Skip to content

Commit d369348

Browse files
bhardestybhardesty
committed
OSDOCS-10467: Update AWS EFS for ROSA/OSD
1 parent 3afc9d1 commit d369348

10 files changed

+212
-23
lines changed

‎_topic_maps/_topic_map_osd.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -624,7 +624,7 @@ Topics:
624624
- Name: AWS Elastic Block Store CSI Driver Operator
625625
File: persistent-storage-csi-ebs
626626
- Name: AWS Elastic File Service CSI Driver Operator
627-
File: osd-persistent-storage-aws-efs-csi
627+
File: persistent-storage-csi-aws-efs
628628
- Name: GCP PD CSI Driver Operator
629629
File: persistent-storage-csi-gcp-pd
630630
- Name: GCP Filestore CSI Driver Operator

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -862,7 +862,7 @@ Topics:
862862
- Name: AWS Elastic Block Store CSI Driver Operator
863863
File: persistent-storage-csi-ebs
864864
- Name: AWS Elastic File Service CSI Driver Operator
865-
File: osd-persistent-storage-aws-efs-csi
865+
File: persistent-storage-csi-aws-efs
866866
- Name: Generic ephemeral volumes
867867
File: generic-ephemeral-vols
868868
- Name: Dynamic provisioning

‎_topic_maps/_topic_map_rosa_hcp.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -835,7 +835,7 @@ Topics:
835835
- Name: AWS Elastic Block Store CSI Driver Operator
836836
File: persistent-storage-csi-ebs
837837
- Name: AWS Elastic File Service CSI Driver Operator
838-
File: osd-persistent-storage-aws-efs-csi
838+
File: persistent-storage-csi-aws-efs
839839
- Name: Generic ephemeral volumes
840840
File: generic-ephemeral-vols
841841
- Name: Dynamic provisioning

‎cloud_experts_tutorials/cloud-experts-getting-started/cloud-experts-getting-started-what-is-rosa.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ Check for a newer version of the ROSA CLI. Every release of the ROSA CLI is loca
144144
== Storage
145145
Refer to the xref:../../rosa_architecture/rosa_policy_service_definition/rosa-service-definition.adoc#rosa-sdpolicy-storage_rosa-service-definition[storage] section of the service definition.
146146

147-
OpenShift includes the CSI driver for AWS EFS. For more information, see xref:../../storage/container_storage_interface/osd-persistent-storage-aws-efs-csi.adoc#osd-persistent-storage-aws-efs-csi[Setting up AWS EFS for Red{nbsp}Hat OpenShift Service on AWS].
147+
OpenShift includes the CSI driver for AWS EFS. For more information, see xref:../../storage/container_storage_interface/persistent-storage-csi-aws-efs.adoc#persistent-storage-csi-aws-efs[Setting up AWS EFS for Red{nbsp}Hat OpenShift Service on AWS].
148148

149149
== Using a VPC
150150
At installation you can select to deploy to an existing VPC or bring your own VPC. You can then select the required subnets and provide a valid CIDR range that encompasses the subnets for the installation program when using those subnets.

‎modules/persistent-storage-csi-about.adoc

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
// * storage/container_storage_interface/persistent-storage-csi-ebs.adoc
44
// * storage/container_storage_interface/persistent-storage-csi-manila.adoc
55
// * storage/container_storage_interface/persistent-storage-csi-aws-efs.adoc
6-
// * storage/container_storage_interface/osd-persistent-storage-aws-efs-csi.adoc
76

87
:_mod-docs-content-type: CONCEPT
98
[id="csi-about_{context}"]

‎modules/persistent-storage-csi-efs-driver-install.adoc

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,12 @@
11
// Module included in the following assemblies:
22
//
33
// * storage/container_storage_interface/persistent-storage-csi-aws-efs.adoc
4-
// * storage/container_storage_interface/osd-persistent-storage-csi-aws-efs.adoc
54

65
:_mod-docs-content-type: PROCEDURE
76
[id="persistent-storage-csi-efs-driver-install_{context}"]
87
= Installing the {FeatureName} CSI Driver
98

10-
ifdef::openshift-rosa[]
11-
After installing the link:https://github.com/openshift/aws-efs-csi-driver-operator[{FeatureName} CSI Driver Operator] (a Red Hat operator) and configuring it with STS, you install the link:https://github.com/openshift/aws-efs-csi-driver[{FeatureName} CSI driver].
12-
endif::openshift-rosa[]
13-
ifdef::openshift-dedicated[]
14-
After installing the {FeatureName} CSI Driver Operator, you install the {FeatureName} CSI Driver.
15-
endif::openshift-dedicated[]
9+
After installing the link:https://github.com/openshift/aws-efs-csi-driver-operator[{FeatureName} CSI Driver Operator] (a Red Hat operator), you install the link:https://github.com/openshift/aws-efs-csi-driver[{FeatureName} CSI driver].
1610

1711
.Prerequisites
1812
* Access to the {product-title} web console.

‎modules/persistent-storage-csi-olm-operator-install.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ endif::restricted[]
5555
.. On the *Install Operator* page, ensure that:
5656
+
5757
ifdef::restricted[]
58-
ifdef::openshift-rosa,openshift-enterprise[]
58+
ifdef::openshift-enterprise,openshift-dedicated,openshift-rosa[]
5959
* If you are using {FeatureName} with AWS Secure Token Service (STS), in the *role ARN* field, enter the ARN role copied from the last step of the _Obtaining a role Amazon Resource Name for Security Token Service_ procedure.
6060
endif::[]
6161
endif::restricted[]

‎modules/persistent-storage-efs-csi-driver-operator-setup.adoc

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,12 @@
11
// Module included in the following assemblies:
22
//
33
// * storage/container_storage_interface/persistent-storage-csi-aws-efs.adoc
4-
// * storage/container_storage_interface/osd-persistent-storage-csi-aws-efs.adoc
54

65
:_mod-docs-content-type: PROCEDURE
76
[id="persistent-storage-efs-csi-driver-operator-setup_{context}"]
87
= Setting up the {FeatureName} CSI Driver Operator
98

10-
ifdef::openshift-rosa[]
11-
. If you are using Amazon Elastic File Storage (Amazon EFS) with AWS Secure Token Service (STS), configure the https://github.com/openshift/aws-efs-csi-driver[{FeatureName} CSI driver] with STS.
12-
endif::openshift-rosa[]
13-
14-
ifdef::openshift-rosa,openshift-enterprise[]
159
. If you are using {FeatureName} with AWS Secure Token Service (STS), obtain a role Amazon Resource Name (ARN) for STS. This is required for installing the {FeatureName} CSI Driver Operator.
16-
endif::[]
1710

1811
. Install the {FeatureName} CSI Driver Operator.
1912

‎modules/sd-persistent-storage-csi-efs-sts.adoc

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * storage/container_storage_interface/persistent-storage-csi-aws-efs.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="efs-sts_{context}"]
7+
= Obtaining a role Amazon Resource Name for Security Token Service
8+
9+
This procedure explains how to obtain a role Amazon Resource Name (ARN) to configure the AWS EFS CSI Driver Operator with {product-title} on AWS Security Token Service (STS).
10+
11+
[IMPORTANT]
12+
====
13+
Perform this procedure before you install the AWS EFS CSI Driver Operator (see _Installing the AWS EFS CSI Driver Operator_ procedure).
14+
====
15+
16+
.Prerequisites
17+
18+
* Access to the cluster as a user with the cluster-admin role.
19+
* AWS account credentials
20+
21+
.Procedure
22+
23+
. Create an IAM policy JSON file with the following content:
24+
+
25+
[source,json]
26+
----
27+
{
28+
"Version": "2012-10-17",
29+
"Statement": [
30+
{
31+
"Effect": "Allow",
32+
"Action": [
33+
"elasticfilesystem:DescribeAccessPoints",
34+
"elasticfilesystem:DescribeFileSystems",
35+
"elasticfilesystem:DescribeMountTargets",
36+
"ec2:DescribeAvailabilityZones",
37+
"elasticfilesystem:TagResource"
38+
],
39+
"Resource": "*"
40+
},
41+
{
42+
"Effect": "Allow",
43+
"Action": [
44+
"elasticfilesystem:CreateAccessPoint"
45+
],
46+
"Resource": "*",
47+
"Condition": {
48+
"StringLike": {
49+
"aws:RequestTag/efs.csi.aws.com/cluster": "true"
50+
}
51+
}
52+
},
53+
{
54+
"Effect": "Allow",
55+
"Action": "elasticfilesystem:DeleteAccessPoint",
56+
"Resource": "*",
57+
"Condition": {
58+
"StringEquals": {
59+
"aws:ResourceTag/efs.csi.aws.com/cluster": "true"
60+
}
61+
}
62+
}
63+
]
64+
}
65+
----
66+
67+
. Create an IAM trust JSON file with the following content:
68+
+
69+
--
70+
[source,json]
71+
----
72+
{
73+
"Version": "2012-10-17",
74+
"Statement": [
75+
{
76+
"Effect": "Allow",
77+
"Principal": {
78+
"Federated": "arn:aws:iam::<your_aws_account_ID>:oidc-provider/<openshift_oidc_provider>" <1>
79+
},
80+
"Action": "sts:AssumeRoleWithWebIdentity",
81+
"Condition": {
82+
"StringEquals": {
83+
"<openshift_oidc_provider>:sub": [ <2>
84+
"system:serviceaccount:openshift-cluster-csi-drivers:aws-efs-csi-driver-operator",
85+
"system:serviceaccount:openshift-cluster-csi-drivers:aws-efs-csi-driver-controller-sa"
86+
]
87+
}
88+
}
89+
}
90+
]
91+
}
92+
----
93+
<1> Specify your AWS account ID and the OpenShift OIDC provider endpoint.
94+
+
95+
Obtain your AWS account ID by running the following command:
96+
+
97+
[source,terminal]
98+
----
99+
$ aws sts get-caller-identity --query Account --output text
100+
----
101+
ifdef::openshift-rosa[]
102+
+
103+
Obtain the OpenShift OIDC endpoint by running the following command:
104+
+
105+
[source,terminal]
106+
----
107+
$ rosa describe cluster \
108+
-c $(oc get clusterversion -o jsonpath='{.items[].spec.clusterID}{"\n"}') \
109+
-o yaml | awk '/oidc_endpoint_url/ {print $2}' | cut -d '/' -f 3,4
110+
----
111+
endif::openshift-rosa[]
112+
ifdef::openshift-dedicated[]
113+
+
114+
Obtain the OpenShift OIDC endpoint by running the following command:
115+
+
116+
[source,terminal]
117+
----
118+
$ openshift_oidc_provider=`oc get authentication.config.openshift.io cluster \
119+
-o json | jq -r .spec.serviceAccountIssuer | sed -e "s/^https:\/\///"`; \
120+
echo $openshift_oidc_provider
121+
----
122+
endif::openshift-dedicated[]
123+
124+
<2> Specify the OpenShift OIDC endpoint again.
125+
--
126+
127+
. Create the IAM role:
128+
+
129+
[source,terminal]
130+
----
131+
ROLE_ARN=$(aws iam create-role \
132+
--role-name "<your_cluster_name>-aws-efs-csi-operator" \
133+
--assume-role-policy-document file://<your_trust_file_name>.json \
134+
--query "Role.Arn" --output text); echo $ROLE_ARN
135+
----
136+
+
137+
Copy the role ARN. You will need it when you install the AWS EFS CSI Driver Operator.
138+
139+
. Create the IAM policy:
140+
+
141+
[source,terminal]
142+
----
143+
POLICY_ARN=$(aws iam create-policy \
144+
--policy-name "<your_cluster_name>-aws-efs-csi" \
145+
--policy-document file://<your_policy_file_name>.json \
146+
--query 'Policy.Arn' --output text); echo $POLICY_ARN
147+
----
148+
149+
. Attach the IAM policy to the IAM role:
150+
+
151+
[source,terminal]
152+
----
153+
$ aws iam attach-role-policy \
154+
--role-name "<your_cluster_name>-aws-efs-csi-operator" \
155+
--policy-arn $POLICY_ARN
156+
----
157+
158+
////
159+
. Create a `Secret` YAML file for the driver operator:
160+
+
161+
[source,yaml]
162+
----
163+
apiVersion: v1
164+
kind: Secret
165+
metadata:
166+
name: aws-efs-cloud-credentials
167+
namespace: openshift-cluster-csi-drivers
168+
stringData:
169+
credentials: |-
170+
[default]
171+
sts_regional_endpoints = regional
172+
role_arn = <role_ARN> <1>
173+
web_identity_token_file = /var/run/secrets/openshift/serviceaccount/token
174+
----
175+
<1> Replace `role_ARN` with the output you saved while creating the role.
176+
177+
. Create the secret:
178+
+
179+
[source,terminal]
180+
----
181+
$ oc apply -f aws-efs-cloud-credentials.yaml
182+
----
183+
+
184+
You are now ready to install the AWS EFS CSI driver.
185+
////

‎storage/container_storage_interface/persistent-storage-csi-aws-efs.adoc

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,12 @@ include::_attributes/common-attributes.adoc[]
66

77
toc::[]
88

9-
// Content similar to osd-persistent-storage-csi-aws-efs.adoc and rosa-persistent-storage-aws-efs-csi.adoc. Modules are reused.
9+
ifdef::openshift-dedicated,openshift-rosa[]
10+
[IMPORTANT]
11+
====
12+
This procedure is specific to the link:https://github.com/openshift/aws-efs-csi-driver-operator[AWS EFS CSI Driver Operator] (a Red Hat Operator), which is only applicable for {product-title} 4.10 and later versions.
13+
====
14+
endif::openshift-dedicated,openshift-rosa[]
1015

1116
== Overview
1217

@@ -32,19 +37,30 @@ include::modules/persistent-storage-csi-about.adoc[leveloffset=+1]
3237
:FeatureName: AWS EFS
3338
include::modules/persistent-storage-efs-csi-driver-operator-setup.adoc[leveloffset=+1]
3439

35-
ifdef::openshift-rosa,openshift-enterprise[]
40+
// Obtaining a role ARN (OCP)
41+
ifndef::openshift-dedicated,openshift-rosa[]
3642
include::modules/persistent-storage-csi-efs-sts.adoc[leveloffset=+2]
43+
endif::openshift-dedicated,openshift-rosa[]
3744

45+
// Obtaining a role ARN (OSD and ROSA)
46+
ifdef::openshift-dedicated,openshift-rosa[]
47+
include::modules/sd-persistent-storage-csi-efs-sts.adoc[leveloffset=+2]
48+
endif::openshift-dedicated,openshift-rosa[]
49+
50+
.Next steps
3851
xref:../../storage/container_storage_interface/persistent-storage-csi-aws-efs.adoc#persistent-storage-csi-olm-operator-install_persistent-storage-csi-aws-efs[Install the AWS EFS CSI Driver Operator].
52+
3953
[role="_additional-resources"]
4054
.Additional resources
4155
* xref:../../storage/container_storage_interface/persistent-storage-csi-aws-efs.adoc#persistent-storage-csi-olm-operator-install_persistent-storage-csi-aws-efs[Installing the AWS EFS CSI Driver Operator]
56+
ifndef::openshift-dedicated,openshift-rosa[]
4257
* xref:../../installing/installing_aws/ipi/installing-aws-customizations.adoc#cco-ccoctl-configuring_installing-aws-customizations[Configuring the Cloud Credential Operator utility]
58+
endif::openshift-dedicated,openshift-rosa[]
4359
* xref:../../storage/container_storage_interface/persistent-storage-csi-aws-efs.adoc#persistent-storage-csi-efs-driver-install_persistent-storage-csi-aws-efs[Installing the {FeatureName} CSI Driver]
44-
endif::[]
4560

4661
include::modules/persistent-storage-csi-olm-operator-install.adoc[leveloffset=+2]
4762

63+
.Next steps
4864
xref:../../storage/container_storage_interface/persistent-storage-csi-aws-efs.adoc#persistent-storage-csi-efs-driver-install_persistent-storage-csi-aws-efs[Install the AWS EFS CSI Driver].
4965

5066
include::modules/persistent-storage-csi-efs-driver-install.adoc[leveloffset=+2]
@@ -55,7 +71,9 @@ include::modules/storage-create-storage-class.adoc[leveloffset=+1]
5571
include::modules/storage-create-storage-class-console.adoc[leveloffset=+2]
5672
include::modules/storage-create-storage-class-cli.adoc[leveloffset=+2]
5773

74+
ifndef::openshift-dedicated,openshift-rosa[]
5875
include::modules/persistent-storage-csi-efs-cross-account.adoc[leveloffset=+1]
76+
endif::openshift-dedicated,openshift-rosa[]
5977

6078
include::modules/persistent-storage-csi-efs-create-volume.adoc[leveloffset=+1]
6179

0 commit comments

Comments
 (0)