Chapter 7. Preparing to update a cluster with manually maintained credentials

Procedure

1. Obtain the OpenShift Container Platform release image:

   $ RELEASE_IMAGE=$(./openshift-install version | awk '/release image/ {print $3}')

   Copy to Clipboard Toggle word wrap

2. Get the CCO container image from the OpenShift Container Platform release image:

   $ CCO_IMAGE=$(oc adm release info --image-for='cloud-credential-operator' $RELEASE_IMAGE)

   Copy to Clipboard Toggle word wrap
   Note

   Ensure that the architecture of the $RELEASE_IMAGE matches the architecture of the environment in which you will use the ccoctl tool.

3. Extract the ccoctl binary from the CCO container image within the OpenShift Container Platform release image:

   $ oc image extract $CCO_IMAGE --file="/usr/bin/ccoctl" -a ~/.pull-secret

   Copy to Clipboard Toggle word wrap

4. Change the permissions to make ccoctl executable:

   $ chmod 775 ccoctl

   Copy to Clipboard Toggle word wrap

Procedure

1. Extract the list of CredentialsRequest custom resources (CRs) from the OpenShift Container Platform release image by running the following command:

   $ oc adm release extract --credentials-requests \
     --cloud=<provider_type> \
     --to=<path_to_directory_with_list_of_credentials_requests>/credrequests \
     quay.io/<path_to>/ocp-release:<version>

   Copy to Clipboard Toggle word wrap

   where:

   • <provider_type> is the value for your cloud provider. Valid values are alibabacloud, aws, gcp, and ibmcloud.
   • credrequests is the directory where the list of CredentialsRequest objects is stored. This command creates the directory if it does not exist.

2. For each CredentialsRequest CR in the release image, ensure that a namespace that matches the text in the spec.secretRef.namespace field exists in the cluster. This field is where the generated secrets that hold the credentials configuration are stored.

   Sample AWS CredentialsRequest object

   apiVersion: cloudcredential.openshift.io/v1
   kind: CredentialsRequest
   metadata:
     name: cloud-credential-operator-iam-ro
     namespace: openshift-cloud-credential-operator
   spec:
     secretRef:
       name: cloud-credential-operator-iam-ro-creds
       namespace: openshift-cloud-credential-operator 

   1

   
     providerSpec:
       apiVersion: cloudcredential.openshift.io/v1
       kind: AWSProviderSpec
       statementEntries:
       - effect: Allow
         action:
         - iam:GetUser
         - iam:GetUserPolicy
         - iam:ListAccessKeys
         resource: "*"

   Copy to Clipboard Toggle word wrap

   1

   This field indicates the namespace which needs to exist to hold the generated secret.

   The CredentialsRequest CRs for other platforms have a similar format with different platform-specific values.

3. For any CredentialsRequest CR for which the cluster does not already have a namespace with the name specified in spec.secretRef.namespace, create the namespace:

   $ oc create namespace <component_namespace>

   Copy to Clipboard Toggle word wrap

4. Use the ccoctl tool to process all CredentialsRequest objects in the credrequests directory by running the command for your cloud provider. The following commands process CredentialsRequest objects:

   • Alibaba Cloud: ccoctl alibabacloud create-ram-users
   • Amazon Web Services (AWS): ccoctl aws create-iam-roles
   • Google Cloud Platform (GCP): ccoctl gcp create-all
   • IBM Cloud: ccoctl ibmcloud create-service-id
   Important

   Refer to the ccoctl utility instructions in the installation content for your cloud provider for important platform-specific details about the required arguments and special considerations.

   For each CredentialsRequest object, ccoctl creates the required provider resources and a permissions policy as defined in each CredentialsRequest object from the OpenShift Container Platform release image.

5. Apply the secrets to your cluster:

   $ ls <path_to_ccoctl_output_dir>/manifests/*-credentials.yaml | xargs -I{} oc apply -f {}

   Copy to Clipboard Toggle word wrap

Procedure

1. Extract and examine the CredentialsRequest custom resource for the new release.

   The "Manually creating IAM" section of the installation content for your cloud provider explains how to obtain and use the credentials required for your cloud.

2. Update the manually maintained credentials on your cluster:

   • Create new secrets for any CredentialsRequest custom resources that are added by the new release image.
   • If the CredentialsRequest custom resources for any existing credentials that are stored in secrets have changed permissions requirements, update the permissions as required.

Procedure

1. Log in to oc on the cluster as a user with the cluster-admin role.

2. Edit the CloudCredential resource to add an upgradeable-to annotation within the metadata field by running the following command:

   $ oc edit cloudcredential cluster

   Copy to Clipboard Toggle word wrap

   Text to add

   ...
     metadata:
       annotations:
         cloudcredential.openshift.io/upgradeable-to: <version_number>
   ...

   Copy to Clipboard Toggle word wrap

   Where <version_number> is the version that you are upgrading to, in the format x.y.z. For example, use 4.10.2 for OpenShift Container Platform 4.10.2.

   It may take several minutes after adding the annotation for the upgradeable status to change.

Verification

1. In the Administrator perspective of the web console, navigate to Administration Cluster Settings.

2. To view the CCO status details, click cloud-credential in the Cluster Operators list.

   • If the Upgradeable status in the Conditions section is False, verify that the upgradeable-to annotation is free of typographical errors.
3. When the Upgradeable status in the Conditions section is True, begin the OpenShift Container Platform upgrade.