Skip to content

Commit 2298dc9

Browse files
ShaunaDiazShaunaDiaz
authored
Merge pull request #94801 from max-cx/OBSDOCS-1976
OBSDOCS-1976: Document support for GCP, Azure, and AWS STP tokens
2 parents 427eca1 + 3ecffad commit 2298dc9

5 files changed

+478
-84
lines changed

‎modules/distr-tracing-tempo-object-storage-setup-aws-sts-cco-install.adoc

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
// Module included in the following assemblies:
2+
//
3+
//* observability/distr_tracing/distr-tracing-tempo-installing.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="setting-up-amazon-s3-storage-with-security-token-service_{context}"]
7+
= Setting up the Amazon S3 storage with the Security Token Service
8+
9+
You can set up the Amazon S3 storage with the Security Token Service (STS) and AWS Command Line Interface (AWS CLI). Optionally, you can also use the Cloud Credential Operator (CCO).
10+
11+
:FeatureName: Using the {TempoShortName} with the Amazon S3 storage and STS
12+
include::snippets/technology-preview.adoc[leveloffset=+1]
13+
14+
.Prerequisites
15+
16+
* You have installed the latest version of the AWS CLI.
17+
* If you intend to use the CCO, you have installed and configured the CCO in your cluster.
18+
19+
.Procedure
20+
21+
. Create an AWS S3 bucket.
22+
23+
. Create the following `trust.json` file for the AWS Identity and Access Management (AWS IAM) policy for the purpose of setting up a trust relationship between the AWS IAM role, which you will create in the next step, and the service account of either the `TempoStack` or `TempoMonolithic` instance:
24+
+
25+
.`trust.json`
26+
[source,yaml]
27+
----
28+
{
29+
"Version": "2012-10-17",
30+
"Statement": [
31+
{
32+
"Effect": "Allow",
33+
"Principal": {
34+
"Federated": "arn:aws:iam::<aws_account_id>:oidc-provider/<oidc_provider>" # <1>
35+
},
36+
"Action": "sts:AssumeRoleWithWebIdentity",
37+
"Condition": {
38+
"StringEquals": {
39+
"<oidc_provider>:sub": [
40+
"system:serviceaccount:<openshift_project_for_tempo>:tempo-<tempo_custom_resource_name>" # <2>
41+
"system:serviceaccount:<openshift_project_for_tempo>:tempo-<tempo_custom_resource_name>-query-frontend"
42+
]
43+
}
44+
}
45+
}
46+
]
47+
}
48+
----
49+
<1> The OpenID Connect (OIDC) provider that you have configured on the {product-title}.
50+
<2> The namespace in which you intend to create either a `TempoStack` or `TempoMonolithic` instance. Replace `<tempo_custom_resource_name>` with the `metadata` name that you define in your `TempoStack` or `TempoMonolithic` custom resource.
51+
+
52+
[TIP]
53+
====
54+
You can also get the value for the OIDC provider by running the following command:
55+
56+
[source,terminal]
57+
----
58+
$ oc get authentication cluster -o json | jq -r '.spec.serviceAccountIssuer' | sed 's~http[s]*://~~g'
59+
----
60+
====
61+
62+
. Create an AWS IAM role by attaching the created `trust.json` policy file. You can do this by running the following command:
63+
+
64+
[source,terminal]
65+
----
66+
$ aws iam create-role \
67+
--role-name "tempo-s3-access" \
68+
--assume-role-policy-document "file:///tmp/trust.json" \
69+
--query Role.Arn \
70+
--output text
71+
----
72+
73+
. Attach an AWS IAM policy to the created AWS IAM role. You can do this by running the following command:
74+
+
75+
[source,terminal]
76+
----
77+
$ aws iam attach-role-policy \
78+
--role-name "tempo-s3-access" \
79+
--policy-arn "arn:aws:iam::aws:policy/AmazonS3FullAccess"
80+
----
81+
82+
. If you are not using the CCO, skip this step. If you are using the CCO, configure the cloud provider environment for the {TempoOperator}. You can do this by running the following command:
83+
+
84+
[source,terminal]
85+
----
86+
$ oc patch subscription <tempo_operator_sub> \ # <1>
87+
-n <tempo_operator_namespace> \ # <2>
88+
--type='merge' -p '{"spec": {"config": {"env": [{"name": "ROLEARN", "value": "'"<role_arn>"'"}]}}}' # <3>
89+
----
90+
<1> The name of the {TempoOperator} subscription.
91+
<2> The namespace of the {TempoOperator}.
92+
<3> The AWS STS requires adding the `ROLEARN` environment variable to the {TempoOperator} subcription. As the `<role_arn>` value, add the Amazon Resource Name (ARN) of the AWS IAM role that you created in step 3.
93+
94+
. In the {product-title}, create an object storage secret with keys as follows:
95+
+
96+
[source,yaml]
97+
----
98+
apiVersion: v1
99+
kind: Secret
100+
metadata:
101+
name: <secret_name>
102+
stringData:
103+
bucket: <s3_bucket_name>
104+
region: <s3_region>
105+
role_arn: <s3_role_arn>
106+
type: Opaque
107+
----
108+
109+
. When the object storage secret is created, update the relevant custom resource of the {TempoShortName} instance as follows:
110+
+
111+
.Example `TempoStack` custom resource
112+
[source,yaml]
113+
----
114+
apiVersion: tempo.grafana.com/v1alpha1
115+
kind: TempoStack
116+
metadata:
117+
name: <name>
118+
namespace: <namespace>
119+
spec:
120+
# ...
121+
storage:
122+
secret: # <1>
123+
name: <secret_name>
124+
type: s3
125+
credentialMode: token-cco # <2>
126+
# ...
127+
----
128+
<1> The secret that you created in the previous step.
129+
<2> If you are not using the CCO, omit this line. If you are using the CCO, add this parameter with the `token-cco` value.
130+
+
131+
.Example `TempoMonolithic` custom resource
132+
[source,yaml]
133+
----
134+
apiVersion: tempo.grafana.com/v1alpha1
135+
kind: TempoMonolithic
136+
metadata:
137+
name: <name>
138+
namespace: <namespace>
139+
spec:
140+
# ...
141+
storage:
142+
traces:
143+
backend: s3
144+
s3:
145+
secret: <secret_name> # <1>
146+
credentialMode: token-cco # <2>
147+
# ...
148+
----
149+
<1> The secret that you created in the previous step.
150+
<2> If you are not using the CCO, omit this line. If you are using the CCO, add this parameter with the `token-cco` value.

‎modules/distr-tracing-tempo-object-storage-setup-aws-sts-install.adoc

Lines changed: 0 additions & 83 deletions
This file was deleted.

0 commit comments

Comments
 (0)