Chapter 3. Manually creating IAM for AWS

Procedure

1. Change to the directory that contains the installation program and create the

   install-config.yaml

   file by running the following command:

   $ openshift-install create install-config --dir <installation_directory>

   where

   <installation_directory>

   is the directory in which the installation program creates files.

2. Edit the

   install-config.yaml

   configuration file so that it contains the

   credentialsMode

   parameter set to

   Manual

   .

   Example install-config.yaml configuration file

   apiVersion: v1
   baseDomain: cluster1.example.com
   credentialsMode: Manual 

   1

   
   compute:
   - architecture: amd64
     hyperthreading: Enabled
   ...

   1

   This line is added to set the credentialsMode parameter to Manual.

3. Generate the manifests by running the following command from the directory that contains the installation program:

   $ openshift-install create manifests --dir <installation_directory>

   where

   <installation_directory>

   is the directory in which the installation program creates files.

4. From the directory that contains the installation program, obtain details of the OpenShift Container Platform release image that your

   openshift-install

   binary is built to use by running the following command:

   $ openshift-install version

   Example output

   release image quay.io/openshift-release-dev/ocp-release:4.y.z-x86_64

5. Locate all

   CredentialsRequest

   objects in this release image that target the cloud you are deploying on by running the following command:

   $ oc adm release extract quay.io/openshift-release-dev/ocp-release:4.y.z-x86_64 \
     --credentials-requests \
     --cloud=aws

   This command creates a YAML file for each

   CredentialsRequest

   object.

   Sample CredentialsRequest object

   apiVersion: cloudcredential.openshift.io/v1
   kind: CredentialsRequest
   metadata:
     name: <component-credentials-request>
     namespace: openshift-cloud-credential-operator
     ...
   spec:
     providerSpec:
       apiVersion: cloudcredential.openshift.io/v1
       kind: AWSProviderSpec
       statementEntries:
       - effect: Allow
         action:
         - iam:GetUser
         - iam:GetUserPolicy
         - iam:ListAccessKeys
         resource: "*"
     ...

6. Create YAML files for secrets in the

   openshift-install

   manifests directory that you generated previously. The secrets must be stored using the namespace and secret name defined in the

   spec.secretRef

   for each

   CredentialsRequest

   object.

   Sample CredentialsRequest object with secrets

   apiVersion: cloudcredential.openshift.io/v1
   kind: CredentialsRequest
   metadata:
     name: <component-credentials-request>
     namespace: openshift-cloud-credential-operator
     ...
   spec:
     providerSpec:
       apiVersion: cloudcredential.openshift.io/v1
       kind: AWSProviderSpec
       statementEntries:
       - effect: Allow
         action:
         - s3:CreateBucket
         - s3:DeleteBucket
         resource: "*"
         ...
     secretRef:
       name: <component-secret>
       namespace: <component-namespace>
     ...

   Sample Secret object

   apiVersion: v1
   kind: Secret
   metadata:
     name: <component-secret>
     namespace: <component-namespace>
   data:
     aws_access_key_id: <base64_encoded_aws_access_key_id>
     aws_secret_access_key: <base64_encoded_aws_secret_access_key>

   Important

   The release image includes

   CredentialsRequest

   objects for Technology Preview features that are enabled by the

   TechPreviewNoUpgrade

   feature set. You can identify these objects by their use of the

   release.openshift.io/feature-set: TechPreviewNoUpgrade

   annotation.

   • If you are not using any of these features, do not create secrets for these objects. Creating secrets for Technology Preview features that you are not using can cause the installation to fail.
   • If you are using any of these features, you must create secrets for the corresponding objects.

   • To find

     CredentialsRequest

     objects with the

     TechPreviewNoUpgrade

     annotation, run the following command:

     $ grep "release.openshift.io/feature-set" *

     Example output

     0000_30_capi-operator_00_credentials-request.yaml:  release.openshift.io/feature-set: TechPreviewNoUpgrade

7. From the directory that contains the installation program, proceed with your cluster creation:

   $ openshift-install create cluster --dir <installation_directory>

   Important

   Before upgrading a cluster that uses manually maintained credentials, you must ensure that the CCO is in an upgradeable state.