Skip to content

Commit ca9fe20

Browse files
lahinsonlahinson
committed
[OSDOCS-12355: Improvements to docs about creating hosted clusters on AWS
1 parent d6877ee commit ca9fe20

File tree

5 files changed

+56
-38
lines changed

5 files changed

+56
-38
lines changed

‎modules/hcp-aws-create-role-sts-creds.adoc

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ arn:aws:iam::1234567890:user/<aws_username>
2525
+
2626
Use this output as the value for `<arn>` in the next step.
2727

28-
. Create a JSON file named `trust-relationship.json` that contains the trust relationship configuration for your role. See the following example:
28+
. Create a JSON file that contains the trust relationship configuration for your role. See the following example:
2929
+
3030
[source,json]
3131
----
@@ -35,7 +35,7 @@ Use this output as the value for `<arn>` in the next step.
3535
{
3636
"Effect": "Allow",
3737
"Principal": {
38-
"AWS": <arn> <1>
38+
"AWS": "<arn>" <1>
3939
},
4040
"Action": "sts:AssumeRole"
4141
}
@@ -54,7 +54,7 @@ $ aws iam create-role \
5454
--query "Role.Arn"
5555
----
5656
<1> Replace `<name>` with the role name, for example, `hcp-cli-role`.
57-
<2> Replace `<file_name>` with the file name, for example, `assume-role-policy.json`.
57+
<2> Replace `<file_name>` with the name of the JSON file you created in the previous step.
5858
+
5959
.Example output
6060
[source,terminal]

‎modules/hcp-aws-create-secret-s3.adoc

Lines changed: 36 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -6,55 +6,59 @@
66
[id="hcp-aws-create-secret-s3_{context}"]
77
= Creating the {aws-full} S3 bucket and S3 OIDC secret
88

9-
If you plan to create and manage hosted clusters on {aws-first}, create the S3 bucket and S3 OIDC secret.
9+
Before you can create and manage hosted clusters on {aws-first}, you must create the S3 bucket and S3 OIDC secret.
1010

1111
.Procedure
1212

13-
. Create an S3 bucket that has public access to host OIDC discovery documents for your clusters:
14-
15-
.. To create the bucket in the `us-east-1` region, enter the following code:
13+
. Create an S3 bucket that has public access to host OIDC discovery documents for your clusters by running the following commands:
1614
+
17-
[source,bash]
15+
[source,terminal]
1816
----
19-
aws s3api create-bucket --bucket <bucket_name>
20-
aws s3api delete-public-access-block --bucket <bucket_name>
21-
echo '{
22-
"Version": "2012-10-17",
23-
"Statement": [
24-
{
25-
"Effect": "Allow",
26-
"Principal": "*",
27-
"Action": "s3:GetObject",
28-
"Resource": "arn:aws:s3:::<bucket_name>/*"
29-
}
30-
]
31-
}' | envsubst > policy.json
32-
aws s3api put-bucket-policy --bucket <bucket_name> --policy file://policy.json
17+
$ aws s3api create-bucket --bucket <bucket_name> \// <1>
18+
--create-bucket-configuration LocationConstraint=<region> \// <2>
19+
--region <region> <2>
3320
----
34-
35-
.. To create the bucket in a region other than the `us-east-1` region, enter the following code:
3621
+
37-
[source,bash]
22+
<1> Replace `<bucket_name>` with the name of the S3 bucket you are creating.
23+
<2> To create the bucket in a region other than the `us-east-1` region, include this line and replace `<region>` with the region you want to use. To create a bucket in the `us-east-1` region, omit this line.
24+
+
25+
[source,terminal]
3826
----
39-
aws s3api create-bucket --bucket <bucket_name> \
40-
--create-bucket-configuration LocationConstraint=<region> \
41-
--region <region>
42-
aws s3api delete-public-access-block --bucket <bucket_name>
43-
echo '{
27+
$ aws s3api delete-public-access-block --bucket <bucket_name> <1>
28+
----
29+
+
30+
<1> Replace `<bucket_name>` with the name of the S3 bucket you are creating.
31+
+
32+
[source,terminal]
33+
----
34+
$ echo '{
4435
"Version": "2012-10-17",
4536
"Statement": [
4637
{
4738
"Effect": "Allow",
4839
"Principal": "*",
4940
"Action": "s3:GetObject",
50-
"Resource": "arn:aws:s3:::<bucket_name>/*"
41+
"Resource": "arn:aws:s3:::<bucket_name>/*" <1>
5142
}
5243
]
5344
}' | envsubst > policy.json
54-
aws s3api put-bucket-policy --bucket <bucket_name> --policy file://policy.json
5545
----
46+
+
47+
<1> Replace `<bucket_name>` with the name of the S3 bucket you are creating.
48+
+
49+
[source,terminal]
50+
----
51+
$ aws s3api put-bucket-policy --bucket <bucket_name> --policy file://policy.json <1>
52+
----
53+
+
54+
<1> Replace `<bucket_name>` with the name of the S3 bucket you are creating.
55+
+
56+
[NOTE]
57+
====
58+
If you are using a Mac computer, you must export the bucket name in order for the policy to work.
59+
====
5660

57-
. Create an OIDC S3 secret named `hypershift-operator-oidc-provider-s3-credentials` for the HyperShift operator.
61+
. Create an OIDC S3 secret named `hypershift-operator-oidc-provider-s3-credentials` for the HyperShift Operator.
5862

5963
. Save the secret in the `local-cluster` namespace.
6064

@@ -75,7 +79,6 @@ aws s3api put-bucket-policy --bucket <bucket_name> --policy file://policy.json
7579
| Specifies the region of the S3 bucket.
7680
|===
7781

78-
7982
. To create an {aws-short} secret, run the following command:
8083
+
8184
[source,terminal]
@@ -85,9 +88,9 @@ $ oc create secret generic <secret_name> --from-file=credentials=<path>/.aws/cre
8588
+
8689
[NOTE]
8790
====
88-
Disaster recovery backup for the secret is not automatically enabled. Run the following command to add the label that enables the `hypershift-operator-oidc-provider-s3-credentials` secret to be backed up for disaster recovery:
91+
Disaster recovery backup for the secret is not automatically enabled. To add the label that enables the `hypershift-operator-oidc-provider-s3-credentials` secret to be backed up for disaster recovery, run the following command:
8992
[source,terminal]
9093
----
9194
$ oc label secret hypershift-operator-oidc-provider-s3-credentials -n local-cluster cluster.open-cluster-management.io/backup=true
9295
----
93-
====
96+
====

‎modules/hcp-cli-console.adoc

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,11 @@ $ chmod +x hcp
3434
$ sudo mv hcp /usr/local/bin/.
3535
----
3636

37+
[NOTE]
38+
====
39+
If you download the CLI on a Mac computer, you might see a warning about the `hcp` binary file. You need to adjust your security settings to allow the binary file to be run.
40+
====
41+
3742
.Verification
3843

3944
* Verify that you see the list of available parameters by running the following command:

‎modules/hcp-cli-gateway.adoc

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,11 @@ $ chmod +x hcp
3232
$ sudo mv hcp /usr/local/bin/.
3333
----
3434

35+
[NOTE]
36+
====
37+
If you download the CLI on a Mac computer, you might see a warning about the `hcp` binary file. You need to adjust your security settings to allow the binary file to be run.
38+
====
39+
3540
.Verification
3641

3742
* Verify that you see the list of available parameters by running the following command:

‎modules/hcp-cli-terminal.adoc

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@
33

44
:_mod-docs-content-type: PROCEDURE
55
[id="hcp-cli-terminal_{context}"]
6-
= Installing the {hcp} command-line interface by using the CLI
6+
= Installing the {hcp} command-line interface from the terminal
77

8-
You can install the {hcp} command-line interface (CLI), `hcp`, by using the CLI.
8+
You can install the {hcp} command-line interface (CLI), `hcp`, from the terminal.
99

1010
.Procedure
1111

@@ -46,6 +46,11 @@ $ chmod +x hcp
4646
$ sudo mv hcp /usr/local/bin/.
4747
----
4848

49+
[NOTE]
50+
====
51+
If you download the CLI on a Mac computer, you might see a warning about the `hcp` binary file. You need to adjust your security settings to allow the binary file to be run.
52+
====
53+
4954
.Verification
5055

5156
* Verify that you see the list of available parameters by running the following command:

0 commit comments

Comments
 (0)