install
3244
include::modules/logging-loki-cli-install.adoc[leveloffset=+2]
@@ -36,10 +48,11 @@ include::modules/loki-create-object-storage-secret-cli.adoc[leveloffset=+2]
3648
.Additional resources
3749
* xref:../../logging/log_storage/installing-log-storage.adoc#logging-loki-storage_installing-log-storage[Loki object storage]
3850

39-
include::modules/create-lokistack-cr-cli.adoc[leveloffset=+2]
51+
include::modules/logging-create-loki-cr-cli.adoc[leveloffset=+2,tag=!pre-5.9]
4052

4153
// Loki object storage
4254
include::modules/logging-loki-storage.adoc[leveloffset=+1]
55+
4356
// create object storage
4457
include::modules/logging-loki-storage-aws.adoc[leveloffset=+2]
4558
include::modules/logging-loki-storage-azure.adoc[leveloffset=+2]

‎modules/create-lokistack-cr-cli.adoc renamed to ‎modules/logging-create-loki-cr-cli.adoc

Lines changed: 39 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
// * logging/log_storage/installing-log-storage.adoc
44

55
:_mod-docs-content-type: PROCEDURE
6-
[id="create-lokistack-cr-cli_{context}"]
6+
[id="logging-create-loki-cr-cli_{context}"]
77
= Creating a LokiStack custom resource by using the CLI
88

99
You can create a `LokiStack` custom resource (CR) by using the {oc-first}.
@@ -17,6 +17,7 @@ You can create a `LokiStack` custom resource (CR) by using the {oc-first}.
1717
.Procedure
1818

1919
. Create a `LokiStack` CR:
20+
// tag::pre-5.9[]
2021
+
2122
--
2223
.Example `LokiStack` CR
@@ -38,26 +39,53 @@ spec:
3839
type: s3 # <3>
3940
storageClassName: <storage_class_name> # <4>
4041
tenants:
41-
mode: openshift-logging # <5>
42+
mode: openshift-logging
4243
----
4344
<1> Specify the deployment size. In the {logging} 5.8 and later versions, the supported size options for production instances of Loki are `1x.extra-small`, `1x.small`, or `1x.medium`.
44-
+
45+
<2> Specify the name of your log store secret.
46+
<3> Specify the type of your log store secret.
47+
<4> Specify the name of a storage class for temporary storage. For best performance, specify a storage class that allocates block storage. Available storage classes for your cluster can be listed by using the `oc get storageclasses` command.
48+
4549
[IMPORTANT]
4650
====
4751
It is not possible to change the number `1x` for the deployment size.
4852
====
49-
<2> Specify the name of your log store secret.
50-
<3> Specify the type of your log store secret.
51-
<4> Specify the name of a storage class for temporary storage. For best performance, specify a storage class that allocates block storage. Available storage classes for your cluster can be listed by using the `oc get storageclasses` command.
52-
<5> LokiStack defaults to running in multi-tenant mode, which cannot be modified. One tenant is provided for each log type: audit, infrastructure, and application logs. This enables access control for individual users and user groups to different log streams.
53-
--
5453

55-
. Apply the `LokiStack` CR by running the following command:
54+
// end::pre-5.9[]
55+
56+
// tag::5.9[]
5657
+
57-
[source,terminal]
58+
.Example `LokiStack` CR
59+
[source,yaml]
5860
----
59-
$ oc apply -f <filename>.yaml
61+
apiVersion: loki.grafana.com/v1
62+
kind: LokiStack
63+
metadata:
64+
name: logging-loki # <1>
65+
namespace: openshift-logging
66+
spec:
67+
size: 1x.small # <2>
68+
storage:
69+
schemas:
70+
- effectiveDate: '2023-10-15'
71+
version: v13
72+
secret:
73+
name: logging-loki-s3 # <3>
74+
type: s3 # <4>
75+
credentialMode: # <5>
76+
storageClassName: <storage_class_name> # <6>
77+
tenants:
78+
mode: openshift-logging
6079
----
80+
<1> Use the name `logging-loki`.
81+
<2> Specify the deployment size. In the {logging} 5.8 and later versions, the supported size options for production instances of Loki are `1x.extra-small`, `1x.small`, or `1x.medium`.
82+
<3> Specify the secret used for your log storage.
83+
<4> Specify the corresponding storage type.
84+
<5> Optional field, {logging} 5.9 and later. Supported user configured values are as follows: `static` is the default authentication mode available for all supported object storage types using credentials stored in a Secret. `token` for short-lived tokens retrieved from a credential source. In this mode the static configuration does not contain credentials needed for the object storage. Instead, they are generated during runtime using a service, which allows for shorter-lived credentials and much more granular control. This authentication mode is not supported for all object storage types. `token-cco` is the default value when Loki is running on managed STS mode and using CCO on STS/WIF clusters.
85+
<6> Enter the name of a storage class for temporary storage. For best performance, specify a storage class that allocates block storage. Available storage classes for your cluster can be listed by using the `oc get storageclasses` command.
86+
// end::5.9[]
87+
88+
. Apply the `LokiStack` CR by running the following command:
6189

6290
.Verification
6391

‎modules/logging-create-loki-cr-console.adoc

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * logging/log_storage/installing-log-storage.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="logging-create-loki-cr-console_{context}"]
7+
= Creating a LokiStack custom resource by using the web console
8+
9+
You can create a `LokiStack` custom resource (CR) by using the {product-title} web console.
10+
11+
.Prerequisites
12+
13+
* You have administrator permissions.
14+
* You have access to the {product-title} web console.
15+
* You installed the {loki-op}.
16+
17+
.Procedure
18+
19+
. Go to the *Operators* -> *Installed Operators* page. Click the *All instances* tab.
20+
21+
. From the *Create new* drop-down list, select *LokiStack*.
22+
23+
. Select *YAML view*, and then use the following template to create a `LokiStack` CR:
24+
// tag::pre-5.9[]
25+
+
26+
[source,yaml]
27+
----
28+
apiVersion: loki.grafana.com/v1
29+
kind: LokiStack
30+
metadata:
31+
name: logging-loki # <1>
32+
namespace: openshift-logging
33+
spec:
34+
size: 1x.small # <2>
35+
storage:
36+
schemas:
37+
- version: v12
38+
effectiveDate: '2022-06-01'
39+
secret:
40+
name: logging-loki-s3 # <3>
41+
type: s3 # <4>
42+
credentialMode: static #
43+
storageClassName: <storage_class_name> # <5>
44+
tenants:
45+
mode: openshift-logging
46+
----
47+
<1> Use the name `logging-loki`.
48+
<2> Specify the deployment size. In the {logging} 5.8 and later versions, the supported size options for production instances of Loki are `1x.extra-small`, `1x.small`, or `1x.medium`.
49+
<3> Specify the secret used for your log storage.
50+
<4> Specify the corresponding storage type.
51+
<5> Enter the name of a storage class for temporary storage. For best performance, specify a storage class that allocates block storage. Available storage classes for your cluster can be listed by using the `oc get storageclasses` command.
52+
// end::pre-5.9[]
53+
54+
// tag::5.9[]
55+
+
56+
[source,yaml]
57+
----
58+
apiVersion: loki.grafana.com/v1
59+
kind: LokiStack
60+
metadata:
61+
name: logging-loki # <1>
62+
namespace: openshift-logging
63+
spec:
64+
size: 1x.small # <2>
65+
storage:
66+
schemas:
67+
- effectiveDate: '2023-10-15'
68+
version: v13
69+
secret:
70+
name: logging-loki-s3 # <3>
71+
type: s3 # <4>
72+
credentialMode: # <5>
73+
storageClassName: <storage_class_name> # <6>
74+
tenants:
75+
mode: openshift-logging
76+
----
77+
<1> Use the name `logging-loki`.
78+
<2> Specify the deployment size. In the {logging} 5.8 and later versions, the supported size options for production instances of Loki are `1x.extra-small`, `1x.small`, or `1x.medium`.
79+
<3> Specify the secret used for your log storage.
80+
<4> Specify the corresponding storage type.
81+
<5> Optional field, {logging} 5.9 and later. Supported user configured values are as follows: `static` is the default authentication mode available for all supported object storage types using credentials stored in a Secret. `token` for short-lived tokens retrieved from a credential source. In this mode the static configuration does not contain credentials needed for the object storage. Instead, they are generated during runtime using a service, which allows for shorter-lived credentials and much more granular control. This authentication mode is not supported for all object storage types. `token-cco` is the default value when Loki is running on managed STS mode and using CCO on STS/WIF clusters.
82+
<6> Enter the name of a storage class for temporary storage. For best performance, specify a storage class that allocates block storage. Available storage classes for your cluster can be listed by using the `oc get storageclasses` command.
83+
// end::5.9[]

‎modules/logging-identity-federation.adoc

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
// Module included in the following assemblies:
2+
// * logging/log_storage/installing-log-storage.adoc
3+
4+
:_mod-docs-content-type: PROCEDURE
5+
[id="logging-identity-federation_{context}"]
6+
= Workload identity federation
7+
Workload identity federation enables authentication to cloud-based log stores using short-lived tokens.
8+
9+
.Prerequisites
10+
* {product-title} 4.14 and later
11+
* {logging-uc} 5.9 and later
12+
13+
.Procedure
14+
* If you use the {product-title} web console to install the {loki-op}, STS clusters are automatically detected. You are prompted to create roles and supply the data required for the {loki-op} to create a `CredentialsRequest` object, which populates a secret.
15+
16+
* If you use the {oc-first} to install the {loki-op}, you must manually create a subscription object using the appropriate template for your storage provider, as shown in the following examples. This authentication strategy is only supported for the storage providers indicated.
17+
18+
.Azure sample subscription
19+
[source,yaml]
20+
----
21+
apiVersion: operators.coreos.com/v1alpha1
22+
kind: Subscription
23+
metadata:
24+
name: loki-operator
25+
namespace: openshift-operators-redhat
26+
spec:
27+
channel: "stable-5.9"
28+
installPlanApproval: Manual
29+
name: loki-operator
30+
source: redhat-operators
31+
sourceNamespace: openshift-marketplace
32+
config:
33+
env:
34+
- name: CLIENTID
35+
value: <your_client_id>
36+
- name: TENANTID
37+
value: <your_tenant_id>
38+
- name: SUBSCRIPTIONID
39+
value: <your_subscription_id>
40+
- name: REGION
41+
value: <your_region>
42+
----
43+
44+
.AWS sample subscription
45+
[source,yaml]
46+
----
47+
apiVersion: operators.coreos.com/v1alpha1
48+
kind: Subscription
49+
metadata:
50+
name: loki-operator
51+
namespace: openshift-operators-redhat
52+
spec:
53+
channel: "stable-5.9"
54+
installPlanApproval: Manual
55+
name: loki-operator
56+
source: redhat-operators
57+
sourceNamespace: openshift-marketplace
58+
config:
59+
env:
60+
- name: ROLEARN
61+
value: <role_ARN>
62+
----

‎modules/logging-loki-storage-aws.adoc

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,18 @@ $ oc create secret generic logging-loki-aws \
2525
--from-literal=access_key_secret="<aws_access_key_secret>" \
2626
--from-literal=region="<aws_region_of_your_bucket>"
2727
----
28+
29+
[id="AWS_storage_STS_{context}"]
30+
== AWS storage for STS enabled clusters
31+
32+
If your cluster has STS enabled, the Cloud Credential Operator (CCO) supports short-term authentication using AWS tokens.
33+
34+
You can create the Loki object storage secret manually by running the following command:
35+
[source,terminal,subs="+quotes"]
36+
----
37+
$ oc -n openshift-logging create secret generic "logging-loki-aws" \
38+
--from-literal=bucketnames="<s3_bucket_name>" \
39+
--from-literal=region="<bucket_region>" \
40+
--from-literal=audience="<oidc_audience>" <1>
41+
----
42+
<1> Optional annotation, default value is `openshift`.

‎modules/logging-loki-storage-azure.adoc

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,18 @@ $ oc create secret generic logging-loki-azure \
2424
--from-literal=account_key="<azure_account_key>"
2525
----
2626
<1> Supported environment values are `AzureGlobal`, `AzureChinaCloud`, `AzureGermanCloud`, or `AzureUSGovernment`.
27+
28+
[id="Azure_storage_STS_{context}"]
29+
== Azure storage for STS enabled clusters
30+
31+
If your cluster has STS enabled, the Cloud Credential Operator (CCO) supports short-term authentication using Azure AD Workload Identity.
32+
33+
You can create the Loki object storage secret manually by running the following command:
34+
35+
[source,terminal,subs="+quotes"]
36+
----
37+
$ oc -n openshift-logging create secret generic logging-loki-azure \
38+
--from-literal=environment="<azure_environment>" \
39+
--from-literal=account_name="<storage_account_name>" \
40+
--from-literal=container="<container_name>"
41+
----

0 commit comments

Comments
 (0)