Skip to content

Commit b9e5191

Browse files
dfitzmaudfitzmau
authored
Merge pull request #80881 from dfitzmau/OCPBUGS-38762
OCPBUGS#38762: Updated the Creating an IAM role for the AWS Load Bala…
2 parents e5041b4 + 44b81a6 commit b9e5191

8 files changed

+86
-57
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1415,7 +1415,7 @@ Topics:
14151415
File: understanding-aws-load-balancer-operator
14161416
- Name: Installing the AWS Load Balancer Operator
14171417
File: install-aws-load-balancer-operator
1418-
- Name: Preparing for the AWS Load Balancer Operator on a cluster using the AWS Security Token Service (STS)
1418+
- Name: Installing the AWS Load Balancer Operator on a cluster that uses AWS STS
14191419
File: installing-albo-sts-cluster
14201420
- Name: Creating an instance of the AWS Load Balancer Controller
14211421
File: create-instance-aws-load-balancer-controller

‎modules/aws-installing-an-aws-load-balancer-operator.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -180,7 +180,7 @@ For more information about formatting credentials files, see link:https://access
180180
----
181181
$ oc -n aws-load-balancer-operator create secret generic aws-load-balancer-operator --from-file=credentials=albo-operator-aws-credentials.cfg
182182
----
183-
. Create the AWS IAM policy required for the AWS Load Balancer Controller (ALBC):
183+
. Create the AWS IAM policy required for the AWS Load Balancer Controller:
184184
+
185185
.. Generate a trust policy file for your identity provider. The following example uses OpenID Connect:
186186
+

‎modules/specifying-role-arn-albo-sts.adoc

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@
66
[id="specifying-role-arn-albo-sts_{context}"]
77
= Configuring the ARN role for the AWS Load Balancer Operator
88

9-
You can configure the Amazon Resource Name (ARN) role for the AWS Load Balancer Operator as an environment variable. You can configure the ARN role by using the CLI.
9+
You can configure the Amazon Resource Name (ARN) role for the {aws-short} Load Balancer Operator as an environment variable. You can configure the ARN role by using the CLI.
1010

1111
.Prerequisites
1212

13-
* You have installed the OpenShift CLI (`oc`).
13+
* You have installed the {oc-first}.
1414
1515
.Procedure
1616

@@ -54,12 +54,12 @@ spec:
5454
config:
5555
env:
5656
- name: ROLEARN
57-
value: "<role-arn>" <1>
57+
value: "<albo_role_arn>" <1>
5858
EOF
5959
----
60-
<1> Specifies the ARN role to be used in the `CredentialsRequest` to provision the AWS credentials for the AWS Load Balancer Operator.
60+
<1> Specifies the ARN role to be used in the `CredentialsRequest` to provision the {aws-short} credentials for the {aws-short} Load Balancer Operator. An example for `<albo_role_arn>` is `arn:aws:iam::<aws_account_number>:role/albo-operator`.
6161
+
6262
[NOTE]
6363
====
64-
The AWS Load Balancer Operator waits until the secret is created before moving to the `Available` status.
64+
The {aws-short} Load Balancer Operator waits until the secret is created before moving to the `Available` status.
6565
====

‎modules/using-aws-cli-create-iam-role-alb-controller.adoc

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@
66
[id="using-aws-cli-create-iam-role-alb-controller_{context}"]
77
= Creating an AWS IAM role for the controller by using the AWS CLI
88

9-
You can use the AWS command line interface to create an AWS IAM role for the AWS Load Balancer Controller. An AWS IAM role is used to interact with subnets and Virtual Private Clouds (VPCs).
9+
You can use the {aws-short} command line interface to create an {aws-short} IAM role for the {aws-short} Load Balancer Controller. An {aws-short} IAM role is used to interact with subnets and Virtual Private Clouds (VPCs).
1010

1111
.Prerequisites
1212

13-
* You must have access to the AWS command line interface (`aws`).
13+
* You must have access to the {aws-short} command line interface (`aws`).
1414
1515
.Procedure
1616

@@ -25,23 +25,23 @@ $ cat <<EOF > albo-controller-trust-policy.json
2525
{
2626
"Effect": "Allow",
2727
"Principal": {
28-
"Federated": "arn:aws:iam::777777777777:oidc-provider/<oidc-provider-id>" <1>
28+
"Federated": "<oidc_arn>" <1>
2929
},
3030
"Action": "sts:AssumeRoleWithWebIdentity",
3131
"Condition": {
3232
"StringEquals": {
33-
"<oidc-provider-id>:sub": "system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-cluster" <2>
33+
"<cluster_oidc_endpoint>:sub": "system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-cluster" <2>
3434
}
3535
}
3636
}
3737
]
3838
}
3939
EOF
4040
----
41-
<1> Specifies the Amazon Resource Name (ARN) of the identity provider.
42-
<2> Specifies the service account for the AWS Load Balancer Controller.
41+
<1> Specifies the Amazon Resource Name (ARN) of the OIDC identity provider, such as `arn:aws:iam::777777777777:oidc-provider/rh-oidc.s3.us-east-1.amazonaws.com/28292va7ad7mr9r4he1fb09b14t59t4f`.
42+
<2> Specifies the service account for the {aws-short} Load Balancer Controller. An example of `<cluster_oidc_endpoint>` is `rh-oidc.s3.us-east-1.amazonaws.com/28292va7ad7mr9r4he1fb09b14t59t4f`.
4343

44-
. Create an AWS IAM role with the generated trust policy by running the following command:
44+
. Create an {aws-short} IAM role with the generated trust policy by running the following command:
4545
+
4646
[source,terminal]
4747
----
@@ -51,22 +51,22 @@ $ aws iam create-role --role-name albo-controller --assume-role-policy-document
5151
.Example output
5252
[source,terminal]
5353
----
54-
ROLE arn:aws:iam::777777777777:role/albo-controller 2023-08-02T12:13:22Z <1>
54+
ROLE arn:aws:iam::<aws_account_number>:role/albo-controller 2023-08-02T12:13:22Z <1>
5555
ASSUMEROLEPOLICYDOCUMENT 2012-10-17
5656
STATEMENT sts:AssumeRoleWithWebIdentity Allow
5757
STRINGEQUALS system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-cluster
58-
PRINCIPAL arn:aws:iam:777777777777:oidc-provider/<oidc-provider-id>
58+
PRINCIPAL arn:aws:iam:<aws_account_number>:oidc-provider/<cluster_oidc_endpoint>
5959
----
60-
<1> Note the ARN of an AWS IAM role.
60+
<1> Note the ARN of an {aws-short} IAM role for the {aws-short} Load Balancer Controller, such as `arn:aws:iam::777777777777:role/albo-controller`.
6161

62-
. Download the permission policy for the AWS Load Balancer Controller by running the following command:
62+
. Download the permission policy for the {aws-short} Load Balancer Controller by running the following command:
6363
+
6464
[source,terminal]
6565
----
6666
$ curl -o albo-controller-permission-policy.json https://raw.githubusercontent.com/openshift/aws-load-balancer-operator/main/assets/iam-policy.json
6767
----
6868

69-
. Attach the permission policy for the AWS Load Balancer Controller to an AWS IAM role by running the following command:
69+
. Attach the permission policy for the {aws-short} Load Balancer Controller to an {aws-short} IAM role by running the following command:
7070
+
7171
[source,terminal]
7272
----
@@ -84,8 +84,8 @@ metadata:
8484
name: cluster <2>
8585
spec:
8686
credentialsRequestConfig:
87-
stsIAMRoleARN: <role-arn> <3>
87+
stsIAMRoleARN: <albc_role_arn> <3>
8888
----
8989
<1> Defines the `AWSLoadBalancerController` object.
90-
<2> Defines the AWS Load Balancer Controller name. All related resources use this instance name as a suffix.
91-
<3> Specifies the ARN role. The `CredentialsRequest` object uses this ARN role to provision the AWS credentials.
90+
<2> Defines the {aws-short} Load Balancer Controller name. All related resources use this instance name as a suffix.
91+
<3> Specifies the ARN role for the {aws-short} Load Balancer Controller. The `CredentialsRequest` object uses this ARN role to provision the {aws-short} credentials. An example of `<albc_role_arn>` is `arn:aws:iam::777777777777:role/albo-controller`.

‎modules/using-aws-cli-create-iam-role-alb-operator.adoc

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@
66
[id="using-aws-cli-create-iam-role-alb-operator_{context}"]
77
= Creating an AWS IAM role by using the AWS CLI
88

9-
You can use the AWS Command Line Interface to create an IAM role for the AWS Load Balancer Operator. The IAM role is used to interact with subnets and Virtual Private Clouds (VPCs).
9+
You can use the {aws-short} Command Line Interface to create an IAM role for the {aws-short} Load Balancer Operator. The IAM role is used to interact with subnets and Virtual Private Clouds (VPCs).
1010

1111
.Prerequisites
1212

13-
* You must have access to the AWS Command Line Interface (`aws`).
13+
* You must have access to the {aws-short} Command Line Interface (`aws`).
1414
1515
.Procedure
1616

@@ -25,21 +25,21 @@ $ cat <<EOF > albo-operator-trust-policy.json
2525
{
2626
"Effect": "Allow",
2727
"Principal": {
28-
"Federated": "arn:aws:iam::777777777777:oidc-provider/<oidc-provider-id>" <1>
28+
"Federated": "<oidc_arn>" <1>
2929
},
3030
"Action": "sts:AssumeRoleWithWebIdentity",
3131
"Condition": {
3232
"StringEquals": {
33-
"<oidc-provider-id>:sub": "system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-operator-controller-manager" <2>
33+
"<cluster_oidc_endpoint>:sub": "system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-cluster" <2>
3434
}
3535
}
3636
}
3737
]
3838
}
3939
EOF
4040
----
41-
<1> Specifies the Amazon Resource Name (ARN) of the identity provider.
42-
<2> Specifies the service account for the AWS Load Balancer Operator.
41+
<1> Specifies the Amazon Resource Name (ARN) of the OIDC identity provider, such as `arn:aws:iam::777777777777:oidc-provider/rh-oidc.s3.us-east-1.amazonaws.com/28292va7ad7mr9r4he1fb09b14t59t4f`.
42+
<2> Specifies the service account for the {aws-short} Load Balancer Controller. An example of `<cluster_oidc_endpoint>` is `rh-oidc.s3.us-east-1.amazonaws.com/28292va7ad7mr9r4he1fb09b14t59t4f`.
4343

4444
. Create the IAM role with the generated trust policy by running the following command:
4545
+
@@ -51,22 +51,22 @@ $ aws iam create-role --role-name albo-operator --assume-role-policy-document fi
5151
.Example output
5252
[source,terminal]
5353
----
54-
ROLE arn:aws:iam::777777777777:role/albo-operator 2023-08-02T12:13:22Z <1>
54+
ROLE arn:aws:iam::<aws_account_number>:role/albo-operator 2023-08-02T12:13:22Z <1>
5555
ASSUMEROLEPOLICYDOCUMENT 2012-10-17
5656
STATEMENT sts:AssumeRoleWithWebIdentity Allow
5757
STRINGEQUALS system:serviceaccount:aws-load-balancer-operator:aws-load-balancer-controller-manager
58-
PRINCIPAL arn:aws:iam:777777777777:oidc-provider/<oidc-provider-id>
58+
PRINCIPAL arn:aws:iam:<aws_account_number>:oidc-provider/<cluster_oidc_endpoint>
5959
----
60-
<1> Note the ARN of the created IAM role.
60+
<1> Note the ARN of the created {aws-short} IAM role that was created for the {aws-short} Load Balancer Operator, such as `arn:aws:iam::777777777777:role/albo-operator`.
6161

62-
. Download the permission policy for the AWS Load Balancer Operator by running the following command:
62+
. Download the permission policy for the {aws-short} Load Balancer Operator by running the following command:
6363
+
6464
[source,terminal]
6565
----
6666
$ curl -o albo-operator-permission-policy.json https://raw.githubusercontent.com/openshift/aws-load-balancer-operator/main/hack/operator-permission-policy.json
6767
----
6868

69-
. Attach the permission policy for the AWS Load Balancer Controller to the IAM role by running the following command:
69+
. Attach the permission policy for the {aws-short} Load Balancer Controller to the IAM role by running the following command:
7070
+
7171
[source,terminal]
7272
----

‎modules/using-ccoctl-create-iam-role-alb-controller.adoc

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
[id="using-ccoctl-create-iam-role-alb-controller_{context}"]
77
= Creating an AWS IAM role for the controller by using the Cloud Credential Operator utility
88

9-
You can use the Cloud Credential Operator utility (`ccoctl`) to create an AWS IAM role for the AWS Load Balancer Controller. An AWS IAM role is used to interact with subnets and Virtual Private Clouds (VPCs).
9+
You can use the Cloud Credential Operator utility (`ccoctl`) to create an {aws-short} IAM role for the {aws-short} Load Balancer Controller. An {aws-short} IAM role is used to interact with subnets and Virtual Private Clouds (VPCs).
1010

1111
.Prerequisites
1212

@@ -18,28 +18,28 @@ You can use the Cloud Credential Operator utility (`ccoctl`) to create an AWS IA
1818
+
1919
[source,terminal]
2020
----
21-
$ curl --create-dirs -o <credrequests-dir>/controller.yaml https://raw.githubusercontent.com/openshift/aws-load-balancer-operator/main/hack/controller/controller-credentials-request.yaml
21+
$ curl --create-dirs -o <credentials_requests_dir>/controller.yaml https://raw.githubusercontent.com/openshift/aws-load-balancer-operator/main/hack/controller/controller-credentials-request.yaml
2222
----
2323

24-
. Use the `ccoctl` utility to create an AWS IAM role by running the following command:
24+
. Use the `ccoctl` utility to create an {aws-short} IAM role by running the following command:
2525
+
2626
[source,terminal]
2727
----
2828
$ ccoctl aws create-iam-roles \
2929
--name <name> \
3030
--region=<aws_region> \
31-
--credentials-requests-dir=<credrequests-dir> \
32-
--identity-provider-arn <oidc-arn>
31+
--credentials-requests-dir=<credentials_requests_dir> \
32+
--identity-provider-arn <oidc_arn>
3333
----
3434
+
3535
.Example output
3636
[source,terminal]
3737
----
3838
2023/09/12 11:38:57 Role arn:aws:iam::777777777777:role/<name>-aws-load-balancer-operator-aws-load-balancer-controller created <1>
39-
2023/09/12 11:38:57 Saved credentials configuration to: /home/user/<credrequests-dir>/manifests/aws-load-balancer-operator-aws-load-balancer-controller-credentials.yaml
39+
2023/09/12 11:38:57 Saved credentials configuration to: /home/user/<credentials_requests_dir>/manifests/aws-load-balancer-operator-aws-load-balancer-controller-credentials.yaml
4040
2023/09/12 11:38:58 Updated Role policy for Role <name>-aws-load-balancer-operator-aws-load-balancer-controller created
4141
----
42-
<1> Note the Amazon Resource Name (ARN) of an AWS IAM role.
42+
<1> Note the Amazon Resource Name (ARN) of an {aws-short} IAM role that was created for the {aws-short} Load Balancer Controller, such as `arn:aws:iam::777777777777:role/<name>-aws-load-balancer-operator-aws-load-balancer-controller`.
4343
+
4444
[NOTE]
4545
====

‎modules/using-ccoctl-create-iam-role-alb-operator.adoc

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
[id="using-ccoctl-create-iam-role-alb-operator_{context}"]
77
= Creating an AWS IAM role by using the Cloud Credential Operator utility
88

9-
You can use the Cloud Credential Operator utility (`ccoctl`) to create an AWS IAM role for the AWS Load Balancer Operator. An AWS IAM role is used to interact with subnets and Virtual Private Clouds (VPCs).
9+
You can use the Cloud Credential Operator utility (`ccoctl`) to create an {aws-short} IAM role for the {aws-short} Load Balancer Operator. An {aws-short} IAM role interacts with subnets and Virtual Private Clouds (VPCs).
1010

1111
.Prerequisites
1212

@@ -18,30 +18,30 @@ You can use the Cloud Credential Operator utility (`ccoctl`) to create an AWS IA
1818
+
1919
[source,terminal]
2020
----
21-
$ curl --create-dirs -o <credrequests-dir>/operator.yaml https://raw.githubusercontent.com/openshift/aws-load-balancer-operator/main/hack/operator-credentials-request.yaml
21+
$ curl --create-dirs -o <credentials_requests_dir>/operator.yaml https://raw.githubusercontent.com/openshift/aws-load-balancer-operator/main/hack/operator-credentials-request.yaml
2222
----
2323

24-
. Use the `ccoctl` utility to create an AWS IAM role by running the following command:
24+
. Use the `ccoctl` utility to create an {aws-short} IAM role by running the following command:
2525
+
2626
[source,terminal]
2727
----
2828
$ ccoctl aws create-iam-roles \
2929
--name <name> \
3030
--region=<aws_region> \
31-
--credentials-requests-dir=<credrequests-dir> \
32-
--identity-provider-arn <oidc-arn>
31+
--credentials-requests-dir=<credentials_requests_dir> \
32+
--identity-provider-arn <oidc_arn>
3333
----
3434
+
3535
.Example output
3636
[source,terminal]
3737
----
3838
2023/09/12 11:38:57 Role arn:aws:iam::777777777777:role/<name>-aws-load-balancer-operator-aws-load-balancer-operator created <1>
39-
2023/09/12 11:38:57 Saved credentials configuration to: /home/user/<credrequests-dir>/manifests/aws-load-balancer-operator-aws-load-balancer-operator-credentials.yaml
39+
2023/09/12 11:38:57 Saved credentials configuration to: /home/user/<credentials_requests_dir>/manifests/aws-load-balancer-operator-aws-load-balancer-operator-credentials.yaml
4040
2023/09/12 11:38:58 Updated Role policy for Role <name>-aws-load-balancer-operator-aws-load-balancer-operator created
4141
----
42-
<1> Note the Amazon Resource Name (ARN) of an AWS IAM role.
42+
<1> Note the Amazon Resource Name (ARN) of an {aws-short} IAM role that was created for the {aws-short} Load Balancer Operator, such as `arn:aws:iam::777777777777:role/<name>-aws-load-balancer-operator-aws-load-balancer-operator`.
4343
+
4444
[NOTE]
4545
====
46-
The length of an AWS IAM role name must be less than or equal to 12 characters.
46+
The length of an {aws-short} IAM role name must be less than or equal to 12 characters.
4747
====

0 commit comments

Comments
 (0)