Skip to content

Commit 2ba3991

Browse files
EricPonvelleEricPonvelle
authored
Merge pull request #77936 from EricPonvelle/OSDOCS-10250_Additional-Principals
OSDOCS#10250: Added information around additional principals
2 parents 60f50af + 75045c4 commit 2ba3991

7 files changed

+132
-0
lines changed

‎images/AWS_cross_account_access.png

103 KB
Loading

‎modules/rosa-additional-principals-create.adoc

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * rosa_hcp/rosa-hcp-aws-private-creating-cluster.adoc
4+
5+
6+
:_mod-docs-content-type: PROCEDURE
7+
[id="rosa-additional-principals-create_{context}"]
8+
= Adding additional principals while creating your {hcp-title} cluster
9+
10+
Use the `--additional-allowed-principals` argument to permit access through other roles.
11+
12+
.Procedure
13+
14+
. Add the `--additional-allowed-principals` argument to the `rosa create cluster` command, similar to the following:
15+
+
16+
[source,terminal]
17+
----
18+
$ rosa create cluster [...] --additional-allowed-principals <arn_string>
19+
----
20+
+
21+
You can use `arn:aws:iam::account_id:role/role_name` to approve a specific role.
22+
23+
. When the cluster creation command runs, you receive a summary of your cluster with the `--additional-allowed-principals` specified:
24+
+
25+
.Example output
26+
+
27+
[source,terminal]
28+
----
29+
Name: mycluster
30+
Domain Prefix: mycluster
31+
Display Name: mycluster
32+
ID: <cluster-id>
33+
External ID: <cluster-id>
34+
Control Plane: ROSA Service Hosted
35+
OpenShift Version: 4.15.17
36+
Channel Group: stable
37+
DNS: Not ready
38+
AWS Account: <aws_id>
39+
AWS Billing Account: <aws_id>
40+
API URL:
41+
Console URL:
42+
Region: us-east-2
43+
Availability:
44+
- Control Plane: MultiAZ
45+
- Data Plane: SingleAZ
46+
47+
Nodes:
48+
- Compute (desired): 2
49+
- Compute (current): 0
50+
Network:
51+
- Type: OVNKubernetes
52+
- Service CIDR: 172.30.0.0/16
53+
- Machine CIDR: 10.0.0.0/16
54+
- Pod CIDR: 10.128.0.0/14
55+
- Host Prefix: /23
56+
- Subnets: subnet-453e99d40, subnet-666847ce827
57+
EC2 Metadata Http Tokens: optional
58+
Role (STS) ARN: arn:aws:iam::<aws_id>:role/mycluster-HCP-ROSA-Installer-Role
59+
Support Role ARN: arn:aws:iam::<aws_id>:role/mycluster-HCP-ROSA-Support-Role
60+
Instance IAM Roles:
61+
- Worker: arn:aws:iam::<aws_id>:role/mycluster-HCP-ROSA-Worker-Role
62+
Operator IAM Roles:
63+
- arn:aws:iam::<aws_id>:role/mycluster-kube-system-control-plane-operator
64+
- arn:aws:iam::<aws_id>:role/mycluster-openshift-cloud-network-config-controller-cloud-creden
65+
- arn:aws:iam::<aws_id>:role/mycluster-openshift-image-registry-installer-cloud-credentials
66+
- arn:aws:iam::<aws_id>:role/mycluster-openshift-ingress-operator-cloud-credentials
67+
- arn:aws:iam::<aws_id>:role/mycluster-openshift-cluster-csi-drivers-ebs-cloud-credentials
68+
- arn:aws:iam::<aws_id>:role/mycluster-kube-system-kms-provider
69+
- arn:aws:iam::<aws_id>:role/mycluster-kube-system-kube-controller-manager
70+
- arn:aws:iam::<aws_id>:role/mycluster-kube-system-capa-controller-manager
71+
Managed Policies: Yes
72+
State: waiting (Waiting for user action)
73+
Private: No
74+
Delete Protection: Disabled
75+
Created: Jun 25 2024 13:36:37 UTC
76+
User Workload Monitoring: Enabled
77+
Details Page: https://console.redhat.com/openshift/details/s/Bvbok4O79q1Vg8
78+
OIDC Endpoint URL: https://oidc.op1.openshiftapps.com/vhufi5lap6vbl3jlq20e (Managed)
79+
Audit Log Forwarding: Disabled
80+
External Authentication: Disabled
81+
Additional Principals: arn:aws:iam::<aws_id>:role/additional-user-role
82+
----

‎modules/rosa-additional-principals-edit.adoc

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * rosa_hcp/rosa-hcp-aws-private-creating-cluster.adoc
4+
5+
6+
:_mod-docs-content-type: PROCEDURE
7+
[id="rosa-additional-principals-edit_{context}"]
8+
= Adding additional principals to your existing {hcp-title} cluster
9+
10+
You can add additional principals to your cluster by using the command line interface (CLI).
11+
12+
.Procedure
13+
14+
* Run the following command to edit your cluster and add an additional principal who can access this cluster's endpoint:
15+
+
16+
[source,terminal]
17+
----
18+
$ rosa edit cluster -c <cluster_name> --additional-allowed-principals <arn_string>
19+
----
20+
+
21+
You can use `arn:aws:iam::account_id:role/role_name` to approve a specific role.

‎modules/rosa-additional-principals-overview.adoc

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * rosa_hcp/rosa-hcp-aws-private-creating-cluster.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="rosa-additional-principals-overview_{context}"]
7+
= Additional principals on your {hcp-title} cluster
8+
9+
You can allow AWS Identity and Access Management (IAM) roles as additional principals to connect to your cluster's private API server endpoint.
10+
11+
You can access your {hcp-title} cluster's API Server endpoint from either the public internet or the interface endpoint that was created within the VPC private subnets. By default, you can privately access your {hcp-title} API Server by using the `-kube-system-kube-controller-manager` Operator role. To be able to access ROSA with HCP API server from another account directly without using the primary account where cluster is installed, you must include cross-account IAM roles as additional principals. This feature allows you to simplify your network architecture and reduce data transfer costs by avoiding peering or attaching cross-account VPCs to cluster's VPC.
12+
13+
image::AWS_cross_account_access.png[Overview of AWS cross account access]
14+
15+
In this diagram, the cluster creating account is designated as Account A. This account designates that another account, Account B, should have access to the API server.
16+
17+
[NOTE]
18+
====
19+
After you have configured additional allowed principals, you must create the interface VPC endpoint in the VPC from where you want to access the cross-account {hcp-title} API server. Then, create a private hosted zone in Route53 to route calls made to cross-account {hcp-title} API server to pass through the created VPC endpoint.
20+
====

‎modules/rosa-create-objects.adoc

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,9 @@ $ rosa create cluster --cluster-name=<cluster_name> [arguments]
192192
|--additional-control-plane-security-group-ids <sec_group_id>
193193
|The identifier of one or more additional security groups to use along with the default security groups that are used with the control plane nodes created alongside the cluster. For more information on additional security groups, see the requirements for _Security groups_ under _Additional resources_.
194194

195+
|--additional-allowed-principals <arn>
196+
|A comma-separated list of additional allowed principal ARNs to be added to the hosted control plane's VPC endpoint service to enable additional VPC endpoint connection requests to be automatically accepted.
197+
195198
a|--cluster-name <cluster_name>
196199
|Required. The name of the cluster. When used with the `create cluster` command, this argument is used to set the cluster name and can hold up to 54 characters. The value for this argument must be unique within your organization.
197200

‎modules/rosa-edit-objects.adoc

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@ $ rosa edit cluster --cluster=<cluster_name> | <cluster_id> [arguments]
2525
|===
2626
|Option |Definition
2727

28+
|--additional-allowed-principals <arn>
29+
|A comma-separated list of additional allowed principal ARNs to be added to the Hosted Control Plane's VPC endpoint service to enable additional VPC endpoint connection requests to be automatically accepted.
30+
2831
|--cluster
2932
|Required: The name or ID (string) of the cluster to edit.
3033

‎rosa_hcp/rosa-hcp-aws-private-creating-cluster.adoc

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ This document describes how to create a {hcp-title-first} private cluster.
1212
//include::modules/osd-aws-privatelink-required-resources.adoc[leveloffset=+1]
1313
include::modules/rosa-hcp-aws-private-create-cluster.adoc[leveloffset=+1]
1414
include::modules/rosa-hcp-aws-private-security-groups.adoc[leveloffset=+1]
15+
include::modules/rosa-additional-principals-overview.adoc[leveloffset=+1]
16+
include::modules/rosa-additional-principals-create.adoc[leveloffset=+2]
17+
include::modules/rosa-additional-principals-edit.adoc[leveloffset=+2]
1518

1619
[id="next-steps_rosa-hcp-aws-private-creating-cluster"]
1720
== Next steps

0 commit comments

Comments
 (0)