Skip to content

Commit 8f732d7

Browse files
stevsmitstevsmit
authored
Merge pull request #87309 from shdeshpa07/OADP-5482-ROSA-STA-RoleARN
OADP-5482 ROSA STS RoleARN
2 parents bc095f2 + 4fe4fd1 commit 8f732d7

File tree

3 files changed

+166
-0
lines changed

3 files changed

+166
-0
lines changed

‎_attributes/common-attributes.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ endif::[]
4747
:oadp-version: 1.4.1
4848
:oadp-version-1-3: 1.3.3
4949
:oadp-version-1-4: 1.4.2
50+
:oadp-bsl-api: backupstoragelocations.velero.io
5051
:oc-first: pass:quotes[OpenShift CLI (`oc`)]
5152
:product-registry: OpenShift image registry
5253
:product-mirror-registry: Mirror registry for Red Hat OpenShift

‎backup_and_restore/application_backup_and_restore/oadp-rosa/oadp-rosa-backing-up-applications.adoc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ include::modules/preparing-aws-credentials-for-oadp.adoc[leveloffset=+1]
3636

3737
include::modules/installing-oadp-rosa-sts.adoc[leveloffset=+1]
3838

39+
include::modules/updating-role-arn-oadp-rosa-sts.adoc[leveloffset=+1]
40+
3941
[role="_additional-resources"]
4042
.Additional resources
4143
// This xref points to a topic that is not published in the ROSA docs.

‎modules/updating-role-arn-oadp-rosa-sts.adoc

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * backup_and_restore/application_backup_and_restore/oadp-rosa/oadp-rosa-backing-up-applications.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="updating-role-arn-oadp-rosa-sts_{context}"]
7+
= Updating the IAM role ARN in the {oadp-short} Operator subscription
8+
9+
While installing the {oadp-short} Operator on a ROSA Security Token Service (STS) cluster, if you provide an incorrect IAM role Amazon Resource Name (ARN), the `openshift-adp-controller` pod gives an error. The credential requests that are generated contain the wrong IAM role ARN. To update the credential requests object with the correct IAM role ARN, you can edit the {oadp-short} Operator subscription and patch the IAM role ARN with the correct value. By editing the {oadp-short} Operator subscription, you do not have to uninstall and reinstall {oadp-short} to update the IAM role ARN.
10+
11+
.Prerequisites
12+
13+
ifdef::openshift-enterprise[]
14+
* You have a {product-rosa} STS cluster with the required access and tokens.
15+
endif::openshift-enterprise[]
16+
ifdef::openshift-rosa,openshift-rosa-hcp[]
17+
* You have a {product-title} STS cluster with the required access and tokens.
18+
endif::openshift-rosa,openshift-rosa-hcp[]
19+
* You have installed {oadp-short} on the ROSA STS cluster.
20+
21+
.Procedure
22+
23+
. To verify that the {oadp-short} subscription has the wrong IAM role ARN environment variable set, run the following command:
24+
+
25+
[source,terminal]
26+
----
27+
$ oc get sub -o yaml redhat-oadp-operator
28+
----
29+
+
30+
.Example subscription
31+
[source,yaml]
32+
----
33+
apiVersion: operators.coreos.com/v1alpha1
34+
kind: Subscription
35+
metadata:
36+
annotations:
37+
creationTimestamp: "2025-01-15T07:18:31Z"
38+
generation: 1
39+
labels:
40+
operators.coreos.com/redhat-oadp-operator.openshift-adp: ""
41+
name: redhat-oadp-operator
42+
namespace: openshift-adp
43+
resourceVersion: "77363"
44+
uid: 5ba00906-5ad2-4476-ae7b-ffa90986283d
45+
spec:
46+
channel: stable-1.4
47+
config:
48+
env:
49+
- name: ROLEARN
50+
value: arn:aws:iam::11111111:role/wrong-role-arn # <1>
51+
installPlanApproval: Manual
52+
name: redhat-oadp-operator
53+
source: prestage-operators
54+
sourceNamespace: openshift-marketplace
55+
startingCSV: oadp-operator.v1.4.2
56+
----
57+
<1> Verify the value of `ROLEARN` you want to update.
58+
59+
. Update the `ROLEARN` field of the subscription with the correct role ARN by running the following command:
60+
+
61+
[source,terminal]
62+
----
63+
$ oc patch subscription redhat-oadp-operator -p '{"spec": {"config": {"env": [{"name": "ROLEARN", "value": "<role_arn>"}]}}}' --type='merge'
64+
----
65+
+
66+
where:
67+
68+
`<role_arn>`:: Specifies the IAM role ARN to be updated. For example, `arn:aws:iam::160.....6956:role/oadprosa.....8wlf`.
69+
70+
. Verify that the `secret` object is updated with correct role ARN value by running the following command:
71+
+
72+
[source,terminal]
73+
----
74+
$ oc get secret cloud-credentials -o jsonpath='{.data.credentials}' | base64 -d
75+
----
76+
+
77+
.Example output
78+
+
79+
[source,terminal]
80+
----
81+
[default]
82+
sts_regional_endpoints = regional
83+
role_arn = arn:aws:iam::160.....6956:role/oadprosa.....8wlf
84+
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
85+
----
86+
87+
. Configure the `DataProtectionApplication` custom resource (CR) manifest file as shown in the following example:
88+
+
89+
[source,yaml]
90+
----
91+
apiVersion: oadp.openshift.io/v1alpha1
92+
kind: DataProtectionApplication
93+
metadata:
94+
name: test-rosa-dpa
95+
namespace: openshift-adp
96+
spec:
97+
backupLocations:
98+
- bucket:
99+
config:
100+
region: us-east-1
101+
cloudStorageRef:
102+
name: <cloud_storage> # <1>
103+
credential:
104+
name: cloud-credentials
105+
key: credentials
106+
prefix: velero
107+
default: true
108+
configuration:
109+
velero:
110+
defaultPlugins:
111+
- aws
112+
- openshift
113+
----
114+
<1> Specify the `CloudStorage` CR.
115+
116+
. Create the `DataProtectionApplication` CR by running the following command:
117+
+
118+
[source,terminal]
119+
----
120+
$ oc create -f <dpa_manifest_file>
121+
----
122+
123+
. Verify that the `DataProtectionApplication` CR is reconciled and the `status` is set to `"True"` by running the following command:
124+
+
125+
[source,terminal]
126+
----
127+
$ oc get dpa -n openshift-adp -o yaml
128+
----
129+
+
130+
.Example `DataProtectionApplication`
131+
+
132+
[source,yaml]
133+
----
134+
apiVersion: oadp.openshift.io/v1alpha1
135+
kind: DataProtectionApplication
136+
...
137+
status:
138+
conditions:
139+
- lastTransitionTime: "2023-07-31T04:48:12Z"
140+
message: Reconcile complete
141+
reason: Complete
142+
status: "True"
143+
type: Reconciled
144+
----
145+
146+
. Verify that the `BackupStorageLocation` CR is in an available state by running the following command:
147+
+
148+
[source,terminal,subs="attributes+"]
149+
----
150+
$ oc get {oadp-bsl-api} -n openshift-adp
151+
----
152+
+
153+
.Example `BackupStorageLocation`
154+
+
155+
[source,terminal]
156+
----
157+
NAME PHASE LAST VALIDATED AGE DEFAULT
158+
ts-dpa-1 Available 3s 6s true
159+
----
160+
161+
162+
163+

0 commit comments

Comments
 (0)